diff --git a/.drone.yml b/.drone.yml index 14ab0377..25990754 100644 --- a/.drone.yml +++ b/.drone.yml @@ -243,3 +243,15 @@ steps: when: instance: - drone-publish.rancher.io +--- +kind: pipeline +name: helm + +steps: +- name: publish + image: otwld/drone-chart-releaser-github-pages + settings: + cr_token: + from_secret: github_token + skip_existing: true + charts_dir: 'charts' # Specify the charts directory \ No newline at end of file diff --git a/charts/system-upgrade-contoller/.helmignore b/charts/system-upgrade-contoller/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/charts/system-upgrade-contoller/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/system-upgrade-contoller/Chart.yaml b/charts/system-upgrade-contoller/Chart.yaml new file mode 100644 index 00000000..6571aa06 --- /dev/null +++ b/charts/system-upgrade-contoller/Chart.yaml @@ -0,0 +1,24 @@ +apiVersion: v2 +name: system-upgrade-contoller +description: This project aims to provide a general-purpose, Kubernetes-native upgrade controller (for nodes). + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "0.13.0" diff --git a/charts/system-upgrade-contoller/crds/crd.yaml b/charts/system-upgrade-contoller/crds/crd.yaml new file mode 100644 index 00000000..dbb26997 --- /dev/null +++ b/charts/system-upgrade-contoller/crds/crd.yaml @@ -0,0 +1,461 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: plans.upgrade.cattle.io +spec: + group: upgrade.cattle.io + names: + categories: + - upgrade + kind: Plan + plural: plans + singular: plan + preserveUnknownFields: false + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.upgrade.image + name: Image + type: string + - jsonPath: .spec.channel + name: Channel + type: string + - jsonPath: .spec.version + name: Version + type: string + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + properties: + channel: + nullable: true + type: string + concurrency: + type: integer + cordon: + type: boolean + drain: + nullable: true + properties: + deleteEmptydirData: + nullable: true + type: boolean + deleteLocalData: + nullable: true + type: boolean + disableEviction: + type: boolean + force: + type: boolean + gracePeriod: + nullable: true + type: integer + ignoreDaemonSets: + nullable: true + type: boolean + podSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + skipWaitForDeleteTimeout: + type: integer + timeout: + nullable: true + type: integer + type: object + nodeSelector: + nullable: true + properties: + matchExpressions: + items: + properties: + key: + nullable: true + type: string + operator: + nullable: true + type: string + values: + items: + nullable: true + type: string + nullable: true + type: array + type: object + nullable: true + type: array + matchLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + type: object + prepare: + nullable: true + properties: + args: + items: + nullable: true + type: string + nullable: true + type: array + command: + items: + nullable: true + type: string + nullable: true + type: array + envFrom: + items: + properties: + configMapRef: + nullable: true + properties: + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + prefix: + nullable: true + type: string + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + type: object + nullable: true + type: array + envs: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + valueFrom: + nullable: true + properties: + configMapKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + fieldRef: + nullable: true + properties: + apiVersion: + nullable: true + type: string + fieldPath: + nullable: true + type: string + type: object + resourceFieldRef: + nullable: true + properties: + containerName: + nullable: true + type: string + divisor: + nullable: true + type: string + resource: + nullable: true + type: string + type: object + secretKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + type: object + type: object + nullable: true + type: array + image: + nullable: true + type: string + volumes: + items: + properties: + destination: + nullable: true + type: string + name: + nullable: true + type: string + source: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + secrets: + items: + properties: + name: + nullable: true + type: string + path: + nullable: true + type: string + type: object + nullable: true + type: array + serviceAccountName: + nullable: true + type: string + tolerations: + items: + properties: + effect: + nullable: true + type: string + key: + nullable: true + type: string + operator: + nullable: true + type: string + tolerationSeconds: + nullable: true + type: integer + value: + nullable: true + type: string + type: object + nullable: true + type: array + upgrade: + nullable: true + properties: + args: + items: + nullable: true + type: string + nullable: true + type: array + command: + items: + nullable: true + type: string + nullable: true + type: array + envFrom: + items: + properties: + configMapRef: + nullable: true + properties: + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + prefix: + nullable: true + type: string + secretRef: + nullable: true + properties: + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + type: object + nullable: true + type: array + envs: + items: + properties: + name: + nullable: true + type: string + value: + nullable: true + type: string + valueFrom: + nullable: true + properties: + configMapKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + fieldRef: + nullable: true + properties: + apiVersion: + nullable: true + type: string + fieldPath: + nullable: true + type: string + type: object + resourceFieldRef: + nullable: true + properties: + containerName: + nullable: true + type: string + divisor: + nullable: true + type: string + resource: + nullable: true + type: string + type: object + secretKeyRef: + nullable: true + properties: + key: + nullable: true + type: string + name: + nullable: true + type: string + optional: + nullable: true + type: boolean + type: object + type: object + type: object + nullable: true + type: array + image: + nullable: true + type: string + volumes: + items: + properties: + destination: + nullable: true + type: string + name: + nullable: true + type: string + source: + nullable: true + type: string + type: object + nullable: true + type: array + type: object + version: + nullable: true + type: string + required: + - upgrade + type: object + status: + properties: + applying: + items: + nullable: true + type: string + nullable: true + type: array + conditions: + items: + properties: + lastTransitionTime: + nullable: true + type: string + lastUpdateTime: + nullable: true + type: string + message: + nullable: true + type: string + reason: + nullable: true + type: string + status: + nullable: true + type: string + type: + nullable: true + type: string + type: object + nullable: true + type: array + latestHash: + nullable: true + type: string + latestVersion: + nullable: true + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/system-upgrade-contoller/templates/NOTES.txt b/charts/system-upgrade-contoller/templates/NOTES.txt new file mode 100644 index 00000000..da0c83f2 --- /dev/null +++ b/charts/system-upgrade-contoller/templates/NOTES.txt @@ -0,0 +1,4 @@ + +This project aims to provide a general-purpose, Kubernetes-native upgrade controller (for nodes). +It introduces a new CRD, the Plan, for defining any and all of your upgrade policies/requirements. +A Plan is an outstanding intent to mutate nodes in your cluster. \ No newline at end of file diff --git a/charts/system-upgrade-contoller/templates/_helpers.tpl b/charts/system-upgrade-contoller/templates/_helpers.tpl new file mode 100644 index 00000000..4ba9e87a --- /dev/null +++ b/charts/system-upgrade-contoller/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "system-upgrade-contoller.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "system-upgrade-contoller.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "system-upgrade-contoller.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "system-upgrade-contoller.labels" -}} +helm.sh/chart: {{ include "system-upgrade-contoller.chart" . }} +{{ include "system-upgrade-contoller.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "system-upgrade-contoller.selectorLabels" -}} +app.kubernetes.io/name: {{ include "system-upgrade-contoller.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "system-upgrade-contoller.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "system-upgrade-contoller.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/charts/system-upgrade-contoller/templates/clusterrole.yaml b/charts/system-upgrade-contoller/templates/clusterrole.yaml new file mode 100644 index 00000000..471aa079 --- /dev/null +++ b/charts/system-upgrade-contoller/templates/clusterrole.yaml @@ -0,0 +1,119 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: system-upgrade-controller +rules: +- apiGroups: + - batch + resources: + - jobs + verbs: + - get + - list + - watch +- apiGroups: + - "apiextensions.k8s.io" + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch + - create + - patch + - update +- apiGroups: + - "" + resources: + - namespaces + - nodes + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - nodes + verbs: + - update +- apiGroups: + - upgrade.cattle.io + resources: + - plans + - plans/status + verbs: + - get + - list + - watch + - create + - patch + - update + - delete +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: system-upgrade-controller +rules: +- apiGroups: + - batch + resources: + - jobs + verbs: + - create + - delete + - deletecollection + - patch + - update + - get + - list + - watch +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch +--- +# Borrowed from https://stackoverflow.com/a/63553032 +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: system-upgrade-controller-drainer +rules: + # Needed to evict pods + - apiGroups: + - "" + resources: + - "pods/eviction" + verbs: + - "create" + # Needed to list pods by Node + - apiGroups: + - "" + resources: + - "pods" + verbs: + - "get" + - "list" + # Needed to cordon Nodes + - apiGroups: + - "" + resources: + - "nodes" + verbs: + - "get" + - "patch" + # Needed to determine Pod owners + - apiGroups: + - "apps" + resources: + - "statefulsets" + - "daemonsets" + - "replicasets" + verbs: + - "get" + - "list" diff --git a/charts/system-upgrade-contoller/templates/clusterrolebinding.yaml b/charts/system-upgrade-contoller/templates/clusterrolebinding.yaml new file mode 100644 index 00000000..8a74335e --- /dev/null +++ b/charts/system-upgrade-contoller/templates/clusterrolebinding.yaml @@ -0,0 +1,36 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: system-upgrade-drainer +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system-upgrade-controller-drainer +subjects: +- kind: ServiceAccount + name: system-upgrade +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: system-upgrade +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system-upgrade-controller +subjects: +- kind: ServiceAccount + name: system-upgrade +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: system-upgrade +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: system-upgrade-controller +subjects: +- kind: ServiceAccount + name: system-upgrade diff --git a/charts/system-upgrade-contoller/templates/cm.yaml b/charts/system-upgrade-contoller/templates/cm.yaml new file mode 100644 index 00000000..b4375afd --- /dev/null +++ b/charts/system-upgrade-contoller/templates/cm.yaml @@ -0,0 +1,16 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: default-controller-env + namespace: {{.Values.targetns }} +data: + SYSTEM_UPGRADE_CONTROLLER_DEBUG: "false" + SYSTEM_UPGRADE_CONTROLLER_THREADS: "2" + SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: "900" + SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: "99" + SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: "Always" + SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: "rancher/kubectl:v1.25.4" + SYSTEM_UPGRADE_JOB_PRIVILEGED: "true" + SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: "900" + SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: "15m" \ No newline at end of file diff --git a/charts/system-upgrade-contoller/templates/deployment.yaml b/charts/system-upgrade-contoller/templates/deployment.yaml new file mode 100644 index 00000000..8a17c2ca --- /dev/null +++ b/charts/system-upgrade-contoller/templates/deployment.yaml @@ -0,0 +1,91 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: system-upgrade-controller + namespace: {{.Values.targetns }} +spec: + selector: + matchLabels: + upgrade.cattle.io/controller: system-upgrade-controller + template: + metadata: + labels: + upgrade.cattle.io/controller: system-upgrade-controller # necessary to avoid drain + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: "node-role.kubernetes.io/control-plane" + operator: "Exists" + serviceAccountName: system-upgrade + tolerations: + - key: "CriticalAddonsOnly" + operator: "Exists" + - key: "node-role.kubernetes.io/master" + operator: "Exists" + effect: "NoSchedule" + - key: "node-role.kubernetes.io/controlplane" + operator: "Exists" + effect: "NoSchedule" + - key: "node-role.kubernetes.io/control-plane" + operator: "Exists" + effect: "NoSchedule" + - key: "node-role.kubernetes.io/etcd" + operator: "Exists" + effect: "NoExecute" + containers: + - name: system-upgrade-controller + image: {{ .Values.controller.image}}:{{ .Values.controller.version}} + imagePullPolicy: IfNotPresent + securityContext: + runAsNonRoot: true + runAsUser: 65534 + runAsGroup: 65534 + allowPrivilegeEscalation: false + seccompProfile: + type: RuntimeDefault + capabilities: + drop: + - ALL + envFrom: + - configMapRef: + name: default-controller-env + env: + - name: SYSTEM_UPGRADE_CONTROLLER_NAME + valueFrom: + fieldRef: + fieldPath: metadata.labels['upgrade.cattle.io/controller'] + - name: SYSTEM_UPGRADE_CONTROLLER_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + volumeMounts: + - name: etc-ssl + mountPath: /etc/ssl + readOnly: true + - name: etc-pki + mountPath: /etc/pki + readOnly: true + - name: etc-ca-certificates + mountPath: /etc/ca-certificates + readOnly: true + - name: tmp + mountPath: /tmp + volumes: + - name: etc-ssl + hostPath: + path: /etc/ssl + type: DirectoryOrCreate + - name: etc-pki + hostPath: + path: /etc/pki + type: DirectoryOrCreate + - name: etc-ca-certificates + hostPath: + path: /etc/ca-certificates + type: DirectoryOrCreate + - name: tmp + emptyDir: {} diff --git a/charts/system-upgrade-contoller/templates/ns.yaml b/charts/system-upgrade-contoller/templates/ns.yaml new file mode 100644 index 00000000..970f355d --- /dev/null +++ b/charts/system-upgrade-contoller/templates/ns.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: {{.Values.targetns }} + labels: + pod-security.kubernetes.io/enforce: privileged \ No newline at end of file diff --git a/charts/system-upgrade-contoller/templates/plan.yaml b/charts/system-upgrade-contoller/templates/plan.yaml new file mode 100644 index 00000000..bbe6cf89 --- /dev/null +++ b/charts/system-upgrade-contoller/templates/plan.yaml @@ -0,0 +1,44 @@ +{{- if .Values.plan.install -}} +# Server plan +apiVersion: upgrade.cattle.io/v1 +kind: Plan +metadata: + name: server-plan + namespace: {{.Values.targetns }} +spec: + concurrency: 1 + cordon: true + nodeSelector: + matchExpressions: + - key: node-role.kubernetes.io/control-plane + operator: In + values: + - "true" + serviceAccountName: system-upgrade + upgrade: + image: {{.Values.plan.image }} + version: {{ .Values.plan.version}} +--- +# Agent plan +apiVersion: upgrade.cattle.io/v1 +kind: Plan +metadata: + name: agent-plan + namespace: {{.Values.targetns }} +spec: + concurrency: 1 + cordon: true + nodeSelector: + matchExpressions: + - key: node-role.kubernetes.io/control-plane + operator: DoesNotExist + prepare: + args: + - prepare + - server-plan + image: rancher/k3s-upgrade + serviceAccountName: system-upgrade + upgrade: + image: {{.Values.plan.image }} + version: {{ .Values.plan.version}} +{{- end -}} \ No newline at end of file diff --git a/charts/system-upgrade-contoller/templates/serviceaccount.yaml b/charts/system-upgrade-contoller/templates/serviceaccount.yaml new file mode 100644 index 00000000..70109917 --- /dev/null +++ b/charts/system-upgrade-contoller/templates/serviceaccount.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: system-upgrade + namespace: {{.Values.targetns }} \ No newline at end of file diff --git a/charts/system-upgrade-contoller/values.yaml b/charts/system-upgrade-contoller/values.yaml new file mode 100644 index 00000000..30d2d68b --- /dev/null +++ b/charts/system-upgrade-contoller/values.yaml @@ -0,0 +1,16 @@ +# Default values for system-upgrade-contoller. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +# Namespace created on installation +targetns: system-upgrade + +controller: + image: rancher/system-upgrade-controller + version: v0.13.4 + +# if install eq true 2 sample plans will installed +plan: + install: false + image: rancher/k3s-upgrade + version: v1.25.4 \ No newline at end of file diff --git a/scripts/package-controller b/scripts/package-controller index 7536cff6..732f66d0 100755 --- a/scripts/package-controller +++ b/scripts/package-controller @@ -5,9 +5,10 @@ source $(dirname $0)/version cd $(dirname $0)/.. -if [ "$ARCH" != "arm" ]; then - export DOCKER_BUILDKIT=1 -fi +# disable buildkit +#if [ "$ARCH" != "arm" ]; then +# export DOCKER_BUILDKIT=1 +#fi docker build \ --build-arg ARCH=${ARCH} \ diff --git a/scripts/package-e2e-tests b/scripts/package-e2e-tests index 6d1f2e09..8a16e28b 100755 --- a/scripts/package-e2e-tests +++ b/scripts/package-e2e-tests @@ -5,9 +5,10 @@ source $(dirname $0)/version cd $(dirname $0)/.. -if [ "$ARCH" != "arm" ]; then - export DOCKER_BUILDKIT=1 -fi +#dissable Buildkit +#if [ "$ARCH" != "arm" ]; then +# export DOCKER_BUILDKIT=1 +#fi docker build \ --build-arg ARCH=${ARCH} \