protected pod against eviction with system known annotation

phanama · Apr 17, 2020 · 98c9125 · 98c9125
1 parent 6f82ca0
commit 98c9125
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/README.md b/README.md
@@ -69,6 +69,9 @@ Keep the following in mind before deploying Draino:
 * Draino considers a drain to have failed if at least one pod eviction triggered
   by that drain fails. If Draino fails to evict two of five pods it will consider
   the Drain to have failed, but the remaining three pods will always be evicted.
+* Pods that can't be evited by the cluster-autoscaler won't be evicted by draino.
+  See annotation `"cluster-autoscaler.kubernetes.io/safe-to-evict": "false"` in
+  [cluster-autoscaler documentation](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#what-types-of-pods-can-prevent-ca-from-removing-a-node)
 
 ## Deployment
 Draino is automatically built from master and pushed to the [Docker Hub](https://hub.docker.com/r/planetlabs/draino/).

diff --git a/cmd/draino/draino.go b/cmd/draino/draino.go
@@ -140,9 +140,10 @@ func main() {
 	if !*evictStatefulSetPods {
 		pf = append(pf, kubernetes.NewStatefulSetPodFilter(cs))
 	}
-	if len(*protectedPodAnnotations) > 0 {
-		pf = append(pf, kubernetes.UnprotectedPodFilter(*protectedPodAnnotations...))
+	systemKnownAnnotations := []string{
+		"cluster-autoscaler.kubernetes.io/safe-to-evict=false", // https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#what-types-of-pods-can-prevent-ca-from-removing-a-node
 	}
+	pf = append(pf, kubernetes.UnprotectedPodFilter(append(systemKnownAnnotations, *protectedPodAnnotations...)...))
 	var h cache.ResourceEventHandler = kubernetes.NewDrainingResourceEventHandler(
 		kubernetes.NewAPICordonDrainer(cs,
 			kubernetes.MaxGracePeriod(*maxGracePeriod),