From 4420dc82d6f569c54d5cd44dbda1983180aa87fa Mon Sep 17 00:00:00 2001
From: Christian Kotzbauer <christian.kotzbauer@gmail.com>
Date: Sat, 20 Jun 2020 09:35:35 +0200
Subject: [PATCH 01/12] add chart github-actions

Signed-off-by: Christian Kotzbauer <christian.kotzbauer@gmail.com>
---
 .github/ct.yaml                     |  6 ++++++
 .github/workflows/chart-lint.yml    | 32 +++++++++++++++++++++++++++++
 .github/workflows/chart-release.yml | 16 +++++++++++++++
 3 files changed, 54 insertions(+)
 create mode 100644 .github/ct.yaml
 create mode 100644 .github/workflows/chart-lint.yml
 create mode 100644 .github/workflows/chart-release.yml

diff --git a/.github/ct.yaml b/.github/ct.yaml
new file mode 100644
index 0000000..cea6df5
--- /dev/null
+++ b/.github/ct.yaml
@@ -0,0 +1,6 @@
+# See https://github.com/helm/chart-testing#configuration
+remote: origin
+chart-dirs:
+  - charts
+chart-repos: []
+helm-extra-args: --timeout 600s
diff --git a/.github/workflows/chart-lint.yml b/.github/workflows/chart-lint.yml
new file mode 100644
index 0000000..418a68f
--- /dev/null
+++ b/.github/workflows/chart-lint.yml
@@ -0,0 +1,32 @@
+name: lint-chart
+
+on:
+  pull_request:
+    paths:
+      - "charts/**"
+
+jobs:
+  lint-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: "0"
+
+      - name: Run chart-testing (lint)
+        id: lint
+        uses: helm/chart-testing-action@v1.0.0-rc.2
+        with:
+          command: lint
+          config: .github/ct.yaml
+
+      - name: Create kind cluster
+        uses: helm/kind-action@v1.0.0-rc.1
+        if: steps.lint.outputs.changed == 'true'
+
+      - name: Run chart-testing (install)
+        uses: helm/chart-testing-action@v1.0.0-rc.2
+        with:
+          command: install
+          config: .github/ct.yaml
\ No newline at end of file
diff --git a/.github/workflows/chart-release.yml b/.github/workflows/chart-release.yml
new file mode 100644
index 0000000..ecc26ee
--- /dev/null
+++ b/.github/workflows/chart-release.yml
@@ -0,0 +1,16 @@
+name: release-chart
+on:
+  push:
+    tags:
+      - "*"
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Publish Helm chart
+        uses: stefanprodan/helm-gh-pages@master
+        with:
+          token: ${{ secrets.BOT_GITHUB_TOKEN }}
+          charts_dir: charts

From a574a67c618fede0dd7bf9f9c66e0fa0630c62fd Mon Sep 17 00:00:00 2001
From: Christian Kotzbauer <christian.kotzbauer@gmail.com>
Date: Sat, 20 Jun 2020 09:36:07 +0200
Subject: [PATCH 02/12] add unmodified chart from stable repo

Signed-off-by: Christian Kotzbauer <christian.kotzbauer@gmail.com>
---
 charts/kured/.helmignore                      | 21 +++++
 charts/kured/Chart.yaml                       | 14 ++++
 charts/kured/README.md                        | 49 ++++++++++++
 charts/kured/templates/NOTES.txt              |  3 +
 charts/kured/templates/_helpers.tpl           | 54 +++++++++++++
 charts/kured/templates/clusterrole.yaml       | 33 ++++++++
 .../kured/templates/clusterrolebinding.yaml   | 19 +++++
 charts/kured/templates/daemonset.yaml         | 78 +++++++++++++++++++
 charts/kured/templates/lock-cronjob.yaml      | 39 ++++++++++
 charts/kured/templates/podsecuritypolicy.yaml | 24 ++++++
 charts/kured/templates/role.yaml              | 29 +++++++
 charts/kured/templates/rolebinding.yaml       | 20 +++++
 charts/kured/templates/serviceaccount.yaml    |  7 ++
 charts/kured/templates/unlock-cronjob.yaml    | 39 ++++++++++
 charts/kured/values.yaml                      | 38 +++++++++
 15 files changed, 467 insertions(+)
 create mode 100644 charts/kured/.helmignore
 create mode 100644 charts/kured/Chart.yaml
 create mode 100644 charts/kured/README.md
 create mode 100644 charts/kured/templates/NOTES.txt
 create mode 100644 charts/kured/templates/_helpers.tpl
 create mode 100644 charts/kured/templates/clusterrole.yaml
 create mode 100644 charts/kured/templates/clusterrolebinding.yaml
 create mode 100644 charts/kured/templates/daemonset.yaml
 create mode 100644 charts/kured/templates/lock-cronjob.yaml
 create mode 100644 charts/kured/templates/podsecuritypolicy.yaml
 create mode 100644 charts/kured/templates/role.yaml
 create mode 100644 charts/kured/templates/rolebinding.yaml
 create mode 100644 charts/kured/templates/serviceaccount.yaml
 create mode 100644 charts/kured/templates/unlock-cronjob.yaml
 create mode 100644 charts/kured/values.yaml

diff --git a/charts/kured/.helmignore b/charts/kured/.helmignore
new file mode 100644
index 0000000..f0c1319
--- /dev/null
+++ b/charts/kured/.helmignore
@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
diff --git a/charts/kured/Chart.yaml b/charts/kured/Chart.yaml
new file mode 100644
index 0000000..2ecb57f
--- /dev/null
+++ b/charts/kured/Chart.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+appVersion: "1.4.0"
+description: A Helm chart for kured
+name: kured
+version: 1.5.1
+home: https://github.com/weaveworks/kured
+maintainers:
+  - name: plumdog
+    email: plummer574@gmail.com
+  - name: patrickmslatteryvt
+    email: pslattery@mi9retail.com
+sources:
+  - https://github.com/weaveworks/kured
+icon: https://raw.githubusercontent.com/weaveworks/kured/master/img/logo.png
diff --git a/charts/kured/README.md b/charts/kured/README.md
new file mode 100644
index 0000000..8276cc8
--- /dev/null
+++ b/charts/kured/README.md
@@ -0,0 +1,49 @@
+# Kured (KUbernetes REboot Daemon)
+
+See https://github.com/weaveworks/kured
+
+## Autolock feature
+
+This feature is not natively supported by kured but is added using Kubernetes Cronjob to annotate daemonset when to allow kured to run using the lock configuration annotation https://github.com/weaveworks/kured#overriding-lock-configuration
+
+
+| Config                  | Description                                                                 | Default                    |
+| ------                  | -----------                                                                 | -------                    |
+| `image.repository`      | Image repository                                                            | `weaveworks/kured` |
+| `image.tag`             | Image tag                                                                   | `1.4.0`                    |
+| `image.pullPolicy`      | Image pull policy                                                           | `IfNotPresent`             |
+| `image.pullSecrets`     | Image pull secrets                                                          | `[]`                       |
+| `extraArgs`             | Extra arguments to pass to `/usr/bin/kured`. See below.                     | `{}`                       |
+| `rbac.create`           | Create RBAC roles                                                           | `true`                     |
+| `podSecurityPolicy.create` | Create podSecurityPolicy                                                 | `false`                     |
+| `serviceAccount.create` | Create service account roles                                                | `true`                     |
+| `serviceAccount.name`   | Service account name to create (or use if `serviceAccount.create` is false) | (chart fullname)           |
+| `updateStrategy`        | Daemonset update strategy                                                   | `OnDelete`                 |
+| `tolerations`           | Tolerations to apply to the daemonset (eg to allow running on master)       | `[{"key": "node-role.kubernetes.io/master", "effect": "NoSchedule"}]`|
+| `nodeSelector`          | Node Selector for the daemonset (ie, restrict which nodes kured runs on)    | `{}`                       |
+| `priorityClassName`     | Priority Class to be used by the pods                                       | `""`                       |
+| `podAnnotations`        | Annotations to apply to pods (eg to add Prometheus annotations)             | `{}`                       |
+| `autolock.enabled`      | Activate autolock to define when to allow kured to be executed                                                        | `false` |
+| `autolock.image.repository`      | Image repository for kubectl command                                                         | `docker.io/bitnami/kubectl` |
+| `autolock.image.tag`             | Image tag                                                                   | `1.17.5`                    |
+| `autolock.scheduleUnlock`      | CronJob schedule to unlock kured                                                      | `0 4 * * *` |
+| `autolock.schedulelock`      | CronJob schedule to lock kured                                                      | `0 6 * * *` |
+
+See https://github.com/weaveworks/kured#configuration for values for `extraArgs`. Note that
+```yaml
+extraArgs:
+  foo: 1
+  bar-baz: 2
+```
+becomes `/usr/bin/kured ... --foo=1 --bar-baz=2`.
+
+## Prometheus Metrics
+
+Kured exposes a single prometheus metric indicating whether a reboot is required or not (see [kured docs](https://github.com/weaveworks/kured#prometheus-metrics)) for details. It can be scraped with the following set of annotations:
+
+```yaml
+podAnnotations:
+  prometheus.io/scrape: "true"
+  prometheus.io/path: "/metrics"
+  prometheus.io/port: "8080"
+```
diff --git a/charts/kured/templates/NOTES.txt b/charts/kured/templates/NOTES.txt
new file mode 100644
index 0000000..da2a02d
--- /dev/null
+++ b/charts/kured/templates/NOTES.txt
@@ -0,0 +1,3 @@
+Kured will check for /var/run/reboot-required, and reboot nodes when needed.
+
+See https://github.com/weaveworks/kured/ for details.
diff --git a/charts/kured/templates/_helpers.tpl b/charts/kured/templates/_helpers.tpl
new file mode 100644
index 0000000..38c3a43
--- /dev/null
+++ b/charts/kured/templates/_helpers.tpl
@@ -0,0 +1,54 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "kured.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "kured.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "kured.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "kured.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "kured.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the appropriate apiVersion for podsecuritypolicy.
+*/}}
+{{- define "kured.psp.apiVersion" -}}
+{{- if semverCompare "<1.10-0" .Capabilities.KubeVersion.GitVersion -}}
+{{- print "extensions/v1beta1" -}}
+{{- else -}}
+{{- print "policy/v1beta1" -}}
+{{- end -}}
+{{- end -}}
diff --git a/charts/kured/templates/clusterrole.yaml b/charts/kured/templates/clusterrole.yaml
new file mode 100644
index 0000000..f077c21
--- /dev/null
+++ b/charts/kured/templates/clusterrole.yaml
@@ -0,0 +1,33 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "kured.fullname" . }}
+  labels:
+    app: {{ template "kured.name" . }}
+    chart: {{ template "kured.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+# Allow kured to read spec.unschedulable
+# Allow kubectl to drain/uncordon
+#
+# NB: These permissions are tightly coupled to the bundled version of kubectl; the ones below
+# match https://github.com/kubernetes/kubernetes/blob/v1.12.1/pkg/kubectl/cmd/drain.go
+#
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs:     ["get", "patch"]
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs:     ["list","delete","get"]
+- apiGroups: ["extensions"]
+  resources: ["daemonsets"]
+  verbs:     ["get"]
+- apiGroups: ["apps"]
+  resources: ["daemonsets"]
+  verbs:     ["get"]
+- apiGroups: [""]
+  resources: ["pods/eviction"]
+  verbs:     ["create"]
+{{- end -}}
diff --git a/charts/kured/templates/clusterrolebinding.yaml b/charts/kured/templates/clusterrolebinding.yaml
new file mode 100644
index 0000000..a5586e9
--- /dev/null
+++ b/charts/kured/templates/clusterrolebinding.yaml
@@ -0,0 +1,19 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "kured.fullname" . }}
+  labels:
+    app: {{ template "kured.name" . }}
+    chart: {{ template "kured.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "kured.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "kured.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end -}}
diff --git a/charts/kured/templates/daemonset.yaml b/charts/kured/templates/daemonset.yaml
new file mode 100644
index 0000000..4f141ae
--- /dev/null
+++ b/charts/kured/templates/daemonset.yaml
@@ -0,0 +1,78 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ template "kured.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "kured.name" . }}
+    chart: {{ template "kured.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  updateStrategy:
+    type: {{ .Values.updateStrategy }}
+  selector:
+    matchLabels:
+      app: {{ template "kured.name" . }}
+      release: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ template "kured.name" . }}
+        release: {{ .Release.Name }}
+      {{- if .Values.podAnnotations }}
+      annotations:
+      {{- range $key, $value := .Values.podAnnotations }}
+        {{ $key }}: {{ $value | quote }}
+      {{- end }}
+      {{- end }}
+    spec:
+      serviceAccountName: {{ template "kured.serviceAccountName" . }}
+      hostPID: true
+      restartPolicy: Always
+      {{- with .Values.image.pullSecrets }}
+      imagePullSecrets:
+{{ toYaml . | indent 8 }}
+      {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+      {{- end }}
+      {{- if .Values.priorityClassName }}
+      priorityClassName: {{ .Values.priorityClassName }}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            privileged: true # Give permission to nsenter /proc/1/ns/mnt
+          resources:
+{{ toYaml .Values.resources | indent 12 }}
+          command:
+            - /usr/bin/kured
+          args:
+            - --ds-name={{ template "kured.fullname" . }}
+            - --ds-namespace={{ .Release.Namespace }}
+          {{- range $key, $value := .Values.extraArgs }}
+            {{- if $value }}
+            - --{{ $key }}={{ $value }}
+            {{- else }}
+            - --{{ $key }}
+            {{- end }}
+          {{- end }}
+          ports:
+            - containerPort: 8080
+              name: metrics          
+          env:
+            # Pass in the name of the node on which this pod is scheduled
+            # for use with drain/uncordon operations and lock acquisition
+            - name: KURED_NODE_ID
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+      restartPolicy: Always
+      {{- with .Values.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+      {{- end }}
diff --git a/charts/kured/templates/lock-cronjob.yaml b/charts/kured/templates/lock-cronjob.yaml
new file mode 100644
index 0000000..42a4f95
--- /dev/null
+++ b/charts/kured/templates/lock-cronjob.yaml
@@ -0,0 +1,39 @@
+{{- if .Values.autolock.enabled }}
+apiVersion: batch/v1beta1
+kind: CronJob
+metadata:
+  name: {{ template "kured.fullname" . }}-lock
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "kured.name" . }}
+    chart: {{ template "kured.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  schedule: {{ .Values.autolock.schedulelock | quote }}
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: {{ template "kured.name" . }}
+            chart: {{ template "kured.chart" . }}
+            release: {{ .Release.Name }}
+            heritage: {{ .Release.Service }}
+        spec:
+          serviceAccountName: {{ template "kured.serviceAccountName" . }}
+          containers:
+            - name: {{ template "kured.fullname" . }}-lock
+              image: "{{ .Values.autolock.image.repository }}:{{ .Values.autolock.image.tag }}"
+              command:
+                - kubectl
+              args:
+                - -n 
+                - {{ .Release.Namespace }}
+                - annotate
+                - ds
+                - {{ template "kured.fullname" . }}
+                - weave.works/kured-node-lock={"nodeID":"manual"}
+          restartPolicy: Never
+      backoffLimit: 1
+{{- end -}}
diff --git a/charts/kured/templates/podsecuritypolicy.yaml b/charts/kured/templates/podsecuritypolicy.yaml
new file mode 100644
index 0000000..d4e2f18
--- /dev/null
+++ b/charts/kured/templates/podsecuritypolicy.yaml
@@ -0,0 +1,24 @@
+{{- if .Values.podSecurityPolicy.create}}
+apiVersion: {{ template "kured.psp.apiVersion" . }}
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "kured.fullname" . }}
+  labels:
+    app: {{ template "kured.name" . }}
+    chart: {{ template "kured.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  privileged: true
+  hostPID: true
+  allowedCapabilities: ['*']
+  fsGroup:
+    rule: RunAsAny
+  runAsUser:
+    rule: RunAsAny
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  volumes: ['*']
+{{- end }}
diff --git a/charts/kured/templates/role.yaml b/charts/kured/templates/role.yaml
new file mode 100644
index 0000000..5576036
--- /dev/null
+++ b/charts/kured/templates/role.yaml
@@ -0,0 +1,29 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: {{ template "kured.fullname" . }}
+  labels:
+    app: {{ template "kured.name" . }}
+    chart: {{ template "kured.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+  # Allow kured to lock/unlock itself
+  - apiGroups:     ["extensions"]
+    resources:     ["daemonsets"]
+    resourceNames: ["{{ template "kured.fullname" . }}"]
+    verbs:         ["update", "patch"]
+  - apiGroups:     ["apps"]
+    resources:     ["daemonsets"]
+    resourceNames: ["{{ template "kured.fullname" . }}"]
+    verbs:         ["update"]
+{{- if .Values.podSecurityPolicy.create }}
+  - apiGroups:     ["extensions"]
+    resources:     ["podsecuritypolicies"]
+    resourceNames: ["{{ template "kured.fullname" . }}"]
+    verbs:         ["use"]
+{{- end }}
+
+{{- end -}}
diff --git a/charts/kured/templates/rolebinding.yaml b/charts/kured/templates/rolebinding.yaml
new file mode 100644
index 0000000..df3f177
--- /dev/null
+++ b/charts/kured/templates/rolebinding.yaml
@@ -0,0 +1,20 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: {{ template "kured.fullname" . }}
+  labels:
+    app: {{ template "kured.name" . }}
+    chart: {{ template "kured.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+subjects:
+- kind: ServiceAccount
+  namespace: {{ .Release.Namespace }}
+  name: {{ template "kured.serviceAccountName" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "kured.fullname" . }}
+{{- end -}}
diff --git a/charts/kured/templates/serviceaccount.yaml b/charts/kured/templates/serviceaccount.yaml
new file mode 100644
index 0000000..8a754ea
--- /dev/null
+++ b/charts/kured/templates/serviceaccount.yaml
@@ -0,0 +1,7 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "kured.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end -}}
diff --git a/charts/kured/templates/unlock-cronjob.yaml b/charts/kured/templates/unlock-cronjob.yaml
new file mode 100644
index 0000000..9dd4283
--- /dev/null
+++ b/charts/kured/templates/unlock-cronjob.yaml
@@ -0,0 +1,39 @@
+{{- if .Values.autolock.enabled }}
+apiVersion: batch/v1beta1
+kind: CronJob
+metadata:
+  name: {{ template "kured.fullname" . }}-unlock
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "kured.name" . }}
+    chart: {{ template "kured.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  schedule: {{ .Values.autolock.scheduleUnlock | quote }}
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: {{ template "kured.name" . }}
+            chart: {{ template "kured.chart" . }}
+            release: {{ .Release.Name }}
+            heritage: {{ .Release.Service }}
+        spec:
+          serviceAccountName: {{ template "kured.serviceAccountName" . }}
+          containers:
+            - name: {{ template "kured.fullname" . }}-unlock
+              image: "{{ .Values.autolock.image.repository }}:{{ .Values.autolock.image.tag }}"
+              command:
+                - kubectl
+              args:
+                - -n 
+                - {{ .Release.Namespace }}
+                - annotate
+                - ds
+                - {{ template "kured.fullname" . }}
+                - weave.works/kured-node-lock-
+          restartPolicy: Never
+      backoffLimit: 1
+{{- end -}}
diff --git a/charts/kured/values.yaml b/charts/kured/values.yaml
new file mode 100644
index 0000000..824bf44
--- /dev/null
+++ b/charts/kured/values.yaml
@@ -0,0 +1,38 @@
+image:
+  repository: weaveworks/kured
+  tag: 1.4.0
+  pullPolicy: IfNotPresent
+  pullSecrets: []
+
+extraArgs: {}
+
+rbac:
+  create: true
+
+podSecurityPolicy:
+  create: false
+
+serviceAccount:
+  create: true
+  name:
+
+autolock:
+  enabled: false
+  image:
+    repository: docker.io/bitnami/kubectl
+    tag: 1.17.5
+  scheduleUnlock: 0 4 * * *
+  schedulelock: 0 6 * * *
+
+updateStrategy: OnDelete
+
+
+tolerations:
+  - key: node-role.kubernetes.io/master
+    effect: NoSchedule
+
+priorityClassName: ""
+
+nodeSelector: {}
+
+podAnnotations: {}

From c473caafc8de783ddac486abff8dd5518d9a263c Mon Sep 17 00:00:00 2001
From: Christian Kotzbauer <christian.kotzbauer@gmail.com>
Date: Sat, 20 Jun 2020 09:37:44 +0200
Subject: [PATCH 03/12] remove autolock feature

Signed-off-by: Christian Kotzbauer <christian.kotzbauer@gmail.com>
---
 charts/kured/templates/lock-cronjob.yaml   | 39 ----------------------
 charts/kured/templates/unlock-cronjob.yaml | 39 ----------------------
 charts/kured/values.yaml                   |  8 -----
 3 files changed, 86 deletions(-)
 delete mode 100644 charts/kured/templates/lock-cronjob.yaml
 delete mode 100644 charts/kured/templates/unlock-cronjob.yaml

diff --git a/charts/kured/templates/lock-cronjob.yaml b/charts/kured/templates/lock-cronjob.yaml
deleted file mode 100644
index 42a4f95..0000000
--- a/charts/kured/templates/lock-cronjob.yaml
+++ /dev/null
@@ -1,39 +0,0 @@
-{{- if .Values.autolock.enabled }}
-apiVersion: batch/v1beta1
-kind: CronJob
-metadata:
-  name: {{ template "kured.fullname" . }}-lock
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "kured.name" . }}
-    chart: {{ template "kured.chart" . }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}
-spec:
-  schedule: {{ .Values.autolock.schedulelock | quote }}
-  jobTemplate:
-    spec:
-      template:
-        metadata:
-          labels:
-            app: {{ template "kured.name" . }}
-            chart: {{ template "kured.chart" . }}
-            release: {{ .Release.Name }}
-            heritage: {{ .Release.Service }}
-        spec:
-          serviceAccountName: {{ template "kured.serviceAccountName" . }}
-          containers:
-            - name: {{ template "kured.fullname" . }}-lock
-              image: "{{ .Values.autolock.image.repository }}:{{ .Values.autolock.image.tag }}"
-              command:
-                - kubectl
-              args:
-                - -n 
-                - {{ .Release.Namespace }}
-                - annotate
-                - ds
-                - {{ template "kured.fullname" . }}
-                - weave.works/kured-node-lock={"nodeID":"manual"}
-          restartPolicy: Never
-      backoffLimit: 1
-{{- end -}}
diff --git a/charts/kured/templates/unlock-cronjob.yaml b/charts/kured/templates/unlock-cronjob.yaml
deleted file mode 100644
index 9dd4283..0000000
--- a/charts/kured/templates/unlock-cronjob.yaml
+++ /dev/null
@@ -1,39 +0,0 @@
-{{- if .Values.autolock.enabled }}
-apiVersion: batch/v1beta1
-kind: CronJob
-metadata:
-  name: {{ template "kured.fullname" . }}-unlock
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "kured.name" . }}
-    chart: {{ template "kured.chart" . }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}
-spec:
-  schedule: {{ .Values.autolock.scheduleUnlock | quote }}
-  jobTemplate:
-    spec:
-      template:
-        metadata:
-          labels:
-            app: {{ template "kured.name" . }}
-            chart: {{ template "kured.chart" . }}
-            release: {{ .Release.Name }}
-            heritage: {{ .Release.Service }}
-        spec:
-          serviceAccountName: {{ template "kured.serviceAccountName" . }}
-          containers:
-            - name: {{ template "kured.fullname" . }}-unlock
-              image: "{{ .Values.autolock.image.repository }}:{{ .Values.autolock.image.tag }}"
-              command:
-                - kubectl
-              args:
-                - -n 
-                - {{ .Release.Namespace }}
-                - annotate
-                - ds
-                - {{ template "kured.fullname" . }}
-                - weave.works/kured-node-lock-
-          restartPolicy: Never
-      backoffLimit: 1
-{{- end -}}
diff --git a/charts/kured/values.yaml b/charts/kured/values.yaml
index 824bf44..bcf6cd8 100644
--- a/charts/kured/values.yaml
+++ b/charts/kured/values.yaml
@@ -16,14 +16,6 @@ serviceAccount:
   create: true
   name:
 
-autolock:
-  enabled: false
-  image:
-    repository: docker.io/bitnami/kubectl
-    tag: 1.17.5
-  scheduleUnlock: 0 4 * * *
-  schedulelock: 0 6 * * *
-
 updateStrategy: OnDelete
 
 

From 02bb6d650ef64107c07206012765b1de21f10e57 Mon Sep 17 00:00:00 2001
From: Christian Kotzbauer <christian.kotzbauer@gmail.com>
Date: Sat, 20 Jun 2020 09:45:39 +0200
Subject: [PATCH 04/12] use template function for labels

Signed-off-by: Christian Kotzbauer <christian.kotzbauer@gmail.com>
---
 charts/kured/templates/_helpers.tpl            | 10 ++++++++++
 charts/kured/templates/clusterrole.yaml        |  5 +----
 charts/kured/templates/clusterrolebinding.yaml |  5 +----
 charts/kured/templates/daemonset.yaml          | 11 +++--------
 charts/kured/templates/podsecuritypolicy.yaml  |  5 +----
 charts/kured/templates/role.yaml               |  5 +----
 charts/kured/templates/rolebinding.yaml        |  5 +----
 charts/kured/templates/serviceaccount.yaml     |  2 ++
 8 files changed, 20 insertions(+), 28 deletions(-)

diff --git a/charts/kured/templates/_helpers.tpl b/charts/kured/templates/_helpers.tpl
index 38c3a43..271b902 100644
--- a/charts/kured/templates/_helpers.tpl
+++ b/charts/kured/templates/_helpers.tpl
@@ -52,3 +52,13 @@ Return the appropriate apiVersion for podsecuritypolicy.
 {{- print "policy/v1beta1" -}}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Returns a set of labels applied to each resource.
+*/}}
+{{- define "kured.labels" -}}
+app: {{ template "kured.name" . }}
+chart: {{ template "kured.chart" . }}
+release: {{ .Release.Name }}
+heritage: {{ .Release.Service }}
+{{- end -}}
diff --git a/charts/kured/templates/clusterrole.yaml b/charts/kured/templates/clusterrole.yaml
index f077c21..1abde05 100644
--- a/charts/kured/templates/clusterrole.yaml
+++ b/charts/kured/templates/clusterrole.yaml
@@ -4,10 +4,7 @@ kind: ClusterRole
 metadata:
   name: {{ template "kured.fullname" . }}
   labels:
-    app: {{ template "kured.name" . }}
-    chart: {{ template "kured.chart" . }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}
+    {{- include "kured.labels" . | nindent 4 }}
 rules:
 # Allow kured to read spec.unschedulable
 # Allow kubectl to drain/uncordon
diff --git a/charts/kured/templates/clusterrolebinding.yaml b/charts/kured/templates/clusterrolebinding.yaml
index a5586e9..1b2e45b 100644
--- a/charts/kured/templates/clusterrolebinding.yaml
+++ b/charts/kured/templates/clusterrolebinding.yaml
@@ -4,10 +4,7 @@ kind: ClusterRoleBinding
 metadata:
   name: {{ template "kured.fullname" . }}
   labels:
-    app: {{ template "kured.name" . }}
-    chart: {{ template "kured.chart" . }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}
+    {{- include "kured.labels" . | nindent 4 }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
diff --git a/charts/kured/templates/daemonset.yaml b/charts/kured/templates/daemonset.yaml
index 4f141ae..215199d 100644
--- a/charts/kured/templates/daemonset.yaml
+++ b/charts/kured/templates/daemonset.yaml
@@ -4,22 +4,17 @@ metadata:
   name: {{ template "kured.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app: {{ template "kured.name" . }}
-    chart: {{ template "kured.chart" . }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}
+    {{- include "kured.labels" . | nindent 4 }}
 spec:
   updateStrategy:
     type: {{ .Values.updateStrategy }}
   selector:
     matchLabels:
-      app: {{ template "kured.name" . }}
-      release: {{ .Release.Name }}
+      {{- include "kured.labels" . | nindent 6 }}
   template:
     metadata:
       labels:
-        app: {{ template "kured.name" . }}
-        release: {{ .Release.Name }}
+        {{- include "kured.labels" . | nindent 8 }}
       {{- if .Values.podAnnotations }}
       annotations:
       {{- range $key, $value := .Values.podAnnotations }}
diff --git a/charts/kured/templates/podsecuritypolicy.yaml b/charts/kured/templates/podsecuritypolicy.yaml
index d4e2f18..71a3095 100644
--- a/charts/kured/templates/podsecuritypolicy.yaml
+++ b/charts/kured/templates/podsecuritypolicy.yaml
@@ -4,10 +4,7 @@ kind: PodSecurityPolicy
 metadata:
   name: {{ template "kured.fullname" . }}
   labels:
-    app: {{ template "kured.name" . }}
-    chart: {{ template "kured.chart" . }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}
+    {{- include "kured.labels" . | nindent 4 }}
 spec:
   privileged: true
   hostPID: true
diff --git a/charts/kured/templates/role.yaml b/charts/kured/templates/role.yaml
index 5576036..cf0b8b0 100644
--- a/charts/kured/templates/role.yaml
+++ b/charts/kured/templates/role.yaml
@@ -5,10 +5,7 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ template "kured.fullname" . }}
   labels:
-    app: {{ template "kured.name" . }}
-    chart: {{ template "kured.chart" . }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}
+    {{- include "kured.labels" . | nindent 4 }}
 rules:
   # Allow kured to lock/unlock itself
   - apiGroups:     ["extensions"]
diff --git a/charts/kured/templates/rolebinding.yaml b/charts/kured/templates/rolebinding.yaml
index df3f177..58f1b26 100644
--- a/charts/kured/templates/rolebinding.yaml
+++ b/charts/kured/templates/rolebinding.yaml
@@ -5,10 +5,7 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ template "kured.fullname" . }}
   labels:
-    app: {{ template "kured.name" . }}
-    chart: {{ template "kured.chart" . }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}
+    {{- include "kured.labels" . | nindent 4 }}
 subjects:
 - kind: ServiceAccount
   namespace: {{ .Release.Namespace }}
diff --git a/charts/kured/templates/serviceaccount.yaml b/charts/kured/templates/serviceaccount.yaml
index 8a754ea..4ce53b9 100644
--- a/charts/kured/templates/serviceaccount.yaml
+++ b/charts/kured/templates/serviceaccount.yaml
@@ -4,4 +4,6 @@ kind: ServiceAccount
 metadata:
   name: {{ template "kured.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "kured.labels" . | nindent 4 }}
 {{- end -}}

From d3ea5639f42c3fb88ee34d5f09626f8707a5bbd9 Mon Sep 17 00:00:00 2001
From: Christian Kotzbauer <christian.kotzbauer@gmail.com>
Date: Sat, 20 Jun 2020 09:49:20 +0200
Subject: [PATCH 05/12] fix role inconsistencies

Signed-off-by: Christian Kotzbauer <christian.kotzbauer@gmail.com>
---
 charts/kured/templates/role.yaml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/charts/kured/templates/role.yaml b/charts/kured/templates/role.yaml
index cf0b8b0..d937ed7 100644
--- a/charts/kured/templates/role.yaml
+++ b/charts/kured/templates/role.yaml
@@ -15,12 +15,16 @@ rules:
   - apiGroups:     ["apps"]
     resources:     ["daemonsets"]
     resourceNames: ["{{ template "kured.fullname" . }}"]
-    verbs:         ["update"]
+    verbs:         ["update", "patch"]
 {{- if .Values.podSecurityPolicy.create }}
   - apiGroups:     ["extensions"]
     resources:     ["podsecuritypolicies"]
     resourceNames: ["{{ template "kured.fullname" . }}"]
     verbs:         ["use"]
+  - apiGroups:     ["policy"]
+    resources:     ["podsecuritypolicies"]
+    resourceNames: ["{{ template "kured.fullname" . }}"]
+    verbs:         ["use"]
 {{- end }}
 
 {{- end -}}

From ab0b5d137c174a51313a103652dc5ffa0ff484a7 Mon Sep 17 00:00:00 2001
From: Christian Kotzbauer <christian.kotzbauer@gmail.com>
Date: Sat, 20 Jun 2020 09:52:41 +0200
Subject: [PATCH 06/12] add affinity support; removed duplicate restartPolicy

Signed-off-by: Christian Kotzbauer <christian.kotzbauer@gmail.com>
---
 charts/kured/templates/daemonset.yaml | 13 ++++++++-----
 charts/kured/values.yaml              |  3 ++-
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/charts/kured/templates/daemonset.yaml b/charts/kured/templates/daemonset.yaml
index 215199d..2bbe2a5 100644
--- a/charts/kured/templates/daemonset.yaml
+++ b/charts/kured/templates/daemonset.yaml
@@ -27,10 +27,6 @@ spec:
       restartPolicy: Always
       {{- with .Values.image.pullSecrets }}
       imagePullSecrets:
-{{ toYaml . | indent 8 }}
-      {{- end }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
 {{ toYaml . | indent 8 }}
       {{- end }}
       {{- if .Values.priorityClassName }}
@@ -66,8 +62,15 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: spec.nodeName
-      restartPolicy: Always
       {{- with .Values.tolerations }}
       tolerations:
 {{ toYaml . | indent 8 }}
       {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+      {{- end }}
\ No newline at end of file
diff --git a/charts/kured/values.yaml b/charts/kured/values.yaml
index bcf6cd8..30211b0 100644
--- a/charts/kured/values.yaml
+++ b/charts/kured/values.yaml
@@ -18,12 +18,13 @@ serviceAccount:
 
 updateStrategy: OnDelete
 
+priorityClassName: ""
 
 tolerations:
   - key: node-role.kubernetes.io/master
     effect: NoSchedule
 
-priorityClassName: ""
+affinity: {}
 
 nodeSelector: {}
 

From 2afa0a9da7c3f547d43a2bc280eca240574a83cd Mon Sep 17 00:00:00 2001
From: Christian Kotzbauer <christian.kotzbauer@gmail.com>
Date: Sat, 20 Jun 2020 10:17:50 +0200
Subject: [PATCH 07/12] add cli-flags as config-object

Signed-off-by: Christian Kotzbauer <christian.kotzbauer@gmail.com>
---
 charts/kured/templates/daemonset.yaml | 42 +++++++++++++++++++++++++++
 charts/kured/values.yaml              | 16 ++++++++++
 2 files changed, 58 insertions(+)

diff --git a/charts/kured/templates/daemonset.yaml b/charts/kured/templates/daemonset.yaml
index 2bbe2a5..0c308d3 100644
--- a/charts/kured/templates/daemonset.yaml
+++ b/charts/kured/templates/daemonset.yaml
@@ -45,6 +45,48 @@ spec:
           args:
             - --ds-name={{ template "kured.fullname" . }}
             - --ds-namespace={{ .Release.Namespace }}
+          {{- if .Values.configuration.annotationTtl }}
+            - --annotation-ttl={{ .Values.configuration.annotationTtl }}
+          {{- end }}
+          {{- if .Values.configuration.alertFilterRegexp }}
+            - --alert-filter-regexp={{ .Values.configuration.alertFilterRegexp | quote }}
+          {{- end }}
+          {{- if .Values.configuration.blockingPodSelector }}
+            - --blocking-pod-selector={{ .Values.configuration.blockingPodSelector | quote }}
+          {{- end }}
+          {{- if .Values.configuration.endTime }}
+            - --end-time={{ .Values.configuration.endTime | quote }}
+          {{- end }}
+          {{- if .Values.configuration.lockAnnotation }}
+            - --lock-annotation={{ .Values.configuration.lockAnnotation | quote }}
+          {{- end }}
+          {{- if .Values.configuration.period }}
+            - --period={{ .Values.configuration.period | quote }}
+          {{- end }}
+          {{- if .Values.configuration.prometheusUrl }}
+            - --prometheus-url={{ .Values.configuration.prometheusUrl | quote }}
+          {{- end }}
+          {{- if .Values.configuration.rebootDays }}
+            - --reboot-days={{ .Values.configuration.rebootDays | quote }}
+          {{- end }}
+          {{- if .Values.configuration.rebootSentinel }}
+            - --reboot-sentinel={{ .Values.configuration.rebootSentinel | quote }}
+          {{- end }}
+          {{- if .Values.configuration.slackChannel }}
+            - --slack-channel={{ .Values.configuration.slackChannel | quote }}
+          {{- end }}
+          {{- if .Values.configuration.slackHookUrl }}
+            - --slack-hook-url={{ .Values.configuration.slackHookUrl | quote }}
+          {{- end }}
+          {{- if .Values.configuration.slackUsername }}
+            - --slack-username={{ .Values.configuration.slackUsername | quote }}
+          {{- end }}
+          {{- if .Values.configuration.startTime }}
+            - --start-time={{ .Values.configuration.startTime | quote }}
+          {{- end }}
+          {{- if .Values.configuration.timeZone }}
+            - --time-zone={{ .Values.configuration.timeZone | quote }}
+          {{- end }}
           {{- range $key, $value := .Values.extraArgs }}
             {{- if $value }}
             - --{{ $key }}={{ $value }}
diff --git a/charts/kured/values.yaml b/charts/kured/values.yaml
index 30211b0..f1c9e04 100644
--- a/charts/kured/values.yaml
+++ b/charts/kured/values.yaml
@@ -6,6 +6,22 @@ image:
 
 extraArgs: {}
 
+configuration:
+  annotationTtl: 0          # force clean annotation after this ammount of time (default 0, disabled)
+  alertFilterRegexp: ""     # alert names to ignore when checking for active alerts
+  blockingPodSelector: []   # label selector identifying pods whose presence should prevent reboots
+  endTime: ""               # only reboot before this time of day (default "23:59")
+  lockAnnotation: ""        # annotation in which to record locking node (default "weave.works/kured-node-lock")
+  period: ""                # reboot check period (default 1h0m0s)
+  prometheusUrl: ""         # Prometheus instance to probe for active alerts
+  rebootDays: []            # only reboot on these days (default [su,mo,tu,we,th,fr,sa])
+  rebootSentinel: ""        # path to file whose existence signals need to reboot (default "/var/run/reboot-required")
+  slackChannel: ""          # slack channel for reboot notfications
+  slackHookUrl: ""          # slack hook URL for reboot notfications
+  slackUsername: ""         # slack username for reboot notfications (default "kured")
+  startTime: ""             # only reboot after this time of day (default "0:00")
+  timeZone: ""              # time-zone to use (valid zones from "time" golang package)
+
 rbac:
   create: true
 

From 2bb7b7937ed72f37e055af764ecac8b39fc89f2c Mon Sep 17 00:00:00 2001
From: Christian Kotzbauer <christian.kotzbauer@gmail.com>
Date: Sat, 20 Jun 2020 10:46:54 +0200
Subject: [PATCH 08/12] add service and serviceMonitor

Signed-off-by: Christian Kotzbauer <christian.kotzbauer@gmail.com>
---
 charts/kured/templates/service.yaml        | 15 +++++++++++
 charts/kured/templates/servicemonitor.yaml | 31 ++++++++++++++++++++++
 charts/kured/values.yaml                   |  9 +++++++
 3 files changed, 55 insertions(+)
 create mode 100644 charts/kured/templates/service.yaml
 create mode 100644 charts/kured/templates/servicemonitor.yaml

diff --git a/charts/kured/templates/service.yaml b/charts/kured/templates/service.yaml
new file mode 100644
index 0000000..715bee9
--- /dev/null
+++ b/charts/kured/templates/service.yaml
@@ -0,0 +1,15 @@
+{{- if .Values.metrics.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "kured.fullname" . }}
+  labels:
+    {{- include "kured.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - name: metrics
+      port: 8080
+  selector:
+    {{- include "kured.labels" . | nindent 4 }}
+{{- end }}
\ No newline at end of file
diff --git a/charts/kured/templates/servicemonitor.yaml b/charts/kured/templates/servicemonitor.yaml
new file mode 100644
index 0000000..966beb0
--- /dev/null
+++ b/charts/kured/templates/servicemonitor.yaml
@@ -0,0 +1,31 @@
+{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ template "kured.fullname" . }}
+  {{- if .Values.metrics.serviceMonitor.namespace }}
+  namespace: {{ .Values.metrics.serviceMonitor.namespace }}
+  {{- end }}
+  labels:
+    {{- include "kured.labels" . | nindent 4 }}
+    {{- if .Values.metrics.serviceMonitor.labels }}
+    {{- toYaml .Values.metrics.serviceMonitor.labels | nindent 4 }}
+    {{- end }}
+spec:
+  endpoints:
+  - interval: {{ .Values.metrics.serviceMonitor.interval }}
+    {{- if .Values.metrics.serviceMonitor.scrapeTimeout }}
+    scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
+    {{- end }}
+    honorLabels: true
+    targetPort: 8080
+    path: /metrics
+    scheme: http
+  jobLabel: "{{ .Release.Name }}"
+  selector:
+    matchLabels:
+      {{- include "kured.labels" . | nindent 4 }}
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+{{- end }}
diff --git a/charts/kured/values.yaml b/charts/kured/values.yaml
index f1c9e04..bcb4d09 100644
--- a/charts/kured/values.yaml
+++ b/charts/kured/values.yaml
@@ -32,6 +32,15 @@ serviceAccount:
   create: true
   name:
 
+metrics:
+  enabled: false
+  serviceMonitor:
+    enabled: true
+    namespace: ""
+    labels: {}
+    interval: 60s
+    scrapeTimeout: ""
+
 updateStrategy: OnDelete
 
 priorityClassName: ""

From d271165496414dfe5c2a08afc77ce3bf56b78362 Mon Sep 17 00:00:00 2001
From: Christian Kotzbauer <christian.kotzbauer@gmail.com>
Date: Sat, 20 Jun 2020 10:50:54 +0200
Subject: [PATCH 09/12] rearrange default values

Signed-off-by: Christian Kotzbauer <christian.kotzbauer@gmail.com>
---
 charts/kured/templates/service.yaml        |  2 +-
 charts/kured/templates/servicemonitor.yaml |  2 +-
 charts/kured/values.yaml                   | 20 +++++++++++---------
 3 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/charts/kured/templates/service.yaml b/charts/kured/templates/service.yaml
index 715bee9..6bdcc4d 100644
--- a/charts/kured/templates/service.yaml
+++ b/charts/kured/templates/service.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.metrics.enabled }}
+{{- if .Values.metrics.create }}
 apiVersion: v1
 kind: Service
 metadata:
diff --git a/charts/kured/templates/servicemonitor.yaml b/charts/kured/templates/servicemonitor.yaml
index 966beb0..b13682f 100644
--- a/charts/kured/templates/servicemonitor.yaml
+++ b/charts/kured/templates/servicemonitor.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }}
+{{- if and .Values.metrics.create .Values.metrics.serviceMonitor.create }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
diff --git a/charts/kured/values.yaml b/charts/kured/values.yaml
index bcb4d09..7d85ad0 100644
--- a/charts/kured/values.yaml
+++ b/charts/kured/values.yaml
@@ -4,6 +4,10 @@ image:
   pullPolicy: IfNotPresent
   pullSecrets: []
 
+updateStrategy: OnDelete
+
+podAnnotations: {}
+
 extraArgs: {}
 
 configuration:
@@ -25,24 +29,24 @@ configuration:
 rbac:
   create: true
 
-podSecurityPolicy:
-  create: false
-
 serviceAccount:
   create: true
   name:
 
+podSecurityPolicy:
+  create: false
+
+resources: {}
+
 metrics:
-  enabled: false
+  create: false
   serviceMonitor:
-    enabled: true
+    create: true
     namespace: ""
     labels: {}
     interval: 60s
     scrapeTimeout: ""
 
-updateStrategy: OnDelete
-
 priorityClassName: ""
 
 tolerations:
@@ -52,5 +56,3 @@ tolerations:
 affinity: {}
 
 nodeSelector: {}
-
-podAnnotations: {}

From a815867584479859efa73dfe4f1d99e21f866840 Mon Sep 17 00:00:00 2001
From: Christian Kotzbauer <christian.kotzbauer@gmail.com>
Date: Sat, 20 Jun 2020 12:04:27 +0200
Subject: [PATCH 10/12] updated chart docs

Signed-off-by: Christian Kotzbauer <christian.kotzbauer@gmail.com>
---
 charts/kured/README.md | 89 +++++++++++++++++++++++++++++++++---------
 1 file changed, 71 insertions(+), 18 deletions(-)

diff --git a/charts/kured/README.md b/charts/kured/README.md
index 8276cc8..8ebc997 100644
--- a/charts/kured/README.md
+++ b/charts/kured/README.md
@@ -1,11 +1,37 @@
 # Kured (KUbernetes REboot Daemon)
 
-See https://github.com/weaveworks/kured
+## Introduction
+This chart installs the "Kubernetes Reboot Daemon" using the Helm Package Manager.
 
-## Autolock feature
+## Prerequisites
+- Kubernetes 1.9+
 
-This feature is not natively supported by kured but is added using Kubernetes Cronjob to annotate daemonset when to allow kured to run using the lock configuration annotation https://github.com/weaveworks/kured#overriding-lock-configuration
+## Installing the Chart
+To install the chart with the release name `my-release`:
+```bash
+$ helm repo add kured https://weaveworks.github.io/kured
+$ helm install my-release kured/kured
+```
 
+## Uninstalling the Chart
+To uninstall/delete the `my-release` deployment:
+```bash
+$ helm delete my-release
+```
+
+The command removes all the Kubernetes components associated with the chart and deletes the release.
+
+
+## Migrate from stable Helm-Chart
+The following changes have been made compared to the stable chart:
+- **[BREAKING CHANGE]** The `autolock` feature was removed. Use `configuration.startTime` and `configuration.endTime` instead.
+- Role inconsistencies have been fixed (allowed verbs for modifying the `DaemonSet`, apiGroup of `PodSecurityPolicy`)
+- Added support for affinities.
+- Configuration of cli-flags can be made through a `configuration` object.
+- Added optional `Service` and `ServiceMonitor` support for metrics endpoint.
+
+
+## Configuration
 
 | Config                  | Description                                                                 | Default                    |
 | ------                  | -----------                                                                 | -------                    |
@@ -13,23 +39,40 @@ This feature is not natively supported by kured but is added using Kubernetes Cr
 | `image.tag`             | Image tag                                                                   | `1.4.0`                    |
 | `image.pullPolicy`      | Image pull policy                                                           | `IfNotPresent`             |
 | `image.pullSecrets`     | Image pull secrets                                                          | `[]`                       |
-| `extraArgs`             | Extra arguments to pass to `/usr/bin/kured`. See below.                     | `{}`                       |
-| `rbac.create`           | Create RBAC roles                                                           | `true`                     |
-| `podSecurityPolicy.create` | Create podSecurityPolicy                                                 | `false`                     |
-| `serviceAccount.create` | Create service account roles                                                | `true`                     |
-| `serviceAccount.name`   | Service account name to create (or use if `serviceAccount.create` is false) | (chart fullname)           |
 | `updateStrategy`        | Daemonset update strategy                                                   | `OnDelete`                 |
-| `tolerations`           | Tolerations to apply to the daemonset (eg to allow running on master)       | `[{"key": "node-role.kubernetes.io/master", "effect": "NoSchedule"}]`|
-| `nodeSelector`          | Node Selector for the daemonset (ie, restrict which nodes kured runs on)    | `{}`                       |
-| `priorityClassName`     | Priority Class to be used by the pods                                       | `""`                       |
 | `podAnnotations`        | Annotations to apply to pods (eg to add Prometheus annotations)             | `{}`                       |
-| `autolock.enabled`      | Activate autolock to define when to allow kured to be executed                                                        | `false` |
-| `autolock.image.repository`      | Image repository for kubectl command                                                         | `docker.io/bitnami/kubectl` |
-| `autolock.image.tag`             | Image tag                                                                   | `1.17.5`                    |
-| `autolock.scheduleUnlock`      | CronJob schedule to unlock kured                                                      | `0 4 * * *` |
-| `autolock.schedulelock`      | CronJob schedule to lock kured                                                      | `0 6 * * *` |
+| `extraArgs`             | Extra arguments to pass to `/usr/bin/kured`. See below.                     | `{}`                       |
+| `configuration.annotationTtl` | cli-parameter `--annotation-ttl`                                      | `0`                       |
+| `configuration.alertFilterRegexp` | cli-parameter `--alert-filter-regexp`                             | `""`                       |
+| `configuration.blockingPodSelector` | cli-parameter `--blocking-pod-selector` **Note**: Escape like "foo\\,bar" | `[]`             |
+| `configuration.endTime` | cli-parameter `--end-time`                                                  | `""`                      |
+| `configuration.lockAnnotation` | cli-parameter `--lock-annotation`                                    | `""`                      |
+| `configuration.period` | cli-parameter `--period`                                                     | `""`                      |
+| `configuration.prometheusUrl` | cli-parameter `--prometheus-url`                                      | `""`                      |
+| `configuration.rebootDays` | cli-parameter `--reboot-days` **Note**: Escape like "mo\\,tu"             | `[]`                      |
+| `configuration.rebootSentinel` | cli-parameter `--reboot-sentinel`                                    | `""`                      |
+| `configuration.slackChannel` | cli-parameter `--slack-channel`                                        | `""`                      |
+| `configuration.slackHookUrl` | cli-parameter `--slack-hook-url`                                       | `""`                      |
+| `configuration.slackUsername` | cli-parameter `--slack-username`                                      | `""`                      |
+| `configuration.startTime` | cli-parameter `--start-time`                                              | `""`                      |
+| `configuration.timeZone` | cli-parameter `--time-zone`                                                | `""`                      |
+| `rbac.create`           | Create RBAC roles                                                           | `true`                     |
+| `serviceAccount.create` | Create a service account                                                    | `true`                     |
+| `serviceAccount.name`   | Service account name to create (or use if `serviceAccount.create` is false) | (chart fullname)           |
+| `podSecurityPolicy.create` | Create podSecurityPolicy                                                 | `false`                     |
+| `resources`             | Resources requests and limits.                                              | `{}`                       |
+| `metrics.create`        | Create a Service for the metrics endpoint                                   | `false`                    |
+| `metrics.serviceMonitor.create` | Create a ServiceMonitor for prometheus-operator                     | `true`                    |
+| `metrics.serviceMonitor.namespace` | The namespace to create the ServiceMonitor in                    | `""`                    |
+| `metrics.serviceMonitor.labels` | Additional labels for the ServiceMonitor                            | `{}`                    |
+| `metrics.serviceMonitor.interval` | Interval prometheus should scrape the endpoint                    | `60s`                   |
+| `metrics.serviceMonitor.scrapeTimeout` | A custom scrapeTimeout for prometheus                        | `""`                    |
+| `priorityClassName`     | Priority Class to be used by the pods                                       | `""`                       |
+| `tolerations`           | Tolerations to apply to the daemonset (eg to allow running on master)       | `[{"key": "node-role.kubernetes.io/master", "effect": "NoSchedule"}]`|
+| `affinity`              | Affinity for the daemonset (ie, restrict which nodes kured runs on)         | `{}`                       |
+| `nodeSelector`          | Node Selector for the daemonset (ie, restrict which nodes kured runs on)    | `{}`                       |
 
-See https://github.com/weaveworks/kured#configuration for values for `extraArgs`. Note that
+See https://github.com/weaveworks/kured#configuration for values (not contained in the `configuration` object) for `extraArgs`. Note that
 ```yaml
 extraArgs:
   foo: 1
@@ -37,9 +80,19 @@ extraArgs:
 ```
 becomes `/usr/bin/kured ... --foo=1 --bar-baz=2`.
 
+
 ## Prometheus Metrics
 
-Kured exposes a single prometheus metric indicating whether a reboot is required or not (see [kured docs](https://github.com/weaveworks/kured#prometheus-metrics)) for details. It can be scraped with the following set of annotations:
+Kured exposes a single prometheus metric indicating whether a reboot is required or not (see [kured docs](https://github.com/weaveworks/kured#prometheus-metrics)) for details. 
+
+#### Prometheus-Operator
+
+```yaml
+metrics:
+  create: true
+```
+
+#### Prometheus Annotations
 
 ```yaml
 podAnnotations:

From 1ddd45d90b83b38d6020c83b4936317785821446 Mon Sep 17 00:00:00 2001
From: Christian Kotzbauer <christian.kotzbauer@gmail.com>
Date: Mon, 22 Jun 2020 15:20:48 +0200
Subject: [PATCH 11/12] updated maintainers and version

Signed-off-by: Christian Kotzbauer <christian.kotzbauer@gmail.com>
---
 charts/kured/Chart.yaml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/charts/kured/Chart.yaml b/charts/kured/Chart.yaml
index 2ecb57f..3fcddc3 100644
--- a/charts/kured/Chart.yaml
+++ b/charts/kured/Chart.yaml
@@ -2,13 +2,13 @@ apiVersion: v1
 appVersion: "1.4.0"
 description: A Helm chart for kured
 name: kured
-version: 1.5.1
+version: 2.0.0
 home: https://github.com/weaveworks/kured
 maintainers:
-  - name: plumdog
-    email: plummer574@gmail.com
-  - name: patrickmslatteryvt
-    email: pslattery@mi9retail.com
+  - name: dholbach
+    email: daniel@weave.works
+  - name: ckotzbauer
+    email: christian.kotzbauer@gmail.com
 sources:
   - https://github.com/weaveworks/kured
 icon: https://raw.githubusercontent.com/weaveworks/kured/master/img/logo.png

From b78ba8e73b3d5e0a4ee9e4c0b733ad6e980acfd2 Mon Sep 17 00:00:00 2001
From: Christian Kotzbauer <christian.kotzbauer@gmail.com>
Date: Mon, 22 Jun 2020 16:21:30 +0200
Subject: [PATCH 12/12] allow multiple blockingPodSelector and rebootDays to be
 defined

Signed-off-by: Christian Kotzbauer <christian.kotzbauer@gmail.com>
---
 charts/kured/README.md                | 4 ++--
 charts/kured/templates/daemonset.yaml | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/charts/kured/README.md b/charts/kured/README.md
index 8ebc997..ae7ee88 100644
--- a/charts/kured/README.md
+++ b/charts/kured/README.md
@@ -44,12 +44,12 @@ The following changes have been made compared to the stable chart:
 | `extraArgs`             | Extra arguments to pass to `/usr/bin/kured`. See below.                     | `{}`                       |
 | `configuration.annotationTtl` | cli-parameter `--annotation-ttl`                                      | `0`                       |
 | `configuration.alertFilterRegexp` | cli-parameter `--alert-filter-regexp`                             | `""`                       |
-| `configuration.blockingPodSelector` | cli-parameter `--blocking-pod-selector` **Note**: Escape like "foo\\,bar" | `[]`             |
+| `configuration.blockingPodSelector` | Array of selectors for multiple cli-parameters `--blocking-pod-selector` | `[]`             |
 | `configuration.endTime` | cli-parameter `--end-time`                                                  | `""`                      |
 | `configuration.lockAnnotation` | cli-parameter `--lock-annotation`                                    | `""`                      |
 | `configuration.period` | cli-parameter `--period`                                                     | `""`                      |
 | `configuration.prometheusUrl` | cli-parameter `--prometheus-url`                                      | `""`                      |
-| `configuration.rebootDays` | cli-parameter `--reboot-days` **Note**: Escape like "mo\\,tu"             | `[]`                      |
+| `configuration.rebootDays` | Array of days for multiple cli-parameters `--reboot-days`                | `[]`                      |
 | `configuration.rebootSentinel` | cli-parameter `--reboot-sentinel`                                    | `""`                      |
 | `configuration.slackChannel` | cli-parameter `--slack-channel`                                        | `""`                      |
 | `configuration.slackHookUrl` | cli-parameter `--slack-hook-url`                                       | `""`                      |
diff --git a/charts/kured/templates/daemonset.yaml b/charts/kured/templates/daemonset.yaml
index 0c308d3..feb2d72 100644
--- a/charts/kured/templates/daemonset.yaml
+++ b/charts/kured/templates/daemonset.yaml
@@ -51,8 +51,8 @@ spec:
           {{- if .Values.configuration.alertFilterRegexp }}
             - --alert-filter-regexp={{ .Values.configuration.alertFilterRegexp | quote }}
           {{- end }}
-          {{- if .Values.configuration.blockingPodSelector }}
-            - --blocking-pod-selector={{ .Values.configuration.blockingPodSelector | quote }}
+          {{- range .Values.configuration.blockingPodSelector }}
+            - --blocking-pod-selector={{ . | quote }}
           {{- end }}
           {{- if .Values.configuration.endTime }}
             - --end-time={{ .Values.configuration.endTime | quote }}
@@ -66,8 +66,8 @@ spec:
           {{- if .Values.configuration.prometheusUrl }}
             - --prometheus-url={{ .Values.configuration.prometheusUrl | quote }}
           {{- end }}
-          {{- if .Values.configuration.rebootDays }}
-            - --reboot-days={{ .Values.configuration.rebootDays | quote }}
+          {{- range .Values.configuration.rebootDays }}
+            - --reboot-days={{ . | quote }}
           {{- end }}
           {{- if .Values.configuration.rebootSentinel }}
             - --reboot-sentinel={{ .Values.configuration.rebootSentinel | quote }}