This repository has been archived by the owner on Nov 25, 2021. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 10
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Create kured-1.2.0-custom-dockerhub.yml * Update create-aks-cluster.sh
- Loading branch information
Mathieu Benoit
authored
Nov 7, 2019
1 parent
d3ba3a2
commit 1b07d3a
Showing
2 changed files
with
120 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,119 @@ | ||
--- | ||
apiVersion: rbac.authorization.k8s.io/v1 | ||
kind: ClusterRole | ||
metadata: | ||
name: kured | ||
rules: | ||
# Allow kured to read spec.unschedulable | ||
# Allow kubectl to drain/uncordon | ||
# | ||
# NB: These permissions are tightly coupled to the bundled version of kubectl; the ones below | ||
# match https://github.com/kubernetes/kubernetes/blob/v1.12.1/pkg/kubectl/cmd/drain.go | ||
# | ||
- apiGroups: [""] | ||
resources: ["nodes"] | ||
verbs: ["get", "patch"] | ||
- apiGroups: [""] | ||
resources: ["pods"] | ||
verbs: ["list","delete","get"] | ||
- apiGroups: ["extensions"] | ||
resources: ["daemonsets"] | ||
verbs: ["get"] | ||
- apiGroups: [""] | ||
resources: ["pods/eviction"] | ||
verbs: ["create"] | ||
--- | ||
apiVersion: rbac.authorization.k8s.io/v1 | ||
kind: ClusterRoleBinding | ||
metadata: | ||
name: kured | ||
roleRef: | ||
apiGroup: rbac.authorization.k8s.io | ||
kind: ClusterRole | ||
name: kured | ||
subjects: | ||
- kind: ServiceAccount | ||
name: kured | ||
namespace: kube-system | ||
--- | ||
apiVersion: rbac.authorization.k8s.io/v1 | ||
kind: Role | ||
metadata: | ||
namespace: kube-system | ||
name: kured | ||
rules: | ||
# Allow kured to lock/unlock itself | ||
- apiGroups: ["extensions"] | ||
resources: ["daemonsets"] | ||
resourceNames: ["kured"] | ||
verbs: ["update"] | ||
--- | ||
apiVersion: rbac.authorization.k8s.io/v1 | ||
kind: RoleBinding | ||
metadata: | ||
namespace: kube-system | ||
name: kured | ||
subjects: | ||
- kind: ServiceAccount | ||
namespace: kube-system | ||
name: kured | ||
roleRef: | ||
apiGroup: rbac.authorization.k8s.io | ||
kind: Role | ||
name: kured | ||
--- | ||
apiVersion: v1 | ||
kind: ServiceAccount | ||
metadata: | ||
name: kured | ||
namespace: kube-system | ||
--- | ||
apiVersion: apps/v1 | ||
kind: DaemonSet | ||
metadata: | ||
name: kured # Must match `--ds-name` | ||
namespace: kube-system # Must match `--ds-namespace` | ||
spec: | ||
selector: | ||
matchLabels: | ||
name: kured | ||
updateStrategy: | ||
type: RollingUpdate | ||
template: | ||
metadata: | ||
labels: | ||
name: kured | ||
spec: | ||
serviceAccountName: kured | ||
tolerations: | ||
- key: node-role.kubernetes.io/master | ||
effect: NoSchedule | ||
hostPID: true # Facilitate entering the host mount namespace via init | ||
restartPolicy: Always | ||
containers: | ||
- name: kured | ||
image: docker.io/weaveworks/kured:1.2.0 | ||
imagePullPolicy: IfNotPresent | ||
securityContext: | ||
privileged: true # Give permission to nsenter /proc/1/ns/mnt | ||
env: | ||
# Pass in the name of the node on which this pod is scheduled | ||
# for use with drain/uncordon operations and lock acquisition | ||
- name: KURED_NODE_ID | ||
valueFrom: | ||
fieldRef: | ||
fieldPath: spec.nodeName | ||
command: | ||
- /usr/bin/kured | ||
# - --alert-filter-regexp=^RebootRequired$ | ||
# - --blocking-pod-selector=runtime=long,cost=expensive | ||
# - --blocking-pod-selector=name=temperamental | ||
# - --blocking-pod-selector=... | ||
# - --ds-name=kured | ||
# - --ds-namespace=kube-system | ||
# - --lock-annotation=weave.works/kured-node-lock | ||
# - --period=1h | ||
# - --prometheus-url=http://prometheus.monitoring.svc.cluster.local | ||
# - --reboot-sentinel=/var/run/reboot-required | ||
# - --slack-hook-url=https://hooks.slack.com/... | ||
# - --slack-username=prod |