path: root/ansible/roles/ansible-vvp-bootstrap/templates/ignition/worker.yaml.j2

# -*- encoding: utf-8 -*- 
# ============LICENSE_START======================================================= 
# org.onap.vvp/engagementmgr
# ===================================================================
# Copyright © 2017 AT&T Intellectual Property. All rights reserved.
# ===================================================================
#
# Unless otherwise specified, all software contained herein is licensed
# under the Apache License, Version 2.0 (the “License”);
# you may not use this software except in compliance with the License.
# You may obtain a copy of the License at
#
#             http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
#
#
# Unless otherwise specified, all documentation contained herein is licensed
# under the Creative Commons License, Attribution 4.0 Intl. (the “License”);
# you may not use this documentation except in compliance with the License.
# You may obtain a copy of the License at
#
#             https://creativecommons.org/licenses/by/4.0/
#
# Unless required by applicable law or agreed to in writing, documentation
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# ============LICENSE_END============================================
#
# ECOMP is a trademark and service mark of AT&T Intellectual Property.
---
{% raw %}
systemd:
  units:
    - name: sshd.socket
      enable: true
      contents: |
        [Unit]
        Description=OpenSSH Server Socket
        Conflicts=sshd.service

        [Socket]
        ListenStream={{.ssh_ip}}:22
        FreeBind=true
        Accept=yes

        [Install]
        WantedBy=sockets.target
    - name: etcd2.service
      enable: true
      dropins:
        - name: 40-etcd-cluster.conf
          contents: |
            [Service]
            Environment="ETCD_NAME={{.etcd_name}}"
            Environment="ETCD_ADVERTISE_CLIENT_URLS=http://{{.domain_name}}:2379"
            Environment="ETCD_INITIAL_ADVERTISE_PEER_URLS={{.etcd_initial_peers}}"
            Environment="ETCD_LISTEN_CLIENT_URLS=http://0.0.0.0:2379"
            Environment="ETCD_LISTEN_PEER_URLS=http://0.0.0.0:2380"
            Environment="ETCD_INITIAL_CLUSTER={{.etcd_initial_cluster}}"
            Environment="ETCD_STRICT_RECONFIG_CHECK=true"
    - name: flanneld.service
      dropins:
        - name: 40-add-options.conf
          contents: |
            [Service]
            EnvironmentFile=-/etc/flannel/options.env
    - name: docker.service
      dropins:
        - name: 40-flannel.conf
          contents: |
            [Unit]
            Requires=flanneld.service
            After=flanneld.service
            [Service]
            EnvironmentFile=/etc/kubernetes/cni/docker_opts_cni.env
    - name: locksmithd.service
      dropins:
        - name: 40-etcd-lock.conf
          contents: |
            [Service]
            Environment="REBOOT_STRATEGY=off"
    - name: k8s-certs@.service
      contents: |
        [Unit]
        Description=Fetch Kubernetes certificate assets
        Requires=network-online.target
        After=network-online.target
        [Service]
        ExecStartPre=/usr/bin/mkdir -p /etc/kubernetes/ssl
        ExecStart=/usr/bin/bash -c "[ -f /etc/kubernetes/ssl/%i ] || curl {{.k8s_cert_endpoint}}/tls/%i -o /etc/kubernetes/ssl/%i"
    - name: k8s-assets.target
      contents: |
        [Unit]
        Description=Load Kubernetes Assets
        Requires=k8s-certs@worker.pem.service
        After=k8s-certs@worker.pem.service
        Requires=k8s-certs@worker-key.pem.service
        After=k8s-certs@worker-key.pem.service
        Requires=k8s-certs@ca.pem.service
        After=k8s-certs@ca.pem.service
    - name: kubelet.service
      enable: true
      contents: |
        [Unit]
        Description=Kubelet via Hyperkube ACI
        Requires=k8s-assets.target
        After=k8s-assets.target
        [Service]
        Environment=KUBELET_VERSION={{.k8s_version}}
        Environment="RKT_OPTS=--uuid-file-save=/var/run/kubelet-pod.uuid \
          --volume dns,kind=host,source=/etc/resolv.conf \
          --mount volume=dns,target=/etc/resolv.conf \
          {{ if eq .container_runtime "rkt" -}}
          --volume rkt,kind=host,source=/opt/bin/host-rkt \
          --mount volume=rkt,target=/usr/bin/rkt \
          --volume var-lib-rkt,kind=host,source=/var/lib/rkt \
          --mount volume=var-lib-rkt,target=/var/lib/rkt \
          --volume stage,kind=host,source=/tmp \
          --mount volume=stage,target=/tmp \
          {{ end -}}
          --volume modprobe,kind=host,source=/usr/sbin/modprobe \
          --mount volume=modprobe,target=/usr/sbin/modprobe \
          --volume lib-modules,kind=host,source=/lib/modules \
          --mount volume=lib-modules,target=/lib/modules \
          --volume mkfsxfs,kind=host,source=/usr/sbin/mkfs.xfs \
          --mount volume=mkfsxfs,target=/usr/sbin/mkfs.xfs \
          --volume libxfs,kind=host,source=/lib64/libxfs.so.0 \
          --mount volume=libxfs,target=/lib64/libxfs.so.0 \
          --volume var-log,kind=host,source=/var/log \
          --mount volume=var-log,target=/var/log"
        ExecStartPre=/usr/bin/mkdir -p /etc/kubernetes/manifests
        ExecStartPre=/usr/bin/mkdir -p /var/log/containers
        ExecStartPre=-/usr/bin/rkt rm --uuid-file=/var/run/kubelet-pod.uuid
        ExecStart=/usr/lib/coreos/kubelet-wrapper \
          --api-servers={{.k8s_controller_endpoint}} \
          --cni-conf-dir=/etc/kubernetes/cni/net.d \
          --network-plugin=cni \
          --container-runtime={{.container_runtime}} \
          --rkt-path=/usr/bin/rkt \
          --rkt-stage1-image=coreos.com/rkt/stage1-coreos \
          --register-node=true \
          --allow-privileged=true \
          --pod-manifest-path=/etc/kubernetes/manifests \
          --hostname-override={{.domain_name}} \
          --cluster_dns={{.k8s_dns_service_ip}} \
          --cluster_domain=cluster.local \
          --kubeconfig=/etc/kubernetes/worker-kubeconfig.yaml \
          --tls-cert-file=/etc/kubernetes/ssl/worker.pem \
          --tls-private-key-file=/etc/kubernetes/ssl/worker-key.pem
        ExecStop=-/usr/bin/rkt stop --uuid-file=/var/run/kubelet-pod.uuid
        Restart=always
        RestartSec=10
        [Install]
        WantedBy=multi-user.target
    {{ if eq .container_runtime "rkt" }}
    - name: rkt-api.service
      enable: true
      contents: |
        [Unit]
        Before=kubelet.service
        [Service]
        ExecStart=/usr/bin/rkt api-service
        Restart=always
        RestartSec=10
        [Install]
        RequiredBy=kubelet.service
    - name: load-rkt-stage1.service
      enable: true
      contents: |
        [Unit]
        Description=Load rkt stage1 images
        Documentation=http://github.com/coreos/rkt
        Requires=network-online.target
        After=network-online.target
        Before=rkt-api.service
        [Service]
        Type=oneshot
        RemainAfterExit=yes
        ExecStart=/usr/bin/rkt fetch /usr/lib/rkt/stage1-images/stage1-coreos.aci /usr/lib/rkt/stage1-images/stage1-fly.aci  --insecure-options=image
        [Install]
        RequiredBy=rkt-api.service
    {{ end }}
    {{if ne .sysdig_access_key "" }}
    - name: sysdig.service
      enable: true
      contents: |
        [Unit]
        Description=Sysdig Cloud Agent
        After=docker.service
        Requires=docker.service
        [Service]
        TimeoutStartSec=0
        ExecStartPre=-/usr/bin/docker kill sysdig-agent
        ExecStartPre=-/usr/bin/docker rm sysdig-agent
        ExecStartPre=-/usr/bin/docker rmi sysdig-agent
        ExecStartPre=/usr/bin/docker pull sysdig/agent
{% endraw %}
        ExecStart=/usr/bin/docker run --name sysdig-agent --privileged --net host --pid host -e ADDITIONAL_CONF="app_checks:\n  - name: nginx\n    enabled: false" -e ACCESS_KEY={{sysdig_access_key}} -e TAGS=deploy_environment:{{ice_environment}} -v /var/lib/rkt:/host/var/lib/rkt:ro -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro sysdig/agent {% raw %}
        ExecStop=/usr/bin/docker stop sysdig-agent
        [Install]
        WantedBy=multi-user.target
        RequiredBy=k8-addons.service
    {{ end }}
storage:
  filesystems:
{% endraw %}
{% for fs in filesystems %}
    - name: {{fs.device}}
      mount:
        device: {{fs.device}}
        format: {{fs.format}}
        create:
          force: {{fs.create.force}}
{% if "options" in fs.create.keys() %}
          options:
{% for option in fs.create.options %}
            - {{option}}
{% endfor %}
{% endif %}
{% endfor %}{% raw %}
  files:
    - path: /etc/kubernetes/cni/net.d/10-flannel.conf
      filesystem: root
      contents:
        inline: |
          {
              "name": "podnet",
              "type": "flannel",
              "delegate": {
                  "isDefaultGateway": true
              }
          }
    - path: /etc/kubernetes/cni/docker_opts_cni.env
      filesystem: root
      contents:
        inline: |
          DOCKER_OPT_BIP=""
          DOCKER_OPT_IPMASQ=""
    - path: /etc/sysctl.d/max-user-watches.conf
      filesystem: root
      contents:
        inline: |
          fs.inotify.max_user_watches=16184
    - path: /etc/kubernetes/worker-kubeconfig.yaml
      filesystem: root
      contents:
        inline: |
          apiVersion: v1
          kind: Config
          clusters:
          - name: local
            cluster:
              certificate-authority: /etc/kubernetes/ssl/ca.pem
          users:
          - name: kubelet
            user:
              client-certificate: /etc/kubernetes/ssl/worker.pem
              client-key: /etc/kubernetes/ssl/worker-key.pem
          contexts:
          - context:
              cluster: local
              user: kubelet
            name: kubelet-context
          current-context: kubelet-context
    - path: /etc/kubernetes/manifests/kube-proxy.yaml
      filesystem: root
      contents:
        inline: |
          apiVersion: v1
          kind: Pod
          metadata:
            name: kube-proxy
            namespace: kube-system
            annotations:
              rkt.alpha.kubernetes.io/stage1-name-override: coreos.com/rkt/stage1-fly
          spec:
            hostNetwork: true
            containers:
            - name: kube-proxy
              image: quay.io/coreos/hyperkube:{{.k8s_version}}
              command:
              - /hyperkube
              - proxy
              - --master={{.k8s_controller_endpoint}}
              - --kubeconfig=/etc/kubernetes/worker-kubeconfig.yaml
              securityContext:
                privileged: true
              volumeMounts:
                - mountPath: /etc/ssl/certs
                  name: "ssl-certs"
                - mountPath: /etc/kubernetes/worker-kubeconfig.yaml
                  name: "kubeconfig"
                  readOnly: true
                - mountPath: /etc/kubernetes/ssl
                  name: "etc-kube-ssl"
                  readOnly: true
                - mountPath: /var/run/dbus
                  name: dbus
                  readOnly: false
            volumes:
              - name: "ssl-certs"
                hostPath:
                  path: "/usr/share/ca-certificates"
              - name: "kubeconfig"
                hostPath:
                  path: "/etc/kubernetes/worker-kubeconfig.yaml"
              - name: "etc-kube-ssl"
                hostPath:
                  path: "/etc/kubernetes/ssl"
              - hostPath:
                  path: /var/run/dbus
                name: dbus
    - path: /etc/flannel/options.env
      filesystem: root
      contents:
        inline: |
          FLANNELD_ETCD_ENDPOINTS={{.k8s_etcd_endpoints}}
          FLANNELD_IFACE={{.k8s_flanneld_iface}}
    {{ if eq .container_runtime "rkt" }}
    - path: /opt/bin/host-rkt
      filesystem: root
      mode: 0544
      contents:
        inline: |
          #!/bin/sh
          # This is bind mounted into the kubelet rootfs and all rkt shell-outs go
          # through this rkt wrapper. It essentially enters the host mount namespace
          # (which it is already in) only for the purpose of breaking out of the chroot
          # before calling rkt. It makes things like rkt gc work and avoids bind mounting
          # in certain rkt filesystem dependancies into the kubelet rootfs. This can
          # eventually be obviated when the write-api stuff gets upstream and rkt gc is
          # through the api-server. Related issue:
          # https://github.com/coreos/rkt/issues/2878
          exec nsenter -m -u -i -n -p -t 1 -- /usr/bin/rkt "$@"
    {{ end }}
    - path: "/etc/modules-load.d/rbd.conf"
      filesystem: root
      contents:
        inline: |
          rbd
    - path: "/opt/bin/ceph-rbdnamer"
      filesystem: root
      mode: 0755
      contents:
        inline: |
          #!/bin/sh
          DEV=$1
          NUM=`echo $DEV | sed 's#p.*##g' | tr -d 'a-z'`
          POOL=`cat /sys/devices/rbd/$NUM/pool`
          IMAGE=`cat /sys/devices/rbd/$NUM/name`
          SNAP=`cat /sys/devices/rbd/$NUM/current_snap`
          if [ "$SNAP" = "-" ]; then
              echo -n "$POOL $IMAGE"
          else
             echo -n "$POOL $IMAGE@$SNAP"
          fi
    - path: "/etc/udev/rules.d/50-rbd.rules"
      filesystem: root
      contents:
        inline: |
         KERNEL=="rbd[0-9]*", ENV{DEVTYPE}=="disk", PROGRAM="/opt/bin/ceph-rbdnamer %k", SYMLINK+="rbd/%c{1}/%c{2}"
         KERNEL=="rbd[0-9]*", ENV{DEVTYPE}=="partition", PROGRAM="/opt/bin/ceph-rbdnamer %k", SYMLINK+="rbd/%c{1}/%c{2}-part%n"
    - path: /etc/ssh/sshd_config
      filesystem: root
      mode: 0600
      user:
        id: 0
      group:
        id: 0
      contents:
        inline: |
          # Use most defaults for sshd configuration.
          UsePrivilegeSeparation sandbox
          Subsystem sftp internal-sftp
          ClientAliveInterval 180
          UseDNS no
          ListenAddress {{.ssh_ip}}
{{ if index . "ssh_authorized_keys" }}
passwd:
  users:
    - name: core
      ssh_authorized_keys:
        {{ range $element := .ssh_authorized_keys }}
        - {{$element}}
        {{end}}
{{end}}{% endraw %}