home-ops/kubernetes/apps/tools/system-upgrade-controller/values.yaml at f01fbf122e776273215192b68d20a77dd67113b4 · deedee-ops/home-ops · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
---
# yaml-language-server: $schema=https://deedee-ops.github.io/schemas/custom/bjw-s-apptemplate.json
app-template:
  defaultPodOptions:
    securityContext:
      fsGroup: 65000
      runAsUser: 65000
      runAsGroup: 65000
      runAsNonRoot: true
      seccompProfile:
        type: RuntimeDefault
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
            - matchExpressions:
                - key: node-role.kubernetes.io/control-plane
                  operator: Exists
    tolerations:
      - key: CriticalAddonsOnly
        operator: Exists
      - key: node-role.kubernetes.io/master
        operator: Exists
        effect: NoSchedule
      - key: node-role.kubernetes.io/controlplane
        operator: Exists
        effect: NoSchedule
      - key: node-role.kubernetes.io/control-plane
        operator: Exists
        effect: NoSchedule
      - key: node-role.kubernetes.io/etcd
        operator: Exists
        effect: NoSchedule

  controllers:
    system-upgrade-controller:
      strategy: RollingUpdate
      annotations:
        reloader.stakater.com/auto: "true"
      containers:
        app:
          image:
            repository: ghcr.io/deedee-ops/system-upgrade-controller
            tag: v0.13.4
          env:
            SYSTEM_UPGRADE_CONTROLLER_DEBUG: false
            SYSTEM_UPGRADE_CONTROLLER_THREADS: 2
            SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: 900
            SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: 99
            SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: IfNotPresent
            SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: public.ecr.aws/bitnami/kubectl:1.31.0
            SYSTEM_UPGRADE_JOB_PRIVILEGED: true
            SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: 900
            SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: 15m
            SYSTEM_UPGRADE_CONTROLLER_NAME: system-upgrade-controller
            SYSTEM_UPGRADE_CONTROLLER_NAMESPACE: tools

          securityContext:
            runAsNonRoot: true
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL

  serviceAccount:
    name: system-upgrade
    create: false

  persistence:
    etc-ssl:
      type: hostPath
      hostPath: /etc/ssl
      hostPathType: DirectoryOrCreate
      globalMounts:
        - path: /etc/ssl
          readOnly: true
    etc-pki:
      type: hostPath
      hostPath: /etc/pki
      hostPathType: DirectoryOrCreate
      globalMounts:
        - path: /etc/pki
          readOnly: true
    etc-ca-certificates:
      type: hostPath
      hostPath: /etc/ca-certificates
      hostPathType: DirectoryOrCreate
      globalMounts:
        - path: /etc/ca-certificates
          readOnly: true
    tmp:
      type: emptyDir
      globalMounts:
        - path: /tmp