kbootcd

The Kubernetes Bootc Daemon is a node-level agent that automates OS image updates for Kubernetes nodes using bootc.

Operation

The daemon runs a reconciliation loop that continuously aligns the node's OS image with a desired target by performing the following steps:

1. Read Desired State: It reads the target OS image digest or reference from a local file, which is typically mounted via a Kubernetes ConfigMap.
2. Evaluate Current State: It queries the host using bootc status to determine the currently booted and staged image layers.
3. Stage Update: If the desired image differs from the booted image and is not yet staged, the agent executes bootc switch to stage the new OS image layer on the host.
4. Maintenance Window Validation: If an update is staged and requires a reboot, the daemon waits for the host time to enter the configured maintenance window.
5. Cluster Coordination: To prevent simultaneous node restarts, it attempts to acquire a distributed lock via a Kubernetes Lease object in the cluster.
6. Health Check: It verifies that all other nodes in the cluster are in a Ready state before proceeding with node disruption.
7. Drain and Reboot: After acquiring the lock and confirming cluster health, it safely cordons the node, evicts running workloads, and issues a host reboot.
8. Restore: After the node reboots with the updated OS image, it automatically uncordons the node to resume scheduling and releases the distributed lock.

Configuration

Kubernetes Bootc Daemon

Usage:
  kbootcd [flags]

Flags:
      --config-path string       Path to the ConfigMap mount containing the desired digest (default "/etc/bootc-config/target_image")
      --end-time string          schedule reboot only before this time of day (default "23:59:59")
  -h, --help                     help for kbootcd
      --interval duration        How often to run the reconciliation loop (default 5m0s)
      --lease-name string        Name of the cluster-wide coordination lease (default "bootc-upgrade-lock")
      --lease-namespace string   Namespace of the coordination lease (default "kube-system")
      --log-format string        Log format. Valid values: text, json (default "text")
      --log-level string         Log level. Valid values: DEBUG, INFO, WARN, ERROR (default "INFO")
      --reboot-days strings      schedule reboot on these days (default [Sunday,Monday,Tuesday,Wednesday,Thursday,Friday,Saturday])
      --start-time string        schedule reboot only after this time of day (default "0:00")
      --time-zone string         use this timezone for schedule inputs (default "UTC")

Environment Variables

• NODE_NAME: The name of the Kubernetes node the daemon is running on. Must be set to identify the node for API operations and the node drain process.