Dustin C. Hatch
fc66058251
[fleetlock] is an implementation of the Zincati FleetLock reboot coordination protocol. It only works for machines that are Kubernetes nodes, but it does enable safe rolling updates for those machines. Specifically, when a node acquires a lock (backed by a Kubernetes Lease), it cordons that node and evicts pods from it. After the node has rebooted into the new version of Fedora CoreOS, it uncordons the node and releases the lock. [fleetlock]: https://github.com/poseidon/fleetlock
93 lines
1.7 KiB
YAML
93 lines
1.7 KiB
YAML
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: fleetlock
|
|
labels:
|
|
app.kubernetes.io/name: fleetlock
|
|
app.kubernetes.io/component: fleetlock
|
|
app.kubernetes.io/part-of: fleetlock
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: fleetlock
|
|
labels:
|
|
app.kubernetes.io/name: fleetlock
|
|
app.kubernetes.io/component: fleetlock
|
|
app.kubernetes.io/part-of: fleetlock
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- nodes
|
|
verbs:
|
|
- list
|
|
- patch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
verbs:
|
|
- list
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods/eviction
|
|
verbs:
|
|
- create
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: fleetlock
|
|
labels:
|
|
app.kubernetes.io/name: fleetlock
|
|
app.kubernetes.io/component: fleetlock
|
|
app.kubernetes.io/part-of: fleetlock
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: fleetlock
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: fleetlock
|
|
namespace: default
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: fleetlock
|
|
labels:
|
|
app.kubernetes.io/name: fleetlock
|
|
app.kubernetes.io/component: fleetlock
|
|
app.kubernetes.io/part-of: fleetlock
|
|
rules:
|
|
- apiGroups:
|
|
- coordination.k8s.io
|
|
resources:
|
|
- leases
|
|
verbs:
|
|
- create
|
|
- get
|
|
- update
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: fleetlock
|
|
labels:
|
|
app.kubernetes.io/name: fleetlock
|
|
app.kubernetes.io/component: fleetlock
|
|
app.kubernetes.io/part-of: fleetlock
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: fleetlock
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: fleetlock
|