apiVersion: release-notes/v2
kind: feature
area: installation
issue:
  - 47867

releaseNotes:
  - |

  selector:
    matchLabels:
      k8s-app: calico-typha-autoscaler
  template:
    metadata:
      labels:
        k8s-app: calico-typha-autoscaler
    spec:
      priorityClassName: system-cluster-critical
      securityContext:
        supplementalGroups: [ 65534 ]
        fsGroup: 65534
      containers:
      - image: registry.k8s.io/cluster-proportional-autoscaler-amd64:1.7.1
        name: autoscaler

spec:
  hard:
    pods: {{ .Values.cni.resourceQuotas.pods | quote }}
  scopeSelector:
    matchExpressions:
    - operator: In
      scopeName: PriorityClass
      values:
      - system-node-critical

	{"tighten tuple selectors", "schedule"},
	// remove critical edges before phi tighten, so that phi args get better placement
	{"critical", "phi tighten"},
	// don't layout blocks until critical edges have been removed
	{"critical", "layout"},
	// regalloc requires the removal of all critical edges
	{"critical", "regalloc"},
	// regalloc requires all the values in a block to be scheduled

	}

	return false
}

// IsCriticalPodBasedOnPriority checks if the given pod is a critical pod based on priority resolved from pod Spec.
func IsCriticalPodBasedOnPriority(priority int32) bool {
	return priority >= scheduling.SystemCriticalPriority
}

// IsNodeCriticalPod checks if the given pod is a system-node-critical
func IsNodeCriticalPod(pod *v1.Pod) bool {

configurations.all {
    resolutionStrategy.eachDependency {
        if (requested.group == "org.software" && requested.name == "some-library" && requested.version == "1.2") {
            useVersion("1.2.1")
            because("fixes critical bug in 1.2")
        }
    }
}
// end::denying_version[]

// tag::module_substitution[]
configurations.all {
    resolutionStrategy.eachDependency {
        if (requested.name == "groovy-all") {

  selector:
    matchLabels:
      k8s-app: calico-node-autoscaler
  template:
    metadata:
      labels:
        k8s-app: calico-node-autoscaler
    spec:
      priorityClassName: system-cluster-critical
      containers:
        - image: registry.k8s.io/cpvpa-amd64:v0.8.3
          name: autoscaler
          command:
            - /cpvpa
            - --target=daemonset/calico-node

  selector:
    matchLabels:
      k8s-app: calico-typha-autoscaler
  template:
    metadata:
      labels:
        k8s-app: calico-typha-autoscaler
    spec:
      priorityClassName: system-cluster-critical
      containers:
        - image: registry.k8s.io/cpvpa-amd64:v0.8.3
          name: autoscaler
          command:
            - /cpvpa
            - --target=deployment/calico-typha

  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 10%
  template:
    metadata:
      labels:
        k8s-app: kube-proxy
    spec:
      priorityClassName: system-node-critical
      hostNetwork: true
      nodeSelector:
        kubernetes.io/os: linux
        node.kubernetes.io/kube-proxy-ds-ready: "true"
      tolerations:
      - operator: "Exists"
        effect: "NoExecute"

utf8 = yes
default_md = sha256
default_bits = 4096
req_extensions = req_ext
x509_extensions = req_ext
distinguished_name = req_dn
[ req_ext ]
subjectKeyIdentifier = hash
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, keyCertSign
subjectAltName=@san
[ san ]
DNS.1 = istiod.{{ .SystemNamespace }}
DNS.2 = istiod.{{ .SystemNamespace }}.svc