path: root/ansible/roles/ansible-vvp-bootstrap/templates/ignition/worker.yaml.j2

{#
-*- encoding: utf-8 -*-
============LICENSE_START=======================================================
org.onap.vvp/engagementmgr
===================================================================
Copyright © 2017 AT&T Intellectual Property. All rights reserved.
===================================================================

Unless otherwise specified, all software contained herein is licensed
under the Apache License, Version 2.0 (the “License”);
you may not use this software except in compliance with the License.
You may obtain a copy of the License at

            http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.



Unless otherwise specified, all documentation contained herein is licensed
under the Creative Commons License, Attribution 4.0 Intl. (the “License”);
you may not use this documentation except in compliance with the License.
You may obtain a copy of the License at

            https://creativecommons.org/licenses/by/4.0/

Unless required by applicable law or agreed to in writing, documentation
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

============LICENSE_END============================================

 ECOMP is a trademark and service mark of AT&T Intellectual Property.
#}
---
{% raw %}
systemd:
  units:
    - name: sshd.socket
      enable: true
      contents: |
        [Unit]
        Description=OpenSSH Server Socket
        Conflicts=sshd.service

        [Socket]
        ListenStream={{.ssh_ip}}:22
        FreeBind=true
        Accept=yes

        [Install]
        WantedBy=sockets.target
    - name: etcd2.service
      enable: true
      dropins:
        - name: 40-etcd-cluster.conf
          contents: |
            [Service]
            Environment="ETCD_NAME={{.etcd_name}}"
            Environment="ETCD_ADVERTISE_CLIENT_URLS=http://{{.domain_name}}:2379"
            Environment="ETCD_INITIAL_ADVERTISE_PEER_URLS={{.etcd_initial_peers}}"
            Environment="ETCD_LISTEN_CLIENT_URLS=http://0.0.0.0:2379"
            Environment="ETCD_LISTEN_PEER_URLS=http://0.0.0.0:2380"
            Environment="ETCD_INITIAL_CLUSTER={{.etcd_initial_cluster}}"
            Environment="ETCD_STRICT_RECONFIG_CHECK=true"
    - name: flanneld.service
      dropins:
        - name: 40-add-options.conf
          contents: |
            [Service]
            EnvironmentFile=-/etc/flannel/options.env
    - name: docker.service
      dropins:
        - name: 40-flannel.conf
          contents: |
            [Unit]
            Requires=flanneld.service
            After=flanneld.service
            [Service]
            EnvironmentFile=/etc/kubernetes/cni/docker_opts_cni.env
    - name: locksmithd.service
      dropins:
        - name: 40-etcd-lock.conf
          contents: |
            [Service]
            Environment="REBOOT_STRATEGY=off"
    - name: k8s-certs@.service
      contents: |
        [Unit]
        Description=Fetch Kubernetes certificate assets
        Requires=network-online.target
        After=network-online.target
        [Service]
        ExecStartPre=/usr/bin/mkdir -p /etc/kubernetes/ssl
        ExecStart=/usr/bin/bash -c "[ -f /etc/kubernetes/ssl/%i ] || curl {{.k8s_cert_endpoint}}/tls/%i -o /etc/kubernetes/ssl/%i"
    - name: k8s-assets.target
      contents: |
        [Unit]
        Description=Load Kubernetes Assets
        Requires=k8s-certs@worker.pem.service
        After=k8s-certs@worker.pem.service
        Requires=k8s-certs@worker-key.pem.service
        After=k8s-certs@worker-key.pem.service
        Requires=k8s-certs@ca.pem.service
        After=k8s-certs@ca.pem.service
    - name: kubelet.service
      enable: true
      contents: |
        [Unit]
        Description=Kubelet via Hyperkube ACI
        Requires=k8s-assets.target
        After=k8s-assets.target
        [Service]
        Environment=KUBELET_VERSION={{.k8s_version}}
        Environment="RKT_OPTS=--uuid-file-save=/var/run/kubelet-pod.uuid \
          --volume dns,kind=host,source=/etc/resolv.conf \
          --mount volume=dns,target=/etc/resolv.conf \
          {{ if eq .container_runtime "rkt" -}}
          --volume rkt,kind=host,source=/opt/bin/host-rkt \
          --mount volume=rkt,target=/usr/bin/rkt \
          --volume var-lib-rkt,kind=host,source=/var/lib/rkt \
          --mount volume=var-lib-rkt,target=/var/lib/rkt \
          --volume stage,kind=host,source=/tmp \
          --mount volume=stage,target=/tmp \
          {{ end -}}
          --volume modprobe,kind=host,source=/usr/sbin/modprobe \
          --mount volume=modprobe,target=/usr/sbin/modprobe \
          --volume lib-modules,kind=host,source=/lib/modules \
          --mount volume=lib-modules,target=/lib/modules \
          --volume mkfsxfs,kind=host,source=/usr/sbin/mkfs.xfs \
          --mount volume=mkfsxfs,target=/usr/sbin/mkfs.xfs \
          --volume libxfs,kind=host,source=/lib64/libxfs.so.0 \
          --mount volume=libxfs,target=/lib64/libxfs.so.0 \
          --volume var-log,kind=host,source=/var/log \
          --mount volume=var-log,target=/var/log"
        ExecStartPre=/usr/bin/mkdir -p /etc/kubernetes/manifests
        ExecStartPre=/usr/bin/mkdir -p /var/log/containers
        ExecStartPre=-/usr/bin/rkt rm --uuid-file=/var/run/kubelet-pod.uuid
        ExecStart=/usr/lib/coreos/kubelet-wrapper \
          --api-servers={{.k8s_controller_endpoint}} \
          --cni-conf-dir=/etc/kubernetes/cni/net.d \
          --network-plugin=cni \
          --container-runtime={{.container_runtime}} \
          --rkt-path=/usr/bin/rkt \
          --rkt-stage1-image=coreos.com/rkt/stage1-coreos \
          --register-node=true \
          --allow-privileged=true \
          --pod-manifest-path=/etc/kubernetes/manifests \
          --hostname-override={{.domain_name}} \
          --cluster_dns={{.k8s_dns_service_ip}} \
          --cluster_domain=cluster.local \
          --kubeconfig=/etc/kubernetes/worker-kubeconfig.yaml \
          --tls-cert-file=/etc/kubernetes/ssl/worker.pem \
          --tls-private-key-file=/etc/kubernetes/ssl/worker-key.pem
        ExecStop=-/usr/bin/rkt stop --uuid-file=/var/run/kubelet-pod.uuid
        Restart=always
        RestartSec=10
        [Install]
        WantedBy=multi-user.target
    {{ if eq .container_runtime "rkt" }}
    - name: rkt-api.service
      enable: true
      contents: |
        [Unit]
        Before=kubelet.service
        [Service]
        ExecStart=/usr/bin/rkt api-service
        Restart=always
        RestartSec=10
        [Install]
        RequiredBy=kubelet.service
    - name: load-rkt-stage1.service
      enable: true
      contents: |
        [Unit]
        Description=Load rkt stage1 images
        Documentation=http://github.com/coreos/rkt
        Requires=network-online.target
        After=network-online.target
        Before=rkt-api.service
        [Service]
        Type=oneshot
        RemainAfterExit=yes
        ExecStart=/usr/bin/rkt fetch /usr/lib/rkt/stage1-images/stage1-coreos.aci /usr/lib/rkt/stage1-images/stage1-fly.aci  --insecure-options=image
        [Install]
        RequiredBy=rkt-api.service
    {{ end }}
    {{if ne .sysdig_access_key "" }}
    - name: sysdig.service
      enable: true
      contents: |
        [Unit]
        Description=Sysdig Cloud Agent
        After=docker.service
        Requires=docker.service
        [Service]
        TimeoutStartSec=0
        ExecStartPre=-/usr/bin/docker kill sysdig-agent
        ExecStartPre=-/usr/bin/docker rm sysdig-agent
        ExecStartPre=-/usr/bin/docker rmi sysdig-agent
        ExecStartPre=/usr/bin/docker pull sysdig/agent
{% endraw %}
        ExecStart=/usr/bin/docker run --name sysdig-agent --privileged --net host --pid host -e ADDITIONAL_CONF="app_checks:\n  - name: nginx\n    enabled: false" -e ACCESS_KEY={{sysdig_access_key}} -e TAGS=deploy_environment:{{ice_environment}} -v /var/lib/rkt:/host/var/lib/rkt:ro -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro sysdig/agent {% raw %}
        ExecStop=/usr/bin/docker stop sysdig-agent
        [Install]
        WantedBy=multi-user.target
        RequiredBy=k8-addons.service
    {{ end }}
storage:
  filesystems:
{% endraw %}
{% for fs in filesystems %}
    - name: {{fs.device}}
      mount:
        device: {{fs.device}}
        format: {{fs.format}}
        create:
          force: {{fs.create.force}}
{% if "options" in fs.create.keys() %}
          options:
{% for option in fs.create.options %}
            - {{option}}
{% endfor %}
{% endif %}
{% endfor %}{% raw %}
  files:
    - path: /etc/kubernetes/cni/net.d/10-flannel.conf
      filesystem: root
      contents:
        inline: |
          {
              "name": "podnet",
              "type": "flannel",
              "delegate": {
                  "isDefaultGateway": true
              }
          }
    - path: /etc/kubernetes/cni/docker_opts_cni.env
      filesystem: root
      contents:
        inline: |
          DOCKER_OPT_BIP=""
          DOCKER_OPT_IPMASQ=""
    - path: /etc/sysctl.d/max-user-watches.conf
      filesystem: root
      contents:
        inline: |
          fs.inotify.max_user_watches=16184
    - path: /etc/kubernetes/worker-kubeconfig.yaml
      filesystem: root
      contents:
        inline: |
          apiVersion: v1
          kind: Config
          clusters:
          - name: local
            cluster:
              certificate-authority: /etc/kubernetes/ssl/ca.pem
          users:
          - name: kubelet
            user:
              client-certificate: /etc/kubernetes/ssl/worker.pem
              client-key: /etc/kubernetes/ssl/worker-key.pem
          contexts:
          - context:
              cluster: local
              user: kubelet
            name: kubelet-context
          current-context: kubelet-context
    - path: /etc/kubernetes/manifests/kube-proxy.yaml
      filesystem: root
      contents:
        inline: |
          apiVersion: v1
          kind: Pod
          metadata:
            name: kube-proxy
            namespace: kube-system
            annotations:
              rkt.alpha.kubernetes.io/stage1-name-override: coreos.com/rkt/stage1-fly
          spec:
            hostNetwork: true
            containers:
            - name: kube-proxy
              image: quay.io/coreos/hyperkube:{{.k8s_version}}
              command:
              - /hyperkube
              - proxy
              - --master={{.k8s_controller_endpoint}}
              - --kubeconfig=/etc/kubernetes/worker-kubeconfig.yaml
              securityContext:
                privileged: true
              volumeMounts:
                - mountPath: /etc/ssl/certs
                  name: "ssl-certs"
                - mountPath: /etc/kubernetes/worker-kubeconfig.yaml
                  name: "kubeconfig"
                  readOnly: true
                - mountPath: /etc/kubernetes/ssl
                  name: "etc-kube-ssl"
                  readOnly: true
                - mountPath: /var/run/dbus
                  name: dbus
                  readOnly: false
            volumes:
              - name: "ssl-certs"
                hostPath:
                  path: "/usr/share/ca-certificates"
              - name: "kubeconfig"
                hostPath:
                  path: "/etc/kubernetes/worker-kubeconfig.yaml"
              - name: "etc-kube-ssl"
                hostPath:
                  path: "/etc/kubernetes/ssl"
              - hostPath:
                  path: /var/run/dbus
                name: dbus
    - path: /etc/flannel/options.env
      filesystem: root
      contents:
        inline: |
          FLANNELD_ETCD_ENDPOINTS={{.k8s_etcd_endpoints}}
          FLANNELD_IFACE={{.k8s_flanneld_iface}}
    {{ if eq .container_runtime "rkt" }}
    - path: /opt/bin/host-rkt
      filesystem: root
      mode: 0544
      contents:
        inline: |
          #!/bin/sh
          # This is bind mounted into the kubelet rootfs and all rkt shell-outs go
          # through this rkt wrapper. It essentially enters the host mount namespace
          # (which it is already in) only for the purpose of breaking out of the chroot
          # before calling rkt. It makes things like rkt gc work and avoids bind mounting
          # in certain rkt filesystem dependancies into the kubelet rootfs. This can
          # eventually be obviated when the write-api stuff gets upstream and rkt gc is
          # through the api-server. Related issue:
          # https://github.com/coreos/rkt/issues/2878
          exec nsenter -m -u -i -n -p -t 1 -- /usr/bin/rkt "$@"
    {{ end }}
    - path: "/etc/modules-load.d/rbd.conf"
      filesystem: root
      contents:
        inline: |
          rbd
    - path: "/opt/bin/ceph-rbdnamer"
      filesystem: root
      mode: 0755
      contents:
        inline: |
          #!/bin/sh
          DEV=$1
          NUM=`echo $DEV | sed 's#p.*##g' | tr -d 'a-z'`
          POOL=`cat /sys/devices/rbd/$NUM/pool`
          IMAGE=`cat /sys/devices/rbd/$NUM/name`
          SNAP=`cat /sys/devices/rbd/$NUM/current_snap`
          if [ "$SNAP" = "-" ]; then
              echo -n "$POOL $IMAGE"
          else
             echo -n "$POOL $IMAGE@$SNAP"
          fi
    - path: "/etc/udev/rules.d/50-rbd.rules"
      filesystem: root
      contents:
        inline: |
         KERNEL=="rbd[0-9]*", ENV{DEVTYPE}=="disk", PROGRAM="/opt/bin/ceph-rbdnamer %k", SYMLINK+="rbd/%c{1}/%c{2}"
         KERNEL=="rbd[0-9]*", ENV{DEVTYPE}=="partition", PROGRAM="/opt/bin/ceph-rbdnamer %k", SYMLINK+="rbd/%c{1}/%c{2}-part%n"
    - path: /etc/ssh/sshd_config
      filesystem: root
      mode: 0600
      user:
        id: 0
      group:
        id: 0
      contents:
        inline: |
          # Use most defaults for sshd configuration.
          UsePrivilegeSeparation sandbox
          Subsystem sftp internal-sftp
          ClientAliveInterval 180
          UseDNS no
          ListenAddress {{.ssh_ip}}
{{ if index . "ssh_authorized_keys" }}
passwd:
  users:
    - name: core
      ssh_authorized_keys:
        {{ range $element := .ssh_authorized_keys }}
        - {{$element}}
        {{end}}
{{end}}{% endraw %}