feat: add system-upgrade-controller

k8s/argo-apps/system-upgrade-controller.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+    name: system-upgrade-controller
+    namespace: argo-cd
+spec:
+    destination:
+        name: ''
+        namespace: system-upgrade
+        server: https://kubernetes.default.svc
+    source:
+        repoURL: https://git.roboces.dev/catalin/fukuops.git
+        path: k8s/services/system-upgrade-controller
+        targetRevision: feat/system-upgrade-controller
+    project: management
+    syncPolicy:
+        automated: {}

k8s/services/system-upgrade-controller/k3s-upgrade.yaml

@@ -0,0 +1,370 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: system-upgrade
+    labels:
+        pod-security.kubernetes.io/enforce: privileged
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+    name: system-upgrade
+    namespace: system-upgrade
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+    name: default-controller-env
+    namespace: system-upgrade
+data:
+    SYSTEM_UPGRADE_CONTROLLER_DEBUG: "false"
+    SYSTEM_UPGRADE_CONTROLLER_THREADS: "2"
+    SYSTEM_UPGRADE_CONTROLLER_LEADER_ELECT: "true"
+    SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: "900"
+    SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: "99"
+    SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: Always
+    SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: rancher/kubectl:v1.30.3
+    SYSTEM_UPGRADE_JOB_PRIVILEGED: "true"
+    SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: "900"
+    SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: 15m
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+    name: system-upgrade-controller
+rules:
+    - apiGroups:
+          - batch
+      resources:
+          - jobs
+      verbs:
+          - get
+          - list
+          - watch
+    - apiGroups:
+          - apiextensions.k8s.io
+      resources:
+          - customresourcedefinitions
+      verbs:
+          - get
+          - list
+          - watch
+          - create
+          - patch
+          - update
+    - apiGroups:
+          - ""
+      resources:
+          - namespaces
+          - nodes
+      verbs:
+          - get
+          - list
+          - watch
+    - apiGroups:
+          - ""
+      resources:
+          - nodes
+      verbs:
+          - update
+    - apiGroups:
+          - ""
+      resources:
+          - events
+      verbs:
+          - get
+          - create
+          - patch
+          - update
+    - apiGroups:
+          - coordination.k8s.io
+      resources:
+          - leases
+      verbs:
+          - create
+    - apiGroups:
+          - coordination.k8s.io
+      resources:
+          - leases
+      resourceNames:
+          - system-upgrade-controller
+      verbs:
+          - get
+          - update
+    - apiGroups:
+          - upgrade.cattle.io
+      resources:
+          - plans
+          - plans/status
+      verbs:
+          - get
+          - list
+          - watch
+          - create
+          - patch
+          - update
+          - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+    name: system-upgrade-controller-drainer
+rules:
+    - apiGroups:
+          - ""
+      resources:
+          - pods/eviction
+      verbs:
+          - create
+    - apiGroups:
+          - ""
+      resources:
+          - pods
+      verbs:
+          - get
+          - list
+          - delete
+    - apiGroups:
+          - ""
+      resources:
+          - nodes
+      verbs:
+          - get
+          - patch
+    - apiGroups:
+          - apps
+      resources:
+          - statefulsets
+          - daemonsets
+          - replicasets
+      verbs:
+          - get
+          - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+    name: system-upgrade
+roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: ClusterRole
+    name: system-upgrade-controller
+subjects:
+    - kind: ServiceAccount
+      name: system-upgrade
+      namespace: system-upgrade
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+    name: system-upgrade-drainer
+roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: ClusterRole
+    name: system-upgrade-controller-drainer
+subjects:
+    - kind: ServiceAccount
+      name: system-upgrade
+      namespace: system-upgrade
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+    name: system-upgrade-controller
+    namespace: system-upgrade
+rules:
+    - apiGroups:
+          - batch
+      resources:
+          - jobs
+      verbs:
+          - create
+          - delete
+          - deletecollection
+          - patch
+          - update
+          - get
+          - list
+          - watch
+    - apiGroups:
+          - ""
+      resources:
+          - secrets
+      verbs:
+          - get
+          - list
+          - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+    name: system-upgrade
+    namespace: system-upgrade
+roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: Role
+    name: system-upgrade-controller
+subjects:
+    - kind: ServiceAccount
+      name: system-upgrade
+      namespace: system-upgrade
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+    name: system-upgrade-controller
+    namespace: system-upgrade
+spec:
+    strategy:
+        type: Recreate
+    selector:
+        matchLabels:
+            upgrade.cattle.io/controller: system-upgrade-controller
+    template:
+        metadata:
+            labels:
+                app.kubernetes.io/component: controller
+                app.kubernetes.io/name: system-upgrade-controller
+                upgrade.cattle.io/controller: system-upgrade-controller
+        spec:
+            affinity:
+                nodeAffinity:
+                    requiredDuringSchedulingIgnoredDuringExecution:
+                        nodeSelectorTerms:
+                            - matchExpressions:
+                                  - key: node-role.kubernetes.io/control-plane
+                                    operator: Exists
+                                  - key: kubernetes.io/os
+                                    operator: In
+                                    values:
+                                        - linux
+                podAntiAffinity:
+                    requiredDuringSchedulingIgnoredDuringExecution:
+                        - topologyKey: kubernetes.io/hostname
+                          labelSelector:
+                              matchExpressions:
+                                  - key: app.kubernetes.io/name
+                                    operator: In
+                                    values:
+                                        - system-upgrade-controller
+            serviceAccountName: system-upgrade
+            tolerations:
+                - key: CriticalAddonsOnly
+                  operator: Exists
+                - key: node-role.kubernetes.io/master
+                  operator: Exists
+                  effect: NoSchedule
+                - key: node-role.kubernetes.io/controlplane
+                  operator: Exists
+                  effect: NoSchedule
+                - key: node-role.kubernetes.io/control-plane
+                  operator: Exists
+                  effect: NoSchedule
+                - key: node-role.kubernetes.io/etcd
+                  operator: Exists
+                  effect: NoExecute
+            containers:
+                - name: system-upgrade-controller
+                  image: rancher/system-upgrade-controller:v0.14.0
+                  imagePullPolicy: IfNotPresent
+                  securityContext:
+                      runAsNonRoot: true
+                      runAsUser: 65534
+                      runAsGroup: 65534
+                      allowPrivilegeEscalation: false
+                      seccompProfile:
+                          type: RuntimeDefault
+                      capabilities:
+                          drop:
+                              - ALL
+                  envFrom:
+                      - configMapRef:
+                            name: default-controller-env
+                  env:
+                      - name: SYSTEM_UPGRADE_CONTROLLER_NAME
+                        valueFrom:
+                            fieldRef:
+                                fieldPath: metadata.labels['upgrade.cattle.io/controller']
+                      - name: SYSTEM_UPGRADE_CONTROLLER_NAMESPACE
+                        valueFrom:
+                            fieldRef:
+                                fieldPath: metadata.namespace
+                      - name: SYSTEM_UPGRADE_CONTROLLER_NODE_NAME
+                        valueFrom:
+                            fieldRef:
+                                fieldPath: spec.nodeName
+                  volumeMounts:
+                      - name: etc-ssl
+                        mountPath: /etc/ssl
+                        readOnly: true
+                      - name: etc-pki
+                        mountPath: /etc/pki
+                        readOnly: true
+                      - name: etc-ca-certificates
+                        mountPath: /etc/ca-certificates
+                        readOnly: true
+                      - name: tmp
+                        mountPath: /tmp
+            volumes:
+                - name: etc-ssl
+                  hostPath:
+                      path: /etc/ssl
+                      type: DirectoryOrCreate
+                - name: etc-pki
+                  hostPath:
+                      path: /etc/pki
+                      type: DirectoryOrCreate
+                - name: etc-ca-certificates
+                  hostPath:
+                      path: /etc/ca-certificates
+                      type: DirectoryOrCreate
+                - name: tmp
+                  emptyDir: {}
+---
+apiVersion: upgrade.cattle.io/v1
+kind: Plan
+metadata:
+    name: k3s-server
+    namespace: system-upgrade
+    labels:
+        k3s-upgrade: server
+spec:
+    concurrency: 1
+    version: v1.36.3+k3s1
+    nodeSelector:
+        matchExpressions:
+            - {key: k3s-upgrade, operator: Exists}
+            - {key: k3s-upgrade, operator: NotIn, values: ["disabled", "false"]}
+            - {key: k3os.io/mode, operator: DoesNotExist}
+            - {key: node-role.kubernetes.io/control-plane, operator: Exists}
+    serviceAccountName: system-upgrade
+    cordon: true
+    upgrade:
+        image: rancher/k3s-upgrade
+---
+apiVersion: upgrade.cattle.io/v1
+kind: Plan
+metadata:
+    name: k3s-agent
+    namespace: system-upgrade
+    labels:
+        k3s-upgrade: agent
+spec:
+    concurrency: 2
+    version: v1.36.3+k3s1
+    nodeSelector:
+        matchExpressions:
+            - {key: k3s-upgrade, operator: Exists}
+            - {key: k3s-upgrade, operator: NotIn, values: ["disabled", "false"]}
+            - {key: k3os.io/mode, operator: DoesNotExist}
+            - {key: node-role.kubernetes.io/control-plane, operator: DoesNotExist}
+    serviceAccountName: system-upgrade
+    prepare:
+        image: rancher/k3s-upgrade
+        args: ["prepare", "k3s-server"]
+    drain:
+        force: true
+        skipWaitForDeleteTimeout: 60
+    upgrade:
+        image: rancher/k3s-upgrade