Skip to content

Commit 12f11a2

Browse files
googs1025googs1025
committed
add EvictionProtection filed for DefaultEvictorArgs
Signed-off-by: googs1025 <[email protected]>
1 parent c8912ac commit 12f11a2

11 files changed

+843
-88
lines changed

‎README.md

Lines changed: 81 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -148,22 +148,66 @@ In general, each plugin can consume metrics from a different provider so multipl
148148

149149
The Default Evictor Plugin is used by default for filtering pods before processing them in an strategy plugin, or for applying a PreEvictionFilter of pods before eviction. You can also create your own Evictor Plugin or use the Default one provided by Descheduler. Other uses for the Evictor plugin can be to sort, filter, validate or group pods by different criteria, and that's why this is handled by a plugin and not configured in the top level config.
150150

151-
| Name |type| Default Value | Description |
152-
|---------------------------|----|---------------|-----------------------------------------------------------------------------------------------------------------------------|
153-
| `nodeSelector` |`string`| `nil` | limiting the nodes which are processed |
154-
| `evictLocalStoragePods` |`bool`| `false` | allows eviction of pods with local storage |
155-
| `evictDaemonSetPods` | bool | false | allows eviction of DaemonSet managed Pods. |
156-
| `evictSystemCriticalPods` |`bool`| `false` | [Warning: Will evict Kubernetes system pods] allows eviction of pods with any priority, including system pods like kube-dns |
157-
| `ignorePvcPods` |`bool`| `false` | set whether PVC pods should be evicted or ignored |
158-
| `evictFailedBarePods` |`bool`| `false` | allow eviction of pods without owner references and in failed phase |
159-
| `labelSelector` |`metav1.LabelSelector`|| (see [label filtering](#label-filtering)) |
160-
| `priorityThreshold` |`priorityThreshold`|| (see [priority filtering](#priority-filtering)) |
161-
| `nodeFit` |`bool`|`false`| (see [node fit filtering](#node-fit-filtering)) |
162-
| `minReplicas` |`uint`|`0`| ignore eviction of pods where owner (e.g. `ReplicaSet`) replicas is below this threshold |
163-
| `minPodAge` |`metav1.Duration`|`0`| ignore eviction of pods with a creation time within this threshold |
164-
| `ignorePodsWithoutPDB` |`bool`|`false`| set whether pods without PodDisruptionBudget should be evicted or ignored |
165-
166-
### Example policy
151+
| Name | Type | Default Value | Description |
152+
|---------------------------|--------------------------|---------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
153+
| `nodeSelector` | `string` | `nil` | Limits the nodes that are processed. |
154+
| `evictLocalStoragePods` | `bool` | `false` | **[Deprecated: Use `protectionPolicies` with `"podsWithLocalStorage"` instead]**<br>Allows eviction of pods using local storage. |
155+
| `evictDaemonSetPods` | `bool` | `false` | **[Deprecated: Use `protectionPolicies` with `"daemonSetPods"` instead]**<br>Allows eviction of DaemonSet managed Pods. |
156+
| `evictSystemCriticalPods` | `bool` | `false` | **[Deprecated: Use `protectionPolicies` with `"systemCriticalPods"` instead]**<br>[Warning: Will evict Kubernetes system pods] Allows eviction of pods with any priority, including system-critical pods like kube-dns. |
157+
| `ignorePvcPods` | `bool` | `false` | **[Deprecated: Use `protectionPolicies` with `"podsWithPVC"` instead]**<br>Sets whether PVC pods should be evicted or ignored. |
158+
| `evictFailedBarePods` | `bool` | `false` | **[Deprecated: Use `protectionPolicies` with `"failedBarePods"` instead]**<br>Allows eviction of pods without owner references and in a failed phase. |
159+
| `labelSelector` | `metav1.LabelSelector` | | (See [label filtering](#label-filtering)) |
160+
| `priorityThreshold` | `priorityThreshold` | | (See [priority filtering](#priority-filtering)) |
161+
| `nodeFit` | `bool` | `false` | (See [node fit filtering](#node-fit-filtering)) |
162+
| `minReplicas` | `uint` | `0` | Ignores eviction of pods where the owner (e.g., `ReplicaSet`) replicas are below this threshold. |
163+
| `minPodAge` | `metav1.Duration` | `0` | Ignores eviction of pods with a creation time within this threshold. |
164+
| `ignorePodsWithoutPDB` | `bool` | `false` | **[Deprecated: Use `protectionPolicies` with `"podsWithoutPDB"` instead]**<br>Sets whether pods without PodDisruptionBudget should be evicted or ignored. |
165+
| `protectionPolicies` | `PodProtections` | `{}` | Holds the list of enabled and disabled protection policies.<br>Users can selectively disable certain default protection rules or enable extra ones. See below for supported values. |### Example policy
166+
167+
#### Supported Values for `protectionPolicies.Disabled`
168+
169+
| Value | Meaning |
170+
|--------------------------|-------------------------------------------------------------------------|
171+
| `"podsWithLocalStorage"` | Prevents eviction of Pods using local storage. Equivalent to old field `evictLocalStoragePods: true`. |
172+
| `"daemonSetPods"` | Prevents eviction of DaemonSet-managed Pods. Equivalent to old field `evictDaemonSetPods: true`. |
173+
| `"systemCriticalPods"` | Prevents eviction of system-critical Pods. Equivalent to old field `evictSystemCriticalPods: true`. |
174+
| `"failedBarePods"` | Prevents eviction of failed bare Pods (without controllers). Equivalent to old field `evictFailedBarePods: true`. |
175+
176+
> Setting these values will **disable the default protection rules**, meaning these Pods may be evicted.
177+
178+
---
179+
180+
#### Supported Values for `protectionPolicies.ExtraEnabled`
181+
182+
| Value | Meaning |
183+
|--------------------|-------------------------------------------------------------------------|
184+
| `"podsWithPVC"` | Prevents eviction of Pods using Persistent Volume Claims (PVCs). Equivalent to old field `ignorePvcPods: true`. |
185+
| `"podsWithoutPDB"` | Prevents eviction of Pods without a PodDisruptionBudget (PDB). Equivalent to old field `ignorePodsWithoutPDB: true`. |
186+
187+
> Setting these values will **enable additional protection rules**, meaning these Pods will not be evicted.
188+
189+
---
190+
191+
#### Example: Migrating from Old Fields to New Fields
192+
193+
#### Old YAML:
194+
195+
```yaml
196+
evictSystemCriticalPods: false
197+
evictLocalStoragePods: false
198+
ignorePvcPods: true
199+
ignorePodsWithoutPDB: true
200+
```
201+
#### New YAML:
202+
```yaml
203+
protectionPolicies:
204+
disabled:
205+
- podsWithLocalStorage
206+
- systemCriticalPods
207+
extraEnabled:
208+
- podsWithPVC
209+
- podsWithoutPDB
210+
```
167211
168212
As part of the policy, you will start deciding which top level configuration to use, then which Evictor plugin to use (if you have your own, the Default Evictor if not), followed by deciding the configuration passed to the Evictor Plugin. By default, the Default Evictor is enabled for both `filter` and `preEvictionFilter` extension points. After that you will enable/disable eviction strategies plugins and configure them properly.
169213

@@ -193,11 +237,29 @@ profiles:
193237
pluginConfig:
194238
- name: "DefaultEvictor"
195239
args:
196-
evictSystemCriticalPods: true
197-
evictFailedBarePods: true
198-
evictLocalStoragePods: true
240+
# Deprecated: Use `disabledDefaultPodProtections` with "systemCriticalPods" instead.
241+
# evictSystemCriticalPods: true
242+
# Deprecated: Use `disabledDefaultPodProtections` with "failedBarePods" instead.
243+
# evictFailedBarePods: true
244+
# Deprecated: Use `disabledDefaultPodProtections` with "withLocalStorage" instead.
245+
# evictLocalStoragePods: true
199246
nodeFit: true
200247
minReplicas: 2
248+
# PodProtectionPolicies holds the list of enabled and disabled protection policies.
249+
# Users can selectively disable certain default protection rules or enable extra ones.
250+
protectionPolicies:
251+
# ExtraEnabled specifies additional protection policies that should be enabled.
252+
# Supports: podsWithPVC, podsWithoutPDB
253+
extraEnabled:
254+
# - podsWithPVC
255+
# - podsWithoutPDB
256+
257+
# Disabled specifies which default protection policies should be disabled.
258+
# Supports: podsWithLocalStorage, daemonSetPods, systemCriticalPods, failedBarePods
259+
disabled:
260+
# - podsWithLocalStorage
261+
# - systemCriticalPods
262+
# - failedBarePods
201263
plugins:
202264
# DefaultEvictor is enabled for both `filter` and `preEvictionFilter`
203265
# filter:

‎pkg/descheduler/policyconfig.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,10 @@ func setDefaultEvictor(profile api.DeschedulerProfile, client clientset.Interfac
108108
IgnorePvcPods: false,
109109
EvictFailedBarePods: false,
110110
IgnorePodsWithoutPDB: false,
111+
PodProtectionPolicies: defaultevictor.PodProtections{
112+
Disabled: []defaultevictor.PodProtectionPolicy{},
113+
ExtraEnabled: []defaultevictor.PodProtectionPolicy{},
114+
},
111115
},
112116
}
113117

0 commit comments

Comments
 (0)