CoreOS Linux -> Flatcar upgrader

flatcar-upgrader.jsonnet

local kube = import "https://github.com/anguslees/k8s-home/raw/3818a2cd0c2065ee81c43c6fff5ef53b4d19825d/kube.libsonnet";
local utils = import "https://github.com/anguslees/k8s-home/raw/3818a2cd0c2065ee81c43c6fff5ef53b4d19825d/utils.libsonnet";

{
  flatcar_upgrader: kube.DaemonSet("flatcar-upgrader") {
    spec+: {
      template+: {
        spec+: {
          nodeSelector+: {
            "container-linux-update.v1.coreos.com/id": "coreos",
          },
          volumes_: {
            root: kube.HostPathVolume("/"),
          },
          hostPID: true, // required for systemctl
          initContainers_+: {
            upgrade: utils.shcmd("upgrade") {
              securityContext+: {privileged: true},
              volumeMounts_+: {
                root: {mountPath: "/target", mountPropagation: "Bidirectional"},
              },
              command: ["chroot", "/target"] + super.command,
              // Slightly modified version of
              // https://docs.flatcar-linux.org/update-to-flatcar.sh
              shcmd: |||
                d=/run/flatcar-update
                mkdir -p $d
                cat <<EOF >$d/key
                -----BEGIN PUBLIC KEY-----
                MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw/NZ5Tvc93KynOLPDOxa
                hyAGRKB2NvgF9l2A61SsFw5CuZc/k02u1/BvFehK4XL/eOo90Dt8A2l28D/YKs7g
                2IPUSAnA9hc5OKBbpHsDzisxlAh7kg4FpeeJJWJMzO8NDCG5NZVqXEpGjCmX0qSh
                5MLiTDr9dU2YhLo93/92dKnTvsLjUVv5wnuF55Lt2wJv4CbxVn4hHwotGfSomTBO
                +7o6hE3VIIo1C6lkP+FAqMyWKA9s6U0x4tGxCXszW3hPWOANLIT4m0e55ayxiy5A
                ESEVW/xx6Rul75u925m21AqA6wwaEB6ZPKTnUiWoNKNv1xi8LPIz12+0nuE6iT1K
                jQIDAQAB
                -----END PUBLIC KEY-----
                EOF
                umount /usr/share/update_engine/update-payload-key.pub.pem || :
                mount --bind $d/key /usr/share/update_engine/update-payload-key.pub.pem
                sed -i '$a\
                SERVER=https://public.update.flatcar-linux.net/v1/update/
                /^SERVER=/d' /etc/coreos/update.conf
                umount /usr/share/coreos/release || :
                sed -E 's/(COREOS_RELEASE_VERSION=).*/\10.0.0/' </usr/share/coreos/release >$d/release
                mount --bind $d/release /usr/share/coreos/release
                systemctl restart update-engine
                echo "Success. Waiting for regular update/reboot cycle."
              |||,
            },
          },
          containers_: {
            pause: kube.Container("pause") {
              image: "k8s.gcr.io/pause:3.1",
            },
          },
        },
      },
    },
  },
}

flatcar-upgrader.yaml

---
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  labels:
    name: flatcar-upgrader
  name: flatcar-upgrader
spec:
  selector:
    matchLabels:
      name: flatcar-upgrader
  template:
    metadata:
      labels:
        name: flatcar-upgrader
    spec:
      containers:
      - args: []
        env: []
        image: k8s.gcr.io/pause:3.1
        imagePullPolicy: IfNotPresent
        name: pause
        ports: []
        stdin: false
        tty: false
        volumeMounts: []
      hostPID: true
      initContainers:
      - args: []
        command:
        - chroot
        - /target
        - /bin/sh
        - -e
        - -x
        - -c
        - |
          d=/run/flatcar-update
          mkdir -p $d
          cat <<EOF >$d/key
          -----BEGIN PUBLIC KEY-----
          MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw/NZ5Tvc93KynOLPDOxa
          hyAGRKB2NvgF9l2A61SsFw5CuZc/k02u1/BvFehK4XL/eOo90Dt8A2l28D/YKs7g
          2IPUSAnA9hc5OKBbpHsDzisxlAh7kg4FpeeJJWJMzO8NDCG5NZVqXEpGjCmX0qSh
          5MLiTDr9dU2YhLo93/92dKnTvsLjUVv5wnuF55Lt2wJv4CbxVn4hHwotGfSomTBO
          +7o6hE3VIIo1C6lkP+FAqMyWKA9s6U0x4tGxCXszW3hPWOANLIT4m0e55ayxiy5A
          ESEVW/xx6Rul75u925m21AqA6wwaEB6ZPKTnUiWoNKNv1xi8LPIz12+0nuE6iT1K
          jQIDAQAB
          -----END PUBLIC KEY-----
          EOF
          umount /usr/share/update_engine/update-payload-key.pub.pem || :
          mount --bind $d/key /usr/share/update_engine/update-payload-key.pub.pem
          sed -i '$a\
          SERVER=https://public.update.flatcar-linux.net/v1/update/
          /^SERVER=/d' /etc/coreos/update.conf
          umount /usr/share/coreos/release || :
          sed -E 's/(COREOS_RELEASE_VERSION=).*/\10.0.0/' </usr/share/coreos/release >$d/release
          mount --bind $d/release /usr/share/coreos/release
          systemctl restart update-engine
          echo "Success. Waiting for regular update/reboot cycle."
        env: []
        image: busybox
        imagePullPolicy: IfNotPresent
        name: upgrade
        ports: []
        securityContext:
          privileged: true
        stdin: false
        tty: false
        volumeMounts:
        - mountPath: /target
          mountPropagation: Bidirectional
          name: root
      nodeSelector:
        container-linux-update.v1.coreos.com/id: coreos
      terminationGracePeriodSeconds: 30
      volumes:
      - hostPath:
          path: /
          type: ""
        name: root
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate

(Added the expanded YAML, for people who are still using that.)