---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
metadata:
  name: &app system-upgrade-controller
spec:
  interval: 30m
  chart:
    spec:
      chart: app-template
      version: 2.5.0
      sourceRef:
        kind: HelmRepository
        name: bjw-s
        namespace: flux-system
  install:
    remediation:
      retries: 3
  upgrade:
    cleanupOnFail: true
    remediation:
      retries: 3
  uninstall:
    keepHistory: false
  values:
    controllers:
      main:
        strategy: RollingUpdate
        containers:
          main:
            image:
              repository: docker.io/rancher/system-upgrade-controller
              tag: v0.13.2
            env:
              SYSTEM_UPGRADE_CONTROLLER_DEBUG: false
              SYSTEM_UPGRADE_CONTROLLER_THREADS: 2
              SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: 900
              SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: 99
              SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: IfNotPresent
              SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: docker.io/rancher/kubectl:v1.29.0
              SYSTEM_UPGRADE_JOB_PRIVILEGED: true
              SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: 900
              SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: 15m
              SYSTEM_UPGRADE_CONTROLLER_NAME: *app
              SYSTEM_UPGRADE_CONTROLLER_NAMESPACE:
                valueFrom:
                  fieldRef:
                    fieldPath: metadata.namespace
            securityContext:
              allowPrivilegeEscalation: false
              readOnlyRootFilesystem: true
              capabilities: { drop: ["ALL"] }
              seccompProfile:
                type: RuntimeDefault
        pod:
          securityContext:
            runAsUser: 65534
            runAsGroup: 65534
            runAsNonRoot: true
          affinity:
            nodeAffinity:
              requiredDuringSchedulingIgnoredDuringExecution:
                nodeSelectorTerms:
                  - matchExpressions:
                      - key: node-role.kubernetes.io/control-plane
                        operator: Exists
          tolerations:
            - {key: CriticalAddonsOnly, operator: Exists}
            - {key: node-role.kubernetes.io/master, operator: Exists, effect: NoSchedule}
            - {key: node-role.kubernetes.io/controlplane, operator: Exists, effect: NoSchedule}
            - {key: node-role.kubernetes.io/control-plane, operator: Exists, effect: NoSchedule}
            - {key: node-role.kubernetes.io/etcd, operator: Exists, effect: NoExecute}
    serviceAccount:
      create: true
      name: system-upgrade
    service:
      main:
        enabled: false
    persistence:
      tmp:
        type: emptyDir
        globalMounts:
          - path: /tmp
      etc-ssl:
        type: hostPath
        hostPath: /etc/ssl
        hostPathType: DirectoryOrCreate
        globalMounts:
          - path: /etc/ssl
            readOnly: true
      etc-pki:
        type: hostPath
        hostPath: /etc/pki
        hostPathType: DirectoryOrCreate
        globalMounts:
          - path: /etc/pki
            readOnly: true
      etc-ca-certificates:
        type: hostPath
        hostPath: /etc/ca-certificates
        hostPathType: DirectoryOrCreate
        globalMounts:
          - path: /etc/ca-certificates
            readOnly: true