Cluster update module (shturval-update)

About the service #

Contents #

1. Review
2. Architecture
3. Installation/deployment
4. Diagnostics
5. Lifecycle
6. Operator parameters
7. CRD/API reference

1. Review #

Purpose: the shturval-update operator updates the Shturval platform to the version specified in ShturvalUpdate.spec.version, checks the availability of versions through the update channel and can launch the update on a cron schedule.

Features #

Initiation scripts #

Limitations and implications #

Place in the chain of command #

Update control chain #

In the operational chain, the administrator or automation sets the target version via ShturvalUpdate. ShturvalUpdateChannel prepopulates the list of available versions from the registry. If a schedule is used, ShturvalUpdateSchedule selects the appropriate version from the channel resource status and patches the default update resource. ShturvalUpdate then performs the update phases and reflects the progress of the process in status.ready and status.conditions.

Key Features #

Controllers #

2. Architecture #

Workload Components #

Deployment architecture #

Interaction with external systems #

Update Resource Links #

Access to child clusters #

If the update phase accesses a child cluster, the operator expects a Secret with kubeconfig:

apiVersion: v1
kind: Secret
metadata:
  name: <clusterId>-kubeconfig
  namespace: <clusterId>
type: Opaque
stringData:
  value: |
    apiVersion: v1
    kind: Config
    clusters:
    - name: <cluster>
      cluster:
        server: https://<api-server>
        certificate-authority-data: <base64-ca>
    contexts:
    - name: <cluster>
      context:
        cluster: <cluster>
        user: <user>
    current-context: <cluster>
    users:
    - name: <user>
      user:
        token: <token>    

SSH keys and passphrase-protected SSH keys are not read by this circuit: kubeconfig from the value key is used for access.

3. Installation / deployment #

The delivery includes two Helm charts: shturval-update-crds for the CRD and shturval-update for the controller. The installation must first deliver the CRD, then the main chart with Deployment, RBAC, webhook and related objects.

Note: any changes to installation parameters must be made in concert with the platform via ShturvalServicePatch (SSP) or other approved service management mechanism, without manual changes that bypass the platform lifecycle.

Minimum installation order #

4. Diagnostics #

Diagnostics are based on the CR and conditions status fields. The original technical manual does not have a ready set of operational kubectl get/logs commands, so the test commands are not duplicated here.

General symptoms #

Conditions ShturvalUpdate #

Conditions ShturvalUpdateChannel #

ShturvalUpdateChannel has no separate conditions defined. The fields status.ready, status.currentversion, status.lastchecked and status.availableupdates are used for diagnostics.

Conditions ShturvalUpdateSchedule #

5. Life cycle #

End-to-end update lifecycle #

Update via ShturvalUpdate #

Finalizer: update.shturval.tech/finalizer. When deleted, the operator removes the finalizer and completes the reconcile.

Reconcile ShturvalUpdate #

Checking the update channel #

Finalizer: update.shturval.tech/finalizer. When deleting a channel resource, the operator removes the finalizer.

Reconcile ShturvalUpdateChannel #

Scheduled update #

When deleting ShturvalUpdateSchedule, the operator prohibits deletion if the default ShturvalUpdate.spec.followSchedule points to the schedule to be deleted; otherwise it removes the finalizer.

Reconcile ShturvalUpdateSchedule #

Resource Negotiation Protocol #

6. Operator parameters #

Process flags #

Environment Variables #

| Variable | Default/Source | Purpose | |————|———————————|————|| WATCH_NAMESPACE | shturval-update-system if env is missing | namespace of reconciler work | | SYNC_PERIOD | 60m | retry interval for ShturvalUpdateChannel | | SCHEDULE_SYNC_PERIOD | at runtime 60m, Helm default 10m | retry interval for ShturvalUpdateSchedule | | SYSTEM_REGISTRY | r.shturval.tech | registry host; operator adds schema and path /repository/shturval_bin_public | | SYSTEM_REGISTRY_INSECURE | false; auto true for non-default registry without env | insecure HTTP client mode for registry | | ENABLE_WEBHOOKS | enabled if not false | webhook registration | | GODEBUG | tlsmlkem=0 | runtime/build Go option |

7. CRD/API reference #

API group/version for all resources: update.shturval.tech/v1beta1.

ShturvalUpdate (su, shup, shupdate) — Namespaced #

Conditions ShturvalUpdate are listed in the Diagnostics section.

ShturvalUpdateChannel (suc, shupch, shupdatechannel) — Namespaced #

Conditions for ShturvalUpdateChannel are not defined.

ShturvalUpdateSchedule — Namespaced #

There is no ShortName marker for ShturvalUpdateSchedule. #QUESTION: is a short alias necessary?for kubectl.

Conditions ShturvalUpdateSchedule are listed in the Diagnostics section.

Where to configure #

Services and repositories → Installed services → shturval-update → Manage. More details: Update Kubernetes.