Repository: kubernetes-sigs/descheduler

Issue #1595: helm chart version 0.32.0 lacks poddisruptionbudgets.policy perms
Created: 2025-01-03T11:15:19Z
What version of descheduler are you using?
descheduler version: v0.32.0
Does this issue reproduce with the latest release?
This is latest release.
Which descheduler CLI options are you using?
Please provide a copy of your descheduler policy config file
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: descheduler
  namespace: flux-system
spec:
  interval: 24h
  url: https://kubernetes-sigs.github.io/descheduler/
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: descheduler
  namespace: flux-system
spec:
  interval: 30m
  releaseName: descheduler
  targetNamespace: kube-system
  serviceAccountName: helm-controller
  chart:
    spec:
      chart: descheduler
      version: 0.32.x
      sourceRef:
        kind: HelmRepository
        name: descheduler
        namespace: flux-system
      interval: 12h
  values:
    kind: Deployment
    service:
      enabled: true
    serviceMonitor:
      enabled: true
    deschedulerPolicy:
      nodeSelector: node-role.kubernetes.io/worker=true
      profiles:
        - name: ProfileName
          pluginConfig:
            - name: DefaultEvictor
              args:
                nodeFit: true
            - name: RemoveDuplicates
            - name: RemovePodsViolatingInterPodAntiAffinity
            - name: RemovePodsHavingTooManyRestarts
              args:
                podRestartThreshold: 50
                includingInitContainers: true
            - name: LowNodeUtilization
              args:
                thresholds:
                  cpu: 20
                  memory: 20
                  pods: 20
                targetThresholds:
                  cpu: 50
                  memory: 50
                  pods: 50
                evictableNamespaces:
                  exclude:
                    - kube-system
                    - democratic-csi
            - name: HighNodeUtilization
              args:
                thresholds:
                  cpu: 20
                  memory: 20
                  pods: 20
                evictableNamespaces:
                  exclude:
                    - kube-system
                    - democratic-csi
            - name: PodLifeTime
              args:
                maxPodLifeTimeSeconds: 86400
                states:
                  - Pending
                  - PodInitializing
          plugins:
            balance:
              enabled:
                - HighNodeUtilization
                - LowNodeUtilization
                - RemoveDuplicates
            deschedule:
              enabled:
                - RemovePodsViolatingInterPodAntiAffinity
                - RemovePodsHavingTooManyRestarts
                - PodLifeTime


What k8s version are you using (kubectl version)?
kubectl version Output$ kubectl version
Client Version: v1.31.4
Kustomize Version: v5.4.2
Server Version: v1.31.2

What did you do?
helm chart updated from 0.31.0 and now...
I0103 10:56:40.865811       1 feature_gate.go:387] feature gates: {map[]}
I0103 10:56:41.472815       1 secure_serving.go:57] Forcing use of http/1.1 only
I0103 10:56:41.473036       1 named_certificates.go:53] "Loaded SNI cert" index=0 certName="self-signed loopback" certDetail="\"apiserver-loopback-client@1735901801\" [serving] validServingFor=[apiserver-loopback-client] issuer=\"apiserver-loopback-client-ca@1735901801\" (2025-01-03 09:56:40 +0000 UTC to 2026-01-03 09:56:40 +0000 UTC (now=2025-01-03 10:56:41.472973203 +0000 UTC))"
I0103 10:56:41.473060       1 secure_serving.go:213] Serving securely on [::]:10258
I0103 10:56:41.473077       1 tracing.go:87] Did not find a trace collector endpoint defined. Switching to NoopTraceProvider
I0103 10:56:41.473093       1 tlsconfig.go:243] "Starting DynamicServingCertificateController"
I0103 10:56:41.473338       1 envvar.go:172] "Feature gate default state" feature="ClientsAllowCBOR" enabled=false
I0103 10:56:41.473361       1 envvar.go:172] "Feature gate default state" feature="ClientsPreferCBOR" enabled=false
I0103 10:56:41.473366       1 envvar.go:172] "Feature gate default state" feature="InformerResourceVersion" enabled=false
I0103 10:56:41.473370       1 envvar.go:172] "Feature gate default state" feature="WatchListClient" enabled=false
I0103 10:56:41.498844       1 reflector.go:313] Starting reflector *v1.Namespace (0s) from k8s.io/client-go/informers/factory.go:160
I0103 10:56:41.498848       1 reflector.go:313] Starting reflector *v1.Node (0s) from k8s.io/client-go/informers/factory.go:160
I0103 10:56:41.498844       1 reflector.go:313] Starting reflector *v1.PriorityClass (0s) from k8s.io/client-go/informers/factory.go:160
I0103 10:56:41.498870       1 reflector.go:349] Listing and watching *v1.Node from k8s.io/client-go/informers/factory.go:160
I0103 10:56:41.498853       1 reflector.go:313] Starting reflector *v1.Pod (0s) from k8s.io/client-go/informers/factory.go:160
I0103 10:56:41.498880       1 reflector.go:349] Listing and watching *v1.PriorityClass from k8s.io/client-go/informers/factory.go:160
I0103 10:56:41.498889       1 reflector.go:349] Listing and watching *v1.Pod from k8s.io/client-go/informers/factory.go:160
I0103 10:56:41.498856       1 reflector.go:313] Starting reflector *v1.PodDisruptionBudget (0s) from k8s.io/client-go/informers/factory.go:160
I0103 10:56:41.498902       1 reflector.go:349] Listing and watching *v1.PodDisruptionBudget from k8s.io/client-go/informers/factory.go:160
I0103 10:56:41.498864       1 reflector.go:349] Listing and watching *v1.Namespace from k8s.io/client-go/informers/factory.go:160
I0103 10:56:41.502794       1 reflector.go:376] Caches populated for *v1.PriorityClass from k8s.io/client-go/informers/factory.go:160
W0103 10:56:41.504105       1 reflector.go:569] k8s.io/client-go/informers/factory.go:160: failed to list *v1.PodDisruptionBudget: poddisruptionbudgets.policy is forbidden: User "system:serviceaccount:kube-system:descheduler" cannot list resource "poddisruptionbudgets" in API group "policy" at the cluster scope
E0103 10:56:41.504128       1 reflector.go:166] "Unhandled Error" err="k8s.io/client-go/informers/factory.go:160: Failed to watch *v1.PodDisruptionBudget: failed to list *v1.PodDisruptionBudget: poddisruptionbudgets.policy is forbidden: User \"system:serviceaccount:kube-system:descheduler\" cannot list resource \"poddisruptionbudgets\" in API group \"policy\" at the cluster scope" logger="UnhandledError"
I0103 10:56:41.504676       1 reflector.go:376] Caches populated for *v1.Namespace from k8s.io/client-go/informers/factory.go:160
I0103 10:56:41.505533       1 reflector.go:376] Caches populated for *v1.Node from k8s.io/client-go/informers/factory.go:160

Duplicate issue #1597: charts: missing perms in ClusterRole if metricsCollector.enabled is true
Created: 2025-01-03T12:42:10Z
What version of descheduler are you using?
descheduler version: v0.32.0
Does this issue reproduce with the latest release?
It's the latest one
Which descheduler CLI options are you using?
Please provide a copy of your descheduler policy config file
deschedulerPolicy:
      nodeSelector: node-role.kubernetes.io/worker=true
      metricsCollector:
        enabled: true

What k8s version are you using (kubectl version)?
kubectl version Output$ kubectl version
Client Version: v1.31.4
Kustomize Version: v5.4.2
Server Version: v1.31.2

What did you do?
enabled metricsCollector
What did you expect to see?
What did you see instead?
E0103 12:37:27.584970       1 metricscollector.go:128] "Error fetching metrics" err="nodes.metrics.k8s.io \"k3s-node3\" is forbidden: User \"system:serviceaccount:kube-system:descheduler\" cannot get resource \"nodes\" in API group \"metrics.k8s.io\" at the cluster scope" node="k3s-node3"

Closing comment (2025-01-07T17:10:00Z): Dupe of #1595