cluster-etcd-operator/bindata/tnfdeployment/cronjob.yaml at 93c007d4a7f969ead64c6fb2744b438ef8c0f378 · openshift/cluster-etcd-operator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
apiVersion: batch/v1
kind: CronJob
metadata:
  name: <injected>
  namespace: <injected>
  labels:
    app.kubernetes.io/name: <injected>
spec:
  schedule: <injected>
  concurrencyPolicy: "Replace"
  startingDeadlineSeconds: 120
  failedJobsHistoryLimit: 3
  # successfulJobsHistoryLimit + ttlSecondsAfterFinished: TTL deletes finished Jobs before CronJob pruning (OCPBUGS-81340).
  successfulJobsHistoryLimit: 12
  jobTemplate:
    metadata:
      labels:
        app.kubernetes.io/name: <injected>
        app.kubernetes.io/component: two-node-fencing-setup
    spec:
      activeDeadlineSeconds: 90
      ttlSecondsAfterFinished: 300
      template:
        metadata:
          annotations:
            openshift.io/required-scc: "privileged"
          labels:
            app: tnf-job
            app.kubernetes.io/name: <injected>
        spec:
          terminationGracePeriodSeconds: 1
          containers:
            - name: collector
              image: <injected>
              imagePullPolicy: IfNotPresent
              terminationMessagePolicy: FallbackToLogsOnError
              command: ["<injected>"]
              resources:
                requests:
                  cpu: 10m
                  memory: 32Mi
              # Two Node Fencing (TNF) requires privileged access to run whitelisted
              # pacemaker/PCS commands for etcd fencing and cluster status collection:
              #   - sudo -n pcs status xml (cluster status)
              #   - sudo -n pcs cluster config show (node configuration)
              # privileged and allowPrivilegeEscalation are intentional to enable
              # these operations which must run as root.
              securityContext:
                privileged: true
                allowPrivilegeEscalation: true
          hostIPC: false
          hostNetwork: false
          # hostPID is required to observe host process state for pacemaker
          # resource monitoring (e.g., detecting if pacemaker daemons are running).
          hostPID: true
          # Note: automountServiceAccountToken, enableServiceLinks, and shareProcessNamespace
          # are intentionally omitted. These pointer fields default to nil and remain nil on
          # the server (unlike fields like DNSPolicy which get server-applied defaults).
          # The kubelet interprets nil as: automountServiceAccountToken=true (needed for API
          # access), enableServiceLinks=true, shareProcessNamespace=false (required since
          # hostPID=true). No drift occurs from these omissions.
          serviceAccountName: tnf-setup-manager
          priorityClassName: system-node-critical
          nodeSelector:
            node-role.kubernetes.io/master: ""
          affinity:
            nodeAffinity:
              requiredDuringSchedulingIgnoredDuringExecution:
                nodeSelectorTerms:
                - matchExpressions:
                  - key: node.kubernetes.io/not-ready
                    operator: DoesNotExist
                  - key: node.kubernetes.io/unreachable
                    operator: DoesNotExist
          tolerations:
            - key: node-role.kubernetes.io/master
              operator: Exists
              effect: NoSchedule
            - key: node.kubernetes.io/memory-pressure
              operator: Exists
              effect: NoSchedule
            - key: node.kubernetes.io/disk-pressure
              operator: Exists
              effect: NoSchedule
            - key: node.kubernetes.io/pid-pressure
              operator: Exists
              effect: NoSchedule
          restartPolicy: Never