forked from caseydavenport/kube-cluster
-
Notifications
You must be signed in to change notification settings - Fork 0
/
master-config-template.yaml
199 lines (189 loc) · 7.38 KB
/
master-config-template.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
#cloud-config
---
write_files:
# Network config file for the Calico CNI plugin.
- path: /etc/cni/net.d/10-calico.conf
owner: root
permissions: 0755
content: |
{
"name": "calico-k8s-network",
"type": "calico",
"etcd_authority": "172.18.18.101:2379",
"log_level": "info",
"ipam": {
"type": "calico-ipam"
}
}
# Get the certificates for the master.
- path: /opt/bin/get-certs.sh
owner: root
permissions: 0755
content: |
#!/bin/bash
sudo mkdir -p /etc/kubernetes/ssl/
sudo wget -N -P /etc/kubernetes/ssl/ http://172.18.18.1:8000/ca.pem
sudo wget -N -P /etc/kubernetes/ssl/ http://172.18.18.1:8000/apiserver.pem
sudo wget -N -P /etc/kubernetes/ssl/ http://172.18.18.1:8000/apiserver-key.pem
# Set permissions.
sudo chmod 600 /etc/kubernetes/ssl/*-key.pem
sudo chown root:root /etc/kubernetes/ssl/*-key.pem
coreos:
update:
reboot-strategy: off
etcd2:
name: "etcdserver"
listen-client-urls: http://0.0.0.0:2379
advertise-client-urls: http://$private_ipv4:2379
initial-cluster: etcdserver=http://$private_ipv4:2380
initial-advertise-peer-urls: http://$private_ipv4:2380
listen-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001
listen-peer-urls: http://0.0.0.0:2380
fleet:
metadata: "role=master"
etcd_servers: "http://localhost:2379"
units:
- name: etcd2.service
command: start
- name: fleet.service
command: start
- name: kube-apiserver.service
command: start
content: |
[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
Requires=etcd2.service get-certs.service
After=etcd2.service
[Service]
ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v1.2.0-alpha.8/bin/linux/amd64/kube-apiserver
ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-apiserver
ExecStart=/opt/bin/kube-apiserver \
--allow-privileged=true \
--etcd-servers=http://127.0.0.1:2379 \
--secure-port=443 \
--bind-address=0.0.0.0 \
--advertise-address=172.18.18.101 \
--insecure-bind-address=127.0.0.1 \
--service-cluster-ip-range=10.100.0.0/24 \
--runtime-config=extensions/v1beta1=true,extensions/v1beta1/thirdpartyresources=true \
--admission-control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota \
--tls-cert-file=/etc/kubernetes/ssl/apiserver.pem \
--tls-private-key-file=/etc/kubernetes/ssl/apiserver-key.pem \
--client-ca-file=/etc/kubernetes/ssl/ca.pem \
--service-account-key-file=/etc/kubernetes/ssl/apiserver-key.pem \
--logtostderr=true
Restart=always
RestartSec=10
- name: kube-controller-manager.service
command: start
content: |
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
Requires=kube-apiserver.service
After=kube-apiserver.service
[Service]
ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v1.2.0-alpha.8/bin/linux/amd64/kube-controller-manager
ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-controller-manager
ExecStart=/opt/bin/kube-controller-manager \
--master=127.0.0.1:8080 \
--service-account-private-key-file=/etc/kubernetes/ssl/apiserver-key.pem \
--root-ca-file=/etc/kubernetes/ssl/ca.pem
--logtostderr=true
Restart=always
RestartSec=10
- name: kube-scheduler.service
command: start
content: |
[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
Requires=kube-apiserver.service
After=kube-apiserver.service
[Service]
ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v1.2.0-alpha.8/bin/linux/amd64/kube-scheduler
ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-scheduler
ExecStart=/opt/bin/kube-scheduler --master=127.0.0.1:8080
Restart=always
RestartSec=10
- name: calico-node.service
runtime: true
command: start
content: |
[Unit]
Description=calicoctl node
After=docker.service
Requires=docker.service
[Service]
User=root
Environment="ETCD_AUTHORITY=172.18.18.101:2379"
PermissionsStartOnly=true
ExecStartPre=/usr/bin/wget -N -P /opt/bin https://github.com/projectcalico/calico-containers/releases/download/v0.17.0/calicoctl
ExecStartPre=/usr/bin/chmod +x /opt/bin/calicoctl
ExecStartPre=/opt/bin/calicoctl pool add 192.168.0.0/16 --nat-outgoing
ExecStart=/opt/bin/calicoctl node --detach=false --node-image=calico/node:v0.17.0-k8s-policy
Restart=always
RestartSec=10
[Install]
WantedBy=multi-user.target
- name: kubelet.service
runtime: true
command: start
content: |
[Unit]
Description=Kubernetes Kubelet
Documentation=https://github.com/kubernetes/kubernetes
After=docker.service
Requires=docker.service
[Service]
ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v1.2.0-alpha.8/bin/linux/amd64/kubectl
ExecStartPre=/usr/bin/chmod +x /opt/bin/kubectl
ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v1.2.0-alpha.8/bin/linux/amd64/kubelet
ExecStartPre=/usr/bin/chmod +x /opt/bin/kubelet
ExecStartPre=/usr/bin/wget -N -P /opt/cni/bin http://172.18.18.1:8000/calico-cni/dist/calico
ExecStartPre=/usr/bin/chmod +x /opt/cni/bin/calico
ExecStart=/opt/bin/kubelet \
--port=10250 \
--address=0.0.0.0 \
--allow-privileged=true \
--register-node=false \
--cluster-dns=10.100.0.10 \
--cluster-domain=cluster.local \
--api-servers=http://localhost:8080 \
--network-plugin-dir=/etc/cni/net.d \
--network-plugin=cni \
--hostname-override=$private_ipv4 \
--logtostderr=true
Restart=always
RestartSec=10
[Install]
WantedBy=multi-user.target
- name: kube-proxy.service
command: start
content: |
[Unit]
Description=Kubernetes Proxy
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
Requires=kubelet.service
After=kubelet.service
[Service]
ExecStartPre=/usr/bin/wget -N -P /opt/bin https://storage.googleapis.com/kubernetes-release/release/v1.2.0-alpha.8/bin/linux/amd64/kube-proxy
ExecStartPre=/usr/bin/chmod +x /opt/bin/kube-proxy
ExecStart=/opt/bin/kube-proxy \
--master=http://localhost:8080 \
--proxy-mode=iptables \
--logtostderr=true
Restart=always
RestartSec=10
- name: get-certs.service
runtime: true
command: start
content: |
[Unit]
Description=Install certificates
After=network-online.service
[Service]
ExecStart=/opt/bin/get-certs.sh
RemainAfterExit=yes
Type=oneshot