02-kured.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: kured-config
  namespace: kube-system
data:
  KURED_SLACK_URL: "https://hooks.slack.com/services/<...>"
  KURED_SLACK_NAME: "kured"
  KURED_SLACK_CHANNEL: "alerting"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kured
rules:
  # Allow kured to read spec.unschedulable
  # Allow kubectl to drain/uncordon
  #
  # NB: These permissions are tightly coupled to the bundled version of kubectl; the ones below
  # match https://github.com/kubernetes/kubernetes/blob/v1.19.4/staging/src/k8s.io/kubectl/pkg/cmd/drain/drain.go
  #
  - apiGroups: [""]
    resources: ["nodes"]
    verbs:     ["get", "patch"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs:     ["list","delete","get"]
  - apiGroups: ["apps"]
    resources: ["daemonsets"]
    verbs:     ["get"]
  - apiGroups: [""]
    resources: ["pods/eviction"]
    verbs:     ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kured
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kured
subjects:
  - kind: ServiceAccount
    name: kured
    namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: kube-system
  name: kured
rules:
  # Allow kured to lock/unlock itself
  - apiGroups:     ["apps"]
    resources:     ["daemonsets"]
    resourceNames: ["kured"]
    verbs:         ["update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: kube-system
  name: kured
subjects:
  - kind: ServiceAccount
    namespace: kube-system
    name: kured
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kured
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kured
  namespace: kube-system
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kured            # Must match `--ds-name`
  namespace: kube-system # Must match `--ds-namespace`
spec:
  selector:
    matchLabels:
      name: kured
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        name: kured
    spec:
      serviceAccountName: kured
      tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule
      hostPID: true # Facilitate entering the host mount namespace via init
      restartPolicy: Always
      containers:
        - name: kured
          image: docker.io/weaveworks/kured:1.6.1
                 # If you find yourself here wondering why there is no
                 # :latest tag on Docker Hub,see the FAQ in the README
          imagePullPolicy: IfNotPresent
          securityContext:
            privileged: true # Give permission to nsenter /proc/1/ns/mnt
          env:
            # Pass in the name of the node on which this pod is scheduled
            # for use with drain/uncordon operations and lock acquisition
            - name: KURED_NODE_ID
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: KURED_SLACK_URL
              valueFrom:
                configMapKeyRef:
                  name: kured-config
                  key: KURED_SLACK_URL
            - name: KURED_SLACK_NAME
              valueFrom:
                configMapKeyRef:
                  name: kured-config
                  key: KURED_SLACK_NAME
            - name: KURED_SLACK_CHANNEL
              valueFrom:
                configMapKeyRef:
                  name: kured-config
                  key: KURED_SLACK_CHANNEL
          command:
            - /usr/bin/kured
          args:
            - "--slack-hook-url=$(KURED_SLACK_URL)"
            - "--slack-username=$(KURED_SLACK_NAME)"
            - "--slack-channel=$(KURED_SLACK_CHANNEL)"

            #            - --alert-filter-regexp=^RebootRequired$
            #            - --blocking-pod-selector=runtime=long,cost=expensive
            #            - --blocking-pod-selector=name=temperamental
            #            - --blocking-pod-selector=...
            #            - --ds-name=kured
            #            - --ds-namespace=kube-system
            #            - --end-time=23:59:59
            #            - --lock-annotation=weave.works/kured-node-lock
            #            - --period=1h
            #            - --prometheus-url=http://prometheus.monitoring.svc.cluster.local
            #            - --reboot-days=sun,mon,tue,wed,thu,fri,sat
            #            - --reboot-sentinel=/var/run/reboot-required
            #            - --message-template-drain=Draining node %s
            #            - --message-template-drain=Rebooting node %s
            #            - --start-time=0:00
            #            - --time-zone=UTC