Bug 1718458

Summary:	[3.11] Extend cluster-autoscaler RBAC rules to allow to access pods/eviction resource
Product:	OpenShift Container Platform	Reporter:	Jan Chaloupka <jchaloup>
Component:	Installer	Assignee:	Russell Teague <rteague>
Installer sub component:	openshift-ansible	QA Contact:	Johnny Liu <jialiu>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	medium
Priority:	low	CC:	aos-bugs, bsmitley, eparis, jhou, jokerman, mburke, mmccomas, vigoyal, xtian
Version:	3.11.0
Target Milestone:	---
Target Release:	3.11.z
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	Cause: The cluster autoscaler does not have the clusterrole permission to evict pods. Consequence: Nodes cannot be automatically scaled because pods are not evicted. Fix: Added 'eviction' permission to autoscaler clusterrole. Result: Pods can be evicted and nodes scaled down.	Story Points:	---
Clone Of:	1705233	Environment:
Last Closed:	2019-06-26 09:08:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1705233
Bug Blocks:

Comment 1 Jan Chaloupka 2019-06-07 19:48:31 UTC

```yaml
- apiGroups: [""]
  resources: ["pods/eviction"]
  verbs: ["create"]
```

needs to be added under https://github.com/openshift/openshift-ansible/blob/release-3.11/roles/openshift_cluster_autoscaler/files/clusterrole.yml

Comment 2 Jan Chaloupka 2019-06-07 19:55:21 UTC

Upstream PR: https://github.com/openshift/openshift-ansible/pull/11673

Comment 4 Jianwei Hou 2019-06-12 06:13:18 UTC

Verified this has been added to the ansible role.

Comment 6 errata-xmlrpc 2019-06-26 09:08:11 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:1605