values.yaml

# Default values for kube-node-init
image:
  repository: mumoshu/kube-node-init
  tag: 0.1.0
  pullPolicy: IfNotPresent
  ## It is possible to specify docker registry credentials
  ## See https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
  # pullSecrets:
  #    - name: regsecret

script: |
  ls /var/node-init/chrony.conf
  echo
  cat /var/node-init/chrony.conf
  echo 
  systemctl status chronyd
  cp /etc/chrony.conf{,.old}
  cp /var/node-init/chrony.conf /etc/chrony.conf
  echo
  diff --unified /etc/chrony.conf{.old,}
  echo
  systemctl restart chronyd
  echo
  systemctl status chronyd

sysctl:
  # When enabled, host's /proc/sys is mounted under /host/proc/sys and the following kernel params are set
  enabled: true
  params:
    # default: 812152
    #fs.file-max: 400143
    # default: 128
    net.core.somaxconn: 65535
    # default: 256
    net.ipv4.tcp_max_syn_backlog: 65535
    # dfault: 1000
    net.core.netdev_max_backlog: 16384
    # default: 32768 60999
    net.ipv4.ip_local_port_range: 1024 65535
    # default: 0
    # enable(1) to optimize against short-lived sessions
    net.ipv4.tcp_tw_reuse: 1
    # default: 7200
    net.ipv4.tcp_keepalive_time: 200
    # default: 75
    net.ipv4.tcp_keepalive_intvl: 60
    # default: 9
    net.ipv4.tcp_keepalive_probes: 3
    # default: 6
    net.ipv4.tcp_syn_retries: 5

# useHostNetwork: true

useHostPID: true

## Annotations to add to the DaemonSet's Pods
# podAnnotations:
#   scheduler.alpha.kubernetes.io/tolerations: '[{"key": "example", "value": "foo"}]'

## Allow the DaemonSet to schedule on tainted nodes (requires Kubernetes >= 1.6)
# tolerations: []

## Allow the DaemonSet to schedule on selected nodes
# Ref: https://kubernetes.io/docs/user-guide/node-selection/
# nodeSelector: {}

## Allow the DaemonSet to schedule ussing affinity rules
# Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
# affinity: {}

## Allow the DaemonSet to perform a rolling update on helm update
## ref: https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/
updateStrategy: RollingUpdate

## Sets PriorityClassName if defined
# priorityClassName:

## You can modify the security context used to run the containers by
## modifying the label type below:
securityContext:
  # especially /proc/sys mount fails without this: Error: failed to start container "node-init": Error response from daemon: OCI runtime create failed: container_linux.go:348: starting container process caused "process_linux.go:402: container init caused \"rootfs_linux.go:58: mounting \\\"/proc/sys\\\" to rootfs \\\"/var/lib/docker/overlay2/b708076b3b2c02e544f4bb8cbf33ac66f68ce41830cc34232f8dca194be49586/merged\\\" at \\\"/proc/sys\\\" caused \\\"\\\\\\\"/var/lib/docker/overlay2/b708076b3b2c02e544f4bb8cbf33ac66f68ce41830cc34232f8dca194be49586/merged/proc/sys\\\\\\\" cannot be mounted because it is located inside \\\\\\\"/proc\\\\\\\"\\\"\"": unknown
  privileged: true
#   seLinuxOptions:
#     seLinuxLabel: "spc_t"

## Daemonset container name
name: node-init

## The dd-agent supports many environment variables
## ref: https://github.com/DataDog/node-init-agent/tree/master/Dockerfiles/agent#environment-variables
##
# env:
#   - name:
#     value:

## If needed, you can specify additionnal volumes to mount in the container
volumes:
- name: var
  hostPath:
    path: /var
    type: Directory
- name: run
  hostPath:
    path: /run
    type: Directory
- name: usr-lib-systemd
  hostPath:
    path: /usr/lib/systemd
    type: Directory
- name: etc
  hostPath:
    path: /etc
    type: Directory
volumeMounts:
- name: var
  mountPath: /var
- name: run
  mountPath: /run
- name: usr-lib-systemd
  mountPath: /usr/lib/systemd
- name: etc
  mountPath: /etc

  ## Override the agent's liveness probe logic from the default:
# livenessProbe:
#   exec:
#     command: ["/bin/true"]

## Override the agent's readiness probe logic from the default:
# readinessProbe:
#   exec:
#     command: ["/bin/true"]

## node-init-agent resource requests and limits
## Make sure to keep requests and limits equal to keep the pods in the Guaranteed QoS class
## Ref: http://kubernetes.io/docs/user-guide/compute-resources/
##
resources:
  requests:
    cpu: 100m
    memory: 32Mi
  limits:
    cpu: 100m
    memory: 32Mi

rbac:
  ## If true, create & use RBAC resources
  create: true

  ## Ignored if rbac.create is true
  serviceAccountName: default

tolerations: []

configMaps:
  node-init:
    enabled: true
    mountPath: /var/node-init
    templates:
      "run": |-
        #!/bin/bash
        set -euo pipefail

        trap 'kill $(jobs -p); exit 0' TERM

        name={{ template "node-init.fullname" . }}

        echo "$name started."

        st_hash_file="/host/var/$name"
        if [[ ! -f "$st_hash_file" ]]; then
          touch "$st_hash_file"
        fi

        st_tar_hash={{ toYaml . | sha256sum }}
        st_cur_hash=$(cat "$st_hash_file")
        if [[ "$st_tar_hash" != "$st_cur_hash" ]]; then
          echo "init script must be run."

          {{ if .Values.sysctl.enabled -}}
          set_kernel_param() {
            k=$1
            v=$2
            path=/host/proc/sys/$(echo $k | sed -e 's/\./\//g')
            c=$(if [ -f $path ]; then cat $path; fi)
            if [ "$c" != "$v" ]; then
              echo changing $k: "$c => $v"
              echo "$k = $v" >> /etc/sysctl.d/80-node-init.conf
            else
              echo retaining $k: "$c"
            fi
          }
          printf "" > /etc/sysctl.d/80-node-init.conf
          {{ range $k, $v := .Values.sysctl.params -}}
          set_kernel_param "{{ $k }}" "{{ $v }}"
          {{ end -}}
          echo using /etc/sysctl.d/80-node-init.conf
          cat /etc/sysctl.d/80-node-init.conf
          echo running update-sysctl
          cat <<EOF > /etc/systemd/system/update-sysctl.service
        [Unit]
        Description=Update sysctl values written by kube-node-init
        [Service]
        ExecStart=/usr/lib/systemd/systemd-sysctl
        EOF
          systemctl daemon-reload
          systemctl restart update-sysctl
          {{- end }}

        {{ .Values.script | indent 2 }}
        fi

        echo "$name" finished.

        while true; do
          sleep 60 &
          wait $!
        done
    files:
      "chrony.conf": |-
        ##
        ## DO NOT MANUALLY EDIT THIS FILE
        ## This file is generated by kube-node-init
        ##

        # use the local instance NTP service, if available
        server 169.254.169.123 prefer iburst

        # Use public servers from the pool.ntp.org project.
        # Please consider joining the pool (http://www.pool.ntp.org/join.html).
        pool 2.amazon.pool.ntp.org iburst

        # Record the rate at which the system clock gains/losses time.
        driftfile /var/lib/chrony/drift

        # Allow the system clock to be stepped in the first three updates
        # if its offset is larger than 1 second.
        makestep 1.0 3

        # Allow NTP client access from local network.
        #allow 192.168.0.0/16
        allow 127.0.0.1/32

        # Specify file containing keys for NTP authentication.
        keyfile /etc/chrony.keys

        # Specify directory for log files.
        logdir /var/log/chrony

        # Select which information is logged.
        #log measurements statistics tracking

        # save data between restarts for fast re-load
        dumponexit
        dumpdir /var/run/chrony

  # default:
  #   enabled: false
  #   mountPath: /config-default
  #   annotations:
  #     name: value
  #   labels:
  #     name: value
  #   env:
  #     ENV_NAME: ENV_VALUE
  #   files:
  #     "test.txt": |-
  #         ...
  #     "test.yaml":
  #         group:
  #           key: value

secrets: {}
  # default:
  #   enabled: false
  #   mountPath: /secret-default
  #   annotations:
  #     name: value
  #   labels:
  #     name: value
  #   env:
  #     ENV_NAME: ENV_VALUE
  #   files:
  #     "test.crt": |-
  #         ...
  #     "test.yaml":
  #         group:
  #           key: value