Add option to ignore namespaces #6788

adrianmoisey · 2024-05-01T14:59:31Z

What type of PR is this?

/kind feature

What this PR does / why we need it:

This is a replacement PR for #6428

It allows a user to specify a list of namespaces for the various VPA components to ignore.

Which issue(s) this PR fixes:

Fixes #6232

Special notes for your reviewer:

There are no tests at the moment. I'm just making the PR to get some early review to ensure that this is on the right track.

Does this PR introduce a user-facing change?

Add new `---ignored-vpa-object-namespaces` parameter to specify namespaces for the VPA to ignore

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

N/A

To both recommender and updater

k8s-ci-robot · 2024-05-01T14:59:36Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: adrianmoisey
Once this PR has been reviewed and has the lgtm label, please assign jbartosik for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

vertical-pod-autoscaler/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2024-05-01T14:59:40Z

Welcome @adrianmoisey!

It looks like this is your first PR to kubernetes/autoscaler 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/autoscaler has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2024-05-01T14:59:41Z

Hi @adrianmoisey. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

In the unlikely case that a nil value is passed in, this code would have failed with an error

kwiesmueller · 2024-05-01T15:30:54Z

vertical-pod-autoscaler/pkg/admission-controller/config.go

@@ -96,6 +96,15 @@ func selfRegistration(clientset *kubernetes.Clientset, caCert []byte, namespace,
 	sideEffects := admissionregistration.SideEffectClassNone
 	failurePolicy := admissionregistration.Ignore
 	RegisterClientConfig.CABundle = caCert
+	namespaceSelector := metav1.LabelSelector{


Is this changing any behavior if the list is empty? What about not setting any selector when no ignores are set?

I wonder if just by having the all namespaces selector we impact cost or performance on the apiserver.

Fixed in cef6dcb

kwiesmueller · 2024-05-01T15:32:41Z

vertical-pod-autoscaler/pkg/admission-controller/main.go

 )

 func main() {
 	klog.InitFlags(nil)
 	kube_flag.InitFlags()
+
+	if len(*vpaObjectNamespace) > 0 && len(*ignoredVpaObjectNamespaces) > 0 {


This should probably happen after the info log below to still give a log about the version used.

Fixed in 590b4fc

kwiesmueller · 2024-05-01T15:34:23Z

vertical-pod-autoscaler/pkg/recommender/input/cluster_feeder.go

@@ -332,6 +344,12 @@ func filterVPAs(feeder *clusterStateFeeder, allVpaCRDs []*vpa_types.VerticalPodA
 				continue
 			}
 		}
+
+		if selectsNamespace(vpaCRD.ObjectMeta.Namespace, feeder.ignoredNamespaces) {


Can the sourcing of VPAs already do the filtering? So the API server doesn't send namespaces we don't want?

I did have a look at this, but I didn't find an easy solution to it.
The updater and recommender both seems to use a ListWatch in client-go (https://github.com/kubernetes/autoscaler/blob/vertical-pod-autoscaler-1.1.1/vertical-pod-autoscaler/vendor/k8s.io/client-go/tools/cache/listwatch.go#L69-L100)
This seems to take either a single namespace or all namespaces. There doesn't seem to be a way to exclude any namespaces.

An alternative could be to setup a ListWatch per namespace, but then I imagine we'll need to do quite a big refactor and continuously watch for updates to namespaces, and add/remove the ListWatch as namespaces are added and removed. I also don't know if that sort of change would be better or worse, efficiency wise, compared to this current PR's approach.

My current experience with VPA/client-go is very minimal, so I didn't want to take such a large task that could potentially be the wrong direction.

kwiesmueller · 2024-05-01T15:34:47Z

vertical-pod-autoscaler/pkg/recommender/main.go

@@ -108,6 +110,11 @@ const (
 func main() {
 	klog.InitFlags(nil)
 	kube_flag.InitFlags()
+
+	if len(*vpaObjectNamespace) > 0 && len(*ignoredVpaObjectNamespaces) > 0 {


Same here, I think the version log should come first.

Fixed in 590b4fc

kwiesmueller · 2024-05-01T15:35:27Z

vertical-pod-autoscaler/pkg/updater/logic/updater.go

@@ -137,6 +149,10 @@ func (u *updater) RunOnce(ctx context.Context) {
 	vpas := make([]*vpa_api_util.VpaWithSelector, 0)

 	for _, vpa := range vpaList {
+		if selectsNamespace(vpa.Namespace, u.ignoredNamespaces) {


Same here, why are we even getting those VPAs here?

kwiesmueller · 2024-05-01T15:36:09Z

vertical-pod-autoscaler/pkg/updater/main.go

-	vpaObjectNamespace = flag.String("vpa-object-namespace", apiv1.NamespaceAll, "Namespace to search for VPA objects. Empty means all namespaces will be used.")
+	namespace                  = os.Getenv("NAMESPACE")
+	vpaObjectNamespace         = flag.String("vpa-object-namespace", apiv1.NamespaceAll, "Namespace to search for VPA objects. Empty means all namespaces will be used.")
+	ignoredVpaObjectNamespaces = flag.String("ignored-vpa-object-namespaces", "", "Comma separated list of namespaces to ignore.")


Is there a shared library of sorts where we could put all this instead? It seems like there is no difference in code between the components.

There doesn't seem to be a shared library for these flags. The existing VPA components all declare their own flags.

ssanders1449 · 2024-05-08T11:03:29Z

vertical-pod-autoscaler/pkg/admission-controller/config.go

+				},
+			},
+		}
+	}


Shouldn't we also be setting a nameSpaceSelector for the case where vpa-object-namespace is used to cause the webhook to operate only for that namespace? This way the pods for all other namespaces do not have to wait for an answer from the admission controller before they start (it will also reduce the load on the admission controller)

Good idea!
Fixed in 4073194

adrianmoisey · 2024-05-14T19:48:30Z

@kwiesmueller I've replied to your comments. I just want to check if this path is worth going down? And if I should spend the time to write tests for this PR.

adrianmoisey · 2024-05-29T16:07:41Z

@kwiesmueller any chance you have some time to look at this again?

kwiesmueller · 2024-05-29T19:08:10Z

/assign @raywainman
Ray, can you have a look?

britdm and others added 8 commits January 8, 2024 13:55

gcp: fix unsafe webhook vpa-webhook-config

e23e769

Fix operator value

b5bdba3

wrap namespaceSelector values for admission-controller with a flag

81ab072

Merge branch 'master' into master

6474581

Merge remote-tracking branch 'britdm/master' into vpa-ignore-namespace

a5f6d01

Add "ignored-vpa-object-namespaces"

2d38ced

To both recommender and updater

Rename the option in the admission-controller for consistency

cfb625e

Move README comment to the toplevel readme

3e4cc78

k8s-ci-robot added the kind/feature Categorizes issue or PR as related to a new feature. label May 1, 2024

k8s-ci-robot requested a review from jbartosik May 1, 2024 14:59

k8s-ci-robot added the area/vertical-pod-autoscaler label May 1, 2024

k8s-ci-robot requested a review from kgolab May 1, 2024 14:59

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label May 1, 2024

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label May 1, 2024

k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label May 1, 2024

adrianmoisey mentioned this pull request May 1, 2024

[GCE] fix unsafe webhook vpa-webhook-config #6428

Closed

adrianmoisey added 2 commits May 1, 2024 17:11

Add the new example to the index

5cca0cc

Don't pass around pointers

9e9ca33

In the unlikely case that a nil value is passed in, this code would have failed with an error

kwiesmueller requested changes May 1, 2024

View reviewed changes

adrianmoisey added 2 commits May 1, 2024 21:36

Move error log to below startup log

590b4fc

Make namespaceSelector empty when the list of namespaces is empty

cef6dcb

ssanders1449 reviewed May 8, 2024

View reviewed changes

Allow webhook to select namespaces

4073194

k8s-ci-robot assigned raywainman May 29, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add option to ignore namespaces #6788

Add option to ignore namespaces #6788

adrianmoisey commented May 1, 2024

k8s-ci-robot commented May 1, 2024

k8s-ci-robot commented May 1, 2024

k8s-ci-robot commented May 1, 2024

kwiesmueller May 1, 2024

kwiesmueller May 1, 2024

adrianmoisey May 2, 2024

kwiesmueller May 1, 2024

adrianmoisey May 1, 2024

kwiesmueller May 1, 2024

adrianmoisey May 1, 2024

kwiesmueller May 1, 2024

adrianmoisey May 1, 2024

kwiesmueller May 1, 2024

kwiesmueller May 1, 2024

adrianmoisey May 1, 2024

ssanders1449 May 8, 2024

adrianmoisey May 14, 2024

adrianmoisey commented May 14, 2024

adrianmoisey commented May 29, 2024

kwiesmueller commented May 29, 2024

Add option to ignore namespaces #6788

Are you sure you want to change the base?

Add option to ignore namespaces #6788

Conversation

adrianmoisey commented May 1, 2024

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

k8s-ci-robot commented May 1, 2024

k8s-ci-robot commented May 1, 2024

k8s-ci-robot commented May 1, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

adrianmoisey commented May 14, 2024

adrianmoisey commented May 29, 2024

kwiesmueller commented May 29, 2024