Skip to content

Commit 5eb0c5d

Browse files
ofirc-wizofirc-wiz
authored
Add Horizontal Pod Autoscaling (HPA) support to Wiz AC (#418)
* Add Horizontal Pod Autoscaling (HPA) support to Wiz AC By default this is disabled. Prerequisites: metrics-server installed on the cluster: https://github.com/kubernetes-sigs/metrics-server To enable HPA, set: wiz-admission-controller: hpa: enabled: true
1 parent 9c23bbd commit 5eb0c5d

File tree

8 files changed

+162
-10
lines changed

8 files changed

+162
-10
lines changed

‎wiz-admission-controller/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ type: application
77
# This is the chart version. This version number should be incremented each time you make changes
88
# to the chart and its templates, including the app version.
99
# Versions are expected to follow Semantic Versioning (https://semver.org/)
10-
version: 3.6.0
10+
version: 3.6.1-preview
1111

1212
# This is the version number of the application being deployed. This version number should be
1313
# incremented each time you make changes to the application. Versions are not expected to

‎wiz-admission-controller/templates/_helpers.tpl‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,14 @@ If release name contains chart name it will be used as a full name.
4040
{{- end }}
4141
{{- end }}
4242

43+
{{- define "wiz-hpa-enforcer.name" -}}
44+
{{- printf "%s-hpa" (include "wiz-admission-controller.fullname" .) | trunc 63 | trimSuffix "-" }}
45+
{{- end }}
46+
47+
{{- define "wiz-hpa-audit-logs.name" -}}
48+
{{- printf "%s-hpa" (include "wiz-kubernetes-audit-log-collector.name" .) | trunc 63 | trimSuffix "-" }}
49+
{{- end }}
50+
4351
{{/*
4452
Create chart name and version as used by the chart label.
4553
*/}}
@@ -101,6 +109,21 @@ app.kubernetes.io/name: {{ include "wiz-kubernetes-audit-log-collector.name" . }
101109
{{ include "wiz-kubernetes-audit-log-collector.selectorLabels" . }}
102110
{{- end }}
103111

112+
{{/*
113+
Wiz Horizontal Pod Autoscaler labels
114+
*/}}
115+
116+
{{- define "wiz-hpa-enforcer.labels" -}}
117+
{{ include "wiz-admission-controller.labels" . }}
118+
app.kubernetes.io/name: {{ include "wiz-hpa-enforcer.name" . }}
119+
{{- end }}
120+
121+
{{- define "wiz-hpa-audit-logs.labels" -}}
122+
{{ include "wiz-admission-controller.labels" . }}
123+
app.kubernetes.io/name: {{ include "wiz-hpa-audit-logs.name" . }}
124+
{{- end }}
125+
126+
104127
{{/*
105128
106129
{{/*
@@ -189,3 +212,25 @@ Use for debug purpose only.
189212
{{- define "helpers.var_dump" -}}
190213
{{- . | mustToPrettyJson | printf "\nThe JSON output of the dumped var is: \n%s" | fail }}
191214
{{- end -}}
215+
216+
{{- define "wiz-admission-controller.resources" -}}
217+
{{- if hasKey .Values "resources" }}
218+
{{- toYaml .Values.resources }}
219+
{{- else -}}
220+
{{- if .Values.hpa.enabled }}
221+
requests:
222+
cpu: 500m
223+
memory: 300Mi
224+
{{- else }}
225+
{}
226+
{{- end -}}
227+
{{- end -}}
228+
{{- end -}}
229+
230+
{{- define "wiz-admission-controller.isEnforcerEnabled" -}}
231+
{{- if or .Values.opaWebhook.enabled .Values.imageIntegrityWebhook.enabled .Values.debugWebhook.enabled }}
232+
true
233+
{{- else }}
234+
false
235+
{{- end }}
236+
{{- end }}

‎wiz-admission-controller/templates/deploymentauditlogs.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,9 @@ metadata:
77
labels:
88
{{- include "wiz-kubernetes-audit-log-collector.labels" . | nindent 4 }}
99
spec:
10+
{{- if not .Values.hpa.enabled }}
1011
replicas: {{ .Values.kubernetesAuditLogsWebhook.replicaCount }}
12+
{{- end }}
1113
selector:
1214
matchLabels:
1315
{{- include "wiz-admission-controller.selectorLabels" . | nindent 6 }}
@@ -184,7 +186,7 @@ spec:
184186
value: "true"
185187
{{- end }}
186188
resources:
187-
{{- toYaml .Values.resources | nindent 12 }}
189+
{{- include "wiz-admission-controller.resources" . | nindent 12 }}
188190
volumeMounts:
189191
- mountPath: /var/server-certs
190192
name: server-certs

‎wiz-admission-controller/templates/deploymentenforcement.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
{{- if or .Values.opaWebhook.enabled .Values.imageIntegrityWebhook.enabled .Values.debugWebhook.enabled}}
1+
{{- $isEnabled := include "wiz-admission-controller.isEnforcerEnabled" . | trim | lower }}
2+
{{- if eq $isEnabled "true" }}
23
apiVersion: apps/v1
34
kind: Deployment
45
metadata:
@@ -7,7 +8,9 @@ metadata:
78
labels:
89
{{- include "wiz-admission-controller-enforcement.labels" . | nindent 4 }}
910
spec:
11+
{{- if not .Values.hpa.enabled }}
1012
replicas: {{ .Values.replicaCount }}
13+
{{- end }}
1114
selector:
1215
matchLabels:
1316
{{- include "wiz-admission-controller.selectorLabels" . | nindent 6 }}
@@ -209,9 +212,9 @@ spec:
209212
{{- if .Values.debugWebhook.enabled }}
210213
- name: WIZ_DEBUG_WEBHOOK_ENABLED
211214
value: "true"
212-
{{- end }}
215+
{{- end }}
213216
resources:
214-
{{- toYaml .Values.resources | nindent 12 }}
217+
{{- include "wiz-admission-controller.resources" . | nindent 12 }}
215218
volumeMounts:
216219
- mountPath: /var/cache
217220
name: cache

‎wiz-admission-controller/templates/hpa.yaml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{{- if .Values.hpa.enabled }}
2+
{{- $isEnabled := include "wiz-admission-controller.isEnforcerEnabled" . | trim | lower }}
3+
{{- if eq $isEnabled "true" }}
4+
apiVersion: autoscaling/v2
5+
kind: HorizontalPodAutoscaler
6+
metadata:
7+
name: {{ include "wiz-hpa-enforcer.name" . }}
8+
namespace: {{ .Release.Namespace }}
9+
labels:
10+
{{- include "wiz-hpa-enforcer.labels" . | nindent 4 }}
11+
spec:
12+
scaleTargetRef:
13+
apiVersion: apps/v1
14+
kind: Deployment
15+
name: {{ include "wiz-admission-controller.fullname" . }}
16+
minReplicas: {{ .Values.hpa.minReplicas }}
17+
maxReplicas: {{ .Values.hpa.maxReplicas }}
18+
metrics:
19+
{{- if .Values.hpa.enableCPU }}
20+
- type: Resource
21+
resource:
22+
name: cpu
23+
target:
24+
type: Utilization
25+
averageUtilization: {{ .Values.hpa.targetCPUUtilizationPercentage }}
26+
{{- end }}
27+
{{- if .Values.hpa.enableMemory }}
28+
- type: Resource
29+
resource:
30+
name: memory
31+
target:
32+
type: Utilization
33+
averageUtilization: {{ .Values.hpa.targetMemoryUtilizationPercentage }}
34+
{{- end }}
35+
{{- with .Values.hpa.customMetrics }}
36+
{{- toYaml . | nindent 4 }}
37+
{{- end }}
38+
{{- if hasKey .Values.hpa "behavior" }}
39+
behavior:
40+
{{- toYaml .Values.hpa.behavior | nindent 4 }}
41+
{{- end }}
42+
---
43+
{{- end }}
44+
{{ if .Values.kubernetesAuditLogsWebhook.enabled -}}
45+
apiVersion: autoscaling/v2
46+
kind: HorizontalPodAutoscaler
47+
metadata:
48+
name: {{ include "wiz-hpa-audit-logs.name" . }}
49+
namespace: {{ .Release.Namespace }}
50+
labels:
51+
{{- include "wiz-hpa-audit-logs.labels" . | nindent 4 }}
52+
spec:
53+
scaleTargetRef:
54+
apiVersion: apps/v1
55+
kind: Deployment
56+
name: {{ include "wiz-kubernetes-audit-log-collector.name" . }}
57+
minReplicas: {{ .Values.hpa.minReplicas }}
58+
maxReplicas: {{ .Values.hpa.maxReplicas }}
59+
metrics:
60+
{{- if .Values.hpa.enableCPU }}
61+
- type: Resource
62+
resource:
63+
name: cpu
64+
target:
65+
type: Utilization
66+
averageUtilization: {{ .Values.hpa.targetCPUUtilizationPercentage }}
67+
{{- end }}
68+
{{- if .Values.hpa.enableMemory }}
69+
- type: Resource
70+
resource:
71+
name: memory
72+
target:
73+
type: Utilization
74+
averageUtilization: {{ .Values.hpa.targetMemoryUtilizationPercentage }}
75+
{{- end }}
76+
{{- with .Values.hpa.customMetrics }}
77+
{{- toYaml . | nindent 4 }}
78+
{{- end }}
79+
{{- if hasKey .Values.hpa "behavior" }}
80+
behavior:
81+
{{- toYaml .Values.hpa.behavior | nindent 4 }}
82+
{{- end }}
83+
{{- end }}
84+
{{- end }}

‎wiz-admission-controller/templates/opawebhook.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,8 @@ webhooks:
163163
failurePolicy: {{ .Values.debugWebhook.failurePolicy }}
164164
sideEffects: {{ .Values.debugWebhook.sideEffects }}
165165
{{- end }}
166-
{{- if and (or .Values.opaWebhook.enabled .Values.imageIntegrityWebhook.enabled .Values.kubernetesAuditLogsWebhook.enabled .Values.debugWebhook.enabled) (not $useCertManagerCerts) }}
166+
{{- $isEnabled := include "wiz-admission-controller.isEnforcerEnabled" . | trim | lower }}
167+
{{- if and (eq $isEnabled "true") (not $useCertManagerCerts) }}
167168
---
168169
apiVersion: v1
169170
kind: Secret

‎wiz-admission-controller/templates/service.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
{{- if or .Values.opaWebhook.enabled .Values.imageIntegrityWebhook.enabled .Values.debugWebhook.enabled}}
1+
{{- $isEnabled := include "wiz-admission-controller.isEnforcerEnabled" . | trim | lower }}
2+
{{- if eq $isEnabled "true" }}
23
---
34
apiVersion: v1
45
kind: Service

‎wiz-admission-controller/values.yaml‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -390,9 +390,11 @@ tlsCertificate:
390390
tlsCertificate: ""
391391
tlsKey: ""
392392

393-
resources: {}
394-
# The recommended values should vary depending on the load in each cluster, the number of replicas, and more.
395-
# To make sure we cover most cases, the following is a suggestion for environments with a high load, we recommend adjusting it based on your needs.
393+
# Remove the comment below to provide custom requests and limits to the Wiz pods.
394+
#
395+
# resources:
396+
## The recommended values should vary depending on the load in each cluster, the number of replicas, and more.
397+
## To make sure we cover most cases, the following is a suggestion for environments with a high load, we recommend adjusting it based on your needs.
396398
# requests:
397399
# cpu: 0.5
398400
# memory: 256M
@@ -426,6 +428,20 @@ probes: # Probes config for the container
426428
timeoutSeconds: 30
427429
failureThreshold: 3
428430

431+
# Horizontal Pod Autoscaling support.
432+
hpa:
433+
enabled: false
434+
minReplicas: 2
435+
maxReplicas: 5
436+
enableCPU: true
437+
targetCPUUtilizationPercentage: 50
438+
enableMemory: false
439+
targetMemoryUtilizationPercentage: 50
440+
customMetrics: []
441+
# Uncomment to customize the behavior.
442+
# If not set, the default HPAScalingRules for scale up and scale down are used.
443+
#behavior: {}
444+
429445
# Global values to override chart values.
430446
global:
431447
nameOverride: "" # Override the release’s name.

0 commit comments

Comments
 (0)