108 lines
3.1 KiB
YAML
108 lines
3.1 KiB
YAML
---
|
|
apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: &app system-upgrade-controller
|
|
spec:
|
|
interval: 30m
|
|
chart:
|
|
spec:
|
|
chart: app-template
|
|
version: 2.5.0
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: bjw-s
|
|
namespace: flux-system
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
cleanupOnFail: true
|
|
remediation:
|
|
retries: 3
|
|
uninstall:
|
|
keepHistory: false
|
|
values:
|
|
controllers:
|
|
main:
|
|
strategy: RollingUpdate
|
|
containers:
|
|
main:
|
|
image:
|
|
repository: docker.io/rancher/system-upgrade-controller
|
|
tag: v0.13.2
|
|
env:
|
|
SYSTEM_UPGRADE_CONTROLLER_DEBUG: false
|
|
SYSTEM_UPGRADE_CONTROLLER_THREADS: 2
|
|
SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: 900
|
|
SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: 99
|
|
SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: IfNotPresent
|
|
SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: docker.io/rancher/kubectl:v1.29.0
|
|
SYSTEM_UPGRADE_JOB_PRIVILEGED: true
|
|
SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: 900
|
|
SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: 15m
|
|
SYSTEM_UPGRADE_CONTROLLER_NAME: *app
|
|
SYSTEM_UPGRADE_CONTROLLER_NAMESPACE:
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities: { drop: ["ALL"] }
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
pod:
|
|
securityContext:
|
|
runAsUser: 65534
|
|
runAsGroup: 65534
|
|
runAsNonRoot: true
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
tolerations:
|
|
- key: CriticalAddonsOnly
|
|
operator: Exists
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
- key: node-role.kubernetes.io/master
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
serviceAccount:
|
|
create: true
|
|
name: system-upgrade
|
|
service:
|
|
main:
|
|
enabled: false
|
|
persistence:
|
|
tmp:
|
|
type: emptyDir
|
|
globalMounts:
|
|
- path: /tmp
|
|
etc-ssl:
|
|
type: hostPath
|
|
hostPath: /etc/ssl
|
|
hostPathType: DirectoryOrCreate
|
|
globalMounts:
|
|
- path: /etc/ssl
|
|
readOnly: true
|
|
etc-pki:
|
|
type: hostPath
|
|
hostPath: /etc/pki
|
|
hostPathType: DirectoryOrCreate
|
|
globalMounts:
|
|
- path: /etc/pki
|
|
readOnly: true
|
|
etc-ca-certificates:
|
|
type: hostPath
|
|
hostPath: /etc/ca-certificates
|
|
hostPathType: DirectoryOrCreate
|
|
globalMounts:
|
|
- path: /etc/ca-certificates
|
|
readOnly: true
|