OCPBUGS-39133: Add graceful shutdown flags

.github/workflows/gh-workflow-approve.yaml

@@ -8,6 +8,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   approve:
     name: Approve ok-to-test

.github/workflows/lint-test-chart.yaml

@@ -6,6 +6,9 @@ on:
       - .github/workflows/lint-test-chart.yaml
       - "charts/metrics-server/**"
 
+permissions:
+  contents: read
+
 jobs:
   lint-test:
     name: Lint & Test
@@ -16,17 +19,17 @@ jobs:
         shell: bash
     steps:
       - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
         with:
           fetch-depth: 0
 
       - name: Set-up Python
-        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
+        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
         with:
           python-version: "3.x"
 
       - name: Set-up Helm
-        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
+        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           version: latest
@@ -48,20 +51,20 @@ jobs:
       - name: Get chart version
         id: chart_version
         if: steps.changes.outputs.changed == 'true'
-        uses: mikefarah/yq@dd648994340a5d03225d97abf19c9bf1086c3f07 # v4.40.5
+        uses: mikefarah/yq@bbdd97482f2d439126582a59689eb1c855944955 # v4.44.3
         with:
           cmd: yq eval '.version' './charts/metrics-server/Chart.yaml'
 
       - name: Get changelog entry
         if: steps.changes.outputs.changed == 'true'
-        uses: mindsers/changelog-reader-action@b97ce03a10d9bdbb07beb491c76a5a01d78cd3ef # v2.2.2
+        uses: mindsers/changelog-reader-action@32aa5b4c155d76c94e4ec883a223c947b2f02656 # v2.2.3
         with:
           path: charts/metrics-server/CHANGELOG.md
-          version: ${{ steps.chart_version.outputs.version }}
+          version: ${{ steps.chart_version.outputs.result }}
 
       - name: Set-up Artifact Hub CLI
         if: steps.changes.outputs.changed == 'true'
-        uses: action-stars/install-tool-from-github-release@b21a01813213cbbf482eeceda07ad03b41b754d1 # v0.2.1
+        uses: action-stars/install-tool-from-github-release@ece2623611b240002e0dd73a0d685505733122f6 # v0.2.4
         with:
           github_token: ${{ github.token }}
           owner: artifacthub
@@ -80,7 +83,7 @@ jobs:
 
       - name: Create Kind cluster
         if: steps.changes.outputs.changed == 'true'
-        uses: helm/kind-action@dda0770415bac9fc20092cacbc54aa298604d140 # v1.8.0
+        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
         with:
           wait: 120s
 

.github/workflows/release-chart.yaml

@@ -7,6 +7,9 @@ on:
     paths:
       - charts/metrics-server/Chart.yaml
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release
@@ -15,9 +18,11 @@ jobs:
     defaults:
       run:
         shell: bash
+    permissions:
+      contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
         with:
           fetch-depth: 0
 
@@ -28,13 +33,13 @@ jobs:
 
       - name: Get chart version
         id: chart_version
-        uses: mikefarah/yq@dd648994340a5d03225d97abf19c9bf1086c3f07 # v4.40.5
+        uses: mikefarah/yq@bbdd97482f2d439126582a59689eb1c855944955 # v4.44.3
         with:
           cmd: yq eval '.version' './charts/metrics-server/Chart.yaml'
 
       - name: Get chart app version
         id: chart_app_version
-        uses: mikefarah/yq@dd648994340a5d03225d97abf19c9bf1086c3f07 # v4.40.5
+        uses: mikefarah/yq@bbdd97482f2d439126582a59689eb1c855944955 # v4.44.3
         with:
           cmd: yq eval '.appVersion' './charts/metrics-server/Chart.yaml'
 
@@ -60,18 +65,18 @@ jobs:
 
       - name: Set-up Helm
         if: steps.check_can_release.outputs.continue == 'true'
-        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
+        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           version: latest
 
       - name: Get CHANGELOG entry
         id: changelog_reader
         if: steps.check_can_release.outputs.continue == 'true'
-        uses: mindsers/changelog-reader-action@b97ce03a10d9bdbb07beb491c76a5a01d78cd3ef # v2.2.2
+        uses: mindsers/changelog-reader-action@32aa5b4c155d76c94e4ec883a223c947b2f02656 # v2.2.3
         with:
           path: charts/metrics-server/CHANGELOG.md
-          version: ${{ steps.chart_version.outputs.version }}
+          version: ${{ steps.chart_version.outputs.result }}
 
       - name: Create release notes
         if: steps.check_can_release.outputs.continue == 'true'

.github/workflows/release.yaml

@@ -5,20 +5,25 @@ on:
     types:
       - published
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: build
     runs-on: ubuntu-latest
     defaults:
       run:
         shell: bash
+    permissions:
+      contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7
       - name: Build manifests
         run: make release-manifests
       - name: Release manifests
-        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
+        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v0.1.15
         with:
           files: |
             _output/components.yaml
@@ -27,7 +32,7 @@ jobs:
       - name: Build binaries
         run: make build-all
       - name: Release binaries
-        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
+        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v0.1.15
         with:
           files: |
             _output/metrics-server-*

Makefile

@@ -170,29 +170,28 @@ test-image: container
 
 .PHONY: test-image-all
 test-image-all:
-	@for arch in $(ALL_ARCHITECTURES); do ARCH=$${arch} $(MAKE) test-image; done
+	@set -e;for arch in $(ALL_ARCHITECTURES); do ARCH=$${arch} $(MAKE) test-image; done
 
 # E2e tests
 # -----------
 
 .PHONY: test-e2e
-test-e2e: test-e2e-1.29
+test-e2e: test-e2e-1.31
 
 .PHONY: test-e2e-all
-test-e2e-all: test-e2e-1.29 test-e2e-1.28 test-e2e-1.27
+test-e2e-all: test-e2e-1.31 test-e2e-1.30 test-e2e-1.29
 
-.PHONY: test-e2e-1.29
-test-e2e-1.29:
-	NODE_IMAGE=kindest/node:v1.29.0@sha256:eaa1450915475849a73a9227b8f201df25e55e268e5d619312131292e324d570 KIND_CONFIG="${PWD}/test/kind-config-with-sidecar-containers.yaml" ./test/test-e2e.sh
-
-.PHONY: test-e2e-1.28
-test-e2e-1.28:
-	NODE_IMAGE=kindest/node:v1.28.0@sha256:b7a4cad12c197af3ba43202d3efe03246b3f0793f162afb40a33c923952d5b31 KIND_CONFIG="${PWD}/test/kind-config-with-sidecar-containers.yaml" ./test/test-e2e.sh
+.PHONY: test-e2e-1.31
+test-e2e-1.31:
+	NODE_IMAGE=kindest/node:v1.31.0@sha256:53df588e04085fd41ae12de0c3fe4c72f7013bba32a20e7325357a1ac94ba865 KIND_CONFIG="${PWD}/test/kind-config-with-sidecar-containers.yaml" ./test/test-e2e.sh
 
-.PHONY: test-e2e-1.27
-test-e2e-1.27:
-	NODE_IMAGE=kindest/node:v1.27.3@sha256:3966ac761ae0136263ffdb6cfd4db23ef8a83cba8a463690e98317add2c9ba72 ./test/test-e2e.sh
+.PHONY: test-e2e-1.30
+test-e2e-1.30:
+	NODE_IMAGE=kindest/node:v1.30.4@sha256:976ea815844d5fa93be213437e3ff5754cd599b040946b5cca43ca45c2047114 KIND_CONFIG="${PWD}/test/kind-config-with-sidecar-containers.yaml" ./test/test-e2e.sh
 
+.PHONY: test-e2e-1.29
+test-e2e-1.29:
+	NODE_IMAGE=kindest/node:v1.29.8@sha256:d46b7aa29567e93b27f7531d258c372e829d7224b25e3fc6ffdefed12476d3aa KIND_CONFIG="${PWD}/test/kind-config-with-sidecar-containers.yaml" ./test/test-e2e.sh
 
 .PHONY: test-e2e-ha
 test-e2e-ha:

README.md

@@ -7,7 +7,8 @@ Metrics Server collects resource metrics from Kubelets and exposes them in Kuber
 for use by [Horizontal Pod Autoscaler] and [Vertical Pod Autoscaler]. Metrics API can also be accessed by `kubectl top`,
 making it easier to debug autoscaling pipelines.
 
-Metrics Server is not meant for non-autoscaling purposes. For example, don't use it to forward metrics to monitoring solutions, or as a source of monitoring solution metrics. In such cases please collect metrics from Kubelet `/metrics/resource` endpoint directly.
+> [!CAUTION]
+> Metrics Server is meant only for autoscaling purposes. For example, don't use it to forward metrics to monitoring solutions, or as a source of monitoring solution metrics. In such cases please collect metrics from Kubelet `/metrics/resource` endpoint directly.
 
 Metrics Server offers:
 
@@ -33,7 +34,7 @@ Don't use Metrics Server when you need:
 - An accurate source of resource usage metrics
 - Horizontal autoscaling based on other resources than CPU/Memory
 
-For unsupported use cases, check out full monitoring solutions like Prometheus.
+For unsupported use cases, check out full monitoring solutions like [Prometheus](https://github.com/prometheus/prometheus).
 
 [Horizontal Autoscaling]: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
 [Vertical Autoscaling]: https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler/
@@ -93,7 +94,8 @@ On Kubernetes v1.19-1.21:
 kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/high-availability.yaml
 ```
 
-Note that this configuration **requires** having a cluster with at least 2 nodes on which Metrics Server can be scheduled.
+>[!NOTE]
+> This configuration **requires** having a cluster with at least 2 nodes on which Metrics Server can be scheduled.
 
 Also, to maximize the efficiency of this highly available configuration, it is **recommended** to add the `--enable-aggregator-routing=true` CLI flag to the kube-apiserver so that requests sent to Metrics Server are load balanced between the 2 instances.
 

charts/metrics-server/CHANGELOG.md

@@ -14,11 +14,20 @@
 
 ## [UNRELEASED]
 
+### Fixed
+
+- Fixed nanny's RoleBinding which contained a hard-coded namespace instead of the Helm's release namespace. ([#1479](https://github.com/kubernetes-sigs/metrics-server/pull/1479)) _@
+the-technat_
+
+- ### Changed
+- Updated the _addonResizer_ OCI image to [1.8.21](https://github.com/kubernetes/autoscaler/releases/tag/addon-resizer-1.8.21). _@jimmy-ungerman_
+
 ## [3.12.1] - TBC
 
 ### Changed
 
 - Updated the _Metrics Server_ OCI image to [v0.7.1](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.1). ([#1461](https://github.com/kubernetes-sigs/metrics-server/pull/1461)) _@stevehipwell_
+- Changed `Deployment` templating to ignore `schedulerName` when value is empty. ([#1475](https://github.com/kubernetes-sigs/metrics-server/pull/1475)) _@senges_
 
 ## [3.12.0] - 2024-02-07
 

charts/metrics-server/README.md

@@ -33,7 +33,7 @@ The following table lists the configurable parameters of the _Metrics Server_ ch
 | `serviceAccount.name`                | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the full name template.                                                                                                                                  | `nil`                                                                          |
 | `serviceAccount.secrets`             | The list of secrets mountable by this service account. See <https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets>                                                                                                             | `[]`                                                                           |
 | `rbac.create`                        | If `true`, create the RBAC resources.                                                                                                                                                                                                                            | `true`                                                                         |
-| `rbac.pspEnabled`                    | If `true`, create a pod security policy resource.                                                                                                                                                                                                                | `false`                                                                        |
+| `rbac.pspEnabled`                    | If `true`, create a pod security policy resource, unless Kubernetes version is 1.25 or later.                                                                                                                                                                    | `false`                                                                        |
 | `apiService.create`                  | If `true`, create the `v1beta1.metrics.k8s.io` API service. You typically want this enabled! If you disable API service creation you have to manage it outside of this chart for e.g horizontal pod autoscaling to work with this release.                       | `true`                                                                         |
 | `apiService.annotations`             | Annotations to add to the API service                                                                                                                                                                                                                            | `{}`                                                                           |
 | `apiService.insecureSkipTLSVerify`   | Specifies whether to skip TLS verification (NOTE: this setting is not a proxy for the `--kubelet-insecure-tls` metrics-server flag)                             | `true`                                          |
@@ -63,7 +63,7 @@ The following table lists the configurable parameters of the _Metrics Server_ ch
 | `addonResizer.enabled`               | If `true`, run the addon-resizer as a sidecar to automatically scale resource requests with cluster size.                                                                                                                                                        | `false`                                                                        |
 | `addonResizer.securityContext`       | Security context for the _metrics_server_container.       |                                                                                                                                             _See values.yaml |
 | `addonResizer.image.repository`      | addon-resizer image repository                                                                                                                                                                                                                                   | `registry.k8s.io/autoscaling/addon-resizer`                                    |
-| `addonResizer.image.tag`             | addon-resizer image tag                                                                                                                                                                                                                                          | `1.8.19`                                                                       |
+| `addonResizer.image.tag`             | addon-resizer image tag                                                                                                                                                                                                                                          | `1.8.21`                                                                       |
 | `addonResizer.resources`             | Resource requests and limits for the _nanny_ container.                                                                                                                                                                                                          | `{ requests: { cpu: 40m, memory: 25Mi }, limits: { cpu: 40m, memory: 25Mi } }` |
 | `addonResizer.nanny.cpu`             | The base CPU requirement.                                                                                                                                                                                                                                        | `0m`                                                                           |
 | `addonResizer.nanny.extraCPU`        | The amount of CPU to add per node.                                                                                                                                                                                                                               | `1m`                                                                           |

charts/metrics-server/templates/deployment.yaml

@@ -33,7 +33,9 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
     spec:
-      schedulerName: {{ .Values.schedulerName }}
+      {{- with .Values.schedulerName }}
+      schedulerName: {{ . }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}

charts/metrics-server/templates/psp.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.rbac.pspEnabled }}
+{{- if and (.Values.rbac.pspEnabled) (semverCompare "<1.25-0" .Capabilities.KubeVersion.GitVersion) }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:

charts/metrics-server/templates/rolebinding-nanny.yaml

@@ -4,7 +4,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: {{ printf "%s-nanny" (include "metrics-server.fullname" .)  }}
-  namespace: kube-system
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "metrics-server.labels" . | nindent 4 }}
 roleRef:

charts/metrics-server/values.yaml

@@ -29,6 +29,7 @@ serviceAccount:
 rbac:
   # Specifies whether RBAC resources should be created
   create: true
+  # Note: PodSecurityPolicy will not be created when Kubernetes version is 1.25 or later.
   pspEnabled: false
 
 apiService:
@@ -129,7 +130,7 @@ addonResizer:
   enabled: false
   image:
     repository: registry.k8s.io/autoscaling/addon-resizer
-    tag: 1.8.20
+    tag: 1.8.21
   securityContext:
     allowPrivilegeEscalation: false
     readOnlyRootFilesystem: true