FEATURE: Support force delete unevictable pods and update to go 1.20

.gitignore

@@ -15,3 +15,6 @@ draino
 
 # Go vendor directory
 vendor/
+
+# Coverage
+coverage.txt

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.13.15-alpine3.11 AS build
+FROM golang:1.20-alpine AS build
 
 RUN apk update && apk add git && apk add curl
 
@@ -7,7 +7,7 @@ COPY . .
 
 RUN go build -o /draino ./cmd/draino
 
-FROM alpine:3.11
+FROM alpine:3.18
 
 RUN apk update && apk add ca-certificates
 RUN addgroup -S user && adduser -S user -G user

README.md

@@ -33,8 +33,8 @@ Flags:
       --kubeconfig=KUBECONFIG    Path to kubeconfig file. Leave unset to use in-cluster config.
       --master=MASTER            Address of Kubernetes API server. Leave unset to use in-cluster config.
       --dry-run                  Emit an event without cordoning or draining matching nodes.
-      --max-grace-period=8m0s    Maximum time evicted pods will be given to terminate gracefully.
-      --eviction-headroom=30s    Additional time to wait after a pod's termination grace period for it to have been deleted.
+      --max-grace-period=1m      Maximum time evicted pods will be given to terminate gracefully.
+      --eviction-headroom=10m    Additional time to wait after a pod's termination grace period for it to have been deleted.
       --drain-buffer=10m0s       Minimum time between starting each drain. Nodes are always cordoned immediately.
       --node-label="foo=bar"     (DEPRECATED) Only nodes with this label will be eligible for cordoning and draining. May be specified multiple times.
       --node-label-expr="metadata.labels.foo == 'bar'"
@@ -48,10 +48,14 @@ Flags:
                                  Leader election retry period.
       --skip-drain               Whether to skip draining nodes after cordoning.
       --evict-daemonset-pods     Evict pods that were created by an extant DaemonSet.
+      --evict-statefulset-pods   Evict pods that were created by an extant StatefulSet.
       --evict-emptydir-pods      Evict pods with local storage, i.e. with emptyDir volumes.
       --evict-unreplicated-pods  Evict pods that were not created by a replication controller.
+      --allow-force-delete       Allow force to delete the pods if they do not terminate within 3x grace period.
       --protected-pod-annotation=KEY[=VALUE] ...
                                  Protect pods with this annotation from eviction. May be specified multiple times.
+      --ignore-safe-to-evict-annotation
+                                 Ignore the "cluster-autoscaler.kubernetes.io/safe-to-evict=false" annotation.
 
 Args:
   <node-conditions>  Nodes for which any of these conditions are true will be cordoned and drained.

cmd/draino/draino.go

@@ -72,8 +72,10 @@ func main() {
 		evictStatefulSetPods  = app.Flag("evict-statefulset-pods", "Evict pods that were created by an extant StatefulSet.").Bool()
 		evictLocalStoragePods = app.Flag("evict-emptydir-pods", "Evict pods with local storage, i.e. with emptyDir volumes.").Bool()
 		evictUnreplicatedPods = app.Flag("evict-unreplicated-pods", "Evict pods that were not created by a replication controller.").Bool()
+		allowForceDelete      = app.Flag("allow-force-delete", "Allow force to delete the pods if they do not terminate within the grace period.").Bool()
 
-		protectedPodAnnotations = app.Flag("protected-pod-annotation", "Protect pods with this annotation from eviction. May be specified multiple times.").PlaceHolder("KEY[=VALUE]").Strings()
+		protectedPodAnnotations      = app.Flag("protected-pod-annotation", "Protect pods with this annotation from eviction. May be specified multiple times.").PlaceHolder("KEY[=VALUE]").Strings()
+		ingoreSafeToEvictAnnotations = app.Flag("ignore-safe-to-evict-annotation", "Ignore the cluster-autoscaler.kubernetes.io/safe-to-evict=false annotation.").Bool()
 
 		conditions = app.Arg("node-conditions", "Nodes for which any of these conditions are true will be cordoned and drained.").Required().Strings()
 	)
@@ -154,8 +156,9 @@ func main() {
 	if !*evictStatefulSetPods {
 		pf = append(pf, kubernetes.NewStatefulSetPodFilter(cs))
 	}
-	systemKnownAnnotations := []string{
-		"cluster-autoscaler.kubernetes.io/safe-to-evict=false", // https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#what-types-of-pods-can-prevent-ca-from-removing-a-node
+	systemKnownAnnotations := []string{}
+	if !*ingoreSafeToEvictAnnotations {
+		systemKnownAnnotations = append(systemKnownAnnotations, "cluster-autoscaler.kubernetes.io/safe-to-evict=false")
 	}
 	pf = append(pf, kubernetes.UnprotectedPodFilter(append(systemKnownAnnotations, *protectedPodAnnotations...)...))
 	var h cache.ResourceEventHandler = kubernetes.NewDrainingResourceEventHandler(
@@ -165,6 +168,7 @@ func main() {
 			kubernetes.WithSkipDrain(*skipDrain),
 			kubernetes.WithPodFilter(kubernetes.NewPodFilters(pf...)),
 			kubernetes.WithAPICordonDrainerLogger(log),
+			kubernetes.WithAllowForceDelete(*allowForceDelete),
 		),
 		kubernetes.NewEventRecorder(cs),
 		kubernetes.WithLogger(log),
@@ -214,7 +218,7 @@ func main() {
 	defer cancel()
 
 	lock, err := resourcelock.New(
-		resourcelock.EndpointsResourceLock,
+		"leases",
 		*namespace,
 		*leaderElectionTokenName,
 		cs.CoreV1(),

go.mod

@@ -1,38 +1,74 @@
 module github.com/planetlabs/draino
 
-go 1.13
-
-// Kube 1.15.3
-replace k8s.io/client-go => k8s.io/client-go v0.0.0-20190819141724-e14f31a72a77
-
-// Kube 1.15.3
-replace k8s.io/api => k8s.io/api v0.0.0-20190819141258-3544db3b9e44
-
-// Kube 1.15.3
-replace k8s.io/apimachinery => k8s.io/apimachinery v0.0.0-20190817020851-f2f3a405f61d
+go 1.20
 
 require (
 	contrib.go.opencensus.io/exporter/prometheus v0.1.0
-	github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc // indirect
-	github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf // indirect
 	github.com/antonmedv/expr v1.8.8
 	github.com/go-test/deep v1.0.1
 	github.com/julienschmidt/httprouter v1.1.0
-	github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
 	github.com/oklog/run v1.0.0
-	github.com/onsi/ginkgo v1.12.0 // indirect
-	github.com/onsi/gomega v1.9.0 // indirect
-	github.com/pkg/errors v0.8.0
-	github.com/stretchr/testify v1.5.1
+	github.com/pkg/errors v0.9.1
+	github.com/stretchr/testify v1.8.2
 	go.opencensus.io v0.21.0
-	go.uber.org/atomic v1.3.2 // indirect
-	go.uber.org/multierr v1.1.0 // indirect
 	go.uber.org/zap v1.9.1
 	gopkg.in/alecthomas/kingpin.v2 v2.2.6
-	gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f // indirect
-	gotest.tools v2.2.0+incompatible
-	k8s.io/api v0.0.0-20190819141258-3544db3b9e44
-	k8s.io/apimachinery v0.0.0-20190817020851-f2f3a405f61d
-	k8s.io/client-go v8.0.0+incompatible
+	k8s.io/api v0.28.0
+	k8s.io/apimachinery v0.28.0
+	k8s.io/client-go v0.28.0
 	k8s.io/klog v0.3.1
 )
+
+require (
+	github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc // indirect
+	github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf // indirect
+	github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.9.0 // indirect
+	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
+	github.com/go-logr/logr v1.2.4 // indirect
+	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/uuid v1.3.0 // indirect
+	github.com/hashicorp/golang-lru v0.5.0 // indirect
+	github.com/imdario/mergo v0.3.6 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_golang v0.9.2 // indirect
+	github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910 // indirect
+	github.com/prometheus/common v0.0.0-20181126121408-4724e9255275 // indirect
+	github.com/prometheus/procfs v0.0.0-20181204211112-1dc9a6cbc91a // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	go.uber.org/atomic v1.3.2 // indirect
+	go.uber.org/multierr v1.1.0 // indirect
+	golang.org/x/net v0.13.0 // indirect
+	golang.org/x/oauth2 v0.8.0 // indirect
+	golang.org/x/sys v0.10.0 // indirect
+	golang.org/x/term v0.10.0 // indirect
+	golang.org/x/text v0.11.0 // indirect
+	golang.org/x/time v0.3.0 // indirect
+	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/protobuf v1.30.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/klog/v2 v2.100.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 // indirect
+	k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
+	sigs.k8s.io/yaml v1.3.0 // indirect
+)