From a574a67c618fede0dd7bf9f9c66e0fa0630c62fd Mon Sep 17 00:00:00 2001 From: Christian Kotzbauer Date: Sat, 20 Jun 2020 09:36:07 +0200 Subject: [PATCH] add unmodified chart from stable repo Signed-off-by: Christian Kotzbauer --- charts/kured/.helmignore | 21 +++++ charts/kured/Chart.yaml | 14 ++++ charts/kured/README.md | 49 ++++++++++++ charts/kured/templates/NOTES.txt | 3 + charts/kured/templates/_helpers.tpl | 54 +++++++++++++ charts/kured/templates/clusterrole.yaml | 33 ++++++++ .../kured/templates/clusterrolebinding.yaml | 19 +++++ charts/kured/templates/daemonset.yaml | 78 +++++++++++++++++++ charts/kured/templates/lock-cronjob.yaml | 39 ++++++++++ charts/kured/templates/podsecuritypolicy.yaml | 24 ++++++ charts/kured/templates/role.yaml | 29 +++++++ charts/kured/templates/rolebinding.yaml | 20 +++++ charts/kured/templates/serviceaccount.yaml | 7 ++ charts/kured/templates/unlock-cronjob.yaml | 39 ++++++++++ charts/kured/values.yaml | 38 +++++++++ 15 files changed, 467 insertions(+) create mode 100644 charts/kured/.helmignore create mode 100644 charts/kured/Chart.yaml create mode 100644 charts/kured/README.md create mode 100644 charts/kured/templates/NOTES.txt create mode 100644 charts/kured/templates/_helpers.tpl create mode 100644 charts/kured/templates/clusterrole.yaml create mode 100644 charts/kured/templates/clusterrolebinding.yaml create mode 100644 charts/kured/templates/daemonset.yaml create mode 100644 charts/kured/templates/lock-cronjob.yaml create mode 100644 charts/kured/templates/podsecuritypolicy.yaml create mode 100644 charts/kured/templates/role.yaml create mode 100644 charts/kured/templates/rolebinding.yaml create mode 100644 charts/kured/templates/serviceaccount.yaml create mode 100644 charts/kured/templates/unlock-cronjob.yaml create mode 100644 charts/kured/values.yaml diff --git a/charts/kured/.helmignore b/charts/kured/.helmignore new file mode 100644 index 0000000..f0c1319 --- /dev/null +++ b/charts/kured/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/charts/kured/Chart.yaml b/charts/kured/Chart.yaml new file mode 100644 index 0000000..2ecb57f --- /dev/null +++ b/charts/kured/Chart.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +appVersion: "1.4.0" +description: A Helm chart for kured +name: kured +version: 1.5.1 +home: https://github.com/weaveworks/kured +maintainers: + - name: plumdog + email: plummer574@gmail.com + - name: patrickmslatteryvt + email: pslattery@mi9retail.com +sources: + - https://github.com/weaveworks/kured +icon: https://raw.githubusercontent.com/weaveworks/kured/master/img/logo.png diff --git a/charts/kured/README.md b/charts/kured/README.md new file mode 100644 index 0000000..8276cc8 --- /dev/null +++ b/charts/kured/README.md @@ -0,0 +1,49 @@ +# Kured (KUbernetes REboot Daemon) + +See https://github.com/weaveworks/kured + +## Autolock feature + +This feature is not natively supported by kured but is added using Kubernetes Cronjob to annotate daemonset when to allow kured to run using the lock configuration annotation https://github.com/weaveworks/kured#overriding-lock-configuration + + +| Config | Description | Default | +| ------ | ----------- | ------- | +| `image.repository` | Image repository | `weaveworks/kured` | +| `image.tag` | Image tag | `1.4.0` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Image pull secrets | `[]` | +| `extraArgs` | Extra arguments to pass to `/usr/bin/kured`. See below. | `{}` | +| `rbac.create` | Create RBAC roles | `true` | +| `podSecurityPolicy.create` | Create podSecurityPolicy | `false` | +| `serviceAccount.create` | Create service account roles | `true` | +| `serviceAccount.name` | Service account name to create (or use if `serviceAccount.create` is false) | (chart fullname) | +| `updateStrategy` | Daemonset update strategy | `OnDelete` | +| `tolerations` | Tolerations to apply to the daemonset (eg to allow running on master) | `[{"key": "node-role.kubernetes.io/master", "effect": "NoSchedule"}]`| +| `nodeSelector` | Node Selector for the daemonset (ie, restrict which nodes kured runs on) | `{}` | +| `priorityClassName` | Priority Class to be used by the pods | `""` | +| `podAnnotations` | Annotations to apply to pods (eg to add Prometheus annotations) | `{}` | +| `autolock.enabled` | Activate autolock to define when to allow kured to be executed | `false` | +| `autolock.image.repository` | Image repository for kubectl command | `docker.io/bitnami/kubectl` | +| `autolock.image.tag` | Image tag | `1.17.5` | +| `autolock.scheduleUnlock` | CronJob schedule to unlock kured | `0 4 * * *` | +| `autolock.schedulelock` | CronJob schedule to lock kured | `0 6 * * *` | + +See https://github.com/weaveworks/kured#configuration for values for `extraArgs`. Note that +```yaml +extraArgs: + foo: 1 + bar-baz: 2 +``` +becomes `/usr/bin/kured ... --foo=1 --bar-baz=2`. + +## Prometheus Metrics + +Kured exposes a single prometheus metric indicating whether a reboot is required or not (see [kured docs](https://github.com/weaveworks/kured#prometheus-metrics)) for details. It can be scraped with the following set of annotations: + +```yaml +podAnnotations: + prometheus.io/scrape: "true" + prometheus.io/path: "/metrics" + prometheus.io/port: "8080" +``` diff --git a/charts/kured/templates/NOTES.txt b/charts/kured/templates/NOTES.txt new file mode 100644 index 0000000..da2a02d --- /dev/null +++ b/charts/kured/templates/NOTES.txt @@ -0,0 +1,3 @@ +Kured will check for /var/run/reboot-required, and reboot nodes when needed. + +See https://github.com/weaveworks/kured/ for details. diff --git a/charts/kured/templates/_helpers.tpl b/charts/kured/templates/_helpers.tpl new file mode 100644 index 0000000..38c3a43 --- /dev/null +++ b/charts/kured/templates/_helpers.tpl @@ -0,0 +1,54 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "kured.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "kured.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "kured.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "kured.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "kured.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for podsecuritypolicy. +*/}} +{{- define "kured.psp.apiVersion" -}} +{{- if semverCompare "<1.10-0" .Capabilities.KubeVersion.GitVersion -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "policy/v1beta1" -}} +{{- end -}} +{{- end -}} diff --git a/charts/kured/templates/clusterrole.yaml b/charts/kured/templates/clusterrole.yaml new file mode 100644 index 0000000..f077c21 --- /dev/null +++ b/charts/kured/templates/clusterrole.yaml @@ -0,0 +1,33 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "kured.fullname" . }} + labels: + app: {{ template "kured.name" . }} + chart: {{ template "kured.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: +# Allow kured to read spec.unschedulable +# Allow kubectl to drain/uncordon +# +# NB: These permissions are tightly coupled to the bundled version of kubectl; the ones below +# match https://github.com/kubernetes/kubernetes/blob/v1.12.1/pkg/kubectl/cmd/drain.go +# +- apiGroups: [""] + resources: ["nodes"] + verbs: ["get", "patch"] +- apiGroups: [""] + resources: ["pods"] + verbs: ["list","delete","get"] +- apiGroups: ["extensions"] + resources: ["daemonsets"] + verbs: ["get"] +- apiGroups: ["apps"] + resources: ["daemonsets"] + verbs: ["get"] +- apiGroups: [""] + resources: ["pods/eviction"] + verbs: ["create"] +{{- end -}} diff --git a/charts/kured/templates/clusterrolebinding.yaml b/charts/kured/templates/clusterrolebinding.yaml new file mode 100644 index 0000000..a5586e9 --- /dev/null +++ b/charts/kured/templates/clusterrolebinding.yaml @@ -0,0 +1,19 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "kured.fullname" . }} + labels: + app: {{ template "kured.name" . }} + chart: {{ template "kured.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "kured.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ template "kured.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end -}} diff --git a/charts/kured/templates/daemonset.yaml b/charts/kured/templates/daemonset.yaml new file mode 100644 index 0000000..4f141ae --- /dev/null +++ b/charts/kured/templates/daemonset.yaml @@ -0,0 +1,78 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: {{ template "kured.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + app: {{ template "kured.name" . }} + chart: {{ template "kured.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + updateStrategy: + type: {{ .Values.updateStrategy }} + selector: + matchLabels: + app: {{ template "kured.name" . }} + release: {{ .Release.Name }} + template: + metadata: + labels: + app: {{ template "kured.name" . }} + release: {{ .Release.Name }} + {{- if .Values.podAnnotations }} + annotations: + {{- range $key, $value := .Values.podAnnotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} + spec: + serviceAccountName: {{ template "kured.serviceAccountName" . }} + hostPID: true + restartPolicy: Always + {{- with .Values.image.pullSecrets }} + imagePullSecrets: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName }} + {{- end }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + securityContext: + privileged: true # Give permission to nsenter /proc/1/ns/mnt + resources: +{{ toYaml .Values.resources | indent 12 }} + command: + - /usr/bin/kured + args: + - --ds-name={{ template "kured.fullname" . }} + - --ds-namespace={{ .Release.Namespace }} + {{- range $key, $value := .Values.extraArgs }} + {{- if $value }} + - --{{ $key }}={{ $value }} + {{- else }} + - --{{ $key }} + {{- end }} + {{- end }} + ports: + - containerPort: 8080 + name: metrics + env: + # Pass in the name of the node on which this pod is scheduled + # for use with drain/uncordon operations and lock acquisition + - name: KURED_NODE_ID + valueFrom: + fieldRef: + fieldPath: spec.nodeName + restartPolicy: Always + {{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} diff --git a/charts/kured/templates/lock-cronjob.yaml b/charts/kured/templates/lock-cronjob.yaml new file mode 100644 index 0000000..42a4f95 --- /dev/null +++ b/charts/kured/templates/lock-cronjob.yaml @@ -0,0 +1,39 @@ +{{- if .Values.autolock.enabled }} +apiVersion: batch/v1beta1 +kind: CronJob +metadata: + name: {{ template "kured.fullname" . }}-lock + namespace: {{ .Release.Namespace }} + labels: + app: {{ template "kured.name" . }} + chart: {{ template "kured.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + schedule: {{ .Values.autolock.schedulelock | quote }} + jobTemplate: + spec: + template: + metadata: + labels: + app: {{ template "kured.name" . }} + chart: {{ template "kured.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + spec: + serviceAccountName: {{ template "kured.serviceAccountName" . }} + containers: + - name: {{ template "kured.fullname" . }}-lock + image: "{{ .Values.autolock.image.repository }}:{{ .Values.autolock.image.tag }}" + command: + - kubectl + args: + - -n + - {{ .Release.Namespace }} + - annotate + - ds + - {{ template "kured.fullname" . }} + - weave.works/kured-node-lock={"nodeID":"manual"} + restartPolicy: Never + backoffLimit: 1 +{{- end -}} diff --git a/charts/kured/templates/podsecuritypolicy.yaml b/charts/kured/templates/podsecuritypolicy.yaml new file mode 100644 index 0000000..d4e2f18 --- /dev/null +++ b/charts/kured/templates/podsecuritypolicy.yaml @@ -0,0 +1,24 @@ +{{- if .Values.podSecurityPolicy.create}} +apiVersion: {{ template "kured.psp.apiVersion" . }} +kind: PodSecurityPolicy +metadata: + name: {{ template "kured.fullname" . }} + labels: + app: {{ template "kured.name" . }} + chart: {{ template "kured.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + privileged: true + hostPID: true + allowedCapabilities: ['*'] + fsGroup: + rule: RunAsAny + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: ['*'] +{{- end }} diff --git a/charts/kured/templates/role.yaml b/charts/kured/templates/role.yaml new file mode 100644 index 0000000..5576036 --- /dev/null +++ b/charts/kured/templates/role.yaml @@ -0,0 +1,29 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + namespace: {{ .Release.Namespace }} + name: {{ template "kured.fullname" . }} + labels: + app: {{ template "kured.name" . }} + chart: {{ template "kured.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: + # Allow kured to lock/unlock itself + - apiGroups: ["extensions"] + resources: ["daemonsets"] + resourceNames: ["{{ template "kured.fullname" . }}"] + verbs: ["update", "patch"] + - apiGroups: ["apps"] + resources: ["daemonsets"] + resourceNames: ["{{ template "kured.fullname" . }}"] + verbs: ["update"] +{{- if .Values.podSecurityPolicy.create }} + - apiGroups: ["extensions"] + resources: ["podsecuritypolicies"] + resourceNames: ["{{ template "kured.fullname" . }}"] + verbs: ["use"] +{{- end }} + +{{- end -}} diff --git a/charts/kured/templates/rolebinding.yaml b/charts/kured/templates/rolebinding.yaml new file mode 100644 index 0000000..df3f177 --- /dev/null +++ b/charts/kured/templates/rolebinding.yaml @@ -0,0 +1,20 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + namespace: {{ .Release.Namespace }} + name: {{ template "kured.fullname" . }} + labels: + app: {{ template "kured.name" . }} + chart: {{ template "kured.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +subjects: +- kind: ServiceAccount + namespace: {{ .Release.Namespace }} + name: {{ template "kured.serviceAccountName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "kured.fullname" . }} +{{- end -}} diff --git a/charts/kured/templates/serviceaccount.yaml b/charts/kured/templates/serviceaccount.yaml new file mode 100644 index 0000000..8a754ea --- /dev/null +++ b/charts/kured/templates/serviceaccount.yaml @@ -0,0 +1,7 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "kured.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end -}} diff --git a/charts/kured/templates/unlock-cronjob.yaml b/charts/kured/templates/unlock-cronjob.yaml new file mode 100644 index 0000000..9dd4283 --- /dev/null +++ b/charts/kured/templates/unlock-cronjob.yaml @@ -0,0 +1,39 @@ +{{- if .Values.autolock.enabled }} +apiVersion: batch/v1beta1 +kind: CronJob +metadata: + name: {{ template "kured.fullname" . }}-unlock + namespace: {{ .Release.Namespace }} + labels: + app: {{ template "kured.name" . }} + chart: {{ template "kured.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + schedule: {{ .Values.autolock.scheduleUnlock | quote }} + jobTemplate: + spec: + template: + metadata: + labels: + app: {{ template "kured.name" . }} + chart: {{ template "kured.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + spec: + serviceAccountName: {{ template "kured.serviceAccountName" . }} + containers: + - name: {{ template "kured.fullname" . }}-unlock + image: "{{ .Values.autolock.image.repository }}:{{ .Values.autolock.image.tag }}" + command: + - kubectl + args: + - -n + - {{ .Release.Namespace }} + - annotate + - ds + - {{ template "kured.fullname" . }} + - weave.works/kured-node-lock- + restartPolicy: Never + backoffLimit: 1 +{{- end -}} diff --git a/charts/kured/values.yaml b/charts/kured/values.yaml new file mode 100644 index 0000000..824bf44 --- /dev/null +++ b/charts/kured/values.yaml @@ -0,0 +1,38 @@ +image: + repository: weaveworks/kured + tag: 1.4.0 + pullPolicy: IfNotPresent + pullSecrets: [] + +extraArgs: {} + +rbac: + create: true + +podSecurityPolicy: + create: false + +serviceAccount: + create: true + name: + +autolock: + enabled: false + image: + repository: docker.io/bitnami/kubectl + tag: 1.17.5 + scheduleUnlock: 0 4 * * * + schedulelock: 0 6 * * * + +updateStrategy: OnDelete + + +tolerations: + - key: node-role.kubernetes.io/master + effect: NoSchedule + +priorityClassName: "" + +nodeSelector: {} + +podAnnotations: {}