From cd48b2f8f4f8091dc72367d373b2d91e0ded7069 Mon Sep 17 00:00:00 2001 From: Adrian Moisey Date: Sun, 5 Jan 2025 15:32:18 +0200 Subject: [PATCH 1/2] VPA: Add docs about AKS and EKS with Cilium Ref: - AKS: https://github.com/kubernetes/autoscaler/issues/7392 - EKS: https://github.com/kubernetes/autoscaler/issues/6915 --- vertical-pod-autoscaler/docs/faq.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/vertical-pod-autoscaler/docs/faq.md b/vertical-pod-autoscaler/docs/faq.md index d317731a4c8a..1001085f8db9 100644 --- a/vertical-pod-autoscaler/docs/faq.md +++ b/vertical-pod-autoscaler/docs/faq.md @@ -10,6 +10,8 @@ - [What are the parameters to VPA recommender?](#what-are-the-parameters-to-vpa-recommender) - [What are the parameters to VPA updater?](#what-are-the-parameters-to-vpa-updater) - [How can I configure VPA to manage only specific resources?](#how-can-i-configure-vpa-to-manage-only-specific-resources) +- [Special requirements when running in AKS?](#special-requirements-when-running-in-aks) +- [Special requirements when running in EKS with Cilium?](#special-requirements-when-running-in-eks-with-cilium) ### VPA restarts my pods but does not modify CPU or memory settings @@ -294,4 +296,17 @@ Common use cases: 2. CPU-only VPA: * Use controlledResources: ["cpu"] when you want to automate CPU resource allocation -* Useful when memory requirements are stable but CPU usage varies \ No newline at end of file +* Useful when memory requirements are stable but CPU usage varies + +### Special requirements when running in AKS? + +When running a webhook in AKS, it blocks webhook requests for the kube-system namespace in order to protect the system. +See the [AKS FAQ page](https://learn.microsoft.com/en-us/azure/aks/faq#can-admission-controller-webhooks-impact-kube-system-and-internal-aks-namespaces-) for more info. + +The `--webhook-labels` paramater for the VPA admission-controller can be used to bypass this behaviour, if required by the user. + +### Special requirements when running in EKS with Cilium? + +When running in EKS with Cilium, the EKS API server cannot route traffic to the overlap network. The VPA admission-controller +Pods either need to use host networking or be exposed through a service or ingress. +See the [Cilium Helm installation page](https://docs.cilium.io/en/stable/installation/k8s-install-helm/) for more info. From 823bc9d59b7001d6f2bbd2976b142b37688db444 Mon Sep 17 00:00:00 2001 From: Adrian Moisey Date: Tue, 7 Jan 2025 13:00:44 +0200 Subject: [PATCH 2/2] Fix typos and improve wording --- vertical-pod-autoscaler/docs/faq.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/vertical-pod-autoscaler/docs/faq.md b/vertical-pod-autoscaler/docs/faq.md index 1001085f8db9..fe625376c23a 100644 --- a/vertical-pod-autoscaler/docs/faq.md +++ b/vertical-pod-autoscaler/docs/faq.md @@ -10,8 +10,8 @@ - [What are the parameters to VPA recommender?](#what-are-the-parameters-to-vpa-recommender) - [What are the parameters to VPA updater?](#what-are-the-parameters-to-vpa-updater) - [How can I configure VPA to manage only specific resources?](#how-can-i-configure-vpa-to-manage-only-specific-resources) -- [Special requirements when running in AKS?](#special-requirements-when-running-in-aks) -- [Special requirements when running in EKS with Cilium?](#special-requirements-when-running-in-eks-with-cilium) +- [How can I have Pods in the kube-system namespace under VPA control in AKS?](#how-can-i-have-pods-in-the-kube-system-namespace-under-vpa-control-in-aks) +- [How can I configure VPA when running in EKS with Cilium?](#how-can-i-configure-vpa-when-running-in-eks-with-cilium) ### VPA restarts my pods but does not modify CPU or memory settings @@ -298,15 +298,15 @@ Common use cases: * Use controlledResources: ["cpu"] when you want to automate CPU resource allocation * Useful when memory requirements are stable but CPU usage varies -### Special requirements when running in AKS? +### How can I have Pods in the kube-system namespace under VPA control in AKS? When running a webhook in AKS, it blocks webhook requests for the kube-system namespace in order to protect the system. See the [AKS FAQ page](https://learn.microsoft.com/en-us/azure/aks/faq#can-admission-controller-webhooks-impact-kube-system-and-internal-aks-namespaces-) for more info. -The `--webhook-labels` paramater for the VPA admission-controller can be used to bypass this behaviour, if required by the user. +The `--webhook-labels` parameter for the VPA admission-controller can be used to bypass this behaviour, if required by the user. -### Special requirements when running in EKS with Cilium? +### How can I configure VPA when running in EKS with Cilium? -When running in EKS with Cilium, the EKS API server cannot route traffic to the overlap network. The VPA admission-controller +When running in EKS with Cilium, the EKS API server cannot route traffic to the overlay network. The VPA admission-controller Pods either need to use host networking or be exposed through a service or ingress. See the [Cilium Helm installation page](https://docs.cilium.io/en/stable/installation/k8s-install-helm/) for more info.