Skip to content

Commit 37c46f2

Browse files
onedr0ponedr0p
authored
Revert "Revert "feat: deploy SUC (#1770)" (#1772)"
This reverts commit bdb0460.
1 parent bdb0460 commit 37c46f2

File tree

12 files changed

+220
-4
lines changed

12 files changed

+220
-4
lines changed

‎README.md

+14-2
Original file line numberDiff line numberDiff line change
@@ -199,10 +199,22 @@ task talos:apply-node IP=? MODE=?
199199
# e.g. task talos:apply-node IP=10.10.10.10 MODE=auto
200200
```
201201
202-
### ⬆️ Updating Talos and Kubernetes versions
202+
### ⬆️ Upgrading Talos and Kubernetes versions
203203
204+
#### Method 1: System Upgrade Controller (SUC)
205+
206+
> [!IMPORTANT]
207+
> In order to upgrade make sure `TALOS_VERSION` and `KUBERNETES_VERSION` in `kubernetes/apps/kube-system/system-upgrade/ks.yaml` are set to the versions you wish to upgrade to. Once your cluster receives this configuration the upgrade processes will kick off in the `kube-system` namespace. These versions are under the watch of renovate, which means once the pull requests is merged SUC will attempt to upgrade Kubernetes / Talos and reboot.
208+
209+
Talos and Kubernetes upgrades should be handled via the [rancher/system-upgrade-controller](https://github.com/rancher/system-upgrade-controller) which is deployed in the `kube-system` namespace.
210+
211+
#### Method 2: Taskfile
212+
213+
> [!WARNING]
214+
> Upgrading via this method can interfere with the System Upgrade Controller. SUC could potentially downgrade Talos or Kubernetes versions if care is not taken.
215+
---
204216
> [!IMPORTANT]
205-
> Ensure the `talosVersion` and `kubernetesVersion` in `talconfig.yaml` are up-to-date with the version you wish to upgrade to.
217+
> In order to upgrade make sure `talosVersion` and `kubernetesVersion` in `talconfig.yaml` are set to the versions you wish to upgrade to.
206218
207219
```sh
208220
# Upgrade node to a newer Talos version

‎templates/config/kubernetes/apps/default/echo-server/app/helmrelease.yaml.j2

-1
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,6 @@ spec:
6565
runAsNonRoot: true
6666
runAsUser: 65534
6767
runAsGroup: 65534
68-
seccompProfile: { type: RuntimeDefault }
6968
service:
7069
app:
7170
controller: echo-server

‎templates/config/kubernetes/apps/kube-system/kustomization.yaml.j2

+1
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,4 @@ resources:
1111
- ./metrics-server/ks.yaml
1212
- ./reloader/ks.yaml
1313
- ./spegel/ks.yaml
14+
- ./system-upgrade/ks.yaml

‎templates/config/kubernetes/apps/kube-system/system-upgrade/app/helmrelease.yaml.j2

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
3+
apiVersion: helm.toolkit.fluxcd.io/v2
4+
kind: HelmRelease
5+
metadata:
6+
name: &app system-upgrade
7+
spec:
8+
interval: 30m
9+
chart:
10+
spec:
11+
chart: app-template
12+
version: 3.7.1
13+
sourceRef:
14+
kind: HelmRepository
15+
name: bjw-s
16+
namespace: flux-system
17+
install:
18+
remediation:
19+
retries: 3
20+
upgrade:
21+
cleanupOnFail: true
22+
remediation:
23+
strategy: rollback
24+
retries: 3
25+
values:
26+
controllers:
27+
system-upgrade:
28+
strategy: RollingUpdate
29+
containers:
30+
app:
31+
image:
32+
repository: docker.io/rancher/system-upgrade-controller
33+
tag: v0.15.0-rc2@sha256:d6faa9cb5123ae14cfbf0e9e22fa5302e1369649a6f1d117874c30a2a8df732b
34+
env:
35+
SYSTEM_UPGRADE_CONTROLLER_NAME: *app
36+
SYSTEM_UPGRADE_CONTROLLER_NAMESPACE:
37+
valueFrom:
38+
fieldRef:
39+
fieldPath: metadata.namespace
40+
SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: "99"
41+
SYSTEM_UPGRADE_JOB_PRIVILEGED: false
42+
securityContext:
43+
allowPrivilegeEscalation: false
44+
readOnlyRootFilesystem: true
45+
capabilities: { drop: ["ALL"] }
46+
defaultPodOptions:
47+
affinity:
48+
nodeAffinity:
49+
requiredDuringSchedulingIgnoredDuringExecution:
50+
nodeSelectorTerms:
51+
- matchExpressions:
52+
- key: node-role.kubernetes.io/control-plane
53+
operator: Exists
54+
securityContext:
55+
runAsNonRoot: true
56+
runAsUser: 65534
57+
runAsGroup: 65534
58+
tolerations:
59+
- key: node-role.kubernetes.io/control-plane
60+
operator: Exists
61+
effect: NoSchedule
62+
serviceAccount:
63+
name: *app
64+
create: true

‎templates/config/kubernetes/apps/kube-system/system-upgrade/app/kustomization.yaml.j2

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
3+
apiVersion: kustomize.config.k8s.io/v1beta1
4+
kind: Kustomization
5+
resources:
6+
- ./helmrelease.yaml
7+
- ./rbac.yaml

‎templates/config/kubernetes/apps/kube-system/system-upgrade/app/rbac.yaml.j2

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRoleBinding
4+
metadata:
5+
name: system-upgrade
6+
roleRef:
7+
apiGroup: rbac.authorization.k8s.io
8+
kind: ClusterRole
9+
name: cluster-admin
10+
subjects:
11+
- kind: ServiceAccount
12+
name: system-upgrade
13+
namespace: kube-system
14+
---
15+
apiVersion: talos.dev/v1alpha1
16+
kind: ServiceAccount
17+
metadata:
18+
name: system-upgrade
19+
spec:
20+
roles: ["os:admin"]

‎templates/config/kubernetes/apps/kube-system/system-upgrade/ks.yaml.j2

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
3+
apiVersion: kustomize.toolkit.fluxcd.io/v1
4+
kind: Kustomization
5+
metadata:
6+
name: &app system-upgrade
7+
namespace: &namespace kube-system
8+
spec:
9+
commonMetadata:
10+
labels:
11+
app.kubernetes.io/name: *app
12+
interval: 30m
13+
path: ./kubernetes/apps/kube-system/system-upgrade/app
14+
prune: true
15+
sourceRef:
16+
kind: GitRepository
17+
name: flux-system
18+
namespace: flux-system
19+
targetNamespace: *namespace
20+
timeout: 5m
21+
wait: true
22+
---
23+
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
24+
apiVersion: kustomize.toolkit.fluxcd.io/v1
25+
kind: Kustomization
26+
metadata:
27+
name: &app system-upgrade-plans
28+
namespace: &namespace kube-system
29+
spec:
30+
commonMetadata:
31+
labels:
32+
app.kubernetes.io/name: *app
33+
dependsOn:
34+
- name: system-upgrade
35+
namespace: kube-system
36+
interval: 30m
37+
path: ./kubernetes/apps/kube-system/system-upgrade/plans
38+
postBuild:
39+
substitute:
40+
# renovate: datasource=docker depName=ghcr.io/siderolabs/installer
41+
TALOS_VERSION: v1.9.3
42+
# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
43+
KUBERNETES_VERSION: v1.32.2
44+
prune: true
45+
sourceRef:
46+
kind: GitRepository
47+
name: flux-system
48+
namespace: flux-system
49+
targetNamespace: *namespace
50+
timeout: 5m
51+
wait: false

‎templates/config/kubernetes/apps/kube-system/system-upgrade/plans/kubernetes.yaml.j2

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
apiVersion: upgrade.cattle.io/v1
3+
kind: Plan
4+
metadata:
5+
name: kubernetes
6+
spec:
7+
version: ${KUBERNETES_VERSION}
8+
concurrency: 1
9+
postCompleteDelay: 30s
10+
exclusive: true
11+
serviceAccountName: system-upgrade
12+
secrets:
13+
- name: system-upgrade
14+
path: /var/run/secrets/talos.dev
15+
ignoreUpdates: true
16+
nodeSelector:
17+
matchExpressions:
18+
- key: node-role.kubernetes.io/control-plane
19+
operator: Exists
20+
upgrade:
21+
image: ghcr.io/siderolabs/talosctl:${TALOS_VERSION}
22+
args:
23+
- --nodes=$(SYSTEM_UPGRADE_NODE_NAME)
24+
- upgrade-k8s
25+
- --to=$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)

‎templates/config/kubernetes/apps/kube-system/system-upgrade/plans/kustomization.yaml.j2

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
3+
apiVersion: kustomize.config.k8s.io/v1beta1
4+
kind: Kustomization
5+
resources:
6+
- ./kubernetes.yaml
7+
- ./talos.yaml

‎templates/config/kubernetes/apps/kube-system/system-upgrade/plans/talos.yaml.j2

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
apiVersion: upgrade.cattle.io/v1
3+
kind: Plan
4+
metadata:
5+
name: talos
6+
spec:
7+
version: ${TALOS_VERSION}
8+
concurrency: 1
9+
postCompleteDelay: 2m
10+
exclusive: true
11+
serviceAccountName: system-upgrade
12+
secrets:
13+
- name: system-upgrade
14+
path: /var/run/secrets/talos.dev
15+
ignoreUpdates: true
16+
nodeSelector:
17+
matchExpressions:
18+
- key: kubernetes.io/os
19+
operator: In
20+
values: ["linux"]
21+
upgrade:
22+
image: ghcr.io/jfroy/tnu:0.4.0
23+
args:
24+
- --node=$(SYSTEM_UPGRADE_NODE_NAME)
25+
- --tag=$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)

‎templates/config/kubernetes/apps/network/external/cloudflared/helmrelease.yaml.j2

-1
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,6 @@ spec:
7777
runAsNonRoot: true
7878
runAsUser: 65534
7979
runAsGroup: 65534
80-
seccompProfile: { type: RuntimeDefault }
8180
service:
8281
app:
8382
controller: cloudflared

‎templates/config/kubernetes/bootstrap/talos/patches/controller/machine-features.yaml.j2

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
machine:
2+
features:
3+
kubernetesTalosAPIAccess:
4+
enabled: true
5+
allowedRoles: ["os:admin"]
6+
allowedKubernetesNamespaces: ["kube-system"]

0 commit comments

Comments
 (0)