etc-kubernetes-manifests-etcd-member.yaml

filesystem: "root"
mode: 0644
path: "/etc/kubernetes/manifests/etcd-member.yaml"
contents:
  inline: |
    apiVersion: v1
    kind: Pod
    metadata:
      name: etcd-member
      namespace: kube-system
      labels:
        k8s-app: etcd
    spec:
      initContainers:
      - name: discovery
        image: "registry.svc.ci.openshift.org/openshift/origin-v4.0:setup-etcd-environment"
        args:
        - "run"
        - "--discovery-srv={{.ClusterName}}.{{.BaseDomain}}"
        - "--output-file=/run/etcd/environment"
        - "--v=4"
        securityContext:
          priviledged: true
        volumeMounts:
        - name: discovery
          mountPath: /run/etcd/
      - name: certs
        image: "quay.io/coreos/kube-client-agent:36c62ccd7b16b522450c61e96fc556b217ee24f5" ## FIXME(abhinav): these images should be replacable by release image.
        command:
        - /bin/sh
        - -c
        - |
          #!/bin/sh
          set -euo pipefail

          source /run/etcd/environment

          [ -e /etc/ssl/etcd/system:etcd-server:${ETCD_DNS_NAME}.crt -a \
            -e /etc/ssl/etcd/system:etcd-server:${ETCD_DNS_NAME}.key ] || \
            /usr/local/bin/kube-client-agent \
              request \
                --kubeconfig=/etc/kubernetes/kubeconfig \
                --orgname=system:etcd-servers \
                --assetsdir=/etc/ssl/etcd \
                --dnsnames={{etcdServerCertDNSNames .}} \
                --commonname=system:etcd-server:${ETCD_DNS_NAME} \
                --ipaddrs=${ETCD_IPV4_ADDRESS},127.0.0.1 \

          [ -e /etc/ssl/etcd/system:etcd-peer:${ETCD_DNS_NAME}.crt -a \
            -e /etc/ssl/etcd/system:etcd-peer:${ETCD_DNS_NAME}.key ] || \
            /usr/local/bin/kube-client-agent \
              request \
                --kubeconfig=/etc/kubernetes/kubeconfig \
                --orgname=system:etcd-peers \
                --assetsdir=/etc/ssl/etcd \
                --dnsnames={{etcdPeerCertDNSNames .}} \
                --commonname=system:etcd-peer:${ETCD_DNS_NAME} \
                --ipaddrs=${ETCD_IPV4_ADDRESS} \
          
        securityContext:
          priviledged: true
        resources:
          requests:
            memory: 600Mi
        volumeMounts:
        - name: discovery
          mountPath: /run/etcd/
        - name: certs
          mountPath: /etc/ssl/etcd/
        - name: kubeconfig
          mountPath: /etc/kubernetes/kubeconfig
      containers:
      - name: etcd-member
        image: "quay.io/coreos/etcd:v3.3.10" ## FIXME(abhinav): these images should be replacable by release image.
        command:
        - /bin/sh
        - -c
        - |
          #!/bin/sh
          set -euo pipefail

          source /run/etcd/environment

          /usr/local/bin/etcd \
            --discovery-srv {{.ClusterName}}.{{.BaseDomain}} \
            --initial-advertise-peer-urls=https://${ETCD_IPV4_ADDRESS}:2380 \
            --cert-file=/etc/ssl/etcd/system:etcd-server:${ETCD_DNS_NAME}.crt \
            --key-file=/etc/ssl/etcd/system:etcd-server:${ETCD_DNS_NAME}.key \
            --trusted-ca-file=/etc/ssl/etcd/ca.crt \
            --client-cert-auth=true \
            --peer-cert-file=/etc/ssl/etcd/system:etcd-peer:${ETCD_DNS_NAME}.crt \
            --peer-key-file=/etc/ssl/etcd/system:etcd-peer:${ETCD_DNS_NAME}.key \
            --peer-trusted-ca-file=/etc/ssl/etcd/ca.crt \
            --peer-client-cert-auth=true \
            --advertise-client-urls=https://${ETCD_IPV4_ADDRESS}:2379 \
            --listen-client-urls=https://0.0.0.0:2379 \
            --listen-peer-urls=https://0.0.0.0:2380 \
        securityContext:
          priviledged: true
        volumeMounts:
        - name: discovery
          mountPath: /run/etcd/
        - name: certs
          mountPath: /etc/ssl/etcd/
        - name: data-dir
          mountPath: /var/lib/etcd/
        env:
        - name: ETCD_DATA_DIR
          value: "/var/lib/etcd"
        - name: ETCD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        ports:
        - name: peer
          containerPort: 2380
          protocol: TCP
        - name: server
          containerPort: 2379
          protocol: TCP
      hostNetwork: true
      restartPolicy: Always
      volumes:
      - name: certs
        hostPath:
          path: /etc/kubernetes/static-pod-resources/etcd-member
      - name: kubeconfig
        hostPath:
          path: /etc/kubernetes/kubeconfig
      - name: discovery
        hostPath:
          path: /run/etcd
      - name: data-dir
        hostPath:
          path: /var/lib/etcd