# =============================================================================
# Kured (KUbernetes REboot Daemon)
# =============================================================================
# K4.1 2026-03-28: Automatic node reboot for OS updates
# Deployed by: Claude Code (首席架構師)
# Maintenance window: 02:00-04:00 (UTC+8 台北時間)
# =============================================================================
---
apiVersion: v1
kind: Namespace
metadata:
  name: kured
  labels:
    app.kubernetes.io/name: kured
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kured
  namespace: kured
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kured
rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "patch"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["list", "delete", "get"]
  - apiGroups: ["apps"]
    resources: ["daemonsets"]
    verbs: ["get"]
  - apiGroups: [""]
    resources: ["pods/eviction"]
    verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kured
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kured
subjects:
  - kind: ServiceAccount
    name: kured
    namespace: kured
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: kured
  namespace: kured
rules:
  - apiGroups: ["apps"]
    resources: ["daemonsets"]
    verbs: ["update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kured
  namespace: kured
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kured
subjects:
  - kind: ServiceAccount
    name: kured
    namespace: kured
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kured
  namespace: kured
  labels:
    app.kubernetes.io/name: kured
    app.kubernetes.io/version: "1.15.1"
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: kured
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: kured
    spec:
      serviceAccountName: kured
      tolerations:
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: NoSchedule
        - key: node-role.kubernetes.io/master
          operator: Exists
          effect: NoSchedule
      hostPID: true
      restartPolicy: Always
      containers:
        - name: kured
          image: ghcr.io/kubereboot/kured:1.15.1
          imagePullPolicy: IfNotPresent
          securityContext:
            privileged: true
          env:
            - name: KURED_NODE_ID
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          command:
            - /usr/bin/kured
            - --reboot-sentinel=/var/run/reboot-required
            # DaemonSet 位置 (修復 CrashLoopBackOff)
            - --ds-namespace=kured
            - --ds-name=kured
            # 維護窗口: 02:00-04:00 台北時間 (UTC+8)
            - --start-time=02:00
            - --end-time=04:00
            - --time-zone=Asia/Taipei
            # 重啟間隔: 1小時
            - --period=1h
            # PodDisruptionBudget 檢查
            - --blocking-pod-selector=app.kubernetes.io/name=awoooi
            # Prometheus metrics
            # 2026-04-29 ogt + Claude Opus 4.7: drift fix — 188 是 Ollama Hub
            # Prometheus 實際在 110。kured 連錯主機 = 跳過 alert 守門員直接 reboot
            # 對齊 ConfigMap 04-configmap.yaml + config.py PROMETHEUS_URL
            - --prometheus-url=http://192.168.0.110:9090
          resources:
            limits:
              cpu: 100m
              memory: 64Mi
            requests:
              cpu: 10m
              memory: 32Mi
          volumeMounts:
            - name: hostrun
              mountPath: /var/run
      volumes:
        - name: hostrun
          hostPath:
            path: /var/run