GoogleCloudPlatform / GoogleCloudPlatform/k8s-stackdriver
Deployment YAMLs create unnecessary ClusterRole and ClusterRoleBinding on kube-system/horizontal-pod-autoscaler
- Dominant language
- Go
- Stars
- 409
- Forks
- 236
- Avg merge
- 2h 34m
- Merged PRs (30d)
- 9
Description
The YAML for both the [old resource model](https://raw.githubusercontent.com/GoogleCloudPlatform/k8s-stackdriver/master/custom-metrics-stackdriver-adapter/deploy/production/adapter.yaml) and the [new resource model](https://raw.githubusercontent.com/GoogleCloudPlatform/k8s-stackdriver/master/custom-metrics-stackdriver-adapter/deploy/production/adapter_new_resource_model.yaml) create a `ClusterRole` and `ClusterRoleBinding` involving the `kube-system/horizontal-pod-autoscaler` SA:
```
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: external-metrics-reader
rules:
- apiGroups:
- "external.metrics.k8s.io"
resources:
- "*"
verbs:
- list
- get
- watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: external-metrics-reader
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: external-metrics-reader
subjects:
- kind: ServiceAccount
name: horizontal-pod-autoscaler
namespace: kube-system
```
However in my GKE cluster (`1.18.12-gke.1210`), there is no `horizontal-pod-autoscaler` service account in the `kube-system` namespace (even after successfully creating an HPA). Further, I found that an HPA configured with an external metric exposed by the Stackdriver custom metrics adapter worked normally without creating either of these resources.
Should these resources be removed from the deploy YAML?
Contributor guide
Assessment
This issue has not been assessed yet.