150 lines
3.9 KiB
YAML
150 lines
3.9 KiB
YAML
# =============================================================================
|
|
# Kured (KUbernetes REboot Daemon)
|
|
# =============================================================================
|
|
# K4.1 2026-03-28: Automatic node reboot for OS updates
|
|
# Deployed by: Claude Code (首席架構師)
|
|
# Maintenance window: 02:00-04:00 (UTC+8 台北時間)
|
|
# =============================================================================
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: kured
|
|
labels:
|
|
app.kubernetes.io/name: kured
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: kured
|
|
namespace: kured
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kured
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["nodes"]
|
|
verbs: ["get", "patch"]
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["list", "delete", "get"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["daemonsets"]
|
|
verbs: ["get"]
|
|
- apiGroups: [""]
|
|
resources: ["pods/eviction"]
|
|
verbs: ["create"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: kured
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: kured
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kured
|
|
namespace: kured
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: kured
|
|
namespace: kured
|
|
rules:
|
|
- apiGroups: ["apps"]
|
|
resources: ["daemonsets"]
|
|
verbs: ["update"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: kured
|
|
namespace: kured
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: kured
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kured
|
|
namespace: kured
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
name: kured
|
|
namespace: kured
|
|
labels:
|
|
app.kubernetes.io/name: kured
|
|
app.kubernetes.io/version: "1.15.1"
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: kured
|
|
updateStrategy:
|
|
type: RollingUpdate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: kured
|
|
spec:
|
|
serviceAccountName: kured
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
- key: node-role.kubernetes.io/master
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
hostPID: true
|
|
restartPolicy: Always
|
|
containers:
|
|
- name: kured
|
|
image: 192.168.0.110:5000/awoooi/runtime-mirror/kured@sha256:70fe8ceeef3f93319619062de2e0c6d5cce9c4f8687b90c1841e0c96f486ab1d
|
|
imagePullPolicy: IfNotPresent
|
|
securityContext:
|
|
privileged: true
|
|
env:
|
|
- name: KURED_NODE_ID
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: spec.nodeName
|
|
command:
|
|
- /usr/bin/kured
|
|
- --reboot-sentinel=/var/run/reboot-required
|
|
# DaemonSet 位置 (修復 CrashLoopBackOff)
|
|
- --ds-namespace=kured
|
|
- --ds-name=kured
|
|
# 維護窗口: 02:00-04:00 台北時間 (UTC+8)
|
|
- --start-time=02:00
|
|
- --end-time=04:00
|
|
- --time-zone=Asia/Taipei
|
|
# 重啟間隔: 1小時
|
|
- --period=1h
|
|
# PodDisruptionBudget 檢查
|
|
- --blocking-pod-selector=app.kubernetes.io/name=awoooi
|
|
# Prometheus metrics
|
|
# 2026-04-29 ogt + Claude Opus 4.7: drift fix — 188 是 Ollama Hub
|
|
# Prometheus 實際在 110。kured 連錯主機 = 跳過 alert 守門員直接 reboot
|
|
# 對齊 ConfigMap 04-configmap.yaml + config.py PROMETHEUS_URL
|
|
- --prometheus-url=http://192.168.0.110:9090
|
|
resources:
|
|
limits:
|
|
cpu: 100m
|
|
memory: 64Mi
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
volumeMounts:
|
|
- name: hostrun
|
|
mountPath: /var/run
|
|
volumes:
|
|
- name: hostrun
|
|
hostPath:
|
|
path: /var/run
|