From 53988d3ee25cab0c9d5c10b52e6b6c906fa46e2f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?c=C4=83t=C4=83lin?= Date: Fri, 14 Aug 2026 10:16:13 +0200 Subject: [PATCH] feat: add system-upgrade-controller --- k8s/argo-apps/system-upgrade-controller.yaml | 18 + .../k3s-upgrade.yaml | 370 ++++++++++++++++++ 2 files changed, 388 insertions(+) create mode 100644 k8s/argo-apps/system-upgrade-controller.yaml create mode 100644 k8s/services/system-upgrade-controller/k3s-upgrade.yaml diff --git a/k8s/argo-apps/system-upgrade-controller.yaml b/k8s/argo-apps/system-upgrade-controller.yaml new file mode 100644 index 0000000..1bb7c16 --- /dev/null +++ b/k8s/argo-apps/system-upgrade-controller.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: system-upgrade-controller + namespace: argo-cd +spec: + destination: + name: '' + namespace: system-upgrade + server: https://kubernetes.default.svc + source: + repoURL: https://git.roboces.dev/catalin/fukuops.git + path: k8s/services/system-upgrade-controller + targetRevision: feat/system-upgrade-controller + project: management + syncPolicy: + automated: {} diff --git a/k8s/services/system-upgrade-controller/k3s-upgrade.yaml b/k8s/services/system-upgrade-controller/k3s-upgrade.yaml new file mode 100644 index 0000000..3cf98d6 --- /dev/null +++ b/k8s/services/system-upgrade-controller/k3s-upgrade.yaml @@ -0,0 +1,370 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: system-upgrade + labels: + pod-security.kubernetes.io/enforce: privileged +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: system-upgrade + namespace: system-upgrade +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: default-controller-env + namespace: system-upgrade +data: + SYSTEM_UPGRADE_CONTROLLER_DEBUG: "false" + SYSTEM_UPGRADE_CONTROLLER_THREADS: "2" + SYSTEM_UPGRADE_CONTROLLER_LEADER_ELECT: "true" + SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: "900" + SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: "99" + SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: Always + SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: rancher/kubectl:v1.30.3 + SYSTEM_UPGRADE_JOB_PRIVILEGED: "true" + SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: "900" + SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: 15m +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: system-upgrade-controller +rules: + - apiGroups: + - batch + resources: + - jobs + verbs: + - get + - list + - watch + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch + - create + - patch + - update + - apiGroups: + - "" + resources: + - namespaces + - nodes + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - update + - apiGroups: + - "" + resources: + - events + verbs: + - get + - create + - patch + - update + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - apiGroups: + - coordination.k8s.io + resources: + - leases + resourceNames: + - system-upgrade-controller + verbs: + - get + - update + - apiGroups: + - upgrade.cattle.io + resources: + - plans + - plans/status + verbs: + - get + - list + - watch + - create + - patch + - update + - delete +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: system-upgrade-controller-drainer +rules: + - apiGroups: + - "" + resources: + - pods/eviction + verbs: + - create + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - delete + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - patch + - apiGroups: + - apps + resources: + - statefulsets + - daemonsets + - replicasets + verbs: + - get + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: system-upgrade +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system-upgrade-controller +subjects: + - kind: ServiceAccount + name: system-upgrade + namespace: system-upgrade +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: system-upgrade-drainer +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system-upgrade-controller-drainer +subjects: + - kind: ServiceAccount + name: system-upgrade + namespace: system-upgrade +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: system-upgrade-controller + namespace: system-upgrade +rules: + - apiGroups: + - batch + resources: + - jobs + verbs: + - create + - delete + - deletecollection + - patch + - update + - get + - list + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: system-upgrade + namespace: system-upgrade +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: system-upgrade-controller +subjects: + - kind: ServiceAccount + name: system-upgrade + namespace: system-upgrade +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: system-upgrade-controller + namespace: system-upgrade +spec: + strategy: + type: Recreate + selector: + matchLabels: + upgrade.cattle.io/controller: system-upgrade-controller + template: + metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: system-upgrade-controller + upgrade.cattle.io/controller: system-upgrade-controller + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: node-role.kubernetes.io/control-plane + operator: Exists + - key: kubernetes.io/os + operator: In + values: + - linux + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - topologyKey: kubernetes.io/hostname + labelSelector: + matchExpressions: + - key: app.kubernetes.io/name + operator: In + values: + - system-upgrade-controller + serviceAccountName: system-upgrade + tolerations: + - key: CriticalAddonsOnly + operator: Exists + - key: node-role.kubernetes.io/master + operator: Exists + effect: NoSchedule + - key: node-role.kubernetes.io/controlplane + operator: Exists + effect: NoSchedule + - key: node-role.kubernetes.io/control-plane + operator: Exists + effect: NoSchedule + - key: node-role.kubernetes.io/etcd + operator: Exists + effect: NoExecute + containers: + - name: system-upgrade-controller + image: rancher/system-upgrade-controller:v0.14.0 + imagePullPolicy: IfNotPresent + securityContext: + runAsNonRoot: true + runAsUser: 65534 + runAsGroup: 65534 + allowPrivilegeEscalation: false + seccompProfile: + type: RuntimeDefault + capabilities: + drop: + - ALL + envFrom: + - configMapRef: + name: default-controller-env + env: + - name: SYSTEM_UPGRADE_CONTROLLER_NAME + valueFrom: + fieldRef: + fieldPath: metadata.labels['upgrade.cattle.io/controller'] + - name: SYSTEM_UPGRADE_CONTROLLER_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: SYSTEM_UPGRADE_CONTROLLER_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + volumeMounts: + - name: etc-ssl + mountPath: /etc/ssl + readOnly: true + - name: etc-pki + mountPath: /etc/pki + readOnly: true + - name: etc-ca-certificates + mountPath: /etc/ca-certificates + readOnly: true + - name: tmp + mountPath: /tmp + volumes: + - name: etc-ssl + hostPath: + path: /etc/ssl + type: DirectoryOrCreate + - name: etc-pki + hostPath: + path: /etc/pki + type: DirectoryOrCreate + - name: etc-ca-certificates + hostPath: + path: /etc/ca-certificates + type: DirectoryOrCreate + - name: tmp + emptyDir: {} +--- +apiVersion: upgrade.cattle.io/v1 +kind: Plan +metadata: + name: k3s-server + namespace: system-upgrade + labels: + k3s-upgrade: server +spec: + concurrency: 1 + version: v1.36.3+k3s1 + nodeSelector: + matchExpressions: + - {key: k3s-upgrade, operator: Exists} + - {key: k3s-upgrade, operator: NotIn, values: ["disabled", "false"]} + - {key: k3os.io/mode, operator: DoesNotExist} + - {key: node-role.kubernetes.io/control-plane, operator: Exists} + serviceAccountName: system-upgrade + cordon: true + upgrade: + image: rancher/k3s-upgrade +--- +apiVersion: upgrade.cattle.io/v1 +kind: Plan +metadata: + name: k3s-agent + namespace: system-upgrade + labels: + k3s-upgrade: agent +spec: + concurrency: 2 + version: v1.36.3+k3s1 + nodeSelector: + matchExpressions: + - {key: k3s-upgrade, operator: Exists} + - {key: k3s-upgrade, operator: NotIn, values: ["disabled", "false"]} + - {key: k3os.io/mode, operator: DoesNotExist} + - {key: node-role.kubernetes.io/control-plane, operator: DoesNotExist} + serviceAccountName: system-upgrade + prepare: + image: rancher/k3s-upgrade + args: ["prepare", "k3s-server"] + drain: + force: true + skipWaitForDeleteTimeout: 60 + upgrade: + image: rancher/k3s-upgrade