worker.yaml

#!cloud-config # https://coreos.com/os/docs/latest/cloud-config.html
---

hostname: ${NODE_NAME}

users:
  - name: "dockerwho"
    passwd: "110uOUNBSWaybBvhQ6JcTNyC/bV37Aj2LnZQi0zRf1v9KTP6KNdKQ4clZLgzzCoqU168lOTudZHQcRiDp+a2cxY1zQbzLQ4QGgFFiPSE2NpSX/4JrTHViIQMhZ2sAePdfrXHsJVJvfgV299XqqrW8KVlflmjRkezefK0kF0wekg="
    groups:
      - "sudo"
      - "docker"

ssh_authorized_keys:
  - ${PUB_RSA}

coreos:
  update:
    group: alpha
    reboot-strategy: off
  etcd2:
    name: ${NODE_NAME}
    advertise-client-urls: "http://${NODE_IP}:2379"
    initial-cluster: "${ETCD_ENDPOINTS}"
    initial-cluster-token: k8s-etcd-cluster
    initial-cluster-state: existing
    initial-advertise-peer-urls: "http://${NODE_IP}:2380"
    listen-peer-urls: "http://0.0.0.0:2380"
    listen-client-urls: "http://0.0.0.0:2379"
  units:
  - name: 10-static.network
    content: |
      [Match]
      Name=${NET_IFACE}

      [Network]
      Address=${NODE_IP}/24
      Gateway=${NODE_GATEWAY}
      DNS=8.8.8.8
  - name: etcd.service
    mask: true
  - name: etcd2.service
    command: start
  - name: flanneld.service
    command: start
  - name: docker-tcp.socket
    command: start
    enable: true
    content: |
      [Unit]
      Description=Docker Socket for the API

      [Socket]
      ListenStream=2375
      Service=docker.service
      BindIPv6Only=both

      [Install]
      WantedBy=sockets.target
  - name: docker.service
    drop-ins:
      - name: 10-require-flannel.conf
        content: |
          [Unit]
          Requires=flanneld.service
          After=flanneld.service
      - name: 50-change-options.conf
        content: |
          [Service]
          Environment='DOCKER_OPTS=-s=overlay --insecure-registry="0.0.0.0/0" --iptables=false --log-level=warn'
  - name: kubelet.service
    command: start
    enable: true
    content: |
      [Service]
      ExecStartPre=/usr/bin/mkdir -p /etc/kubernetes/manifests
      ExecStartPre=/opt/bin/download-k8s-binary kubelet
      ExecStart=/opt/bin/kubelet \
        --api-servers=${MASTER_URL} \
        --register-node=true \
        --allow-privileged=true \
        --config=/etc/kubernetes/manifests \
        --hostname-override=${NODE_IP} \
        --cluster-dns=${DNS_SERVICE_IP} \
        --cluster-domain=cluster.local \
        --cadvisor-port=4194 \
        --healthz-bind-address=0.0.0.0 \
        --max-pods=300 \
        --healthz-port=10248 \
        --kubeconfig=/etc/kubernetes/worker-kubeconfig.yaml \
        --tls-cert-file=/etc/kubernetes/ssl/worker.pem \
        --tls-private-key-file=/etc/kubernetes/ssl/worker-key.pem \
        --host_network_sources="*"
      Restart=always
      RestartSec=10

      [Install]
      WantedBy=multi-user.target
  - name: disable-transparent-huge-pages.service
    command: start
    content: |
      [Unit]
      Description=Disable Transparent Huge Pages

      [Service]
      Type=oneshot
      ExecStart=/bin/sh -c "until (echo 'Waiting for sys mount...' && cat /sys/kernel/mm/transparent_hugepage/enabled >/dev/null 2>&1); do sleep 1; done"
      ExecStart=/bin/sh -c "echo never | tee /sys/kernel/mm/transparent_hugepage/enabled >/dev/null 2>&1"
      ExecStart=/bin/sh -c "echo never | tee /sys/kernel/mm/transparent_hugepage/defrag >/dev/null 2>&1"
write_files:
  - path: /etc/kubernetes/manifests/kube-proxy.yaml
    permissions: "0644"
    owner: "root"
    content: |
      apiVersion: v1
      kind: Pod
      metadata:
        name: kube-proxy
        namespace: kube-system
      spec:
        hostNetwork: true
        containers:
        - name: kube-proxy
          image: ${HYPERKUBE_IMAGE}:${K8S_VER}
          command:
          - /hyperkube
          - proxy
          - --master=https://${NODE_START_IP}
          - --kubeconfig=/etc/kubernetes/worker-kubeconfig.yaml
          - --proxy-mode=iptables
          securityContext:
            privileged: true
          volumeMounts:
            - mountPath: /etc/ssl/certs
              name: "ssl-certs"
            - mountPath: /etc/kubernetes/worker-kubeconfig.yaml
              name: "kubeconfig"
              readOnly: true
            - mountPath: /etc/kubernetes/ssl
              name: "etc-kube-ssl"
              readOnly: true
        volumes:
          - name: "ssl-certs"
            hostPath:
              path: "/usr/share/ca-certificates"
          - name: "kubeconfig"
            hostPath:
              path: "/etc/kubernetes/worker-kubeconfig.yaml"
          - name: "etc-kube-ssl"
            hostPath:
              path: "/etc/kubernetes/ssl"
  - path: /etc/kubernetes/ssl/ca.pem
    permissions: "0644"
    owner: "root"
    encoding: "base64"
    content: |
      ${CA_PEM}
  - path: /etc/kubernetes/ssl/worker-key.pem
    permissions: "0644"
    owner: "root"
    encoding: "base64"
    content: |
      ${WORKER_KEY_PEM}
  - path: /etc/kubernetes/ssl/worker.pem
    permissions: "0644"
    owner: "root"
    encoding: "base64"
    content: |
      ${WORKER_PEM}
  - path: /etc/kubernetes/worker-kubeconfig.yaml
    permissions: "0644"
    owner: "root"
    content: |
      apiVersion: v1
      kind: Config
      clusters:
      - name: local
        cluster:
          certificate-authority: /etc/kubernetes/ssl/ca.pem
      users:
      - name: kubelet
        user:
          client-certificate: /etc/kubernetes/ssl/worker.pem
          client-key: /etc/kubernetes/ssl/worker-key.pem
      contexts:
      - context:
          cluster: local
          user: kubelet
        name: kubelet-context
      current-context: kubelet-context
  - path: /etc/systemd/coredump.conf
    content: |
      [Coredump]
      Storage=none
  - path: /etc/profile.d/nse-function.sh
    permissions: '0755'
    owner: core
    content: |
      function nse() {
        docker exec -it $1 bash
      }
  - path: /home/core/.toolboxrc
    owner: core
    content: |
      TOOLBOX_DOCKER_IMAGE=alpine
      TOOLBOX_DOCKER_TAG=3.2
      TOOLBOX_USER=root
  - path: /opt/bin/download-k8s-binary
    permissions: '0755'
    content: |
      #!/usr/bin/env bash
      FILE=$1
      if [ ! -f /opt/bin/$FILE ]; then
        curl -sSL -o /opt/bin/$FILE https://storage.googleapis.com/kubernetes-release/release/${K8S_VER}/bin/linux/amd64/$FILE
        chmod +x /opt/bin/$FILE
      else
        # we check the version of the binary
        INSTALLED_VERSION=$(/opt/bin/$FILE --version=true)
        MATCH=$(echo "$INSTALLED_VERSION" | grep -c "${K8S_VER}")
        if [ $MATCH -eq 0 ]; then
          # the version is different
          curl -sSL -o /opt/bin/$FILE https://storage.googleapis.com/kubernetes-release/release/${K8S_VER}/bin/linux/amd64/$FILE
          chmod +x /opt/bin/$FILE
        fi
      fi

  - path: /opt/bin/wupiao
    permissions: '0755'
    owner: core
    content: |
      #!/usr/bin/env bash
      # [w]ait [u]ntil [p]ort [i]s [a]ctually [o]pen
      [ -n "$1" ] && \
        until curl -o /dev/null -sIf http://${1}; do \
          sleep 1 && echo .;
        done;
      exit $?
manage_etc_hosts: "localhost"