01-master.yaml

#cloud-config

write_files:
  - path: "/etc/flannel/options.env"
    permissions: "0755"
    content: |
        FLANNELD_IFACE=$private_ipv4
        FLANNELD_ETCD_ENDPOINTS=https://${ETCD_IP}:2379
        FLANNELD_ETCD_CAFILE=/etc/ssl/etcd/ca.pem
        FLANNELD_ETCD_CERTFILE=/etc/ssl/etcd/client.pem
        FLANNELD_ETCD_KEYFILE=/etc/ssl/etcd/client-key.pem
  - path: "/etc/systemd/system/flanneld.service.d/40-ExecStartPre-symlink.conf"
    permissions: "0755"
    content: |
        [Service]
        ExecStartPre=/usr/bin/ln -sf /etc/flannel/options.env /run/flannel/options.env
  - path: "/etc/systemd/system/docker.service.d/40-flannel.conf"
    permissions: "0755"
    content: |
        [Unit]
        Requires=flanneld.service
        After=flanneld.service
  - path: "/etc/systemd/system/kubelet.service"
    permissions: "0755"
    content: |
        [Service]
        Environment=KUBELET_IMAGE_TAG=${HYPERKUBE_VERSION}
        Environment="RKT_RUN_ARGS=--uuid-file-save=/var/run/kubelet-pod.uuid \
          --volume var-log,kind=host,source=/var/log \
          --mount volume=var-log,target=/var/log \
          --volume dns,kind=host,source=/etc/resolv.conf \
          --mount volume=dns,target=/etc/resolv.conf"
        ExecStartPre=/usr/bin/mkdir -p /etc/kubernetes/manifests
        ExecStartPre=/usr/bin/mkdir -p /var/log/containers
        ExecStartPre=-/usr/bin/rkt rm --uuid-file=/var/run/kubelet-pod.uuid
        ExecStart=/usr/lib/coreos/kubelet-wrapper \
          --anonymous-auth=false \
          --client-ca-file=/etc/kubernetes/ssl/ca.pem \
          --api-servers=http://127.0.0.1:8080 \
          --network-plugin-dir=/etc/kubernetes/cni/net.d \
          --container-runtime=docker \
          --allow-privileged=true \
          --pod-manifest-path=/etc/kubernetes/manifests \
          --hostname-override=$private_ipv4 \
          --cluster-dns=${DNS_SERVICE_IP} \
          --cluster-domain=cluster.local \
          --node-labels=kubernetes.io/role=master \
          --register-with-taints=node-role.kubernetes.io/master=:NoSchedule
        ExecStop=-/usr/bin/rkt stop --uuid-file=/var/run/kubelet-pod.uuid
        Restart=always
        RestartSec=10

        [Install]
        WantedBy=multi-user.target
  - path: "/etc/kubernetes/manifests/kube-apiserver.yaml"
    permissions: "0755"
    content: |
        apiVersion: v1
        kind: Pod
        metadata:
          name: kube-apiserver
          namespace: kube-system
        spec:
          hostNetwork: true
          containers:
          - name: kube-apiserver
            image: quay.io/coreos/hyperkube:${HYPERKUBE_VERSION}
            command:
            - /hyperkube
            - apiserver
            - --bind-address=0.0.0.0
            - --etcd-servers=https://${ETCD_IP}:2379
            - --etcd-cafile=/etc/kubernetes/ssl/ca.pem
            - --etcd-certfile=/etc/kubernetes/ssl/client.pem
            - --etcd-keyfile=/etc/kubernetes/ssl/client-key.pem
            - --kubelet-client-certificate=/etc/kubernetes/ssl/client.pem
            - --kubelet-client-key=/etc/kubernetes/ssl/client-key.pem
            - --allow-privileged=true
            - --service-cluster-ip-range=${SERVICE_IP_RANGE}
            - --secure-port=443
            - --storage-backend=etcd2
            - --advertise-address=$private_ipv4
            - --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota
            - --tls-cert-file=/etc/kubernetes/ssl/apiserver.pem
            - --tls-private-key-file=/etc/kubernetes/ssl/apiserver-key.pem
            - --client-ca-file=/etc/kubernetes/ssl/ca.pem
            - --service-account-key-file=/etc/kubernetes/ssl/apiserver-key.pem
            - --anonymous-auth=false
            livenessProbe:
              httpGet:
                host: 127.0.0.1
                port: 8080
                path: /healthz
              initialDelaySeconds: 15
              timeoutSeconds: 15
            ports:
            - containerPort: 443
              hostPort: 443
              name: https
            - containerPort: 8080
              hostPort: 8080
              name: local
            volumeMounts:
            - mountPath: /etc/kubernetes/ssl
              name: ssl-certs-kubernetes
              readOnly: true
            - mountPath: /etc/ssl/certs
              name: ssl-certs-host
              readOnly: true
          volumes:
          - hostPath:
              path: /etc/kubernetes/ssl
            name: ssl-certs-kubernetes
          - hostPath:
              path: /usr/share/ca-certificates
            name: ssl-certs-host
  - path: "/etc/kubernetes/manifests/kube-proxy.yaml"
    permissions: "0755"
    content: |
        apiVersion: v1
        kind: Pod
        metadata:
          name: kube-proxy
          namespace: kube-system
        spec:
          hostNetwork: true
          containers:
          - name: kube-proxy
            image: quay.io/coreos/hyperkube:${HYPERKUBE_VERSION}
            command:
            - /hyperkube
            - proxy
            - --master=http://127.0.0.1:8080
            - --proxy-mode=iptables
            securityContext:
              privileged: true
            volumeMounts:
            - mountPath: /etc/ssl/certs
              name: ssl-certs-host
              readOnly: true
          volumes:
          - hostPath:
              path: /usr/share/ca-certificates
            name: ssl-certs-host
  - path: "/etc/kubernetes/manifests/kube-controller-manager.yaml"
    permissions: "0755"
    content: |
        apiVersion: v1
        kind: Pod
        metadata:
          name: kube-controller-manager
          namespace: kube-system
        spec:
          hostNetwork: true
          containers:
          - name: kube-controller-manager
            image: quay.io/coreos/hyperkube:${HYPERKUBE_VERSION}
            command:
            - /hyperkube
            - controller-manager
            - --master=http://127.0.0.1:8080
            - --leader-elect=true
            - --service-account-private-key-file=/etc/kubernetes/ssl/apiserver-key.pem
            - --root-ca-file=/etc/kubernetes/ssl/ca.pem
            livenessProbe:
              httpGet:
                host: 127.0.0.1
                path: /healthz
                port: 10252
              initialDelaySeconds: 15
              timeoutSeconds: 1
            volumeMounts:
            - mountPath: /etc/kubernetes/ssl
              name: ssl-certs-kubernetes
              readOnly: true
            - mountPath: /etc/ssl/certs
              name: ssl-certs-host
              readOnly: true
          volumes:
          - hostPath:
              path: /etc/kubernetes/ssl
            name: ssl-certs-kubernetes
          - hostPath:
              path: /usr/share/ca-certificates
            name: ssl-certs-host
  - path: "/etc/kubernetes/manifests/kube-scheduler.yaml"
    permissions: "0755"
    content: |
        apiVersion: v1
        kind: Pod
        metadata:
          name: kube-scheduler
          namespace: kube-system
        spec:
          hostNetwork: true
          containers:
          - name: kube-scheduler
            image: quay.io/coreos/hyperkube:${HYPERKUBE_VERSION}
            command:
            - /hyperkube
            - scheduler
            - --master=http://127.0.0.1:8080
            - --leader-elect=true
            livenessProbe:
              httpGet:
                host: 127.0.0.1
                path: /healthz
                port: 10251
              initialDelaySeconds: 15
              timeoutSeconds: 15