# Google サービスアカウントの作成
$ gcloud iam --project=$project_id service-accounts create preemptible-killer \
    --display-name preemptible-killer

# ロールの作成
$ gcloud iam --project=$project_id roles create preemptibleKillerRole \
    --project $project_id \
    --title "Preemptible VM Killer" \
    --description "Delete compute instances for GKE Preemptible VMs" \
    --permissions compute.instances.delete

# 次の手順で利用するサービスアカウントの識別子（メールアドレス形式）を取得
$ service_account_email=$(gcloud iam --project=$project_id service-accounts list --filter preemptible-killer --format 'value([email])'); echo $service_account_email

# ロールの識別子を取得
$ preemptible_role=$(gcloud iam --project=$project_id roles list --filter preemptibleKillerRole --format 'value([name])'); echo $preemptible_role

# Google サービスアカウントとロールを関連付ける
$ gcloud projects add-iam-policy-binding $project_id \
    --member=serviceAccount:${service_account_email} \
    --role=$preemptible_role

# Workload Identity を使いたくない場合はシークレットキーを作成して進めることもできる
$ gcloud iam --project=$project_id service-accounts keys create \
    --iam-account $service_account_email \
    google_service_account.json

repositories:
 - name: estafette
   url: https://helm.estafette.io

releases:
  - name: gke-preemptible-killer
    namespace: gke-vm-killer
    chart: estafette/estafette-gke-preemptible-killer
    values:
      - ./values.yaml

serviceAccount:
  create: true
  name: gke-preemptible-killer

secret:
  # GCP SA を事前に作成しておく
  workloadIdentityServiceAccount: preemptible-killer@${PROJECT_ID}.iam.gserviceaccount.com

nodeSelector:
  # Workload Identity が有効な Node を明示
  iam.gke.io/gke-metadata-server-enabled: "true"

.
├── helmfile.yaml
└── values.yaml

# 適用されるマニフェストを確認する
helmfile diff

# 適用する
helmfile apply

# $service_account_email: preemptible-killer@PROJECT_ID.iam.gserviceaccount.com 形式

$ namespace_sa=gke-vm-killer/gke-preemptible-killer
gcloud iam service-accounts add-iam-policy-binding $service_account_email \
    --role roles/iam.workloadIdentityUser \
    --member "serviceAccount:${project_id}.svc.id.goog[${namespace_sa}]"

{{- if .Values.secret.workloadIdentityServiceAccount }}
annotations:
  iam.gke.io/gcp-service-account: {{ .Values.secret.workloadIdentityServiceAccount }}
{{- end }}

{{- if not .Values.secret.workloadIdentityServiceAccount }}
- name: GOOGLE_APPLICATION_CREDENTIALS
  value: /gcp-service-account/service-account-key.json
{{- end }}

Adding repo estafette https://helm.estafette.io
"estafette" has been added to your repositories

Comparing release=gke-preemptible-killer, chart=estafette/estafette-gke-preemptible-killer
********************

	Release was not present in Helm.  Diff will show entire contents as new.

********************
gke-vm-killer, gke-preemptible-killer, ServiceAccount (v1) has been added:
- 
+ # Source: estafette-gke-preemptible-killer/templates/serviceaccount.yaml
+ apiVersion: v1
+ kind: ServiceAccount
+ metadata:
+   name: gke-preemptible-killer
+   namespace: gke-vm-killer
+   labels:
+     app.kubernetes.io/name: estafette-gke-preemptible-killer
+     helm.sh/chart: estafette-gke-preemptible-killer-1.3.1
+     app.kubernetes.io/instance: gke-preemptible-killer
+     app.kubernetes.io/version: "1.3.1"
+     app.kubernetes.io/managed-by: Helm
+   annotations:
+     iam.gke.io/gcp-service-account: preemptible-killer@project_id.iam.gserviceaccount.com
gke-vm-killer, gke-preemptible-killer-estafette-gke-preemptible-killer, ClusterRole (rbac.authorization.k8s.io) has been added:
- 
+ # Source: estafette-gke-preemptible-killer/templates/clusterrole.yaml
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRole
+ metadata:
+   name: gke-preemptible-killer-estafette-gke-preemptible-killer
+   labels:
+     app.kubernetes.io/name: estafette-gke-preemptible-killer
+     helm.sh/chart: estafette-gke-preemptible-killer-1.3.1
+     app.kubernetes.io/instance: gke-preemptible-killer
+     app.kubernetes.io/version: "1.3.1"
+     app.kubernetes.io/managed-by: Helm
+ rules:
+ - apiGroups: [""] # "" indicates the core API group
+   resources:
+   - nodes
+   verbs:
+   - get
+   - list
+   - patch
+   - update
+   - delete
+ - apiGroups: [""] # "" indicates the core API group
+   resources:
+   - pods
+   verbs:
+   - get
+   - list
+ - apiGroups: [""] # "" indicates the core API group
+   resources:
+   - pods/eviction
+   verbs:
+   - create
gke-vm-killer, gke-preemptible-killer-estafette-gke-preemptible-killer, ClusterRoleBinding (rbac.authorization.k8s.io) has been added:
- 
+ # Source: estafette-gke-preemptible-killer/templates/clusterrolebinding.yaml
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRoleBinding
+ metadata:
+   name: gke-preemptible-killer-estafette-gke-preemptible-killer
+   labels:
+     app.kubernetes.io/name: estafette-gke-preemptible-killer
+     helm.sh/chart: estafette-gke-preemptible-killer-1.3.1
+     app.kubernetes.io/instance: gke-preemptible-killer
+     app.kubernetes.io/version: "1.3.1"
+     app.kubernetes.io/managed-by: Helm
+ roleRef:
+   apiGroup: rbac.authorization.k8s.io
+   kind: ClusterRole
+   name: gke-preemptible-killer-estafette-gke-preemptible-killer
+ subjects:
+ - kind: ServiceAccount
+   name: gke-preemptible-killer
+   namespace: gke-vm-killer
gke-vm-killer, gke-preemptible-killer-estafette-gke-preemptible-killer, Deployment (apps) has been added:
- 
+ # Source: estafette-gke-preemptible-killer/templates/deployment.yaml
+ apiVersion: apps/v1
+ kind: Deployment
+ metadata:
+   name: gke-preemptible-killer-estafette-gke-preemptible-killer
+   namespace: gke-vm-killer
+   labels:
+     app.kubernetes.io/name: estafette-gke-preemptible-killer
+     helm.sh/chart: estafette-gke-preemptible-killer-1.3.1
+     app.kubernetes.io/instance: gke-preemptible-killer
+     app.kubernetes.io/version: "1.3.1"
+     app.kubernetes.io/managed-by: Helm
+ spec:
+   replicas: 1
+   strategy:
+     type: Recreate
+   selector:
+     matchLabels:
+       app.kubernetes.io/name: estafette-gke-preemptible-killer
+       app.kubernetes.io/instance: gke-preemptible-killer
+   template:
+     metadata:
+       labels:
+         app.kubernetes.io/name: estafette-gke-preemptible-killer
+         app.kubernetes.io/instance: gke-preemptible-killer
+         app.kubernetes.io/version: "1.3.1"
+       annotations:
+         prometheus.io/scrape: "true"
+         prometheus.io/port: "9101"
+         checksum/secrets: 1234567890012345678901a7c05124b64eeece964e09c058ef8f9805daca546b
+     spec:
+       serviceAccountName: gke-preemptible-killer
+       securityContext:
+         {}
+       containers:
+         - name: estafette-gke-preemptible-killer
+           securityContext:
+             {}
+           image: "estafette/estafette-gke-preemptible-killer:1.3.1"
+           imagePullPolicy: IfNotPresent
+           env:
+             - name: "ESTAFETTE_LOG_FORMAT"
+               value: "plaintext"
+             - name: DRAIN_TIMEOUT
+               value: "300"
+             - name: INTERVAL
+               value: "300"
+           ports:
+             - name: metrics
+               containerPort: 9101
+               protocol: TCP
+           livenessProbe:
+             httpGet:
+               path: /liveness
+               port: 5000
+             initialDelaySeconds: 30
+             timeoutSeconds: 5
+           resources:
+             limits:
+               cpu: 25m
+               memory: 50Mi
+             requests:
+               cpu: 10m
+               memory: 15Mi
+       terminationGracePeriodSeconds: 300
+       nodeSelector:
+         iam.gke.io/gke-metadata-server-enabled: "true"
+       affinity:
+         nodeAffinity:
+           preferredDuringSchedulingIgnoredDuringExecution:
+           - preference:
+               matchExpressions:
+               - key: cloud.google.com/gke-preemptible
+                 operator: In
+                 values:
+                 - "true"
+             weight: 10

Upgrading release=gke-preemptible-killer, chart=estafette/estafette-gke-preemptible-killer
Release "gke-preemptible-killer" does not exist. Installing it now.
NAME: gke-preemptible-killer
LAST DEPLOYED: Fri Nov 18 00:18:53 2022
NAMESPACE: gke-vm-killer
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
1. Get the application logs by running this command:
kubectl logs -f -l app.kubernetes.io/name=estafette-gke-preemptible-killer,app.kubernetes.io/instance=gke-preemptible-killer -n gke-vm-killer

Listing releases matching ^gke-preemptible-killer$
gke-preemptible-killer	gke-vm-killer	1       	2022-11-18 00:18:53.959859 +0900 JST	deployed	estafette-gke-preemptible-killer-1.3.1	1.3.1      


UPDATED RELEASES:
NAME                     CHART                                        VERSION
gke-preemptible-killer   estafette/estafette-gke-preemptible-killer     1.3.1