install.yaml

apiVersion: v1
kind: Namespace
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: upgrade-toolkit
    control-plane: controller-manager
  name: upgrade-toolkit-system
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.18.0
  name: upgradeplans.management.harvesterhci.io
spec:
  group: management.harvesterhci.io
  names:
    kind: UpgradePlan
    listKind: UpgradePlanList
    plural: upgradeplans
    shortNames:
    - up
    - ups
    singular: upgradeplan
  scope: Cluster
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.version
      name: VERSION
      type: string
    - jsonPath: .status.currentPhase
      name: CURRENTPHASE
      type: string
    - jsonPath: .status.conditions[?(@.type=='Available')].status
      name: AVAILABLE
      type: string
    - jsonPath: .status.conditions[?(@.type=='Progressing')].status
      name: PROGRESSING
      type: string
    - jsonPath: .status.conditions[?(@.type=='Degraded')].status
      name: DEGRADED
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: UpgradePlan is the Schema for the upgradeplans API
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: spec defines the desired state of UpgradePlan
            properties:
              force:
                description: force indicates the UpgradePlan will be forcibly applied,
                  ignoring any pre-upgrade check failures. Default to "false".
                type: boolean
              imagePreloadOption:
                description: imagePreloadOption configures image preload behavior
                  including concurrency control.
                properties:
                  concurrency:
                    description: |-
                      concurrency controls how many nodes preload images simultaneously.
                      When nil or zero, all Harvester-managed nodes preload concurrently.
                      When positive, the value is used as the SUC plan concurrency (capped at node count).
                      When negative, image preloading is skipped entirely.
                    type: integer
                type: object
              nodeUpgradeOption:
                description: nodeUpgradeOption configures node upgrade behavior including
                  pause/unpause control.
                properties:
                  pauseNodes:
                    description: |-
                      pauseNodes lists specific node names to pause before PreDraining.
                      When non-empty, only the listed nodes are paused; all other nodes proceed
                      automatically. When empty (or when nodeUpgradeOption is nil), no nodes are
                      paused. Removing a node from this list unpauses it. To pause all nodes,
                      list every node name explicitly.
                    items:
                      type: string
                    type: array
                    x-kubernetes-list-type: set
                type: object
              restoreVM:
                description: |-
                  restoreVM enables automatic restoration of non-live-migratable VMs
                  that were shut down during node upgrade. Default to false.
                type: boolean
              upgrade:
                description: |-
                  upgrade can be specified to opt for any other specific upgrade image. If not provided, the version resource name is used.
                  For instance, specifying "dev" for the field can go for the "rancher/harvester-upgrade:dev" image.
                type: string
              version:
                description: version refers to the corresponding version resource.
                type: string
            required:
            - version
            type: object
          status:
            description: status defines the observed state of UpgradePlan
            properties:
              conditions:
                description: |-
                  conditions represent the current state of the UpgradePlan resource.
                  Each condition has a unique type and reflects the status of a specific aspect of the resource.

                  Standard condition types include:
                  - "Available": the resource is fully functional
                  - "Progressing": the resource is being created or updated
                  - "Degraded": the resource failed to reach or maintain its desired state

                  The status of each condition is one of True, False, or Unknown.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
              currentPhase:
                description: currentPhase shows what overall phase the UpgradePlan
                  resource is in.
                type: string
              isoImageID:
                description: isoImageID refers to the namespaced name of the VM image
                  that will be used for the upgrade.
                type: string
              nodeUpgradeStatuses:
                additionalProperties:
                  properties:
                    message:
                      type: string
                    reason:
                      type: string
                    state:
                      description: NodeUpgradeState represents a node's position in
                        the upgrade lifecycle.
                      type: string
                  type: object
                description: nodeStatuses reflect each node's upgrade status for node
                  specific tasks.
                type: object
                x-kubernetes-map-type: atomic
              phaseTransitionTimestamps:
                description: phaseTransitionTimestamp is the timestamp of when the
                  last phase change occurred.
                items:
                  properties:
                    phase:
                      description: UpgradePlanPhase defines what overall phase UpgradePlan
                        is in
                      type: string
                    phaseTransitionTimestamp:
                      format: date-time
                      type: string
                  required:
                  - phase
                  - phaseTransitionTimestamp
                  type: object
                type: array
                x-kubernetes-list-type: atomic
              previousVersion:
                description: previousVersion is the Harvester version before upgrade.
                type: string
              provisionGeneration:
                description: |-
                  provisionGeneration records the provisionGeneration value set on the
                  Cluster resource during the NodeUpgrade phase. Used as an idempotency
                  guard so the Cluster is patched exactly once per upgrade.
                type: integer
              releaseMetadata:
                description: releaseMetadata reflects the essential metadata extracted
                  from the artifact.
                properties:
                  harvester:
                    type: string
                  harvesterChart:
                    type: string
                  kubernetes:
                    type: string
                  minUpgradableVersion:
                    type: string
                  monitoringChart:
                    type: string
                  os:
                    type: string
                  rancher:
                    type: string
                type: object
              singleNode:
                description: |-
                  singleNode records the name of the single node in a single-node cluster.
                  Empty for multi-node clusters. Set during the Initialize phase.
                type: string
              version:
                description: version is the snapshot of the associated Version resource.
                properties:
                  isoChecksum:
                    type: string
                  isoURL:
                    type: string
                  releaseDate:
                    type: string
                  tags:
                    items:
                      type: string
                    type: array
                required:
                - isoURL
                type: object
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.18.0
  name: versions.management.harvesterhci.io
spec:
  group: management.harvesterhci.io
  names:
    kind: Version
    listKind: VersionList
    plural: versions
    singular: version
  scope: Cluster
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.isoURL
      name: ISOURL
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: Version is the Schema for the versions API
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: spec defines the desired state of Version
            properties:
              isoChecksum:
                type: string
              isoURL:
                type: string
              releaseDate:
                type: string
              tags:
                items:
                  type: string
                type: array
            required:
            - isoURL
            type: object
          status:
            description: status defines the observed state of Version
            properties:
              conditions:
                description: |-
                  conditions represent the current state of the Version resource.
                  Each condition has a unique type and reflects the status of a specific aspect of the resource.

                  Standard condition types include:
                  - "Available": the resource is fully functional
                  - "Progressing": the resource is being created or updated
                  - "Degraded": the resource failed to reach or maintain its desired state

                  The status of each condition is one of True, False, or Unknown.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: upgrade-toolkit
  name: upgrade-toolkit-controller-manager
  namespace: upgrade-toolkit-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: upgrade-toolkit
  name: upgrade-toolkit-leader-election-role
  namespace: upgrade-toolkit-system
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: upgrade-toolkit-manager-role
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - ""
  resources:
  - nodes
  - secrets
  verbs:
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - nodes/proxy
  - nodes/stats
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - apps
  resources:
  - deployments
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - batch
  resources:
  - jobs
  verbs:
  - create
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - batch
  resources:
  - jobs/status
  verbs:
  - get
- apiGroups:
  - cluster.x-k8s.io
  resources:
  - machines
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - harvesterhci.io
  resources:
  - addons
  verbs:
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - harvesterhci.io
  resources:
  - schedulevmbackups
  - settings
  - virtualmachinebackups
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - harvesterhci.io
  resources:
  - virtualmachineimages
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - kubevirt.io
  resources:
  - virtualmachineinstances
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - longhorn.io
  resources:
  - settings
  verbs:
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - longhorn.io
  resources:
  - volumes
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - management.cattle.io
  resources:
  - managedcharts
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - management.harvesterhci.io
  resources:
  - upgradeplans
  - versions
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - management.harvesterhci.io
  resources:
  - upgradeplans/finalizers
  - versions/finalizers
  verbs:
  - update
- apiGroups:
  - management.harvesterhci.io
  resources:
  - upgradeplans/status
  - versions/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - provisioning.cattle.io
  resources:
  - clusters
  verbs:
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - upgrade.cattle.io
  resources:
  - plans
  verbs:
  - create
  - deletecollection
  - get
  - list
  - update
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: upgrade-toolkit-metrics-auth-role
rules:
- apiGroups:
  - authentication.k8s.io
  resources:
  - tokenreviews
  verbs:
  - create
- apiGroups:
  - authorization.k8s.io
  resources:
  - subjectaccessreviews
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: upgrade-toolkit-metrics-reader
rules:
- nonResourceURLs:
  - /metrics
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: upgrade-toolkit
  name: upgrade-toolkit-upgradeplan-admin-role
rules:
- apiGroups:
  - management.harvesterhci.io
  resources:
  - upgradeplans
  verbs:
  - '*'
- apiGroups:
  - management.harvesterhci.io
  resources:
  - upgradeplans/status
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: upgrade-toolkit
  name: upgrade-toolkit-upgradeplan-editor-role
rules:
- apiGroups:
  - management.harvesterhci.io
  resources:
  - upgradeplans
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - management.harvesterhci.io
  resources:
  - upgradeplans/status
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: upgrade-toolkit
  name: upgrade-toolkit-upgradeplan-viewer-role
rules:
- apiGroups:
  - management.harvesterhci.io
  resources:
  - upgradeplans
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - management.harvesterhci.io
  resources:
  - upgradeplans/status
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: upgrade-toolkit
  name: upgrade-toolkit-version-admin-role
rules:
- apiGroups:
  - management.harvesterhci.io
  resources:
  - versions
  verbs:
  - '*'
- apiGroups:
  - management.harvesterhci.io
  resources:
  - versions/status
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: upgrade-toolkit
  name: upgrade-toolkit-version-editor-role
rules:
- apiGroups:
  - management.harvesterhci.io
  resources:
  - versions
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - management.harvesterhci.io
  resources:
  - versions/status
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: upgrade-toolkit
  name: upgrade-toolkit-version-viewer-role
rules:
- apiGroups:
  - management.harvesterhci.io
  resources:
  - versions
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - management.harvesterhci.io
  resources:
  - versions/status
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: upgrade-toolkit
  name: upgrade-toolkit-leader-election-rolebinding
  namespace: upgrade-toolkit-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: upgrade-toolkit-leader-election-role
subjects:
- kind: ServiceAccount
  name: upgrade-toolkit-controller-manager
  namespace: upgrade-toolkit-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: upgrade-toolkit
  name: upgrade-toolkit-manager-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: upgrade-toolkit-manager-role
subjects:
- kind: ServiceAccount
  name: upgrade-toolkit-controller-manager
  namespace: upgrade-toolkit-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: upgrade-toolkit-metrics-auth-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: upgrade-toolkit-metrics-auth-role
subjects:
- kind: ServiceAccount
  name: upgrade-toolkit-controller-manager
  namespace: upgrade-toolkit-system
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: upgrade-toolkit
    control-plane: controller-manager
  name: upgrade-toolkit-controller-manager-metrics-service
  namespace: upgrade-toolkit-system
spec:
  ports:
  - name: https
    port: 8443
    protocol: TCP
    targetPort: 8443
  selector:
    app.kubernetes.io/name: upgrade-toolkit
    control-plane: controller-manager
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: upgrade-toolkit
  name: upgrade-toolkit-webhook-service
  namespace: upgrade-toolkit-system
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 9443
  selector:
    app.kubernetes.io/name: upgrade-toolkit
    control-plane: controller-manager
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: upgrade-toolkit
    control-plane: controller-manager
  name: upgrade-toolkit-controller-manager
  namespace: upgrade-toolkit-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: upgrade-toolkit
      control-plane: controller-manager
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: manager
      labels:
        app.kubernetes.io/name: upgrade-toolkit
        control-plane: controller-manager
    spec:
      containers:
      - args:
        - --metrics-bind-address=:8443
        - --leader-elect
        - --health-probe-bind-address=:8081
        - --webhook-cert-path=/tmp/k8s-webhook-server/serving-certs
        command:
        - upgrade-toolkit
        - manager
        env:
        - name: UPGRADE_JOB_SERVICE_ACCOUNT
          value: harvester
        - name: UPGRADE_PLAN_SERVICE_ACCOUNT
          value: system-upgrade-controller
        image: controller:latest
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8081
          initialDelaySeconds: 15
          periodSeconds: 20
        name: manager
        ports:
        - containerPort: 9443
          name: webhook-server
          protocol: TCP
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8081
          initialDelaySeconds: 5
          periodSeconds: 10
        resources:
          limits:
            cpu: 500m
            memory: 128Mi
          requests:
            cpu: 10m
            memory: 64Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /tmp/k8s-webhook-server/serving-certs
          name: webhook-certs
          readOnly: true
      securityContext:
        runAsGroup: 1000
        runAsNonRoot: true
        runAsUser: 1000
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: upgrade-toolkit-controller-manager
      terminationGracePeriodSeconds: 10
      volumes:
      - name: webhook-certs
        secret:
          secretName: webhook-server-cert
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: upgrade-toolkit-mutating-webhook-configuration
webhooks:
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: upgrade-toolkit-webhook-service
      namespace: upgrade-toolkit-system
      path: /mutate-management-harvesterhci-io-v1beta1-upgradeplan
  failurePolicy: Fail
  name: mupgradeplan-v1beta1.kb.io
  rules:
  - apiGroups:
    - management.harvesterhci.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    resources:
    - upgradeplans
  sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: upgrade-toolkit-validating-webhook-configuration
webhooks:
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: upgrade-toolkit-webhook-service
      namespace: upgrade-toolkit-system
      path: /validate-management-harvesterhci-io-v1beta1-upgradeplan
  failurePolicy: Fail
  name: vupgradeplan-v1beta1.kb.io
  rules:
  - apiGroups:
    - management.harvesterhci.io
    apiVersions:
    - v1beta1
    operations:
    - CREATE
    - UPDATE
    - DELETE
    resources:
    - upgradeplans
  sideEffects: None