kind: ConfigMap
apiVersion: v1
metadata:
  namespace: kube-system
  name: host-upgrades
  labels:
    app: host-upgrades
data:
  yum-cron.conf: |
    [commands]
    #  What kind of update to use:
    # default                            = yum upgrade
    # security                           = yum --security upgrade
    # security-severity:Critical         = yum --sec-severity=Critical upgrade
    # minimal                            = yum --bugfix update-minimal
    # minimal-security                   = yum --security update-minimal
    # minimal-security-severity:Critical =  --sec-severity=Critical update-minimal
    update_cmd = default

    # Whether a message should be emitted when updates are available,
    # were downloaded, or applied.
    update_messages = yes

    # Whether updates should be downloaded when they are available.
    download_updates = yes

    # Whether updates should be applied when they are available.  Note
    # that download_updates must also be yes for the update to be applied.
    apply_updates = yes

    # Maximum amout of time to randomly sleep, in minutes.  The program
    # will sleep for a random amount of time between 0 and random_sleep
    # minutes before running.  This is useful for e.g. staggering the
    # times that multiple systems will access update servers.  If
    # random_sleep is 0 or negative, the program will run immediately.
    # 6*60 = 360
    random_sleep = 0

    [emitters]
    # Name to use for this system in messages that are emitted.  If
    # system_name is None, the hostname will be used.
    system_name = None

    # How to send messages.  Valid options are stdio and email.  If
    # emit_via includes stdio, messages will be sent to stdout; this is useful
    # to have cron send the messages.  If emit_via includes email, this
    # program will send email itself according to the configured options.
    # If emit_via is None or left blank, no messages will be sent.
    emit_via = stdio

    # The width, in characters, that messages that are emitted should be
    # formatted to.
    output_width = 80


    [email]
    # The address to send email messages from.
    # NOTE: 'localhost' will be replaced with the value of system_name.
    email_from = root@localhost

    # List of addresses to send messages to.
    email_to = root

    # Name of the host to connect to to send email messages.
    email_host = localhost


    [groups]
    # NOTE: This only works when group_command != objects, which is now the default
    # List of groups to update
    group_list = None

    # The types of group packages to install
    group_package_types = mandatory, default

    [base]
    # This section overrides yum.conf

    # Use this to filter Yum core messages
    # -4: critical
    # -3: critical+errors
    # -2: critical+errors+warnings (default)
    debuglevel = 1

    # skip_broken = True
    mdpolicy = group:main

    # Uncomment to auto-import new gpg keys (dangerous)
    # assumeyes = True

  unattended-upgrades.conf: |
    // Override system /etc/apt/apt.conf.d/50unattended-upgrades
    #clear "Unattended-Upgrade::Allowed-Origins";

    // Automatically upgrade packages from these (origin:archive) pairs
    Unattended-Upgrade::Allowed-Origins {
    	"${distro_id}:${distro_codename}";
    	"${distro_id}:${distro_codename}-security";
    	// Extended Security Maintenance; doesn't necessarily exist for
    	// every release and this system may not have it installed, but if
    	// available, the policy for updates is such that unattended-upgrades
    	// should also install from here by default.
    	"${distro_id}ESM:${distro_codename}";
    	"${distro_id}:${distro_codename}-updates";
    //	"${distro_id}:${distro_codename}-proposed";
    //	"${distro_id}:${distro_codename}-backports";
    };

    // List of packages to not update (regexp are supported)
    Unattended-Upgrade::Package-Blacklist {
    //	"vim";
    //	"libc6";
    //	"libc6-dev";
    //	"libc6-i686";
    };

    // This option allows you to control if on a unclean dpkg exit
    // unattended-upgrades will automatically run
    //   dpkg --force-confold --configure -a
    // The default is true, to ensure updates keep getting installed
    //Unattended-Upgrade::AutoFixInterruptedDpkg "false";

    // Split the upgrade into the smallest possible chunks so that
    // they can be interrupted with SIGUSR1. This makes the upgrade
    // a bit slower but it has the benefit that shutdown while a upgrade
    // is running is possible (with a small delay)
    //Unattended-Upgrade::MinimalSteps "true";

    // Install all unattended-upgrades when the machine is shuting down
    // instead of doing it in the background while the machine is running
    // This will (obviously) make shutdown slower
    //Unattended-Upgrade::InstallOnShutdown "true";

    // Send email to this address for problems or packages upgrades
    // If empty or unset then no email is sent, make sure that you
    // have a working mail setup on your system. A package that provides
    // 'mailx' must be installed. E.g. "user@example.com"
    //Unattended-Upgrade::Mail "root";

    // Set this value to "true" to get emails only on errors. Default
    // is to always send a mail if Unattended-Upgrade::Mail is set
    //Unattended-Upgrade::MailOnlyOnError "true";

    // Do automatic removal of new unused dependencies after the upgrade
    // (equivalent to apt-get autoremove)
    Unattended-Upgrade::Remove-Unused-Dependencies "true";

    // Automatically reboot *WITHOUT CONFIRMATION*
    //  if the file /var/run/reboot-required is found after the upgrade
    //Unattended-Upgrade::Automatic-Reboot "false";

    // If automatic reboot is enabled and needed, reboot at the specific
    // time instead of immediately
    //  Default: "now"
    //Unattended-Upgrade::Automatic-Reboot-Time "02:00";

    // Use apt bandwidth limit feature, this example limits the download
    // speed to 70kb/sec
    //Acquire::http::Dl-Limit "70";
