system-upgrade-controller

System Upgrade Controller

Chainguard's redistribution of the System Upgrade Controller Helm chart, pre-configured with hardened Chainguard Images.

The System Upgrade Controller is a Kubernetes-native controller that safely automates node OS and Kubernetes upgrades. It reconciles user-authored Plan resources into Jobs that run on the selected nodes, coordinating drains, reboots, and upgrade scripts across the cluster.

Prerequisites

Authentication is required to access this chart. First, authenticate with Chainguard and configure your environment:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create an image pull secret in the target namespace:

kubectl create namespace cattle-system
kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace cattle-system

Installation

helm install system-upgrade-controller \
  oci://cgr.dev/ORGANIZATION/charts/system-upgrade-controller \
  --namespace cattle-system \
  --create-namespace \
  --set global.cattle.imagePullSecrets[0].name=cgr-pull-secret

About This Chart

This is a redistribution of the upstream Rancher System Upgrade Controller Helm chart. All upstream configuration options apply.

The chart installs the Plan Custom Resource Definition (in the upgrade.cattle.io API group), the controller Deployment, and the RBAC required to reconcile Plan resources into upgrade Jobs.

For full documentation, see: https://github.com/rancher/system-upgrade-controller