cluster-autoscaler clusterrole missing permissions for replicasets.apps

[mhyllander]

Is this a request for help?: No

---

Is this an ISSUE or FEATURE REQUEST? (choose one): ISSUE

---

What version of aks-engine?:
Version: v0.28.1
GitCommit: efc9dcf
GitTreeState: clean

---

Kubernetes version: 1.13.1

What happened: The cluster-autoscaler logs the following error repeatedly:

E0108 13:26:42.946201       1 reflector.go:134] k8s.io/client-go/informers/factory.go:132: Failed to list *v1.ReplicaSet: replicasets.apps is forbidden: User "system:serviceaccount:kube-system:cluster-autoscaler" cannot list resource "replicasets" in API group "apps" at the cluster scope

What you expected to happen: cluster-autscaler should be able to monitor all resources.

How to reproduce it (as minimally and precisely as possible):

Anything else we need to know:
This apparently happens because in the cluster-autoscaler clusterrole, in /etc/kubernetes/addons/cluster-autoscaler-deployment.yaml, there is the following rule:

- apiGroups: ["apps"]
  resources: ["statefulsets"]
  verbs: ["watch","list","get"]

The problem can be fixed by adding "replicasets" to the rule:

- apiGroups: ["apps"]
  resources: ["statefulsets","replicasets"]
  verbs: ["watch","list","get"]

[tariq1890]

@mhyllander Thanks for raising this issue. Feel free to raise a PR for this :)