diff --git a/charts/cluster-autoscaler/Chart.yaml b/charts/cluster-autoscaler/Chart.yaml index f7e1748ef542..b0ff4d599aab 100644 --- a/charts/cluster-autoscaler/Chart.yaml +++ b/charts/cluster-autoscaler/Chart.yaml @@ -17,4 +17,4 @@ name: cluster-autoscaler sources: - https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler type: application -version: 9.16.1 +version: 9.16.2 diff --git a/charts/cluster-autoscaler/README.md b/charts/cluster-autoscaler/README.md index 5ac0858892ab..d21b6352994a 100644 --- a/charts/cluster-autoscaler/README.md +++ b/charts/cluster-autoscaler/README.md @@ -238,72 +238,9 @@ The command removes all the Kubernetes components associated with the chart and ### AWS - IAM -The worker running the cluster autoscaler will need access to certain resources and actions: - -```json -{ - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "autoscaling:DescribeAutoScalingGroups", - "autoscaling:DescribeAutoScalingInstances", - "autoscaling:DescribeLaunchConfigurations", - "autoscaling:DescribeTags", - "autoscaling:SetDesiredCapacity", - "autoscaling:TerminateInstanceInAutoScalingGroup" - ], - "Resource": "*" - } - ] -} -``` - -- `DescribeTags` is required for autodiscovery. -- `DescribeLaunchConfigurations` is required to scale up an ASG from 0. - -If you would like to limit the scope of the Cluster Autoscaler to ***only*** modify ASGs for a particular cluster, use the following policy instead: - -```json -{ - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "autoscaling:DescribeAutoScalingGroups", - "autoscaling:DescribeAutoScalingInstances", - "autoscaling:DescribeLaunchConfigurations", - "autoscaling:DescribeTags", - "ec2:DescribeLaunchTemplateVersions" - ], - "Resource": "*" - }, - { - "Effect": "Allow", - "Action": [ - "autoscaling:SetDesiredCapacity", - "autoscaling:TerminateInstanceInAutoScalingGroup", - "autoscaling:UpdateAutoScalingGroup" - ], - "Resource": [ - "arn:aws:autoscaling:::autoScalingGroup::autoScalingGroupName/node-group-1", - "arn:aws:autoscaling:::autoScalingGroup::autoScalingGroupName/node-group-2", - "arn:aws:autoscaling:::autoScalingGroup::autoScalingGroupName/node-group-3" - ], - "Condition": { - "StringEquals": { - "autoscaling:ResourceTag/k8s.io/cluster-autoscaler/enabled": "true", - "autoscaling:ResourceTag/kubernetes.io/cluster/": "owned" - } - } - } - ] -} -``` +The worker running the cluster autoscaler will need access to certain resources and actions depending on the version you run and your configuration of it. -Make sure to replace the variables ``, ``, ``, and the ARNs of the ASGs where applicable. +For the up-to-date IAM permissions required, please see the [cluster autoscaler's AWS Cloudprovider Readme](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#iam-policy) and switch to the tag of the cluster autoscaler image you are using. ### AWS - IAM Roles for Service Accounts (IRSA) diff --git a/charts/cluster-autoscaler/README.md.gotmpl b/charts/cluster-autoscaler/README.md.gotmpl index 5e50ec4ba2ec..306fd57f01e8 100644 --- a/charts/cluster-autoscaler/README.md.gotmpl +++ b/charts/cluster-autoscaler/README.md.gotmpl @@ -239,72 +239,9 @@ The command removes all the Kubernetes components associated with the chart and ### AWS - IAM -The worker running the cluster autoscaler will need access to certain resources and actions: - -```json -{ - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "autoscaling:DescribeAutoScalingGroups", - "autoscaling:DescribeAutoScalingInstances", - "autoscaling:DescribeLaunchConfigurations", - "autoscaling:DescribeTags", - "autoscaling:SetDesiredCapacity", - "autoscaling:TerminateInstanceInAutoScalingGroup" - ], - "Resource": "*" - } - ] -} -``` - -- `DescribeTags` is required for autodiscovery. -- `DescribeLaunchConfigurations` is required to scale up an ASG from 0. - -If you would like to limit the scope of the Cluster Autoscaler to ***only*** modify ASGs for a particular cluster, use the following policy instead: - -```json -{ - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "autoscaling:DescribeAutoScalingGroups", - "autoscaling:DescribeAutoScalingInstances", - "autoscaling:DescribeLaunchConfigurations", - "autoscaling:DescribeTags", - "ec2:DescribeLaunchTemplateVersions" - ], - "Resource": "*" - }, - { - "Effect": "Allow", - "Action": [ - "autoscaling:SetDesiredCapacity", - "autoscaling:TerminateInstanceInAutoScalingGroup", - "autoscaling:UpdateAutoScalingGroup" - ], - "Resource": [ - "arn:aws:autoscaling:::autoScalingGroup::autoScalingGroupName/node-group-1", - "arn:aws:autoscaling:::autoScalingGroup::autoScalingGroupName/node-group-2", - "arn:aws:autoscaling:::autoScalingGroup::autoScalingGroupName/node-group-3" - ], - "Condition": { - "StringEquals": { - "autoscaling:ResourceTag/k8s.io/cluster-autoscaler/enabled": "true", - "autoscaling:ResourceTag/kubernetes.io/cluster/": "owned" - } - } - } - ] -} -``` +The worker running the cluster autoscaler will need access to certain resources and actions depending on the version you run and your configuration of it. -Make sure to replace the variables ``, ``, ``, and the ARNs of the ASGs where applicable. +For the up-to-date IAM permissions required, please see the [cluster autoscaler's AWS Cloudprovider Readme](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#iam-policy) and switch to the tag of the cluster autoscaler image you are using. ### AWS - IAM Roles for Service Accounts (IRSA)