---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: yum-cron-install
  namespace: kube-system
spec:
  selector:
    matchLabels:
      name: yum-cron-install
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        name: yum-cron-install
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: v1.machine-controller.kubermatic.io/operating-system
                operator: In
                values:
                - amzn
                - centos
                - rhel
            - matchExpressions:
              - key: v1.kubeone.io/operating-system
                operator: In
                values:
                - amzn
                - centos
                - rhel
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
      hostPID: true
      containers:
      - name: "yum-cron-install"
        image: "alpine:3.12.4"
        imagePullPolicy: IfNotPresent
        securityContext:
          privileged: true
        command:
        - /bin/sh
        - -c
        - |
          set -xeuo pipefail
          apk add --no-cache bash util-linux
          nsenter -t 1 -m -u -i -n -p -- bash -c "${STARTUP_SCRIPT}"
          sleep inf
        env:
        - name: STARTUP_SCRIPT
          value: |
            set -xeuo pipefail

            source /etc/os-release

            case "$ID$VERSION_ID" in
            amzn2 | centos7 | rhel7*)
              yum install -y yum-cron
              sed -i 's/apply_updates = no/apply_updates = yes/' /etc/yum/yum-cron.conf
              sed -i 's/update_cmd = default/update_cmd = security/' /etc/yum/yum-cron.conf
              systemctl enable --now yum-cron
              ;;
            centos8 | rhel8*)
              dnf install -y dnf-automatic
              sed -i 's/apply_updates = no/apply_updates = yes/' /etc/dnf/automatic.conf
              sed -i 's/upgrade_type = default/upgrade_type = security/' /etc/dnf/automatic.conf
              systemctl enable --now dnf-automatic.timer
              ;;
            *)
              echo "unknown version"
              cat /etc/os-release
              exit 1
              ;;
            esac
