feat: move tehSUC into kube-system

Signed-off-by: Devin Buhl <devin@buhl.casa>

bootstrap/templates/addons/system-upgrade-controller/app/helmrelease.yaml.j2

@@ -65,13 +65,12 @@ spec:
                       - key: node-role.kubernetes.io/control-plane
                         operator: Exists
           tolerations:
-            - { key: CriticalAddonsOnly, operator: Exists }
-            - { key: node-role.kubernetes.io/master, operator: Exists, effect: NoSchedule }
-            - { key: node-role.kubernetes.io/controlplane, operator: Exists, effect: NoSchedule }
-            - { key: node-role.kubernetes.io/control-plane, operator: Exists, effect: NoSchedule }
-            - { key: node-role.kubernetes.io/etcd, operator: Exists, effect: NoExecute }
+            - {key: CriticalAddonsOnly, operator: Exists}
+            - {key: node-role.kubernetes.io/master, operator: Exists, effect: NoSchedule}
+            - {key: node-role.kubernetes.io/controlplane, operator: Exists, effect: NoSchedule}
+            - {key: node-role.kubernetes.io/control-plane, operator: Exists, effect: NoSchedule}
+            - {key: node-role.kubernetes.io/etcd, operator: Exists, effect: NoExecute}
     serviceAccount:
-      create: true
       name: system-upgrade
     service:
       main:

bootstrap/templates/addons/system-upgrade-controller/app/rbac.yaml.j2

@@ -3,11 +3,6 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: system-upgrade
-  labels:
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    meta.helm.sh/release-name: system-upgrade-controller
-    meta.helm.sh/release-namespace: system-upgrade
 secrets:
   - name: system-upgrade
 ---
@@ -16,22 +11,13 @@ kind: Secret
 type: kubernetes.io/service-account-token
 metadata:
   name: system-upgrade
-  labels:
-    app.kubernetes.io/managed-by: Helm
   annotations:
-    meta.helm.sh/release-name: system-upgrade-controller
-    meta.helm.sh/release-namespace: system-upgrade
     kubernetes.io/service-account.name: system-upgrade
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name:  system-upgrade
-  labels:
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    meta.helm.sh/release-name: system-upgrade-controller
-    meta.helm.sh/release-namespace: system-upgrade
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -39,4 +25,4 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: system-upgrade
-    namespace: system-upgrade
+    namespace: kube-system

bootstrap/templates/addons/system-upgrade-controller/ks.yaml.j2

@@ -5,11 +5,11 @@ metadata:
   name: &app system-upgrade-controller
   namespace: flux-system
 spec:
-  targetNamespace: system-upgrade
+  targetNamespace: kube-system
   commonMetadata:
     labels:
       app.kubernetes.io/name: *app
-  path: ./kubernetes/apps/system-upgrade/system-upgrade-controller/app
+  path: ./kubernetes/apps/kube-system/system-upgrade-controller/app
   prune: true
   sourceRef:
     kind: GitRepository
@@ -25,13 +25,13 @@ metadata:
   name: &app system-upgrade-controller-plans
   namespace: flux-system
 spec:
-  targetNamespace: system-upgrade
+  targetNamespace: kube-system
   commonMetadata:
     labels:
       app.kubernetes.io/name: *app
   dependsOn:
     - name: system-upgrade-controller
-  path: ./kubernetes/apps/system-upgrade/system-upgrade-controller/plans
+  path: ./kubernetes/apps/kube-system/system-upgrade-controller/plans
   prune: true
   sourceRef:
     kind: GitRepository

bootstrap/templates/addons/system-upgrade-controller/plans/agent.yaml.j2

@@ -5,7 +5,7 @@ metadata:
   name: agent
 spec:
   # renovate: datasource=github-releases depName=k3s-io/k3s
-  version: "v1.28.3+k3s1"
+  version: "v1.28.3+k3s2"
   serviceAccountName: system-upgrade
   concurrency: 1
   nodeSelector:

bootstrap/templates/addons/system-upgrade-controller/plans/kustomization.yaml.j2

@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:

bootstrap/templates/addons/system-upgrade-controller/plans/server.yaml.j2

@@ -5,19 +5,12 @@ metadata:
   name: server
 spec:
   # renovate: datasource=github-releases depName=k3s-io/k3s
-  version: "v1.28.3+k3s1"
+  version: "v1.28.3+k3s2"
   serviceAccountName: system-upgrade
   concurrency: 1
   cordon: true
   nodeSelector:
     matchExpressions:
-      - { key: node-role.kubernetes.io/control-plane, operator: Exists }
-  tolerations:
-    - { effect: NoSchedule, operator: Exists }
-    - { effect: NoExecute, operator: Exists }
-    - { key: node-role.kubernetes.io/control-plane, effect: NoSchedule, operator: Exists }
-    - { key: node-role.kubernetes.io/master, effect: NoSchedule, operator: Exists }
-    - { key: node-role.kubernetes.io/etcd, effect: NoExecute, operator: Exists }
-    - { key: CriticalAddonsOnly, operator: Exists }
+      - {key: node-role.kubernetes.io/control-plane, operator: Exists}
   upgrade:
     image: rancher/k3s-upgrade

bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2

@@ -13,3 +13,6 @@ resources:
   {% if csi_driver_nfs.enabled | default(false) %}
   - ./csi-driver-nfs/ks.yaml
   {% endif %}
+  {% if system_upgrade_controller.enabled | default(false) %}
+  - ./system-upgrade-controller/ks.yaml
+  {% endif %}

bootstrap/templates/kubernetes/apps/system-upgrade/kustomization.yaml.j2

@@ -1,9 +0,0 @@
-#jinja2: trim_blocks: True, lstrip_blocks: True
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./namespace.yaml
-  {% if system_upgrade_controller.enabled | default(false) %}
-  - ./system-upgrade-controller/ks.yaml
-  {% endif %}

bootstrap/templates/kubernetes/apps/system-upgrade/namespace.yaml.j2

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: system-upgrade
-  labels:
-    kustomize.toolkit.fluxcd.io/prune: disabled