Add daemonset tolerations where missing

apps/falco/manifests/DaemonSet-falco.yml

@@ -28,10 +28,7 @@ spec:
       serviceAccountName: falco
       priorityClassName: node-observability
       tolerations:
-        - effect: NoSchedule
-          key: node-role.kubernetes.io/master
-        - effect: NoSchedule
-          key: node-role.kubernetes.io/control-plane
+        - operator: Exists
       containers:
         - name: falco
           image: docker.io/falcosecurity/falco:0.44.1

apps/falco/release.yaml

@@ -65,3 +65,5 @@ spec:
           rollingUpdate:
             maxUnavailable: 25%
     podPriorityClassName: node-observability
+    tolerations:
+      - operator: Exists

apps/velero/Makefile

@@ -0,0 +1,28 @@
+SHELL = /usr/bin/env bash
+.PHONY: all render
+
+# Find HelmRelease and Source files
+release := $(shell yq '. | select(.kind=="HelmRelease") | filename' *.yaml)
+source := $(shell yq '. | select(.kind=="HelmRepository") | filename' *.yaml)
+
+# Fetch data from HelmRepository and HelmRelease
+name := $(shell yq '.metadata.name' $(release))
+namespace := $(shell yq '.metadata.namespace' $(release))
+version := $(shell yq '.spec.chart.spec.version' $(release))
+chart := $(shell yq '.spec.chart.spec.chart' $(release))
+values := yq '.spec.values' $(release)
+url := $(shell yq '.spec.url' $(source))
+
+# Run all tasks
+all: crds.yaml render
+
+# Generate CRDs with helm
+crds.yaml: $(release) $(source)
+	helm show crds $(chart) --repo $(url) --version $(version) > $@
+
+# Render template with helm (filtering away noisy annotations when diffing)
+render: $(release) $(source)
+	mkdir -p manifests
+	rm -rf manifests/*
+	helm template $(name) $(chart) --repo $(url) --version $(version) --namespace $(namespace) --skip-crds -f <(echo "$$($(values))") | grep -vE "helm.sh/chart|app.kubernetes.io/version" | yq -s '"manifests/" + .kind + "-" + .metadata.name'
+

apps/velero/manifests/BackupStorageLocation-azure.yml

@@ -0,0 +1,23 @@
+---
+# Source: velero/templates/backupstoragelocation.yaml
+apiVersion: velero.io/v1
+kind: BackupStorageLocation
+metadata:
+  name: azure
+  namespace: velero
+  labels:
+    app.kubernetes.io/name: velero
+    app.kubernetes.io/instance: velero
+    app.kubernetes.io/managed-by: Helm
+spec:
+  credential:
+    name: velero-credentials
+    key: cloud
+  provider: azure
+  accessMode: ${flux_velero_access_mode}
+  objectStorage:
+    bucket: "${flux_velero_azure_bucket_name}"
+  config:
+    resourceGroup: "${flux_velero_azure_resource_group}"
+    storageAccount: "${flux_velero_azure_storage_account}"
+    subscriptionId: "${flux_velero_azure_subscription_id}"

apps/velero/manifests/BackupStorageLocation-default.yml

@@ -0,0 +1,19 @@
+---
+# Source: velero/templates/backupstoragelocation.yaml
+apiVersion: velero.io/v1
+kind: BackupStorageLocation
+metadata:
+  name: default
+  namespace: velero
+  labels:
+    app.kubernetes.io/name: velero
+    app.kubernetes.io/instance: velero
+    app.kubernetes.io/managed-by: Helm
+spec:
+  provider: aws
+  accessMode: ${flux_velero_access_mode}
+  default: true
+  objectStorage:
+    bucket: "${flux_velero_aws_bucket_name}"
+  config:
+    region: "${flux_aws_region}"

apps/velero/manifests/ClusterRole-velero-upgrade-crds.yml

@@ -0,0 +1,26 @@
+---
+# Source: velero/templates/upgrade-crds/clusterrole-upgrade.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: velero-upgrade-crds
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade,pre-rollback
+    "helm.sh/hook-weight": "-5"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+  labels:
+    app.kubernetes.io/component: upgrade-crds
+    app.kubernetes.io/name: velero
+    app.kubernetes.io/instance: velero
+    app.kubernetes.io/managed-by: Helm
+rules:
+  - apiGroups:
+      - "apiextensions.k8s.io"
+    resources:
+      - "customresourcedefinitions"
+    verbs:
+      - create
+      - patch
+      - update
+      - get
+      - list

apps/velero/manifests/ClusterRoleBinding-velero-server.yml

@@ -0,0 +1,19 @@
+---
+# Source: velero/templates/clusterrolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: velero-server
+  labels:
+    app.kubernetes.io/component: server
+    app.kubernetes.io/name: velero
+    app.kubernetes.io/instance: velero
+    app.kubernetes.io/managed-by: Helm
+subjects:
+  - kind: ServiceAccount
+    namespace: velero
+    name: velero-server
+roleRef:
+  kind: ClusterRole
+  name: cluster-admin
+  apiGroup: rbac.authorization.k8s.io

apps/velero/manifests/ClusterRoleBinding-velero-upgrade-crds.yml

@@ -0,0 +1,23 @@
+---
+# Source: velero/templates/upgrade-crds/clusterrolebinding-upgrade.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: velero-upgrade-crds
+  labels:
+    app.kubernetes.io/component: upgrade-crds
+    app.kubernetes.io/name: velero
+    app.kubernetes.io/instance: velero
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade,pre-rollback
+    "helm.sh/hook-weight": "-3"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+subjects:
+  - kind: ServiceAccount
+    namespace: velero
+    name: velero-server-upgrade-crds
+roleRef:
+  kind: ClusterRole
+  name: velero-upgrade-crds
+  apiGroup: rbac.authorization.k8s.io

apps/velero/manifests/ConfigMap-velero-repo-maintenance.yml

@@ -0,0 +1,16 @@
+---
+# Source: velero/templates/repo-maintenance-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: velero-repo-maintenance
+  namespace: velero
+  labels:
+    app.kubernetes.io/name: velero
+    app.kubernetes.io/instance: velero
+    app.kubernetes.io/managed-by: Helm
+data:
+  global: |
+    {
+      "keepLatestMaintenanceJobs": 3
+    }

apps/velero/manifests/DaemonSet-node-agent.yml

@@ -0,0 +1,86 @@
+---
+# Source: velero/templates/node-agent-daemonset.yaml
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: node-agent
+  namespace: velero
+  labels:
+    app.kubernetes.io/name: velero
+    app.kubernetes.io/instance: velero
+    app.kubernetes.io/managed-by: Helm
+spec:
+  selector:
+    matchLabels:
+      name: node-agent
+  template:
+    metadata:
+      labels:
+        name: node-agent
+        role: node-agent
+        app.kubernetes.io/name: velero
+        app.kubernetes.io/instance: velero
+        app.kubernetes.io/managed-by: Helm
+      annotations:
+        prometheus.io/path: /metrics
+        prometheus.io/port: "8085"
+        prometheus.io/scrape: "true"
+    spec:
+      serviceAccountName: velero-server
+      automountServiceAccountToken: true
+      securityContext:
+        runAsUser: 0
+      terminationGracePeriodSeconds: 3600
+      volumes:
+        - name: host-pods
+          hostPath:
+            path: /var/lib/kubelet/pods
+        - name: host-plugins
+          hostPath:
+            path: /var/lib/kubelet/plugins
+        - name: scratch
+          emptyDir: {}
+      dnsPolicy: ClusterFirst
+      containers:
+        - name: node-agent
+          image: "docker.io/velero/velero:v1.18.1"
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http-monitoring
+              containerPort: 8085
+          command:
+            - /velero
+          args:
+            - node-agent
+            - server
+            - --features=EnableCSI
+            - --log-format=json
+          volumeMounts:
+            - name: host-pods
+              mountPath: /host_pods
+              mountPropagation: HostToContainer
+            - name: host-plugins
+              mountPath: /host_plugins
+              mountPropagation: HostToContainer
+            - name: scratch
+              mountPath: /scratch
+          env:
+            - name: VELERO_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: VELERO_SCRATCH_DIR
+              value: /scratch
+          securityContext:
+          resources:
+            limits:
+              memory: ${flux_velero_node_agent_pod_memory}
+            requests:
+              cpu: 5m
+              memory: ${flux_velero_node_agent_pod_memory}
+      tolerations:
+        - operator: Exists

apps/velero/manifests/Deployment-velero.yml

@@ -0,0 +1,109 @@
+---
+# Source: velero/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: velero
+  namespace: velero
+  labels:
+    app.kubernetes.io/name: velero
+    app.kubernetes.io/instance: velero
+    app.kubernetes.io/managed-by: Helm
+    component: velero
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: velero
+      app.kubernetes.io/name: velero
+  template:
+    metadata:
+      labels:
+        name: velero
+        app.kubernetes.io/name: velero
+        app.kubernetes.io/instance: velero
+        app.kubernetes.io/managed-by: Helm
+      annotations:
+    spec:
+      restartPolicy: Always
+      serviceAccountName: velero-server
+      automountServiceAccountToken: true
+      priorityClassName: cluster-infrastructure
+      terminationGracePeriodSeconds: 3600
+      containers:
+        - name: velero
+          image: "docker.io/velero/velero:v1.18.1"
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http-monitoring
+              containerPort: 8085
+          command:
+            - /velero
+          args:
+            - server
+            ### Flags
+            - --uploader-type=kopia
+            - --log-format=json
+            ### Global Flags
+            - --features=EnableCSI
+            - --repo-maintenance-job-configmap=velero-repo-maintenance
+          resources:
+            limits:
+              memory: ${flux_velero_server_pod_memory}
+            requests:
+              cpu: 100m
+              memory: ${flux_velero_server_pod_memory}
+          livenessProbe:
+            failureThreshold: 5
+            httpGet:
+              path: /metrics
+              port: http-monitoring
+              scheme: HTTP
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 5
+          readinessProbe:
+            failureThreshold: 5
+            httpGet:
+              path: /metrics
+              port: http-monitoring
+              scheme: HTTP
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 5
+          volumeMounts:
+            - name: plugins
+              mountPath: /plugins
+            - name: scratch
+              mountPath: /scratch
+          env:
+            - name: VELERO_SCRATCH_DIR
+              value: /scratch
+            - name: VELERO_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.namespace
+            - name: LD_LIBRARY_PATH
+              value: /plugins
+      dnsPolicy: ClusterFirst
+      initContainers:
+        - image: velero/velero-plugin-for-aws:v1.14.2
+          name: velero-plugin-for-aws
+          volumeMounts:
+            - mountPath: /target
+              name: plugins
+        - image: velero/velero-plugin-for-microsoft-azure:v1.14.2
+          name: velero-plugin-for-microsoft-azure
+          volumeMounts:
+            - mountPath: /target
+              name: plugins
+      volumes:
+        - name: plugins
+          emptyDir: {}
+        - name: scratch
+          emptyDir: {}