deploy kured

[jgilfoil]

for os updates

[github-actions]

--- kubernetes/flux Kustomization: flux-system/cluster HelmRepository: flux-system/kubereboot

+++ kubernetes/flux Kustomization: flux-system/cluster HelmRepository: flux-system/kubereboot

@@ -0,0 +1,13 @@

+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: kubereboot
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://kubereboot.github.io/charts
+
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/kured

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/kured

@@ -0,0 +1,40 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: kured
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: kured
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  interval: 30m
+  path: ./kubernetes/apps/kube-system/kured/app
+  postBuild:
+    substituteFrom:
+    - kind: ConfigMap
+      name: cluster-settings
+    - kind: Secret
+      name: cluster-secrets
+    - kind: ConfigMap
+      name: cluster-settings-user
+      optional: true
+    - kind: Secret
+      name: cluster-secrets-user
+      optional: true
+  prune: true
+  retryInterval: 5m30s
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  targetNamespace: kube-system
+  timeout: 5m
+  wait: false
+
--- kubernetes/apps/kube-system/kured/app Kustomization: flux-system/kured HelmRelease: kube-system/kured

+++ kubernetes/apps/kube-system/kured/app Kustomization: flux-system/kured HelmRelease: kube-system/kured

@@ -0,0 +1,61 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: kured
+    kustomize.toolkit.fluxcd.io/name: kured
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: kured
+  namespace: kube-system
+spec:
+  chart:
+    spec:
+      chart: kured
+      interval: 10m
+      sourceRef:
+        kind: HelmRepository
+        name: kubereboot
+        namespace: flux-system
+      version: 5.3.2
+  install:
+    crds: CreateReplace
+    createNamespace: true
+    remediation:
+      retries: 3
+    replace: true
+    timeout: 10m
+  interval: 5m
+  maxHistory: 3
+  rollback:
+    cleanupOnFail: true
+    force: true
+    recreate: true
+  test:
+    enable: true
+  uninstall:
+    keepHistory: false
+  upgrade:
+    cleanupOnFail: true
+    crds: CreateReplace
+    remediation:
+      remediateLastFailure: true
+      retries: 3
+      strategy: rollback
+  values:
+    endTime: '10:00'
+    extraEnvVars:
+    - name: notifyUrl
+      valueFrom:
+        secretKeyRef:
+          key: secret_key
+          name: kured-discord-webhook
+    messageTemplateDrain: "\u23F3 Draining node %s"
+    messageTemplateReboot: "\u267B\uFE0F Rebooted node %s"
+    metrics:
+      create: true
+    service:
+      create: true
+    startTime: '4:00'
+    timeZone: America/Denver
+

[github-actions]

--- HelmRelease: kube-system/kured ServiceAccount: kube-system/kured

+++ HelmRelease: kube-system/kured ServiceAccount: kube-system/kured

@@ -0,0 +1,11 @@

+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kured
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/name: kured
+    app.kubernetes.io/instance: kured
+    app.kubernetes.io/managed-by: Helm
+
--- HelmRelease: kube-system/kured ClusterRole: kube-system/kured

+++ HelmRelease: kube-system/kured ClusterRole: kube-system/kured

@@ -0,0 +1,44 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kured
+  labels:
+    app.kubernetes.io/name: kured
+    app.kubernetes.io/instance: kured
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - nodes
+  verbs:
+  - get
+  - patch
+- apiGroups:
+  - ''
+  resources:
+  - pods
+  verbs:
+  - list
+  - delete
+  - get
+- apiGroups:
+  - extensions
+  resources:
+  - daemonsets
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - daemonsets
+  verbs:
+  - get
+- apiGroups:
+  - ''
+  resources:
+  - pods/eviction
+  verbs:
+  - create
+
--- HelmRelease: kube-system/kured ClusterRoleBinding: kube-system/kured

+++ HelmRelease: kube-system/kured ClusterRoleBinding: kube-system/kured

@@ -0,0 +1,18 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kured
+  labels:
+    app.kubernetes.io/name: kured
+    app.kubernetes.io/instance: kured
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kured
+subjects:
+- kind: ServiceAccount
+  name: kured
+  namespace: kube-system
+
--- HelmRelease: kube-system/kured Role: kube-system/kured

+++ HelmRelease: kube-system/kured Role: kube-system/kured

@@ -0,0 +1,30 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: kube-system
+  name: kured
+  labels:
+    app.kubernetes.io/name: kured
+    app.kubernetes.io/instance: kured
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups:
+  - extensions
+  resources:
+  - daemonsets
+  resourceNames:
+  - kured
+  verbs:
+  - update
+  - patch
+- apiGroups:
+  - apps
+  resources:
+  - daemonsets
+  resourceNames:
+  - kured
+  verbs:
+  - update
+  - patch
+
--- HelmRelease: kube-system/kured RoleBinding: kube-system/kured

+++ HelmRelease: kube-system/kured RoleBinding: kube-system/kured

@@ -0,0 +1,19 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  namespace: kube-system
+  name: kured
+  labels:
+    app.kubernetes.io/name: kured
+    app.kubernetes.io/instance: kured
+    app.kubernetes.io/managed-by: Helm
+subjects:
+- kind: ServiceAccount
+  namespace: kube-system
+  name: kured
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kured
+
--- HelmRelease: kube-system/kured Service: kube-system/kured

+++ HelmRelease: kube-system/kured Service: kube-system/kured

@@ -0,0 +1,19 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: kured
+  labels:
+    app.kubernetes.io/name: kured
+    app.kubernetes.io/instance: kured
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  ports:
+  - name: metrics
+    port: 8080
+    targetPort: 8080
+  selector:
+    app.kubernetes.io/name: kured
+    app.kubernetes.io/instance: kured
+
--- HelmRelease: kube-system/kured DaemonSet: kube-system/kured

+++ HelmRelease: kube-system/kured DaemonSet: kube-system/kured

@@ -0,0 +1,89 @@

+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: kured
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/name: kured
+    app.kubernetes.io/instance: kured
+    app.kubernetes.io/managed-by: Helm
+spec:
+  revisionHistoryLimit: 10
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kured
+      app.kubernetes.io/instance: kured
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: kured
+        app.kubernetes.io/instance: kured
+        app.kubernetes.io/managed-by: Helm
+    spec:
+      serviceAccountName: kured
+      hostNetwork: false
+      hostPID: true
+      restartPolicy: Always
+      containers:
+      - name: kured
+        image: ghcr.io/kubereboot/kured:1.14.2
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          privileged: true
+          readOnlyRootFilesystem: true
+        resources: {}
+        command:
+        - /usr/bin/kured
+        args:
+        - --ds-name=kured
+        - --ds-namespace=kube-system
+        - --metrics-port=8080
+        - --reboot-command=/bin/systemctl reboot
+        - --log-format=text
+        - --concurrency=1
+        ports:
+        - containerPort: 8080
+          name: metrics
+        env:
+        - name: KURED_NODE_ID
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: notifyUrl
+          valueFrom:
+            secretKeyRef:
+              key: secret_key
+              name: kured-discord-webhook
+        livenessProbe:
+          failureThreshold: 5
+          httpGet:
+            path: /metrics
+            port: metrics
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 30
+          successThreshold: 1
+          timeoutSeconds: 5
+        readinessProbe:
+          failureThreshold: 5
+          httpGet:
+            path: /metrics
+            port: metrics
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 30
+          successThreshold: 1
+          timeoutSeconds: 5
+      tolerations:
+      - key: node-role.kubernetes.io/control-plane
+        effect: NoSchedule
+      - key: node-role.kubernetes.io/master
+        effect: NoSchedule
+      nodeSelector:
+        kubernetes.io/os: linux
+
--- HelmRelease: kube-system/kured ServiceMonitor: kube-system/kured

+++ HelmRelease: kube-system/kured ServiceMonitor: kube-system/kured

@@ -0,0 +1,25 @@

+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: kured
+  labels:
+    app.kubernetes.io/name: kured
+    app.kubernetes.io/instance: kured
+    app.kubernetes.io/managed-by: Helm
+spec:
+  endpoints:
+  - interval: 60s
+    honorLabels: true
+    port: metrics
+    path: /metrics
+    scheme: http
+  jobLabel: kured
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kured
+      app.kubernetes.io/instance: kured
+  namespaceSelector:
+    matchNames:
+    - kube-system
+