--- # Source: nodewright/templates/networkpolicy.yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: nodewright-controller-manager-allow-all namespace: "skyhook" labels: helm.sh/chart: nodewright-v0.17.1 app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator app.kubernetes.io/version: "v0.17.0" app.kubernetes.io/managed-by: Helm spec: podSelector: matchLabels: control-plane: controller-manager app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator policyTypes: - Ingress - Egress ingress: - {} egress: - {} --- # Source: nodewright/templates/limitrange.yaml apiVersion: v1 kind: LimitRange metadata: name: nodewright-default-limits namespace: skyhook spec: limits: - type: Container default: cpu: 500m memory: 512Mi defaultRequest: cpu: 250m memory: 256Mi --- # Source: nodewright/templates/deployment.yaml apiVersion: policy/v1 kind: PodDisruptionBudget metadata: name: nodewright-controller-manager-pdb spec: minAvailable: 1 selector: matchLabels: app: nodewright-controller-manager unhealthyPodEvictionPolicy: AlwaysAllow --- # Source: nodewright/templates/serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: name: nodewright-controller-manager namespace: "skyhook" labels: app.kubernetes.io/component: rbac app.kubernetes.io/created-by: skyhook-operator app.kubernetes.io/part-of: skyhook-operator helm.sh/chart: nodewright-v0.17.1 app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator app.kubernetes.io/version: "v0.17.0" app.kubernetes.io/managed-by: Helm annotations: {} --- # Source: nodewright/templates/deploymentpolicy-crd.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: name: deploymentpolicies.skyhook.nvidia.com annotations: controller-gen.kubebuilder.io/version: v0.21.0 labels: helm.sh/chart: nodewright-v0.17.1 app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator app.kubernetes.io/version: "v0.17.0" app.kubernetes.io/managed-by: Helm spec: conversion: strategy: Webhook webhook: clientConfig: service: name: skyhook-operator-webhook-service namespace: 'skyhook' path: /convert conversionReviewVersions: - v1 group: skyhook.nvidia.com names: kind: DeploymentPolicy listKind: DeploymentPolicyList plural: deploymentpolicies singular: deploymentpolicy scope: Cluster versions: - name: v1alpha1 schema: openAPIV3Schema: description: DeploymentPolicy configures safe rollout defaults and compartment overrides properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: DeploymentPolicySpec defines rollout ceilings/strategy by default and per-compartment properties: compartments: description: Compartments, each with selector and budget; optional strategy items: description: Compartment defines a named selector with its own ceiling and optional strategy properties: budget: description: Exactly one of percent or count properties: count: minimum: 1 type: integer percent: maximum: 100 minimum: 1 type: integer type: object name: description: Unique name within the policy minLength: 1 type: string selector: description: Selector defining the nodes in this compartment properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic strategy: description: Optional per-compartment strategy override properties: exponential: properties: batchThreshold: maximum: 100 minimum: 1 type: integer failureThreshold: minimum: 1 type: integer growthFactor: minimum: 2 type: integer initialBatch: minimum: 1 type: integer safetyLimit: maximum: 100 minimum: 1 type: integer type: object fixed: description: Strategy parameters properties: batchThreshold: maximum: 100 minimum: 1 type: integer failureThreshold: minimum: 1 type: integer initialBatch: minimum: 1 type: integer safetyLimit: maximum: 100 minimum: 1 type: integer type: object linear: properties: batchThreshold: maximum: 100 minimum: 1 type: integer delta: minimum: 1 type: integer failureThreshold: minimum: 1 type: integer initialBatch: minimum: 1 type: integer safetyLimit: maximum: 100 minimum: 1 type: integer type: object type: object required: - budget - name - selector type: object type: array default: description: Default budget/strategy for unmatched nodes properties: budget: description: Exactly one of percent or count properties: count: minimum: 1 type: integer percent: maximum: 100 minimum: 1 type: integer type: object strategy: description: Strategy to use properties: exponential: properties: batchThreshold: maximum: 100 minimum: 1 type: integer failureThreshold: minimum: 1 type: integer growthFactor: minimum: 2 type: integer initialBatch: minimum: 1 type: integer safetyLimit: maximum: 100 minimum: 1 type: integer type: object fixed: description: Strategy parameters properties: batchThreshold: maximum: 100 minimum: 1 type: integer failureThreshold: minimum: 1 type: integer initialBatch: minimum: 1 type: integer safetyLimit: maximum: 100 minimum: 1 type: integer type: object linear: properties: batchThreshold: maximum: 100 minimum: 1 type: integer delta: minimum: 1 type: integer failureThreshold: minimum: 1 type: integer initialBatch: minimum: 1 type: integer safetyLimit: maximum: 100 minimum: 1 type: integer type: object type: object required: - strategy type: object resetBatchStateOnCompletion: default: false description: ResetBatchStateOnCompletion controls whether batch state is reset when rollout completes or spec changes type: boolean required: - default type: object type: object served: true storage: true --- # Source: nodewright/templates/skyhook-crd.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: name: skyhooks.skyhook.nvidia.com annotations: controller-gen.kubebuilder.io/version: v0.21.0 labels: helm.sh/chart: nodewright-v0.17.1 app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator app.kubernetes.io/version: "v0.17.0" app.kubernetes.io/managed-by: Helm spec: conversion: strategy: Webhook webhook: clientConfig: service: name: skyhook-operator-webhook-service namespace: 'skyhook' path: /convert conversionReviewVersions: - v1 group: skyhook.nvidia.com names: kind: Skyhook listKind: SkyhookList plural: skyhooks singular: skyhook scope: Cluster versions: - additionalPrinterColumns: - jsonPath: .status.status name: Status type: string - jsonPath: .spec.priority name: Priority type: integer - jsonPath: .metadata.creationTimestamp name: Age type: date - jsonPath: .status.nodesInProgress name: Nodes In-Progress type: integer - jsonPath: .status.completeNodes name: Complete Nodes type: string - jsonPath: .status.packageList name: Packages type: string - jsonPath: .spec.deploymentPolicy name: Policy type: string name: v1alpha1 schema: openAPIV3Schema: description: Skyhook is the Schema for the skyhooks API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: SkyhookSpec defines the desired state of Skyhook properties: additionalTolerations: description: AdditionalTolerations adds tolerations to all packages items: description: |- The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . properties: effect: description: |- Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. type: string key: description: |- Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. type: string operator: description: |- Operator represents a key's relationship to the value. Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. format: int64 type: integer value: description: |- Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. type: string type: object type: array autoTaintNewNodes: default: false description: |- AutoTaintNewNodes enables the operator to automatically apply the runtime-required taint to new nodes that match this Skyhook's node selector. Only meaningful when RuntimeRequired is true. A node is considered "new" if it has no skyhook.nvidia.com/* annotations. type: boolean deploymentPolicy: description: DeploymentPolicy is the name of a DeploymentPolicy for rollout settings type: string deploymentPolicyOptions: description: DeploymentPolicyOptions allows per-Skyhook overrides of DeploymentPolicy settings properties: resetBatchStateOnCompletion: default: true description: ResetBatchStateOnCompletion overrides the DeploymentPolicy setting for this Skyhook type: boolean type: object interruptionBudget: description: InterruptionBudget configures how many nodes that match node selectors that allowed to be interrupted at once. properties: count: description: |- Count is number of nodes that match node selectors that allowed to be interrupted at once. Percent and count are mutually exclusive settings minimum: 0 nullable: true type: integer percent: description: |- Percent of nodes that match node selectors that allowed to be interrupted at once. Percent and count are mutually exclusive settings maximum: 100 minimum: 0 nullable: true type: integer type: object nodeSelectors: description: NodeSelector are a set of labels we want to monitor nodes for applying packages too properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic packages: additionalProperties: description: Package is a container that contains the skyhook agent plus some work to do, plus any dependencies to be run first. properties: agentImageOverride: description: |- Agent Image Override is the container image to override at the package level. Full qualified image with tag. This overrides the image provided via ENV to the operator. example: alpine:3.21.0 type: string configInterrupts: additionalProperties: properties: services: description: List of systemd services to restart items: type: string type: array type: description: Type of interrupt. Reboot, Service, All Services, or Noop enum: - service - reboot - noop - restartAllServices type: string required: - type type: object description: ConfigInterrupts is a map for whether an interrupt is needed for a configmap key type: object configMap: additionalProperties: type: string description: |- ConfigMap contains the configuration data. Each key must consist of alphanumeric characters, '-', '_' or '.'. Values must be UTF-8 byte sequences. The keys stored in Data must not overlap with the keys in the BinaryData field, this is enforced during validation process. type: object containerSHA: description: |- ContainerSHA is the SHA256 digest of the container image for verification purposes. When specified, this will be used instead of the version tag to pull the exact image. Format: sha256:1234567890abcdef... example: sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef type: string dependsOn: additionalProperties: type: string description: |- DependsOn is a map of name:version of dependencies. NOTE: we need to deal with version type: object env: description: Env are the environment variables for the package items: description: EnvVar represents an environment variable present in a Container. properties: name: description: |- Name of the environment variable. May consist of any printable ASCII characters except '='. type: string value: description: |- Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "". type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic fieldRef: description: |- Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object x-kubernetes-map-type: atomic fileKeyRef: description: |- FileKeyRef selects a key of the env file. Requires the EnvFiles feature gate to be enabled. properties: key: description: |- The key within the env file. An invalid key will prevent the pod from starting. The keys defined within a source may consist of any printable ASCII characters except '='. During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. type: string optional: default: false description: |- Specify whether the file or its key must be defined. If the file or key does not exist, then the env var is not published. If optional is set to true and the specified key does not exist, the environment variable will not be set in the Pod's containers. If optional is set to false and the specified key does not exist, an error will be returned during Pod creation. type: boolean path: description: |- The path within the volume from which to select the file. Must be relative and may not contain the '..' path or start with '..'. type: string volumeName: description: The name of the volume mount containing the env file. type: string required: - key - path - volumeName type: object x-kubernetes-map-type: atomic resourceFieldRef: description: |- Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: anyOf: - type: integer - type: string description: Specifies the output format of the exposed resources, defaults to "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object x-kubernetes-map-type: atomic secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic type: object required: - name type: object type: array gracefulShutdown: description: GracefulShutdown is the graceful shutdown timeout for the package, if not set, uses k8s default type: string image: description: Image is the container image to run. Do not included the tag, that is set in the version. example: alpine type: string interrupt: description: Interrupt if supplied is the type of interrupt properties: services: description: List of systemd services to restart items: type: string type: array type: description: Type of interrupt. Reboot, Service, All Services, or Noop enum: - service - reboot - noop - restartAllServices type: string required: - type type: object name: description: Name of the package. Do not set unless you know what your doing. Comes from map key. maxLength: 43 pattern: ^[a-z][-a-z0-9]{0,41}[a-z]$ type: string resources: description: |- Resources lets you set the cpu and memory limits and requests for this package. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ properties: cpuLimit: anyOf: - type: integer - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true cpuRequest: anyOf: - type: integer - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true memoryLimit: anyOf: - type: integer - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true memoryRequest: anyOf: - type: integer - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true type: object uninstall: description: Uninstall configures explicit uninstall support for this package. properties: apply: default: false description: |- Apply triggers the uninstall workflow on all target nodes. Only valid when Enabled is true (webhook rejects apply=true with enabled=false). Set to false (or remove) to cancel a pending uninstall. type: boolean enabled: default: false description: |- Enabled declares this package supports uninstall (has uninstall.sh/uninstall_check.sh). When true, the operator will run uninstall pods before allowing package removal and during CR deletion cleanup. type: boolean required: - apply - enabled type: object version: description: Version is the version of the package type: string required: - image - version type: object description: Packages are the DAG of packages to be applied to nodes. type: object podNonInterruptLabels: description: PodNonInterruptLabels are a set of labels we want to monitor pods for whether they Interruptible properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic priority: description: Priority determines the order in which skyhooks are applied. Lower values are applied first. type: integer minimum: 1 default: 200 runtimeRequired: default: false description: This skyhook is required to have been completed before any workloads can start type: boolean sequencing: default: node description: |- Sequencing controls whether priority ordering is enforced globally or per-node. "node" (default): a node can proceed past this skyhook independently once it completes on that node. "all": all nodes must complete this skyhook before any node starts the next priority. enum: - all - node type: string serial: default: false description: Serial tells skyhook if it allowed to run in packages in parallel. If true, the operator will run one package at a time. type: boolean type: object status: description: SkyhookStatus defines the observed state of Skyhook properties: compartmentStatuses: additionalProperties: description: CompartmentStatus tracks the detailed state of a compartment properties: batchState: description: BatchState tracks the batch processing state for this compartment properties: completedNodes: description: Total number of nodes that have completed successfully (cumulative across all batches) type: integer consecutiveFailures: description: Number of consecutive failures type: integer currentBatch: description: Current batch number (starts at 1) type: integer failedNodes: description: Total number of nodes that have failed (cumulative across all batches) type: integer lastBatchFailed: description: Whether the last batch failed (for slowdown logic) type: boolean lastBatchSize: description: Last batch size (for slowdown calculations) type: integer shouldStop: description: Whether the strategy should stop processing due to failures type: boolean type: object ceiling: description: Ceiling is the maximum number of nodes that can be in progress at once type: integer completed: description: Completed is the number of nodes that have completed successfully type: integer inProgress: description: InProgress is the number of nodes currently in progress type: integer matched: description: Matched is the number of nodes that match this compartment's selector type: integer progressPercent: description: ProgressPercent is the percentage of nodes completed (0-100) type: integer required: - ceiling - completed - inProgress - matched - progressPercent type: object description: CompartmentStatuses tracks the detailed status of each compartment type: object completeNodes: default: 0/0 description: |- CompleteNodes is a string that displays the amount of nodes that are complete out of the total nodes the skyhook is being applied to and is only used for a printer column. example: 3/5 type: string conditions: description: |- Represents the observations of a skyhook's current state. Known .status.conditions.type are: "Available", "Progressing", and "Degraded" // TODO items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map configUpdates: additionalProperties: items: type: string type: array description: ConfigUpdates tracks config updates type: object nodeBootIds: additionalProperties: type: string description: NodeBootIds tracks the boot ids of nodes for triggering on reboot type: object nodeOrderOffset: description: |- NodeOrderOffset tracks the cumulative count of nodes removed from NodePriority. Used with NodePriority to compute monotonic SKYHOOK_NODE_ORDER across batches. type: integer nodePriority: additionalProperties: format: date-time type: string description: NodePriority tracks what nodes we are working on. This is makes the interrupts budgets sticky. type: object nodeState: additionalProperties: additionalProperties: properties: containerSHA: description: ContainerSHA is the SHA256 digest that was actually deployed type: string image: description: Image for the package type: string name: description: Name is the name of the package type: string restarts: description: Restarts are the number of times a package restarted format: int32 type: integer stage: description: |- Stage is where in the package install process is currently for a node. these stages encapsulate checks. Both Apply and PostInterrupt also run checks, these are all or nothing, meaning both need to be successful in order to transition enum: - apply - interrupt - post-interrupt - config - uninstall - uninstall-interrupt - upgrade type: string state: description: State is the current state of this package enum: - complete - in_progress - skipped - erroring - unknown type: string version: description: Version is the version of the package type: string required: - image - name - stage - state - version type: object type: object description: NodeState is the detailed state of each node type: object nodeStatus: additionalProperties: type: string description: NodeStatus tracks by node the status of the node type: object nodesInProgress: default: 0 description: |- NodesInProgress displays the number of nodes that are currently in progress and is only used for printer columns. example: 3 type: integer observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.observedGeneration is 9, then status is out of date format: int64 minimum: 0 type: integer packageList: default: "" description: |- PackageList is a comma separated list of package names from the skyhook spec and is only used for a printer column. example: dexter,spencer,foobar type: string status: description: Status is the roll of this instance of skyhook and all nodes status. enum: - unknown - complete - blocked - waiting - disabled - paused - in_progress - erroring type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: nodewright/templates/manager-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: skyhook-operator-manager-role annotations: checkov.io/skip1: CKV_K8S_155=Operator must manage webhook configs for cert rotation labels: helm.sh/chart: nodewright-v0.17.1 app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator app.kubernetes.io/version: "v0.17.0" app.kubernetes.io/managed-by: Helm rules: - apiGroups: - admissionregistration.k8s.io resources: - mutatingwebhookconfigurations - validatingwebhookconfigurations resourceNames: - skyhook-operator-validating-webhook - skyhook-operator-mutating-webhook verbs: - get - update - apiGroups: - admissionregistration.k8s.io resources: - mutatingwebhookconfigurations - validatingwebhookconfigurations verbs: - list - watch - apiGroups: - "" resources: - configmaps verbs: - create - delete - get - list - patch - update - watch - apiGroups: - "" resources: - events verbs: - create - patch - apiGroups: - "" resources: - nodes verbs: - get - list - patch - update - watch - apiGroups: - "" resources: - nodes/status verbs: - get - patch - update - apiGroups: - "" resources: - pods verbs: - create - delete - get - list - patch - update - watch - apiGroups: - "" resources: - pods/eviction verbs: - create - apiGroups: - "" resources: - pods/status verbs: - get - apiGroups: - "" resources: - secrets verbs: - create - delete - get - list - patch - update - watch - apiGroups: - skyhook.nvidia.com resources: - deploymentpolicies verbs: - get - list - watch - apiGroups: - skyhook.nvidia.com resources: - skyhooks verbs: - create - delete - get - list - patch - update - watch - apiGroups: - skyhook.nvidia.com resources: - skyhooks/finalizers verbs: - update - apiGroups: - skyhook.nvidia.com resources: - skyhooks/status verbs: - get - patch - update --- # Source: nodewright/templates/metrics-reader-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: skyhook-operator-metrics-reader labels: app.kubernetes.io/component: kube-rbac-proxy app.kubernetes.io/created-by: skyhook-operator app.kubernetes.io/part-of: skyhook-operator helm.sh/chart: nodewright-v0.17.1 app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator app.kubernetes.io/version: "v0.17.0" app.kubernetes.io/managed-by: Helm rules: - nonResourceURLs: - /metrics verbs: - get --- # Source: nodewright/templates/proxy-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: skyhook-operator-proxy-role labels: app.kubernetes.io/component: kube-rbac-proxy app.kubernetes.io/created-by: skyhook-operator app.kubernetes.io/part-of: skyhook-operator helm.sh/chart: nodewright-v0.17.1 app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator app.kubernetes.io/version: "v0.17.0" app.kubernetes.io/managed-by: Helm rules: - apiGroups: - authentication.k8s.io resources: - tokenreviews verbs: - create - apiGroups: - authorization.k8s.io resources: - subjectaccessreviews verbs: - create --- # Source: nodewright/templates/manager-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: skyhook-operator-manager-rolebinding labels: app.kubernetes.io/component: rbac app.kubernetes.io/created-by: skyhook-operator app.kubernetes.io/part-of: skyhook-operator helm.sh/chart: nodewright-v0.17.1 app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator app.kubernetes.io/version: "v0.17.0" app.kubernetes.io/managed-by: Helm roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: skyhook-operator-manager-role subjects: - kind: ServiceAccount name: nodewright-controller-manager namespace: 'skyhook' --- # Source: nodewright/templates/proxy-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: skyhook-operator-proxy-rolebinding labels: app.kubernetes.io/component: kube-rbac-proxy app.kubernetes.io/created-by: skyhook-operator app.kubernetes.io/part-of: skyhook-operator helm.sh/chart: nodewright-v0.17.1 app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator app.kubernetes.io/version: "v0.17.0" app.kubernetes.io/managed-by: Helm roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: skyhook-operator-proxy-role subjects: - kind: ServiceAccount name: nodewright-controller-manager namespace: 'skyhook' --- # Source: nodewright/templates/leader-election-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: skyhook-operator-leader-election-role namespace: "skyhook" labels: app.kubernetes.io/component: rbac app.kubernetes.io/created-by: skyhook-operator app.kubernetes.io/part-of: skyhook-operator helm.sh/chart: nodewright-v0.17.1 app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator app.kubernetes.io/version: "v0.17.0" app.kubernetes.io/managed-by: Helm rules: - apiGroups: - "" resources: - configmaps verbs: - get - list - watch - create - update - patch - delete - apiGroups: - coordination.k8s.io resources: - leases verbs: - get - list - watch - create - update - patch - delete - apiGroups: - "" resources: - events verbs: - create - patch --- # Source: nodewright/templates/leader-election-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: skyhook-operator-leader-election-rolebinding namespace: "skyhook" labels: app.kubernetes.io/component: rbac app.kubernetes.io/created-by: skyhook-operator app.kubernetes.io/part-of: skyhook-operator helm.sh/chart: nodewright-v0.17.1 app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator app.kubernetes.io/version: "v0.17.0" app.kubernetes.io/managed-by: Helm roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: skyhook-operator-leader-election-role subjects: - kind: ServiceAccount name: nodewright-controller-manager namespace: 'skyhook' --- # Source: nodewright/templates/metrics-service.yaml apiVersion: v1 kind: Service metadata: name: skyhook-operator-controller-manager-metrics-service namespace: "skyhook" labels: app.kubernetes.io/component: kube-rbac-proxy app.kubernetes.io/created-by: skyhook-operator app.kubernetes.io/part-of: skyhook-operator control-plane: controller-manager annotations: prometheus.io/port: "8080" prometheus.io/scheme: http prometheus.io/scrape: "true" spec: type: ClusterIP selector: control-plane: controller-manager app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator ports: - name: metrics port: 8443 protocol: TCP targetPort: 8443 - name: metrics-http port: 8080 protocol: TCP targetPort: 8080 --- # Source: nodewright/templates/webhook-service.yaml apiVersion: v1 kind: Service metadata: name: skyhook-operator-webhook-service namespace: "skyhook" labels: app.kubernetes.io/component: webhook app.kubernetes.io/created-by: skyhook-operator app.kubernetes.io/part-of: skyhook-operator helm.sh/chart: nodewright-v0.17.1 app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator app.kubernetes.io/version: "v0.17.0" app.kubernetes.io/managed-by: Helm spec: type: ClusterIP selector: control-plane: controller-manager app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator ports: - name: webhook port: 443 protocol: TCP targetPort: 9443 --- # Source: nodewright/templates/deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: nodewright-controller-manager namespace: "skyhook" annotations: checkov.io/skip1: CKV_K8S_43=Image digest not required - we use tags labels: app: nodewright-controller-manager app.kubernetes.io/component: manager app.kubernetes.io/created-by: skyhook-operator app.kubernetes.io/part-of: skyhook-operator control-plane: controller-manager helm.sh/chart: nodewright-v0.17.1 app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator app.kubernetes.io/version: "v0.17.0" app.kubernetes.io/managed-by: Helm spec: replicas: 2 selector: # Deployment.spec.selector is immutable. These labels are sourced from the # shared chart.managerSelectorLabels helper so the selector-migration # pre-upgrade hook compares against the exact same set; if the chart name or # release name ever changes the selector, that hook deletes the stale # Deployment so `helm upgrade` can recreate it. matchLabels: control-plane: controller-manager app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator template: metadata: labels: app: nodewright-controller-manager control-plane: controller-manager app.kubernetes.io/name: nodewright app.kubernetes.io/instance: nodewright-operator annotations: kubectl.kubernetes.io/default-container: manager spec: automountServiceAccountToken: false affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: kubernetes.io/arch operator: In values: - amd64 - arm64 - key: kubernetes.io/os operator: In values: - linux containers: - command: - /manager env: - name: METRICS_PORT value: ":8080" - name: PROBE_PORT value: ":8081" - name: LEADER_ELECTION value: "true" - name: LOG_LEVEL value: "info" - name: ENABLE_WEBHOOKS value: "true" - name: NAMESPACE value: skyhook - name: IMAGE_PULL_SECRET value: "" - name: COPY_DIR_ROOT value: "/var/lib/skyhook" - name: REAPPLY_ON_REBOOT value: "false" - name: RUNTIME_REQUIRED_TAINT value: "skyhook.nvidia.com=runtime-required:NoSchedule" - name: PAUSE_IMAGE value: "registry.k8s.io/pause:3.10" - name: AGENT_IMAGE value: ghcr.io/nvidia/nodewright/agent:v6.4.2@sha256:7cd80f5ef351266dc08c3979e802f9dc936a1ed9fd02e199233e7968a3a0de3e - name: KUBERNETES_CLUSTER_DOMAIN value: "cluster.local" image: ghcr.io/nvidia/nodewright/operator:v0.17.0@sha256:1511449bf51f2844b6bb3a03bde3d5590caf2ca283e3e39c0745a8016af2132f imagePullPolicy: Always livenessProbe: httpGet: path: /healthz port: 8081 initialDelaySeconds: 15 periodSeconds: 20 name: manager ports: - containerPort: 9443 name: webhook-server protocol: TCP volumeMounts: - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access readOnly: true - mountPath: /tmp name: webhook-certs readinessProbe: httpGet: path: /readyz port: 8081 initialDelaySeconds: 5 periodSeconds: 20 successThreshold: 1 failureThreshold: 2 timeoutSeconds: 3 resources: limits: cpu: 1000m memory: 512Mi requests: cpu: 500m memory: 256Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true - args: - --secure-listen-address=0.0.0.0:8443 - --upstream=http://127.0.0.1:8080/ - --logtostderr=true - --v=0 env: - name: KUBERNETES_CLUSTER_DOMAIN value: "cluster.local" image: quay.io/brancz/kube-rbac-proxy:v0.15.0@sha256:2c7b120590cbe9f634f5099f2cbb91d0b668569023a81505ca124a5c437e7663 imagePullPolicy: Always livenessProbe: tcpSocket: port: 8443 initialDelaySeconds: 15 periodSeconds: 20 readinessProbe: tcpSocket: port: 8443 initialDelaySeconds: 5 periodSeconds: 20 successThreshold: 1 failureThreshold: 2 timeoutSeconds: 3 name: kube-rbac-proxy ports: - containerPort: 8443 name: https protocol: TCP volumeMounts: - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access readOnly: true resources: limits: cpu: 500m memory: 128Mi requests: cpu: 5m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true imagePullSecrets: volumes: - name: kube-api-access projected: defaultMode: 420 sources: - serviceAccountToken: path: token expirationSeconds: 3607 - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace - name: webhook-certs emptyDir: {} securityContext: runAsNonRoot: true runAsUser: 10001 seccompProfile: type: RuntimeDefault serviceAccountName: nodewright-controller-manager terminationGracePeriodSeconds: 10 --- # Source: nodewright/templates/mutating-webhook.yaml apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration metadata: name: skyhook-operator-mutating-webhook webhooks: - admissionReviewVersions: - v1 clientConfig: service: name: skyhook-operator-webhook-service namespace: skyhook path: /mutate-skyhook-nvidia-com-v1alpha1-skyhook port: 443 failurePolicy: Fail matchPolicy: Equivalent name: mutate-skyhook.nvidia.com namespaceSelector: {} objectSelector: {} reinvocationPolicy: Never rules: - apiGroups: - skyhook.nvidia.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE resources: - skyhooks scope: '*' sideEffects: None timeoutSeconds: 10 - admissionReviewVersions: - v1 clientConfig: service: name: skyhook-operator-webhook-service namespace: skyhook path: /mutate-skyhook-nvidia-com-v1alpha1-deploymentpolicy port: 443 failurePolicy: Fail matchPolicy: Equivalent name: mutate-deploymentpolicy.nvidia.com namespaceSelector: {} objectSelector: {} reinvocationPolicy: Never rules: - apiGroups: - skyhook.nvidia.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE resources: - deploymentpolicies scope: '*' sideEffects: None timeoutSeconds: 10 --- # Source: nodewright/templates/validating-webhook.yaml apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: skyhook-operator-validating-webhook webhooks: - admissionReviewVersions: - v1 clientConfig: service: name: skyhook-operator-webhook-service namespace: skyhook path: /validate-skyhook-nvidia-com-v1alpha1-skyhook port: 443 failurePolicy: Fail matchPolicy: Equivalent name: validate-skyhook.nvidia.com namespaceSelector: {} objectSelector: {} rules: - apiGroups: - skyhook.nvidia.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE resources: - skyhooks scope: '*' sideEffects: None timeoutSeconds: 10 - admissionReviewVersions: - v1 clientConfig: service: name: skyhook-operator-webhook-service namespace: skyhook path: /validate-skyhook-nvidia-com-v1alpha1-deploymentpolicy port: 443 failurePolicy: Fail matchPolicy: Equivalent name: validate-deploymentpolicy.nvidia.com namespaceSelector: {} objectSelector: {} rules: - apiGroups: - skyhook.nvidia.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE - DELETE resources: - deploymentpolicies scope: '*' sideEffects: None timeoutSeconds: 10