├── .github ├── ISSUE_TEMPLATE │ ├── bug_report.md │ └── feature_request.md └── pull_request_template.md ├── .gitignore ├── CODEOWNERS ├── LICENSE.md ├── NOTICE.md ├── README.md ├── basetemplates ├── README.md ├── auth │ └── kubeconfig ├── bootstrap-manifests │ ├── bootstrap-apiserver.yaml │ ├── bootstrap-controller-manager.yaml │ ├── bootstrap-etcd.yaml │ └── bootstrap-scheduler.yaml ├── etcd │ ├── bootstrap-etcd-service.json │ └── migrate-etcd-cluster.json ├── generate-templates.sh ├── manifests │ ├── etcd-client-tls.yaml │ ├── etcd-operator.yaml │ ├── etcd-peer-tls.yaml │ ├── etcd-server-tls.yaml │ ├── etcd-service.yaml │ ├── kube-apiserver-secret.yaml │ ├── kube-apiserver.yaml │ ├── kube-controller-manager-disruption.yaml │ ├── kube-controller-manager-secret.yaml │ ├── kube-controller-manager.yaml │ ├── kube-dns-deployment.yaml │ ├── kube-dns-svc.yaml │ ├── kube-etcd-network-checkpointer.yaml │ ├── kube-flannel-cfg.yaml │ ├── kube-flannel.yaml │ ├── kube-proxy.yaml │ ├── kube-scheduler-disruption.yaml │ ├── kube-scheduler.yaml │ ├── kube-system-rbac-role-binding.yaml │ └── pod-checkpointer.yaml └── tls │ ├── apiserver.crt │ ├── apiserver.key │ ├── ca.crt │ ├── ca.key │ ├── etcd-client-ca.crt │ ├── etcd-client.crt │ ├── etcd-client.key │ ├── etcd │ ├── peer-ca.crt │ ├── peer.crt │ ├── peer.key │ ├── server-ca.crt │ ├── server.crt │ └── server.key │ ├── kubelet.crt │ ├── kubelet.key │ ├── service-account.key │ └── service-account.pub ├── bin ├── apply ├── bastion ├── ec ├── k ├── ka ├── kd ├── ks ├── kurl ├── lbaas ├── master ├── migrate ├── n ├── os │ ├── os_debug │ └── os_image ├── plan ├── prepare ├── recreate ├── roll ├── tf ├── update ├── utils │ └── render_images └── worker ├── docs ├── README.md ├── addons.md ├── addons │ └── dex.md ├── aws.md ├── azure.md ├── etcd_migration.md ├── files.md ├── kubify.png ├── kubify.svg ├── kubify@20x.png ├── kubify@2x.png ├── manifests │ └── etcdctl.yaml ├── openstack.md ├── presentations │ └── Static-ETCD-Setup.pptx └── troubleshoot.md ├── migrate.mig ├── modules ├── access │ ├── aws │ │ ├── aws.tf │ │ └── variables.tf │ ├── azure │ │ ├── azure.tf │ │ └── variables.tf │ ├── create.sh │ └── node_config │ │ ├── create.sh │ │ ├── node_config.tf │ │ └── variables.tf ├── b64var │ └── variable.tf ├── ca │ └── cert.tf ├── cfgvar │ └── cfgvar.tf ├── cluster │ ├── cluster.tf │ ├── templates │ │ └── cluster-info │ └── tls.tf ├── condlist │ └── condlist.tf ├── condmap │ └── condmap.tf ├── config_check │ └── config_check.tf ├── configurable │ └── configurable.tf ├── defaults │ └── defaults.tf ├── dns │ ├── dns.tf │ └── route53 │ │ └── route53.tf ├── etcd_tls │ ├── access │ │ └── data.tf │ └── etcd.tf ├── faketls │ └── faketls.tf ├── file │ ├── file.tf │ └── resources │ │ └── empty ├── flag │ └── flag.tf ├── instance │ ├── bootstrap.tf │ ├── defaults.tf │ ├── dns.tf │ ├── main.tf │ ├── nodes.tf │ ├── recover.tf │ ├── resources │ │ └── bin │ │ │ ├── azure-meta │ │ │ ├── bootstrap.sh │ │ │ ├── busybox │ │ │ ├── cleanup_etcd │ │ │ ├── complete-cluster │ │ │ ├── complete.sh │ │ │ ├── completeetcd.sh │ │ │ ├── ctlp.sh │ │ │ ├── ec │ │ │ ├── etcd.sh │ │ │ ├── ks │ │ │ ├── operator.sh │ │ │ ├── recover-controlplane.sh │ │ │ ├── source_me │ │ │ ├── wdocker.sh │ │ │ └── wpods.sh │ ├── roll.tf │ ├── settings.tf │ ├── sshkey.tf │ ├── update.tf │ ├── variables.tf │ └── version.tf ├── listvar │ └── variable.tf ├── lookup_list │ └── lookup_list.tf ├── lookup_map │ └── lookup_map.tf ├── map │ └── image.tf ├── mapvar │ └── variable.tf ├── nodes │ ├── mount_point │ │ ├── mount.tf │ │ └── templates │ │ │ └── volume.mount │ ├── nodes.tf │ ├── path_entry │ │ ├── entry.tf │ │ └── templates │ │ │ └── path │ ├── resources │ │ ├── setup_kubeenv │ │ ├── setup_volume │ │ └── updatecacerts.service │ └── templates │ │ ├── bootkube.service │ │ ├── cloud-init │ │ ├── cloud-init-wrapper │ │ └── volume.service ├── optrsc │ └── optrsc.tf ├── roll │ ├── complex_attr │ │ └── attr.tf │ ├── list │ │ └── list.tf │ ├── roll.tf │ └── simple_attr │ │ └── attr.tf ├── seed │ ├── addons.tf │ ├── addons │ │ ├── addon-template.tf │ │ ├── dex │ │ │ ├── dex.tf │ │ │ └── templates │ │ │ │ ├── connectors │ │ │ │ ├── github.yaml │ │ │ │ └── saml.yaml │ │ │ │ ├── manifests │ │ │ │ ├── 10-dex-cm.yaml │ │ │ │ ├── 20-dex-svc.yaml │ │ │ │ ├── 30-dex-dep.yaml │ │ │ │ └── 40-dex-ing.yaml │ │ │ │ └── tls_secret.yaml │ │ ├── external-dns │ │ │ ├── external-dns.tf │ │ │ └── templates │ │ │ │ ├── manifests │ │ │ │ └── external.dns.yaml │ │ │ │ └── types │ │ │ │ └── aws │ │ │ │ ├── env.yaml │ │ │ │ └── secret.yaml │ │ ├── gardener │ │ │ ├── gardener.tf │ │ │ └── templates │ │ │ │ ├── manifests │ │ │ │ ├── gardener-0-namespace.yaml │ │ │ │ ├── gardener-0-rbac.yaml │ │ │ │ ├── gardener-apiserver.yaml │ │ │ │ └── gardener-controller.yaml │ │ │ │ └── route53_domain_secret.yaml │ │ ├── machine │ │ │ ├── machines.tf │ │ │ └── templates │ │ │ │ └── manifests │ │ │ │ ├── 10-machine-ns.yaml │ │ │ │ ├── 20-crds.yaml │ │ │ │ ├── 30-machine-rbac.yaml │ │ │ │ ├── 40-machine-depl.yaml │ │ │ │ └── 50-machine-cfg.yaml │ │ ├── monitoring │ │ │ ├── monitoring.tf │ │ │ └── templates │ │ │ │ ├── alertmanager-base-config.yaml │ │ │ │ ├── alertmanager-default-config.yaml │ │ │ │ ├── grafana-config.yaml │ │ │ │ ├── manifests │ │ │ │ ├── alertmanager.yaml │ │ │ │ ├── grafana.yaml │ │ │ │ └── prometheus.yaml │ │ │ │ ├── prometheus-config.yaml │ │ │ │ └── prometheus-rules.yaml │ │ └── nginx-ingress │ │ │ ├── nginx-ingress.tf │ │ │ └── templates │ │ │ └── manifests │ │ │ ├── nginx-echo.yaml │ │ │ └── nginx-ingress.yaml │ ├── backup.tf │ ├── dns.tf │ ├── pv_backup.tf │ ├── recover.tf │ ├── s3_backup.tf │ ├── scripts │ │ ├── copy_deploy │ │ └── prepare_assets.sh │ ├── templates.tf │ ├── templates │ │ ├── addons │ │ │ ├── dashboard │ │ │ │ └── manifests │ │ │ │ │ ├── dashboard-ingress.yaml │ │ │ │ │ └── dashboard.yaml │ │ │ ├── guestbook │ │ │ │ └── manifests │ │ │ │ │ ├── a-namespace.yml │ │ │ │ │ ├── frontend-deployment.yml │ │ │ │ │ ├── frontend-ingress.yml │ │ │ │ │ ├── frontend-service.yml │ │ │ │ │ ├── redis-master-deployment.yml │ │ │ │ │ ├── redis-master-service.yml │ │ │ │ │ ├── redis-slave-deployment.yml │ │ │ │ │ └── redis-slave-service.yml │ │ │ ├── heapster │ │ │ │ └── manifests │ │ │ │ │ └── heapster.yaml │ │ │ ├── kube-lego │ │ │ │ └── manifests │ │ │ │ │ ├── kube-lego.yaml │ │ │ │ │ └── lego-echo.yaml │ │ │ └── logging │ │ │ │ └── manifests │ │ │ │ ├── es-curator-configmap.yaml │ │ │ │ ├── es-curator-cronjob.yaml │ │ │ │ ├── es-service.yaml │ │ │ │ ├── es-statefulset.yaml │ │ │ │ ├── fluentd-es-configmap.yaml │ │ │ │ ├── fluentd-es-ds.yaml │ │ │ │ ├── kibana-deployment.yaml │ │ │ │ └── kibana-service.yaml │ │ ├── bootkube │ │ │ ├── common │ │ │ │ ├── bootstrap-manifests │ │ │ │ │ ├── bootstrap-apiserver.yaml │ │ │ │ │ ├── bootstrap-controller-manager.yaml │ │ │ │ │ └── bootstrap-scheduler.yaml │ │ │ │ └── manifests │ │ │ │ │ ├── etcd-client-tls.yaml │ │ │ │ │ ├── etcd-peer-tls.yaml │ │ │ │ │ ├── etcd-server-tls.yaml │ │ │ │ │ ├── etcd-service.yaml │ │ │ │ │ ├── kube-apiserver-secret.yaml │ │ │ │ │ ├── kube-apiserver.yaml │ │ │ │ │ ├── kube-controller-manager-disruption.yaml │ │ │ │ │ ├── kube-controller-manager-secret.yaml │ │ │ │ │ ├── kube-controller-manager.yaml │ │ │ │ │ ├── kube-dns-deployment.yaml │ │ │ │ │ ├── kube-dns-svc.yaml │ │ │ │ │ ├── kube-flannel-cfg.yaml │ │ │ │ │ ├── kube-flannel.yaml │ │ │ │ │ ├── kube-proxy.yaml │ │ │ │ │ ├── kube-scheduler-disruption.yaml │ │ │ │ │ ├── kube-scheduler.yaml │ │ │ │ │ ├── kube-system-rbac-role-binding.yaml │ │ │ │ │ └── pod-checkpointer.yaml │ │ │ ├── self │ │ │ │ ├── bootstrap-manifests │ │ │ │ │ └── bootstrap-etcd.yaml │ │ │ │ ├── etcd │ │ │ │ │ ├── bootstrap-etcd-service.json │ │ │ │ │ └── migrate-etcd-cluster.json │ │ │ │ └── manifests │ │ │ │ │ ├── etcd-operator.yaml │ │ │ │ │ └── kube-etcd-network-checkpointer.yaml │ │ │ └── single │ │ │ │ └── manifests │ │ │ │ └── kube-etcd-svc.yaml │ │ ├── empty │ │ │ └── empty │ │ ├── etcd_backup │ │ │ ├── pv │ │ │ │ └── spec.json │ │ │ └── s3 │ │ │ │ ├── config │ │ │ │ ├── credentials │ │ │ │ ├── secret.yaml │ │ │ │ ├── sidecar.yaml │ │ │ │ └── spec.json │ │ ├── etcd_bootstrap │ │ │ ├── initial │ │ │ ├── recover_initcontainers │ │ │ ├── recover_mount_backup │ │ │ ├── recover_mount_etcd │ │ │ ├── recover_volumes │ │ │ ├── static_etcd.yaml │ │ │ └── static_recover_initcontainers │ │ ├── kubelet.conf │ │ ├── kubelet.env │ │ └── misc │ │ │ ├── kube-helm.yaml │ │ │ └── oidc.dropin │ ├── tls.tf │ └── variables.tf ├── template_input │ └── template_input.tf ├── tls │ ├── access │ │ └── data.tf │ └── tls.tf ├── value_check │ └── value_check.tf ├── variable │ └── variable.tf ├── versions │ ├── config.tf │ ├── create.sh │ ├── defaults.tf │ └── variables.tf └── vms │ ├── info.tf │ └── versions.tf ├── platforms ├── aws │ └── modules │ │ ├── config │ │ ├── README.md │ │ ├── config.tf │ │ └── variables.tf │ │ ├── iaas │ │ ├── addons.tf │ │ ├── bastion.tf │ │ ├── cloud-init.tf │ │ ├── cloud.tf │ │ ├── iaas.tf │ │ ├── iam.tf │ │ ├── kube2iam.tf │ │ ├── sshkey.tf │ │ ├── templates │ │ │ ├── addons │ │ │ │ └── manifests │ │ │ │ │ ├── etcd-storage-class.yaml │ │ │ │ │ ├── kube-storage-class.yaml │ │ │ │ │ └── kube2iam.yaml │ │ │ └── cloud.conf │ │ ├── variables.tf │ │ └── versions.tf │ │ ├── lbaas │ │ └── lbaas.tf │ │ ├── machine │ │ ├── machine.tf │ │ ├── templates │ │ │ ├── class.yaml │ │ │ ├── deployment.yaml │ │ │ └── secret.yaml │ │ └── variables.tf │ │ └── vms │ │ ├── fips.tf │ │ ├── lbaas.tf │ │ ├── roll.tf │ │ ├── variables.tf │ │ └── vms.tf ├── azure │ └── modules │ │ ├── config │ │ ├── config.tf │ │ └── variables.tf │ │ ├── iaas │ │ ├── addons.tf │ │ ├── bastion.tf │ │ ├── cloud-init.tf │ │ ├── cloud.tf │ │ ├── iaas.tf │ │ ├── sshkey.tf │ │ ├── templates │ │ │ ├── addons │ │ │ │ └── manifests │ │ │ │ │ ├── etcd-storage-class.yaml │ │ │ │ │ ├── kube-storage-class-ssd.yaml │ │ │ │ │ └── kube-storage-class.yaml │ │ │ └── cloud.conf │ │ └── variables.tf │ │ ├── lbaas │ │ └── lbaas.tf │ │ ├── machine │ │ ├── machine.tf │ │ ├── templates │ │ │ ├── class.yaml │ │ │ ├── deployment.yaml │ │ │ └── secret.yaml │ │ └── variables.tf │ │ └── vms │ │ ├── lbaas.tf │ │ ├── nics.tf │ │ ├── roll.tf │ │ ├── variables.tf │ │ └── vms.tf ├── create.sh ├── interfaces │ ├── iaas │ ├── machine │ └── vms └── openstack │ └── modules │ ├── config │ ├── README.md │ ├── check.tf │ ├── config.tf │ └── variables.tf │ ├── iaas │ ├── addons.tf │ ├── bastion.tf │ ├── cloud-init.tf │ ├── cloud.tf │ ├── iaas.tf │ ├── osrc.tf │ ├── sshkey.tf │ ├── templates │ │ ├── addons │ │ │ └── manifests │ │ │ │ ├── etcd-storage-class.yaml │ │ │ │ └── kube-storage-class.yaml │ │ ├── cloud.conf │ │ └── osrc │ └── variables.tf │ ├── lbaas │ └── lbaas.tf │ ├── machine │ ├── machine.tf │ ├── templates │ │ ├── class.yaml │ │ ├── deployment.yaml │ │ └── secret.yaml │ └── variables.tf │ └── vms │ ├── fips.tf │ ├── lbaas.tf │ ├── roll.tf │ ├── variables.tf │ └── vms.tf └── variants ├── README.md ├── aws ├── aws.tf ├── cluster.tf ├── migrate.mig └── modules │ ├── config │ ├── iaas │ ├── lbaas │ ├── machine │ └── vms ├── azure ├── azure.tf ├── cluster.tf ├── migrate.mig └── modules │ ├── config │ ├── iaas │ ├── lbaas │ ├── machine │ └── vms ├── cluster.tf ├── create.sh ├── current └── openstack ├── cluster.tf ├── migrate.mig ├── modules ├── config ├── iaas ├── lbaas ├── machine └── vms └── os.tf /.github/ISSUE_TEMPLATE/bug_report.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Bug report 3 | about: Tell us about things that don't work 4 | title: '' 5 | labels: '' 6 | assignees: '' 7 | 8 | --- 9 | 10 | **What happened**: 11 | 12 | **What you expected to happen**: 13 | 14 | **How to reproduce it (as minimally and precisely as possible)**: 15 | 16 | **Anything else we need to know?**: 17 | 18 | **Environment**: 19 | 20 | - Which cloud provider is configured for the setup? -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/feature_request.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Feature request 3 | about: Suggest an idea for this project 4 | title: '' 5 | labels: '' 6 | assignees: '' 7 | 8 | --- 9 | 10 | **What would you like to be added**: 11 | 12 | **Why is this needed**: -------------------------------------------------------------------------------- /.github/pull_request_template.md: -------------------------------------------------------------------------------- 1 | **What this PR does / why we need it**: 2 | 3 | **Which issue(s) this PR fixes**: 4 | Fixes # 5 | 6 | **Special notes for your reviewer**: -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | .terraform/ 2 | gen/ 3 | tmp/ 4 | *.sw[opq] 5 | .vscode/ -------------------------------------------------------------------------------- /CODEOWNERS: -------------------------------------------------------------------------------- 1 | # kubify maintainers 2 | * @mandelsoft @afritzler @gonzolino 3 | -------------------------------------------------------------------------------- /NOTICE.md: -------------------------------------------------------------------------------- 1 | ## kubify 2 | Copyright (c) 2017-2018 SAP SE or an SAP affiliate company. All rights reserved. 3 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Kubify 2 | 3 | ![Kubify Logo](docs/kubify@2x.png) 4 | 5 | Kubify is a [Terraform](https://www.terraform.io/) based provisioning project for setting up production ready [Kubernetes](https://kubernetes.io/) clusters on public and private Cloud infrastructures. Kubify currently supports: 6 | 7 | * OpenStack 8 | * AWS 9 | * Azure 10 | 11 | Key features of Kubify are: 12 | 13 | * Kubernetes v1.10.12 14 | * Etcd v3.3.10 multi master node setup 15 | * Etcd backup and restore 16 | * Supports rolling updates 17 | 18 | ---- 19 | 20 | ## To start using or developing Kubify locally 21 | 22 | See our documentation in the `/docs` repository or [find the main documentation here](https://github.com/gardener/kubify/blob/master/docs/README.md). 23 | 24 | ## Feedback and Support 25 | 26 | Feedback and contributions are always welcome. Please report bugs or suggestions about our Kubernetes clusters as such or the Kubify itself as [GitHub issues](https://github.com/gardener/kubify/issues) or join our [Slack channel #gardener](https://kubernetes.slack.com/messages/gardener) (Invite yourself to the Kubernetes Slack workspace [here](http://slack.k8s.io)). -------------------------------------------------------------------------------- /basetemplates/README.md: -------------------------------------------------------------------------------- 1 | # Base Templates 2 | 3 | Render the latest bootkube templates and replace the old one in this directory. 4 | 5 | ``` 6 | ./generate-templates.sh 7 | ``` 8 | 9 | To overwrite the bootkube version 10 | ``` 11 | BOOTKUBE_VERSION=v0.9.1 ./generate-templates.sh 12 | ``` -------------------------------------------------------------------------------- /basetemplates/bootstrap-manifests/bootstrap-controller-manager.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: bootstrap-kube-controller-manager 5 | namespace: kube-system 6 | spec: 7 | containers: 8 | - name: kube-controller-manager 9 | image: gcr.io/google_containers/hyperkube:v1.8.3 10 | command: 11 | - ./hyperkube 12 | - controller-manager 13 | - --allocate-node-cidrs=true 14 | - --cluster-cidr=10.2.0.0/16 15 | - --cloud-provider= 16 | - --configure-cloud-routes=false 17 | - --kubeconfig=/etc/kubernetes/kubeconfig 18 | - --leader-elect=true 19 | - --root-ca-file=/etc/kubernetes/bootstrap-secrets/ca.crt 20 | - --service-account-private-key-file=/etc/kubernetes/bootstrap-secrets/service-account.key 21 | volumeMounts: 22 | - name: kubernetes 23 | mountPath: /etc/kubernetes 24 | readOnly: true 25 | - name: ssl-host 26 | mountPath: /etc/ssl/certs 27 | readOnly: true 28 | hostNetwork: true 29 | volumes: 30 | - name: kubernetes 31 | hostPath: 32 | path: /etc/kubernetes 33 | - name: ssl-host 34 | hostPath: 35 | path: /usr/share/ca-certificates 36 | -------------------------------------------------------------------------------- /basetemplates/bootstrap-manifests/bootstrap-etcd.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: bootstrap-etcd 5 | namespace: kube-system 6 | labels: 7 | k8s-app: boot-etcd 8 | spec: 9 | containers: 10 | - name: etcd 11 | image: quay.io/coreos/etcd:v3.1.8 12 | command: 13 | - /usr/local/bin/etcd 14 | - --name=boot-etcd 15 | - --listen-client-urls=https://0.0.0.0:12379 16 | - --listen-peer-urls=https://0.0.0.0:12380 17 | - --advertise-client-urls=https://10.3.0.20:12379 18 | - --initial-advertise-peer-urls=https://10.3.0.20:12380 19 | - --initial-cluster=boot-etcd=https://10.3.0.20:12380 20 | - --initial-cluster-token=bootkube 21 | - --initial-cluster-state=new 22 | - --data-dir=/var/etcd/data 23 | - --peer-client-cert-auth=true 24 | - --peer-trusted-ca-file=/etc/kubernetes/secrets/etcd/peer-ca.crt 25 | - --peer-cert-file=/etc/kubernetes/secrets/etcd/peer.crt 26 | - --peer-key-file=/etc/kubernetes/secrets/etcd/peer.key 27 | - --client-cert-auth=true 28 | - --trusted-ca-file=/etc/kubernetes/secrets/etcd/server-ca.crt 29 | - --cert-file=/etc/kubernetes/secrets/etcd/server.crt 30 | - --key-file=/etc/kubernetes/secrets/etcd/server.key 31 | volumeMounts: 32 | - mountPath: /etc/kubernetes/secrets 33 | name: secrets 34 | readOnly: true 35 | volumes: 36 | - name: secrets 37 | hostPath: 38 | path: /etc/kubernetes/bootstrap-secrets 39 | hostNetwork: true 40 | restartPolicy: Never 41 | dnsPolicy: ClusterFirstWithHostNet 42 | -------------------------------------------------------------------------------- /basetemplates/bootstrap-manifests/bootstrap-scheduler.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: bootstrap-kube-scheduler 5 | namespace: kube-system 6 | spec: 7 | containers: 8 | - name: kube-scheduler 9 | image: gcr.io/google_containers/hyperkube:v1.8.3 10 | command: 11 | - ./hyperkube 12 | - scheduler 13 | - --kubeconfig=/etc/kubernetes/kubeconfig 14 | - --leader-elect=true 15 | volumeMounts: 16 | - name: kubernetes 17 | mountPath: /etc/kubernetes 18 | readOnly: true 19 | hostNetwork: true 20 | volumes: 21 | - name: kubernetes 22 | hostPath: 23 | path: /etc/kubernetes 24 | -------------------------------------------------------------------------------- /basetemplates/etcd/bootstrap-etcd-service.json: -------------------------------------------------------------------------------- 1 | { 2 | "apiVersion": "v1", 3 | "kind": "Service", 4 | "metadata": { 5 | "name": "bootstrap-etcd-service", 6 | "namespace": "kube-system" 7 | }, 8 | "spec": { 9 | "selector": { 10 | "k8s-app": "boot-etcd" 11 | }, 12 | "clusterIP": "10.3.0.20", 13 | "ports": [ 14 | { 15 | "name": "client", 16 | "port": 12379, 17 | "protocol": "TCP" 18 | }, 19 | { 20 | "name": "peers", 21 | "port": 12380, 22 | "protocol": "TCP" 23 | } 24 | ] 25 | } 26 | } -------------------------------------------------------------------------------- /basetemplates/etcd/migrate-etcd-cluster.json: -------------------------------------------------------------------------------- 1 | { 2 | "apiVersion": "etcd.database.coreos.com/v1beta2", 3 | "kind": "EtcdCluster", 4 | "metadata": { 5 | "name": "kube-etcd", 6 | "namespace": "kube-system" 7 | }, 8 | "spec": { 9 | "size": 1, 10 | "version": "v3.1.8", 11 | "pod": { 12 | "nodeSelector": { 13 | "node-role.kubernetes.io/master": "" 14 | }, 15 | "tolerations": [ 16 | { 17 | "key": "node-role.kubernetes.io/master", 18 | "operator": "Exists", 19 | "effect": "NoSchedule" 20 | } 21 | ] 22 | }, 23 | "selfHosted": { 24 | "bootMemberClientEndpoint": "https://10.3.0.20:12379" 25 | }, 26 | "TLS": { 27 | "static": { 28 | "member": { 29 | "peerSecret": "etcd-peer-tls", 30 | "serverSecret": "etcd-server-tls" 31 | }, 32 | "operatorSecret": "etcd-client-tls" 33 | } 34 | } 35 | } 36 | } -------------------------------------------------------------------------------- /basetemplates/generate-templates.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # Render the latest bootkube templates and replace the old one in this directory. 3 | 4 | BASEDIR="$(dirname "$0")" 5 | 6 | BOOTKUBE_VERSION=v0.9.1 7 | 8 | docker run -it quay.io/coreos/bootkube:$BOOTKUBE_VERSION /bootkube render \ 9 | --asset-dir /generated-templates/ \ 10 | --experimental-self-hosted-etcd \ 11 | && docker cp $(docker ps --last 1 -q):/generated-templates/ $BASEDIR 12 | 13 | # Remove old directories 14 | rm -rf $BASEDIR/auth/ $BASEDIR/bootstrap-manifests/ $BASEDIR/etcd/ $BASEDIR/manifests/ $BASEDIR/tls/ 15 | 16 | # Move generated files into place 17 | cp -r $BASEDIR/generated-templates/* . 18 | rm -rf $BASEDIR/generated-templates/ -------------------------------------------------------------------------------- /basetemplates/manifests/etcd-operator.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1beta2 2 | kind: Deployment 3 | metadata: 4 | name: etcd-operator 5 | namespace: kube-system 6 | labels: 7 | k8s-app: etcd-operator 8 | spec: 9 | replicas: 1 10 | selector: 11 | matchLabels: 12 | k8s-app: etcd-operator 13 | template: 14 | metadata: 15 | labels: 16 | k8s-app: etcd-operator 17 | spec: 18 | containers: 19 | - name: etcd-operator 20 | image: quay.io/coreos/etcd-operator:v0.5.0 21 | command: 22 | - /usr/local/bin/etcd-operator 23 | - --analytics=false 24 | env: 25 | - name: MY_POD_NAMESPACE 26 | valueFrom: 27 | fieldRef: 28 | fieldPath: metadata.namespace 29 | - name: MY_POD_NAME 30 | valueFrom: 31 | fieldRef: 32 | fieldPath: metadata.name 33 | nodeSelector: 34 | node-role.kubernetes.io/master: "" 35 | securityContext: 36 | runAsNonRoot: true 37 | runAsUser: 65534 38 | tolerations: 39 | - key: node-role.kubernetes.io/master 40 | operator: Exists 41 | effect: NoSchedule 42 | strategy: 43 | type: RollingUpdate 44 | rollingUpdate: 45 | maxUnavailable: 1 46 | maxSurge: 1 47 | -------------------------------------------------------------------------------- /basetemplates/manifests/etcd-service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: etcd-service 5 | namespace: kube-system 6 | # This alpha annotation will retain the endpoints even if the etcd pod isn't ready. 7 | # This feature is always enabled in endpoint controller in k8s even it is alpha. 8 | annotations: 9 | service.alpha.kubernetes.io/tolerate-unready-endpoints: "true" 10 | spec: 11 | selector: 12 | app: etcd 13 | etcd_cluster: kube-etcd 14 | clusterIP: 10.3.0.15 15 | ports: 16 | - name: client 17 | port: 2379 18 | protocol: TCP 19 | -------------------------------------------------------------------------------- /basetemplates/manifests/kube-controller-manager-disruption.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: policy/v1beta1 2 | kind: PodDisruptionBudget 3 | metadata: 4 | name: kube-controller-manager 5 | namespace: kube-system 6 | spec: 7 | minAvailable: 1 8 | selector: 9 | matchLabels: 10 | tier: control-plane 11 | k8s-app: kube-controller-manager 12 | -------------------------------------------------------------------------------- /basetemplates/manifests/kube-dns-svc.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: kube-dns 5 | namespace: kube-system 6 | labels: 7 | k8s-app: kube-dns 8 | kubernetes.io/cluster-service: "true" 9 | kubernetes.io/name: "KubeDNS" 10 | spec: 11 | selector: 12 | k8s-app: kube-dns 13 | clusterIP: 10.3.0.10 14 | ports: 15 | - name: dns 16 | port: 53 17 | protocol: UDP 18 | - name: dns-tcp 19 | port: 53 20 | protocol: TCP 21 | -------------------------------------------------------------------------------- /basetemplates/manifests/kube-etcd-network-checkpointer.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1beta2 2 | kind: DaemonSet 3 | metadata: 4 | name: kube-etcd-network-checkpointer 5 | namespace: kube-system 6 | labels: 7 | tier: control-plane 8 | k8s-app: kube-etcd-network-checkpointer 9 | spec: 10 | selector: 11 | matchLabels: 12 | tier: control-plane 13 | k8s-app: kube-etcd-network-checkpointer 14 | template: 15 | metadata: 16 | labels: 17 | tier: control-plane 18 | k8s-app: kube-etcd-network-checkpointer 19 | annotations: 20 | checkpointer.alpha.coreos.com/checkpoint: "true" 21 | spec: 22 | containers: 23 | - image: quay.io/coreos/kenc:0.0.2 24 | name: kube-etcd-network-checkpointer 25 | securityContext: 26 | privileged: true 27 | volumeMounts: 28 | - mountPath: /etc/kubernetes/selfhosted-etcd 29 | name: checkpoint-dir 30 | readOnly: false 31 | - mountPath: /var/etcd 32 | name: etcd-dir 33 | readOnly: false 34 | - mountPath: /var/lock 35 | name: var-lock 36 | readOnly: false 37 | command: 38 | - /usr/bin/flock 39 | - /var/lock/kenc.lock 40 | - -c 41 | - "kenc -r -m iptables && kenc -m iptables" 42 | hostNetwork: true 43 | nodeSelector: 44 | node-role.kubernetes.io/master: "" 45 | tolerations: 46 | - key: node-role.kubernetes.io/master 47 | operator: Exists 48 | effect: NoSchedule 49 | volumes: 50 | - name: checkpoint-dir 51 | hostPath: 52 | path: /etc/kubernetes/checkpoint-iptables 53 | - name: etcd-dir 54 | hostPath: 55 | path: /var/etcd 56 | - name: var-lock 57 | hostPath: 58 | path: /var/lock 59 | updateStrategy: 60 | rollingUpdate: 61 | maxUnavailable: 1 62 | type: RollingUpdate 63 | -------------------------------------------------------------------------------- /basetemplates/manifests/kube-flannel-cfg.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: ConfigMap 3 | metadata: 4 | name: kube-flannel-cfg 5 | namespace: kube-system 6 | labels: 7 | tier: node 8 | k8s-app: flannel 9 | data: 10 | cni-conf.json: | 11 | { 12 | "name": "cbr0", 13 | "cniVersion": "0.3.1", 14 | "plugins": [ 15 | { 16 | "type": "flannel", 17 | "delegate": { 18 | "hairpinMode": true, 19 | "isDefaultGateway": true 20 | } 21 | }, 22 | { 23 | "type": "portmap", 24 | "capabilities": { 25 | "portMappings": true 26 | } 27 | } 28 | ] 29 | } 30 | net-conf.json: | 31 | { 32 | "Network": "10.2.0.0/16", 33 | "Backend": { 34 | "Type": "vxlan" 35 | } 36 | } 37 | -------------------------------------------------------------------------------- /basetemplates/manifests/kube-scheduler-disruption.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: policy/v1beta1 2 | kind: PodDisruptionBudget 3 | metadata: 4 | name: kube-scheduler 5 | namespace: kube-system 6 | spec: 7 | minAvailable: 1 8 | selector: 9 | matchLabels: 10 | tier: control-plane 11 | k8s-app: kube-scheduler 12 | -------------------------------------------------------------------------------- /basetemplates/manifests/kube-system-rbac-role-binding.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: rbac.authorization.k8s.io/v1 2 | kind: ClusterRoleBinding 3 | metadata: 4 | name: system:default-sa 5 | subjects: 6 | - kind: ServiceAccount 7 | name: default 8 | namespace: kube-system 9 | roleRef: 10 | kind: ClusterRole 11 | name: cluster-admin 12 | apiGroup: rbac.authorization.k8s.io 13 | -------------------------------------------------------------------------------- /basetemplates/tls/apiserver.crt: -------------------------------------------------------------------------------- 1 | -----BEGIN CERTIFICATE----- 2 | MIIDrTCCApWgAwIBAgIID/mVVg8X7vIwDQYJKoZIhvcNAQELBQAwVDEtMCsGA1UE 3 | ChMkMjBhODY2ODQtYzViMi00Mjk0LTk5MjMtYmM2MDgxYWU1YTNhMREwDwYDVQQL 4 | Ewhib290a3ViZTEQMA4GA1UEAxMHa3ViZS1jYTAeFw0xNzExMTUxMjUzMzRaFw0x 5 | ODExMTUxMjUzMzVaMC8xFDASBgNVBAoTC2t1YmUtbWFzdGVyMRcwFQYDVQQDEw5r 6 | dWJlLWFwaXNlcnZlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKzR 7 | l0XcazbqJySnggARkIZQk3GNQW20UICWsSk4gE6CVVjUwi4ihWJEQkH+VHbliPNG 8 | r6Qrv8mF8FhhCWaH6n6O+4g9WN17PdM/lG96VKeplVBI13vgDGCu+yNTkeUvX0DB 9 | QqQBK6ljtOnFTI8PvxqS1WuHJlveesq4+3WZyvfgNqENDggz/aGehceT2MYBJjb1 10 | Na5HnkHZ61Yw2Lf9NRj7aWDU6AeJ4GTYX+yzdTDZh3Gvmb9ZrzbPF3B/a9/eqeIb 11 | 7G3WfYu7p0l59CY7Zjjd1+kMcwAOO8i+6QQwxQjDUZsUjIEP12+zLExRc9GkGnil 12 | JxYHI+kwx+WKWagQ2akCAwEAAaOBpzCBpDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l 13 | BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMHMGA1UdEQRsMGqCCmt1YmVybmV0ZXOC 14 | Emt1YmVybmV0ZXMuZGVmYXVsdIIWa3ViZXJuZXRlcy5kZWZhdWx0LnN2Y4Ika3Vi 15 | ZXJuZXRlcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FshwR/AAABhwQKAwABMA0G 16 | CSqGSIb3DQEBCwUAA4IBAQA7iPMjcPBzRKgvFgJyKXmLEFUqlIePwMYnJwGDREIb 17 | DpICKd4qpTQ3xMmNb4Dnp/r9GCO3QX228mVJEeWDkDVr4hpfOILjWIPIfBX1mK8Z 18 | e73Up5mNJUKYjvfTmH7iH8pTEkG2nvQZaW5XE/76MYJAZ2t8RR+v62hLW9R+mFb2 19 | E6RKgEEith3rJHz3N9CEzije+4/xXB8XqFQIZVK27+loaX5T3/PDru3SpBpIPsau 20 | dxS55rN2zRLNPAaOCQlp8HXOMdgp3b8IY1Q9BpPjYHU2TdMAxjPBonCinYcFr+yn 21 | JDR+E+ZiEjPcdtbxvoYC6HW/d8+qTyrbKCA3JBy30raQ 22 | -----END CERTIFICATE----- 23 | -------------------------------------------------------------------------------- /basetemplates/tls/apiserver.key: -------------------------------------------------------------------------------- 1 | -----BEGIN RSA PRIVATE KEY----- 2 | MIIEowIBAAKCAQEArNGXRdxrNuonJKeCABGQhlCTcY1BbbRQgJaxKTiAToJVWNTC 3 | LiKFYkRCQf5UduWI80avpCu/yYXwWGEJZofqfo77iD1Y3Xs90z+Ub3pUp6mVUEjX 4 | e+AMYK77I1OR5S9fQMFCpAErqWO06cVMjw+/GpLVa4cmW956yrj7dZnK9+A2oQ0O 5 | CDP9oZ6Fx5PYxgEmNvU1rkeeQdnrVjDYt/01GPtpYNToB4ngZNhf7LN1MNmHca+Z 6 | v1mvNs8XcH9r396p4hvsbdZ9i7unSXn0JjtmON3X6QxzAA47yL7pBDDFCMNRmxSM 7 | gQ/Xb7MsTFFz0aQaeKUnFgcj6TDH5YpZqBDZqQIDAQABAoIBAFDdedVcwGZfxpUm 8 | NHRnw6K1zWhS2ozE1O52lMte/tq9rcX1OC9yQ8upeP98THWeDikXqFQ/jGx12fLg 9 | 5Q8vBhDWQuiLHCv24QUaORC4wyf4+D8q9nmmauRKvITZM+lz8zRPuikXyyBl4V+J 10 | zLsceSWsE2VPRimyvu5hBHkQz6KQaDJ6ACYBCYOvYLS7KsWHRrklvpdPO4XaCT0t 11 | NR4APayQ8BKlNJubXSN8D8QgSwFd9qiCnDlvXXInIbBC0QNB3ky0IUWfnN4uOK5y 12 | X7isx9x7fk1hs6Lbb1NtfGXEopXoL/Wi9/W2JzZIohJcrTHM9S4H8D2rj8fLUAP0 13 | N1S9NykCgYEA5O8+n+nsPGyAg6unBQpi66LO9DUQSnZAbnnE/fAcgkHxexhu7QFd 14 | o+1p6IuI2ex+0eR62wJwPZz09Hhmejez8feDtOxmnJoZgrweDA0kKBPtBFJVDAzr 15 | fUVw7y/snMZLlbh6ocDixEMSXkurQiY/jsBjIFbFqVIMaF50tNfeOVsCgYEAwT/8 16 | 7F+eXGhZj0XiHMWrLs3yd4bCEHOD23ebZwRn+PCYZH57l2it9UA9vKZWaEwCfLso 17 | 2fO6dC0bKz0dUwtM6mI3zCtC8hNiNOAUNmkG8WYcVGyxSGy9lN2oGjnE9s0wPiHa 18 | zROBQ+PAVysvNImILv+fwWlsV5WQQ69R7CFz5EsCgYBog2xElwc5IpOdCN0r6Oz2 19 | BBKU3DC+vbN2e/LZtydcs/wpJSNm4au9LaKe/iyQyG2xJqyLlVZmWmRdwyWNgCaP 20 | PV8MVqwVrCgfTgAtokYyYb5frbKT2MYdH3mKSIetnr1c8aZSd/tOfAxDrinV/h4f 21 | 7maSmeqM/R8a+pwu/ym9ZwKBgCHFifDRAP7LKaOVJd+7V6AVU6M5xJ5VYZyv+VN2 22 | fKkPesJNLFIYdBYhBOj79KvDZMfheVEle9cjrtTOmFpT5jwrr+6ZPNjLNGVjJ4Ue 23 | s5zqKFdEq3KptjPWzLLQl7A9yYmCJxehqfxwR8O0A0reIhN8jrGhN9LSi2SYtetb 24 | KUKjAoGBALVn4lNV3nvJYBLUVxs1ufDWOj+JgO8F0LOc6DLBvfM5iaxfJDq+tltn 25 | vUyh5oo/8lVgZkfI3nj/WGajbLkamgHORKN8bb3SibU4VtbM70Dqe8JQp3NE0NSl 26 | QmDmrKKPNK62000qTOn+dRDbbL7k53VPg5yK0DE9mZ9AXR2gxfb9 27 | -----END RSA PRIVATE KEY----- 28 | -------------------------------------------------------------------------------- /basetemplates/tls/ca.crt: -------------------------------------------------------------------------------- 1 | -----BEGIN CERTIFICATE----- 2 | MIIDRjCCAi6gAwIBAgIBADANBgkqhkiG9w0BAQsFADBUMS0wKwYDVQQKEyQyMGE4 3 | NjY4NC1jNWIyLTQyOTQtOTkyMy1iYzYwODFhZTVhM2ExETAPBgNVBAsTCGJvb3Rr 4 | dWJlMRAwDgYDVQQDEwdrdWJlLWNhMB4XDTE3MTExNTEyNTMzNFoXDTI3MTExMzEy 5 | NTMzNFowVDEtMCsGA1UEChMkMjBhODY2ODQtYzViMi00Mjk0LTk5MjMtYmM2MDgx 6 | YWU1YTNhMREwDwYDVQQLEwhib290a3ViZTEQMA4GA1UEAxMHa3ViZS1jYTCCASIw 7 | DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKkJljZnrxgbx1epmm5JXCMmETvY 8 | C7J4iqVhsQsQ80ejreyZvtctCIdvY+zVUCGID5DrgEn+9fKWbFTA9WZmrWpPkKTO 9 | yu97PTaeCp3Vzc62HExq+Wa3z8UKMcSSqzQNdsWPL35JShv9cDs68AGOpVxZb8zf 10 | AqDJwU8+Gu4baC5Qqy1Dn9q9KiubMqjjDIJ1gw7/nrZp+y9SEz3SxY3LEpbpfa6u 11 | nEez2gqvNwr0C1OzmvBpsSqaQ5ewttdOnHNcbmHjQi7P3EcwUP4p1kW7GLXAFMxQ 12 | My/brH4VNHGXC3P5NOsGovm7MndfhSWXQT+WS58Onql+GZkN6IoD0AKdE/8CAwEA 13 | AaMjMCEwDgYDVR0PAQH/BAQDAgKkMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcN 14 | AQELBQADggEBAKixXXktzO+5SNd2ff+MMqoSr3vpEWawSRQ6PkAQJnA+xD3GHN1E 15 | XDRTcavCL8ssSB1ghgdEvaw+4KUrzo1eRNF7BZxGmreuGdpSkfaFI60Rzs44qIxZ 16 | mtzZKxg4SbiVluRgYwBt37+O8j0VYYfIEy5dVAT18v1a/LObb/FuIrUMsj24u9Mn 17 | CoIm6RyipDBueTynJ+EgCNfHRrlMdJcM0hCEsWTzT1iT9jT5mi72NtLc/ZhYJwrV 18 | Raa9rw5Hpal8AHgEvd90WAMWt4AQptFZGE3Fgnz4Ypgjhav+2Mv0/pBFPiQjK/lU 19 | fFZqa/BPFbTHiaL3B4hO3yojVdWsEsN5DWs= 20 | -----END CERTIFICATE----- 21 | -------------------------------------------------------------------------------- /basetemplates/tls/ca.key: -------------------------------------------------------------------------------- 1 | -----BEGIN RSA PRIVATE KEY----- 2 | MIIEpQIBAAKCAQEAqQmWNmevGBvHV6mabklcIyYRO9gLsniKpWGxCxDzR6Ot7Jm+ 3 | 1y0Ih29j7NVQIYgPkOuASf718pZsVMD1Zmatak+QpM7K73s9Np4KndXNzrYcTGr5 4 | ZrfPxQoxxJKrNA12xY8vfklKG/1wOzrwAY6lXFlvzN8CoMnBTz4a7htoLlCrLUOf 5 | 2r0qK5syqOMMgnWDDv+etmn7L1ITPdLFjcsSlul9rq6cR7PaCq83CvQLU7Oa8Gmx 6 | KppDl7C2106cc1xuYeNCLs/cRzBQ/inWRbsYtcAUzFAzL9usfhU0cZcLc/k06wai 7 | +bsyd1+FJZdBP5ZLnw6eqX4ZmQ3oigPQAp0T/wIDAQABAoIBAQCe2heDwSRWr6RB 8 | yW0LP32KundvmbREX+tLR+cs0x0MsdD8i+9AH13oiNGK+1t2Z3rZYbcJ0sQm2R2s 9 | +DilptBJG8R+XKdxLot0DElF0mq6W4F0fwMpeIuUS+RBKuQg4pY/SjQDpbQzYZRa 10 | 1SQ/EmJrytC54smBeJhlc6OzJ6Zb/oPdLrtUAxZnP+0EkjIuJ/Tr8PC5nh4/3ltr 11 | jjJ9HIFByV7daKgFKO69a2OPKmoN1cqjuAjyUVBxL1olVfpSSuod3oEe4x0EOgAW 12 | qax3WZCl0OIU6prxx0Nai/KSK72z5TA02F9U4hMdK3hIEo+Gi489lU8p47pLrb40 13 | ezEvP5BhAoGBAMhhmiJ5F9naUJlwAjUfsb9VuMBIxBrn8/TlgkpQo5rS/3BUgymH 14 | 8/L4LT5vUf/2fZ2RUp7nhWmxGNCspjkU7h1Jw5PM1XuufE45FRZZRlBdJwX54iZ/ 15 | gYRRPvvto7NB4VFM574za8TEsRuTLGg5ZQqoely0cmw+I+rmzqfLIQZNAoGBANf0 16 | zVnsDWLleYjLA0wA3/vWyAWKRGUROpclYV2UcrXF5gabXVr7ZuaY00VtzUS91Cxi 17 | ntdtYwSe6rgTJbAQ+qCIbxgWxl6jJhWwLJAI5VhExciu9mNtp1U+DFo1clsS1wL7 18 | zysVWOwc/22H7khmuvbvz0/xisDtWC8kcMXxe8F7AoGBALHC/DTWzhTiepwT5LFy 19 | A4JkrnhOVUI1QZOgwxvgO7NOuXLSVmVSiVSjW6fGo6z542gUEoKLiyw/Am+kqfV7 20 | nt12ob0Netm06euO8ikYW6tRaBwCGODkPma+mKxvnciZiiRQoEl4XoN5plB7GGsB 21 | d6Sj36E8J0HlQoHR7cSnDA4FAoGBAKXVUNPalrT47okDDHcSvO1RE6xdbwQFZO6o 22 | P8pysluvqmIscFXrdCtj8+j+1oARHZsv6DYZw83KkwfjfC9l+m/IFTd0VcRamGZT 23 | MQUyL5vGw/LFmGLl03d7/FRRco1JPF8IKyA0dmJqKiNcHLjwWmZB5PrIyvo3yF37 24 | J7Z5J8V9AoGAZzMNUK+0xWX6erXrHPVXCOLwsrR9nIC9/vjZetoaf5BCUogvm/wU 25 | mvZQAG3vVxoblwb+vV1rscRrSeTODJy6bYbGuL09DufShski7uHeSYnMMG5fj+Rl 26 | AVoRUSD8eMrG1eEyInrC2JZPYyWtoiACEwk0m/heyWqD/e5Nzv+wSbg= 27 | -----END RSA PRIVATE KEY----- 28 | -------------------------------------------------------------------------------- /basetemplates/tls/etcd-client-ca.crt: -------------------------------------------------------------------------------- 1 | -----BEGIN CERTIFICATE----- 2 | MIIDRjCCAi6gAwIBAgIBADANBgkqhkiG9w0BAQsFADBUMS0wKwYDVQQKEyQyMGE4 3 | NjY4NC1jNWIyLTQyOTQtOTkyMy1iYzYwODFhZTVhM2ExETAPBgNVBAsTCGJvb3Rr 4 | dWJlMRAwDgYDVQQDEwdrdWJlLWNhMB4XDTE3MTExNTEyNTMzNFoXDTI3MTExMzEy 5 | NTMzNFowVDEtMCsGA1UEChMkMjBhODY2ODQtYzViMi00Mjk0LTk5MjMtYmM2MDgx 6 | YWU1YTNhMREwDwYDVQQLEwhib290a3ViZTEQMA4GA1UEAxMHa3ViZS1jYTCCASIw 7 | DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKkJljZnrxgbx1epmm5JXCMmETvY 8 | C7J4iqVhsQsQ80ejreyZvtctCIdvY+zVUCGID5DrgEn+9fKWbFTA9WZmrWpPkKTO 9 | yu97PTaeCp3Vzc62HExq+Wa3z8UKMcSSqzQNdsWPL35JShv9cDs68AGOpVxZb8zf 10 | AqDJwU8+Gu4baC5Qqy1Dn9q9KiubMqjjDIJ1gw7/nrZp+y9SEz3SxY3LEpbpfa6u 11 | nEez2gqvNwr0C1OzmvBpsSqaQ5ewttdOnHNcbmHjQi7P3EcwUP4p1kW7GLXAFMxQ 12 | My/brH4VNHGXC3P5NOsGovm7MndfhSWXQT+WS58Onql+GZkN6IoD0AKdE/8CAwEA 13 | AaMjMCEwDgYDVR0PAQH/BAQDAgKkMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcN 14 | AQELBQADggEBAKixXXktzO+5SNd2ff+MMqoSr3vpEWawSRQ6PkAQJnA+xD3GHN1E 15 | XDRTcavCL8ssSB1ghgdEvaw+4KUrzo1eRNF7BZxGmreuGdpSkfaFI60Rzs44qIxZ 16 | mtzZKxg4SbiVluRgYwBt37+O8j0VYYfIEy5dVAT18v1a/LObb/FuIrUMsj24u9Mn 17 | CoIm6RyipDBueTynJ+EgCNfHRrlMdJcM0hCEsWTzT1iT9jT5mi72NtLc/ZhYJwrV 18 | Raa9rw5Hpal8AHgEvd90WAMWt4AQptFZGE3Fgnz4Ypgjhav+2Mv0/pBFPiQjK/lU 19 | fFZqa/BPFbTHiaL3B4hO3yojVdWsEsN5DWs= 20 | -----END CERTIFICATE----- 21 | -------------------------------------------------------------------------------- /basetemplates/tls/etcd-client.crt: -------------------------------------------------------------------------------- 1 | -----BEGIN CERTIFICATE----- 2 | MIIDNTCCAh2gAwIBAgIIHD0I0PgnsuEwDQYJKoZIhvcNAQELBQAwVDEtMCsGA1UE 3 | ChMkMjBhODY2ODQtYzViMi00Mjk0LTk5MjMtYmM2MDgxYWU1YTNhMREwDwYDVQQL 4 | Ewhib290a3ViZTEQMA4GA1UEAxMHa3ViZS1jYTAeFw0xNzExMTUxMjUzMzRaFw0x 5 | ODExMTUxMjUzMzdaMC4xDTALBgNVBAoTBGV0Y2QxHTAbBgNVBAMTFG9wZXJhdG9y 6 | IGV0Y2QgY2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtYAC 7 | xDC41zcK4tNdq8nRvEuElcpkggEG3UaFFjQ2hRGQ+7PkCPYGw8iass1ankLU40kk 8 | j1S6w44PhYFEp0mofyaVTi7Lvd67WwMOEOUQQg+/2fGSK/0wP3vweChKsHA4H6Pm 9 | nhqSkgV/Gtc8GvT2Uw09HxT/UlYwoBB6S3WTOdvo2oznBMMBJ25yykUxBB4DDWAj 10 | aTvdGfpoea2Bet+abjWBrk+OYTOLWPqVpW9oxoxUH91MLi818OnIzs9UAMq1KexP 11 | Bn1N0CvFIZwEpmQSl0FovDgJ0h32IFXBISvTY7GmriX8CvVDPrOqWytmBNaVgK7F 12 | XAaRgbxlQcPHTTn8mQIDAQABozEwLzAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYw 13 | FAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4IBAQBk2c5PZyZo 14 | 5hiblBuqP/mgj44lZ8nrLzboiQeAvCTdjoFzU46+/Mo/tHQIdVupCAdFeih/LruQ 15 | 42b+A0foQNmoihYHPgVmBqtdvb7Yj8Mm6jyOvZ0FaH7Y8Nzdq1uMsV0ysYzYfLQs 16 | dpwx0dYXM5kMBS3EQt8ICPJ27Ch1RfuT7OfAPUC7O2Oe9irCXcR4ijSdBGAojzlx 17 | ov/l44F0+5JNor136FdFZfo71airfh4Qn/BX2LjSjefsRk5LgFnD2R3QXahl9wTg 18 | bOh2u54U3W28IrQ+/FimDppHzOzxnh2E7tE9b+Bt9LZFb2W9HdfxClq+bDE4T32Y 19 | 3pYRHPQQX/pq 20 | -----END CERTIFICATE----- 21 | -------------------------------------------------------------------------------- /basetemplates/tls/etcd-client.key: -------------------------------------------------------------------------------- 1 | -----BEGIN RSA PRIVATE KEY----- 2 | MIIEpAIBAAKCAQEAtYACxDC41zcK4tNdq8nRvEuElcpkggEG3UaFFjQ2hRGQ+7Pk 3 | CPYGw8iass1ankLU40kkj1S6w44PhYFEp0mofyaVTi7Lvd67WwMOEOUQQg+/2fGS 4 | K/0wP3vweChKsHA4H6PmnhqSkgV/Gtc8GvT2Uw09HxT/UlYwoBB6S3WTOdvo2ozn 5 | BMMBJ25yykUxBB4DDWAjaTvdGfpoea2Bet+abjWBrk+OYTOLWPqVpW9oxoxUH91M 6 | Li818OnIzs9UAMq1KexPBn1N0CvFIZwEpmQSl0FovDgJ0h32IFXBISvTY7GmriX8 7 | CvVDPrOqWytmBNaVgK7FXAaRgbxlQcPHTTn8mQIDAQABAoIBAQCzZHtXfvCzh2vz 8 | FgcXrLro6Zt6kjkVZf5q5zDT6XeZvusWXY+ea83z5WtCH0bZ9iSFId5I7O5MKzWc 9 | N1CsKFmqk3AvfoFSgbudET/t4vpW0UpHGEXpxK7TkKT1np10FvbiDxX6XzlPqq8e 10 | 0G5QFp8BJ6yp9A8ISrh0/NRjkSqbm9w0e7tXpqqKIG8sEojCS5OkX5TW4iNb13ws 11 | 8MHc+7d3thuE4Y6tTTrsopbCVtPfjuhF2daUukoO9BoP1TCjlZfCb8/EIFGaa6xA 12 | EbY+TdkI/1Uqp7Q7K519XUim/Fq0oYfahIh0ON5WVbT5wyYtu+KUspQYhJn36Urn 13 | uEan2QCBAoGBAMNRYxTscA3G6jhdDVF0NGaytR4ePBYoaEog5OMJUcQ4eCegFLGf 14 | uA36XxWNytjoeOsCtDpY5L+2Ygm742WRzhCOE9ZSsDm047SE6n/jeqPGWtpNK5/K 15 | VLd7NbeCOyrAj7phIWQS0p2xtfiLOvlHC1vGpheEkq4z/2xR1XHii5XlAoGBAO3j 16 | nmxvIqnVZDof0F92yrKk5CWsqsBHz0vzv71HWvrG3qGfta3PQHXmkZ9flIoWiDwa 17 | x+TpXS8F5VPgv7q8vT0IUvIYPzEmxOSGEGAN7AcuY7vkAsaHhJoz9Uy546hZSngw 18 | QtXG3xJg3qpiayksUUdh/iXIbpkc+PAk0CVsEuClAoGAHAeI/Y60wfVi1XXdHGxd 19 | vMM2pLzYCKIB3Wl9D2vd9RfZfm5Fqfvu0Oq2TISNsLUj7S31KU5qfWyyAw2Yo5Ha 20 | DZwmEqLJMW7ZIqXUdUfy6J/ll+BtO0AxCie/XLduwELkHW4k+ZSN7x16rNFmRDHC 21 | 2ofWfBeFaUSDCktwIyjMuVUCgYBb3iRHIeAUEDmFjNWumDSNKsqElhrW6KRwY3Bv 22 | i0fiQrylVAUYW0o8fc9M6d92OF9iPsFlcI2w5Cj87HV+ivbVxAosPhrhQ2SUEAXw 23 | 4k99MngHjnVX7+vQlTIs8DivwdPVeGXHIubwtQIocJuLqfa1h21bb/zuGlc0fjL3 24 | 0LW1lQKBgQCMG+I6+ORWywE8woG/kn9QpDo7GVbkPtuJxmONTyEGoSoYfYl2rj1D 25 | nZTEErQ94Q1+ypmgSJ4+v25bc3F+UtmW3i1KW7M4CBcN9tQPWz1vSJVBzeRSOMT+ 26 | XpS2AOUIzx1v/cYlKp6vdXwVBvzf8RO8CjbiNhJQXvfjp/ydvJn0Ew== 27 | -----END RSA PRIVATE KEY----- 28 | -------------------------------------------------------------------------------- /basetemplates/tls/etcd/peer-ca.crt: -------------------------------------------------------------------------------- 1 | -----BEGIN CERTIFICATE----- 2 | MIIDRjCCAi6gAwIBAgIBADANBgkqhkiG9w0BAQsFADBUMS0wKwYDVQQKEyQyMGE4 3 | NjY4NC1jNWIyLTQyOTQtOTkyMy1iYzYwODFhZTVhM2ExETAPBgNVBAsTCGJvb3Rr 4 | dWJlMRAwDgYDVQQDEwdrdWJlLWNhMB4XDTE3MTExNTEyNTMzNFoXDTI3MTExMzEy 5 | NTMzNFowVDEtMCsGA1UEChMkMjBhODY2ODQtYzViMi00Mjk0LTk5MjMtYmM2MDgx 6 | YWU1YTNhMREwDwYDVQQLEwhib290a3ViZTEQMA4GA1UEAxMHa3ViZS1jYTCCASIw 7 | DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKkJljZnrxgbx1epmm5JXCMmETvY 8 | C7J4iqVhsQsQ80ejreyZvtctCIdvY+zVUCGID5DrgEn+9fKWbFTA9WZmrWpPkKTO 9 | yu97PTaeCp3Vzc62HExq+Wa3z8UKMcSSqzQNdsWPL35JShv9cDs68AGOpVxZb8zf 10 | AqDJwU8+Gu4baC5Qqy1Dn9q9KiubMqjjDIJ1gw7/nrZp+y9SEz3SxY3LEpbpfa6u 11 | nEez2gqvNwr0C1OzmvBpsSqaQ5ewttdOnHNcbmHjQi7P3EcwUP4p1kW7GLXAFMxQ 12 | My/brH4VNHGXC3P5NOsGovm7MndfhSWXQT+WS58Onql+GZkN6IoD0AKdE/8CAwEA 13 | AaMjMCEwDgYDVR0PAQH/BAQDAgKkMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcN 14 | AQELBQADggEBAKixXXktzO+5SNd2ff+MMqoSr3vpEWawSRQ6PkAQJnA+xD3GHN1E 15 | XDRTcavCL8ssSB1ghgdEvaw+4KUrzo1eRNF7BZxGmreuGdpSkfaFI60Rzs44qIxZ 16 | mtzZKxg4SbiVluRgYwBt37+O8j0VYYfIEy5dVAT18v1a/LObb/FuIrUMsj24u9Mn 17 | CoIm6RyipDBueTynJ+EgCNfHRrlMdJcM0hCEsWTzT1iT9jT5mi72NtLc/ZhYJwrV 18 | Raa9rw5Hpal8AHgEvd90WAMWt4AQptFZGE3Fgnz4Ypgjhav+2Mv0/pBFPiQjK/lU 19 | fFZqa/BPFbTHiaL3B4hO3yojVdWsEsN5DWs= 20 | -----END CERTIFICATE----- 21 | -------------------------------------------------------------------------------- /basetemplates/tls/etcd/peer.crt: -------------------------------------------------------------------------------- 1 | -----BEGIN CERTIFICATE----- 2 | MIIDnzCCAoegAwIBAgIIKEuN0QTsqHcwDQYJKoZIhvcNAQELBQAwVDEtMCsGA1UE 3 | ChMkMjBhODY2ODQtYzViMi00Mjk0LTk5MjMtYmM2MDgxYWU1YTNhMREwDwYDVQQL 4 | Ewhib290a3ViZTEQMA4GA1UEAxMHa3ViZS1jYTAeFw0xNzExMTUxMjUzMzRaFw0x 5 | ODExMTUxMjUzMzZaMCoxDTALBgNVBAoTBGV0Y2QxGTAXBgNVBAMTEGV0Y2QgbWVt 6 | YmVyIHBlZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCaNum0EKA/ 7 | 8NlsOXndcS7rkZjtkGVunJbD3isg8wG2GUGZ9F/b1MF/8zyuE93xcARHFTEaLkWE 8 | BBBGVGpHuKd7QZXIGZ3OJfaMbm4hJC9EPQyau0Le1BhTY2oIjANzkCNl4N+PHntu 9 | hxlS2sZt+6Vxamj4cDWfGf5mhsp8+NdQKwlPGo51I6D56CRWe6wNPU7RA3HugO5F 10 | ncLn8bybQmAKRbW7mtA3TuesAXtg3i+QSuFoJMwBBtcoC2GHoMfDovR9XnBPsmcY 11 | p0of/+29EekvU//8Qsn+aU5MK1IR0PtPAxRpcN+XrRS3KGQC+zZlm0M7CMdWmLgT 12 | fBQJABQkb3alAgMBAAGjgZ4wgZswDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQG 13 | CCsGAQUFBwMBBggrBgEFBQcDAjBqBgNVHREEYzBhgikqLmt1YmUtZXRjZC5rdWJl 14 | LXN5c3RlbS5zdmMuY2x1c3Rlci5sb2NhbIIua3ViZS1ldGNkLWNsaWVudC5rdWJl 15 | LXN5c3RlbS5zdmMuY2x1c3Rlci5sb2NhbIcECgMAFDANBgkqhkiG9w0BAQsFAAOC 16 | AQEAeqE8E2oR1nmLaDn9Nid0tIRBItSFD+niNFWCBpVGS4FkuZz+YEmkiZnK/R96 17 | Vlz4N/TvY1RH7t5y2G2ngJ1jVQeCpJ7xPydf6M1FJdewuzaCwuhXmmTLQ5Ai1Xqv 18 | RhlGW67rtBe+a5hQaKXvTe+9Z4fOUOoovgwJEZHxLIvmqDLEc603sbQKpngYVYhK 19 | K9CEqvaAyEdNps1lzj85Iu6QcXLCUrUCjlG8l/NVVI/xlZksQJBg8igHjEVrBL2v 20 | DJVpvmxVp5FYQA1u8rCq0JJreUcI7BcRKp0n9JNKZgza/8npnWE+yNh9vv7sS0m/ 21 | eEtFC+5V0wFeTTpIUp6+brjngg== 22 | -----END CERTIFICATE----- 23 | -------------------------------------------------------------------------------- /basetemplates/tls/etcd/peer.key: -------------------------------------------------------------------------------- 1 | -----BEGIN RSA PRIVATE KEY----- 2 | MIIEowIBAAKCAQEAmjbptBCgP/DZbDl53XEu65GY7ZBlbpyWw94rIPMBthlBmfRf 3 | 29TBf/M8rhPd8XAERxUxGi5FhAQQRlRqR7ine0GVyBmdziX2jG5uISQvRD0MmrtC 4 | 3tQYU2NqCIwDc5AjZeDfjx57bocZUtrGbfulcWpo+HA1nxn+ZobKfPjXUCsJTxqO 5 | dSOg+egkVnusDT1O0QNx7oDuRZ3C5/G8m0JgCkW1u5rQN07nrAF7YN4vkErhaCTM 6 | AQbXKAthh6DHw6L0fV5wT7JnGKdKH//tvRHpL1P//ELJ/mlOTCtSEdD7TwMUaXDf 7 | l60UtyhkAvs2ZZtDOwjHVpi4E3wUCQAUJG92pQIDAQABAoIBABQkeAH86fFwE/X+ 8 | y9wQnIBIVCEzaww3h7mtmxSCqQaP5fGl6Z9c+qkrrBFQpvySFPzz16YDxTCpFzcY 9 | b4lOpRGET3wDXIlAjCNriRbrEwFmt+695s4UBdlecssK/qhpezYjWQ/oe1bEbppT 10 | 2Pckl0dpDqzkexx82K2rjWclWXou8O6N0VAgJ5oPq6Mod6lmdvOGRvuvKX30WqsS 11 | 9YHF3MJVdTcCvgeO35Us9BmaiOStaG6QJ1APpC6wNnZoi0rbcn807yJCjD0eYRfV 12 | 9e/Nh1vAVKD7FaN4YSWzZo+hz3h77b2vDRieP5nnFv9eQgBwHrtIs0fq1zVj2qAu 13 | 3m5Zf0ECgYEAwyB1f6DGRaFJgPEKgwNLS9Yj9cWDqGjtrHRnMwJS0xa0c9twIv+6 14 | 0xHkbCpr9qs9nZ8E9X32N7n0Z0vpLfziVao+YdkkSq/emmAd2w2BBQtk8uv11Dr7 15 | WMsMSKRxbg+uHwwl2llacnFPonv+eyR3fxi8JTJfOBkmvGRBozua3ScCgYEAylMM 16 | az4SAB/wSsnOJSerLrQjHlCFfe7veI/YCbH026jauKaCF52XseixHlQngDcqij8O 17 | 6h/OdlQeesDFbSx47ICZpXSXP1mh+yrbcMdjOBRkRfdtTOT779HaPnNX7Cl1T4Or 18 | WyUZ7K0A7GZKr88xMGnaUEx5pUtZK4AX9n7YBVMCgYAxz6VvEUHMIKI88kt2qm6c 19 | S2wen28+nJqfvY9irCMsk805DjmQFaxBmX2wRxwMeiZeiGuhp6glDalgfTZncPju 20 | WWlXXTEwh7jRu9ujQc0/1mrMwIOey/fB8QOPv7rdF8+hSV6YYNsAAAEOP4z1Lpf6 21 | r/vHmxZHodQLn6RJ4TtlXQKBgEu0K29tODsHuFejjxjj8O92w7UyF+D5KG2KFSH7 22 | jk0qrzxsQT0o4HvXP37DqkwVWDuGQMRlxlEMRKNVwgmJnG2R6Ou55mXz2eIrNRTL 23 | 5lozdxme7SzaeVJQyUKY0gsxsA1ijRl7lmmyiifqVoPWGOeuk9t74gBxYxodwdmf 24 | uKC1AoGBAKkYSImilEP7tmQgzNMkM4R1Arrm5wzdAVLQ792CLsSxRFKktbxQJ2AW 25 | Yk/iHGJrolmJ6wydpQhx2HfyV2ufaUFrAivgmzuJ5PGA4/BLL4G7auBPCxW7KkIc 26 | yQ2b5/WH/rTsuu5S6Sfi73/HffJLYYc7PwibpaYweii3JBmC9ked 27 | -----END RSA PRIVATE KEY----- 28 | -------------------------------------------------------------------------------- /basetemplates/tls/etcd/server-ca.crt: -------------------------------------------------------------------------------- 1 | -----BEGIN CERTIFICATE----- 2 | MIIDRjCCAi6gAwIBAgIBADANBgkqhkiG9w0BAQsFADBUMS0wKwYDVQQKEyQyMGE4 3 | NjY4NC1jNWIyLTQyOTQtOTkyMy1iYzYwODFhZTVhM2ExETAPBgNVBAsTCGJvb3Rr 4 | dWJlMRAwDgYDVQQDEwdrdWJlLWNhMB4XDTE3MTExNTEyNTMzNFoXDTI3MTExMzEy 5 | NTMzNFowVDEtMCsGA1UEChMkMjBhODY2ODQtYzViMi00Mjk0LTk5MjMtYmM2MDgx 6 | YWU1YTNhMREwDwYDVQQLEwhib290a3ViZTEQMA4GA1UEAxMHa3ViZS1jYTCCASIw 7 | DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKkJljZnrxgbx1epmm5JXCMmETvY 8 | C7J4iqVhsQsQ80ejreyZvtctCIdvY+zVUCGID5DrgEn+9fKWbFTA9WZmrWpPkKTO 9 | yu97PTaeCp3Vzc62HExq+Wa3z8UKMcSSqzQNdsWPL35JShv9cDs68AGOpVxZb8zf 10 | AqDJwU8+Gu4baC5Qqy1Dn9q9KiubMqjjDIJ1gw7/nrZp+y9SEz3SxY3LEpbpfa6u 11 | nEez2gqvNwr0C1OzmvBpsSqaQ5ewttdOnHNcbmHjQi7P3EcwUP4p1kW7GLXAFMxQ 12 | My/brH4VNHGXC3P5NOsGovm7MndfhSWXQT+WS58Onql+GZkN6IoD0AKdE/8CAwEA 13 | AaMjMCEwDgYDVR0PAQH/BAQDAgKkMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcN 14 | AQELBQADggEBAKixXXktzO+5SNd2ff+MMqoSr3vpEWawSRQ6PkAQJnA+xD3GHN1E 15 | XDRTcavCL8ssSB1ghgdEvaw+4KUrzo1eRNF7BZxGmreuGdpSkfaFI60Rzs44qIxZ 16 | mtzZKxg4SbiVluRgYwBt37+O8j0VYYfIEy5dVAT18v1a/LObb/FuIrUMsj24u9Mn 17 | CoIm6RyipDBueTynJ+EgCNfHRrlMdJcM0hCEsWTzT1iT9jT5mi72NtLc/ZhYJwrV 18 | Raa9rw5Hpal8AHgEvd90WAMWt4AQptFZGE3Fgnz4Ypgjhav+2Mv0/pBFPiQjK/lU 19 | fFZqa/BPFbTHiaL3B4hO3yojVdWsEsN5DWs= 20 | -----END CERTIFICATE----- 21 | -------------------------------------------------------------------------------- /basetemplates/tls/etcd/server.crt: -------------------------------------------------------------------------------- 1 | -----BEGIN CERTIFICATE----- 2 | MIIDuTCCAqGgAwIBAgIIQFjKZOCYgtIwDQYJKoZIhvcNAQELBQAwVDEtMCsGA1UE 3 | ChMkMjBhODY2ODQtYzViMi00Mjk0LTk5MjMtYmM2MDgxYWU1YTNhMREwDwYDVQQL 4 | Ewhib290a3ViZTEQMA4GA1UEAxMHa3ViZS1jYTAeFw0xNzExMTUxMjUzMzRaFw0x 5 | ODExMTUxMjUzMzZaMCwxDTALBgNVBAoTBGV0Y2QxGzAZBgNVBAMTEmV0Y2QgbWVt 6 | YmVyIGNsaWVudDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMkgvEB2 7 | zTate2RTDGjnATPvqM3+nrqm4UzYm/B9A+wrsUCCBiI4fE0CjererHwH09mLb9HY 8 | wv+sHBnejRKxR0Gwi78UmAYY1pDksZcw1EjZ8SkF5BQYYqq87hQtIOkOMl7XL04s 9 | F3YPI/2ozp2Bgg5hp8HjCG9INYW9Xp+2qWJ+icwO8x5wSHV6gns26s9mfDXwjSC8 10 | r7VE2m6q8431EfmbJVTHT2XKmC1hPmNINJR1vJ68EP0xUKApBWxXVdBnyqX7YSke 11 | XtHiUwUh+8h+Os7gcwTw5TLNVkjC8qpyob7I0LTwxQI5NdE+IhqOBm9DcaFSFWqX 12 | /Q7qREdIxVmjoo8CAwEAAaOBtjCBszAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYw 13 | FAYIKwYBBQUHAwEGCCsGAQUFBwMCMIGBBgNVHREEejB4gglsb2NhbGhvc3SCKSou 14 | a3ViZS1ldGNkLmt1YmUtc3lzdGVtLnN2Yy5jbHVzdGVyLmxvY2Fsgi5rdWJlLWV0 15 | Y2QtY2xpZW50Lmt1YmUtc3lzdGVtLnN2Yy5jbHVzdGVyLmxvY2FshwQKAwAPhwQK 16 | AwAUhwR/AAABMA0GCSqGSIb3DQEBCwUAA4IBAQAtQE6YtkRLYdScUalO4vpeIdLI 17 | Olm+Di0HoBAdeK7IdD/m2D5dxSRBjhkuvx2+ZP4OWt7pKjQ+yvX5RVCbevRBRQcy 18 | /VEX3ye6QfhB3N8kq5MV2sZ5ST/uTfpWmVvRDxMfXQ096CuiGh6p6jD77kMbo5Vx 19 | 3ViggjzcarqZ1AX+i/U2psp+dR2IMeG7VdOwFviniB2XJDb5OPKZyGgPpWEDUvgp 20 | wmIu6eBm9kd9Mxpjf2NvZ4x01n4VcmwgfSN025nxcbSUspCllnDNgnmnjX8LYe2W 21 | cDp1A9VxTMvbpwkI2F7DKTVlaXbd6evDXIfoZjqWFzvfpHiikzckCMTw8AKj 22 | -----END CERTIFICATE----- 23 | -------------------------------------------------------------------------------- /basetemplates/tls/etcd/server.key: -------------------------------------------------------------------------------- 1 | -----BEGIN RSA PRIVATE KEY----- 2 | MIIEpQIBAAKCAQEAySC8QHbNNq17ZFMMaOcBM++ozf6euqbhTNib8H0D7CuxQIIG 3 | Ijh8TQKN6t6sfAfT2Ytv0djC/6wcGd6NErFHQbCLvxSYBhjWkOSxlzDUSNnxKQXk 4 | FBhiqrzuFC0g6Q4yXtcvTiwXdg8j/ajOnYGCDmGnweMIb0g1hb1en7apYn6JzA7z 5 | HnBIdXqCezbqz2Z8NfCNILyvtUTabqrzjfUR+ZslVMdPZcqYLWE+Y0g0lHW8nrwQ 6 | /TFQoCkFbFdV0GfKpfthKR5e0eJTBSH7yH46zuBzBPDlMs1WSMLyqnKhvsjQtPDF 7 | Ajk10T4iGo4Gb0NxoVIVapf9DupER0jFWaOijwIDAQABAoIBAQCP73ppk9u2tp5o 8 | pLpr1G3a8jdW/FIx972i1h17FKya9oXKSYMEOHJUVnCj1imQNbXZqN0kS0D54fzW 9 | UpuY9f+tth+8ZouJSXs8hD3Hmm1BmZ7pocqgyvbJg53KGKXFw6AumUbEZe+AUMOM 10 | A6Ohuo4Nprt8mPJvWTjcdjJikEFWNzxemPGF01/ju4tIZwkm6gbP6DzdXa2WNqr9 11 | y5gkrWHBr6FpWGaMfIhIReq5V6DNRVnu+BiOtYFo8FDJO3/OIUsoqb7mKLbxh/Z8 12 | YiThALQl5H/UveZ5E1CoSY7r734sosGPkZukn3bKVE1rjdcn9oLCRtLuJCbzEXqx 13 | +h5HIdeZAoGBAM89gaRup8Y4rfw9EvSP81Ywu/ZwQkx3nWZmLxmvwzw0qqGVIaJG 14 | fOnkjjybXAK5FPQsunXXNOlXTl4mxKw+/29Oq+5IljrH/19s+YehwNiJRf1RrYmj 15 | viA9jwNdtFz8VEM0Ic70iGz5kZQsSFLtxQGozdM3eXEvzGazj59ZVrCrAoGBAPhz 16 | EVUL/a9jVQq/tT+BCSvqaQtQTiMuyMfSMTm1d6ZdENrFQP4wjR5VaPaHq8ZpJrjM 17 | 0keX/N9J2VmyAYwy6bTGj+Ls+pWisqEKgvTaF1Bot/PXIvYglDncfVCpjzkNArrI 18 | ksVwx7I9onrRCUHraJ8/Dn0y3id8lLt7Yrss4L2tAoGACb7wu9TgWvgLZpNQsuOa 19 | I/GCxWIeHA57/nbLvD+BxPENHTAwNrtt4Gn5Lmx39UDS9XCtDCGkwVxzuQXFtfv4 20 | czmV6EzNk9IX9lrfmTtIIGbEPdd7e7+Rj16VvSjI9J6BL+/hryPczpMl/3vdoti/ 21 | rQZNN6OiOGpxCFtlY68F3qUCgYEAnBb+7qWn7gbEKQqkfo89CeAturPrQ2NjNVcz 22 | IgSGdXjG3AtNd+Vc44/Zb/lwzCjH8RaNjflJH6ev7BBPtJtQBQky4OjtzhD3lQGb 23 | oOVb/GKuH34sMuHo/ikuefztRHSOIHde7riaXbsnV235GPcjNdlR6wqIU9qLPvaX 24 | 4uyhDckCgYEAj2PYKjfFF6Itlnbu9K/Di4ENZQFJvMzhKIKk5wLz9McA2PGFGYLc 25 | NODzwwHxzUKxf9NRDQFHzKR+FXDgbbmNyFwoTIoMYf6NDhVDB/gynxJMKqX001ek 26 | T6SIMfP3KqbkNli2LdcInWZhERve/qmwsolOoWkxTYdQlDPX2eXXJtM= 27 | -----END RSA PRIVATE KEY----- 28 | -------------------------------------------------------------------------------- /basetemplates/tls/kubelet.crt: -------------------------------------------------------------------------------- 1 | -----BEGIN CERTIFICATE----- 2 | MIIDMjCCAhqgAwIBAgIIPanqRXyDbBIwDQYJKoZIhvcNAQELBQAwVDEtMCsGA1UE 3 | ChMkMjBhODY2ODQtYzViMi00Mjk0LTk5MjMtYmM2MDgxYWU1YTNhMREwDwYDVQQL 4 | Ewhib290a3ViZTEQMA4GA1UEAxMHa3ViZS1jYTAeFw0xNzExMTUxMjUzMzRaFw0x 5 | ODExMTUxMjUzMzVaMCsxFzAVBgNVBAoTDnN5c3RlbTptYXN0ZXJzMRAwDgYDVQQD 6 | EwdrdWJlbGV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3ATRx7B1 7 | FaeV9oWg0NYEtWe1ksfMVh6/x11mVH2gvc8y5OAOUacWVVecUrvnU6wjJupsTxAS 8 | 4OXnQqQ0xpzKxDf4UiNMgQzXpa3eN1ZxhjIS4spQU6ZuFNLBYKKfJqXnkyz7D7VR 9 | WQ2ad1X89+WTULi+653uVDL9N+XaNezxPq88KkIvlP1rvJc5KIhCDs14ioLx26oi 10 | E24QI699iCYznQhce7n+nd/8L+6IfoRr044qazGOBLBhwCiwcrpq3EHjZM2bet1o 11 | +/7p9mYJJCa4RfJRf64v1WIuMuvlk5x8UQMMpto1XLU8BOvhGT0JcP9Tok/2s9g/ 12 | J3YtXHeMmKAl+wIDAQABozEwLzAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYI 13 | KwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4IBAQA8APXDL1HJbuH7 14 | cuUDbxlHf2v/YSHo89v0WtnuGGR119Naw/se8slwS7Y3KmuejJVJjsl0rm951BRW 15 | IZQD9LiyHGsl4ZjPWwn+Jf5Nd71T5CAfAgOHKns28BYoWKTbJeyiyg2fONfb+oV0 16 | 9qjahe7iFs5EOWsTLKe3V5mcAELHrqGYaIKERs8ik8SU6ptWdjl2AjrIZx3TJTf6 17 | XMn1JPDb6m4Dfow5HgiEq+k41x1ie3GAKBWnUrdjBb5oqUt3atji4klEvCW3vTlx 18 | M99wI2LbslqP6R1Uk4bIvXInch1g4l6AP2Yxc9IOrXTdyQjAlVHgnGUPQNGNfA+D 19 | rYX8pv4z 20 | -----END CERTIFICATE----- 21 | -------------------------------------------------------------------------------- /basetemplates/tls/kubelet.key: -------------------------------------------------------------------------------- 1 | -----BEGIN RSA PRIVATE KEY----- 2 | MIIEowIBAAKCAQEA3ATRx7B1FaeV9oWg0NYEtWe1ksfMVh6/x11mVH2gvc8y5OAO 3 | UacWVVecUrvnU6wjJupsTxAS4OXnQqQ0xpzKxDf4UiNMgQzXpa3eN1ZxhjIS4spQ 4 | U6ZuFNLBYKKfJqXnkyz7D7VRWQ2ad1X89+WTULi+653uVDL9N+XaNezxPq88KkIv 5 | lP1rvJc5KIhCDs14ioLx26oiE24QI699iCYznQhce7n+nd/8L+6IfoRr044qazGO 6 | BLBhwCiwcrpq3EHjZM2bet1o+/7p9mYJJCa4RfJRf64v1WIuMuvlk5x8UQMMpto1 7 | XLU8BOvhGT0JcP9Tok/2s9g/J3YtXHeMmKAl+wIDAQABAoIBAQDb5r09FrKPaCZM 8 | dJac46tlHDiwcZ1bXfRT8Jf8TmvACj1V4FKvbY620Y/eaQv15xBjLt39z5Tuzxnq 9 | 03AkKkXHBCHfBoTKXumSIEr/iBiDBb02ivrqAGf5zAOW8DKdUCg6QzTTKGgb16rR 10 | J1Jk+kHY5i18FSdFZIkNu1/zkdQ0ztmQi3t+nifGK3u5cNjTBEnoqNqv68cjdUjg 11 | FzLOdZwXITI79CbgwQgkIKIqe/Sx1JoBNp+ei4JFCewhrGdFQ2tZkijPlyGv2qgj 12 | NjS/rOBUtQkqqBLsY8NhZrD1zr9R7c2jbSrS+ZCcD0EkTJVHxkiisTrpl35DFTm+ 13 | n0F2YoDhAoGBAPJ0GRppT07HU1D/zlJiJfqTjNxDcXfWeTBXZdfagaXtwUapKz1v 14 | 36aD1OI2EpmXhPLDYfubMtlNRk3FqcBM+DKg16LUr9iuyCmHMP/orUg0A+BIPjk5 15 | 4REB34YloW47nj2C0WIV0bkdEZxtmdvqAECby4zCVJRAARLAVe6qMUqjAoGBAOhP 16 | 1HHj5O3Yrtp3++QrQzG34vG0rfrCai0LK+zVb2wUEy+Q06N/JzPwdfQ/rokeigDs 17 | uhi6KR5sQVAdAP+I6CcysytlKvyun1hVg0ep4noDqy5o30nQF2liAM2IGtEsoMWJ 18 | h3/Zqp3Dy52F4nBZg3gy+nQEB7iWsuP9B3xgVgTJAoGAJbGxGW8X+mp45JXwsNQ7 19 | jVqVQsVlhbkdfEuKNOXu1CpDq0WvyEx1XAEQ/t5jQ+fPrqJ7wE9ft3MRJBRAEPqm 20 | d9CT1ef1Mt3xlqtDDfZRwnD7zUnOCr2Z5TgCVWvSTj4MmwmUnghAY+RGEajki9E0 21 | mtbd7ZNk7OuKfyzR71occbsCgYA3xPpWQQRzSOJpFgbFdtFRvThhGCPwH/4HRDhO 22 | ScrO4l7cu2LjTCIoKODYOvV2e3tbz3i5eO9oG0rupZfYwJAi4Nv8XfQc5vrf5N94 23 | M8Nn0TumD40TFj6YkOtqa/MsJg+OfH6n5aQ87YUTEtIScJrMH0ja0yDbYmodq1/B 24 | rwrXaQKBgH40Lggb6bzlbJngkkn2i9FIFeYZIBVR7LUNSa1vrNPNWr7EtFhvo9FO 25 | Fe3i+f9XdD4s0juI/x7Scz4yOkE7OP8ukAW+nbwFOOin+FXCbM3dqIxU/wPCAcZj 26 | BupBo7RvNFgEwrZ6mU0pzvdtLmBBDeIngjhB7olUoZUV1FgyInwa 27 | -----END RSA PRIVATE KEY----- 28 | -------------------------------------------------------------------------------- /basetemplates/tls/service-account.key: -------------------------------------------------------------------------------- 1 | -----BEGIN RSA PRIVATE KEY----- 2 | MIIEpAIBAAKCAQEA73X2AS+mikLt+O9g+uDxKa0wgQSWOPbn1+/yJywvvOYARifF 3 | QMFhP5/4oNuff4xacZjVC+fth0wYmlKHCtecpsb8xHgVPXKyTqCAXC8pteTy265c 4 | 53ov/qopOgZjZA/IGnpwQNyLRvEra31DBkvVjvdAQZV/SnVhhtGS2NLRElmGXJEa 5 | Digd8gE2HHHDdNAT/sbhNErjpWAgxob7KoKTZTbTjNmOIr2hOAZStpnbL7GazrnG 6 | ns4VtSjOXR2DdMBqQHK6JyntWu72qH3GWk9KnEnXnaNuG2sAYicOIOQbRm8IMtdN 7 | DHZiyA2HUGKRE9g5K6sZqhtBThxrsT+ZRAKe8QIDAQABAoIBABI0/uJyNBB5LEzs 8 | LoyEw/FuSKzWo3FrXI9voBLYajzLpCOxbG8TBQjoaegZKtRw4IOYokJIfSf3YjuB 9 | oODzKecIZDmwA7VrXiFaVMgtkddRtCF97XRwNuv/FiliSPZXuNhCjPxxiGl5dtqy 10 | aIE3DOLU697Qth/8MtEkaCzyQpFJdaSApte4L1Xgah2xcQZmmhxA8Qtk6f/nhIVw 11 | Ma7JTrJ9DixSMtmqjdaocJAEjkwhRMUH98Da9Rhc4BgfrbDQP0UDZQviRxP41m/d 12 | zrRapBEymjfgqZj0UWo9WSVhb7YkeKdQ5bvFpWGSYBfreUlLRRp6ThpkZsndJZNo 13 | usBQnv0CgYEA/D+9wbsCU3gZ6KCrnkhxflal1+DDJ9RlUqgk2J5o57ZomJZzXTsT 14 | JcV7OiYYynw+2Ak9v5tXnGkNL3XSI4K5sQeqyZjTrY2TJ3al2jIhWQOnzjEaS9eT 15 | tU2vxfjlVbgEnqfhUYAHUE0+jfDlwO8W9t8QuWMP/8wN46vKuKQi5O8CgYEA8wWJ 16 | p++8eFMuC8UOmRUq0vRDflcuEIrgyaa/EMXLZvQ5uTjb4bEwIhiSbmNW+SLZ0tYX 17 | jLMTh1uFlUvl0QwTkBvSrIWJAmWI5TLBcUKrykBjY8RxoZdURNW/5+TetYyOigXE 18 | 9/glpmBPyaF5kNylzfLUmulcrOs5Wu/qNX5Beh8CgYEArA1aA7LnkkFAAsDcbfjh 19 | mJfHRKjk09z2Q1u2zh22Vh2/2Bv+kh/CHqhFNdNYY3w9bSNYf8GYD3JD8RQ/AcOf 20 | npUpM5pO/3iqX2d5FovM3Sc2JNivI/3lnOthMfpjioUaeZDuiaV215noSe5+94rc 21 | sgRSJvDfr8zhyGGbwzcJKfcCgYEAn82ZamP7xAe2dKjc448GvPdAVpjPQrOAAznx 22 | 0/6stQON3Z1lAXD5XMJZr9sE+wiOwdRkYfHzuoNVQQpKkf9l8dJJ44ZfxMKtlUGd 23 | 8HNN8c4LTTSFICQZlrYT3lIinLFTnbETh5eWcmRMsyLKhJaDNP0kDsW7Wj3HVmQC 24 | 17AxMDMCgYBPHFRbS/Ut4yrtC3YAaMPndU4KWoFQEOoA6ApZp4Hb/vl+PbxrKmX9 25 | FoQ6BepLVOSe+aZsYHZzzaDMCmDd7AbwXHNOzwk5sLPmIsN8BWxDICOJyrtrVSGR 26 | HKrY0VCgGIahRKEPQ+X9KA/SVQri7EPwdFbIW4upfWWhT0pbY0GEig== 27 | -----END RSA PRIVATE KEY----- 28 | -------------------------------------------------------------------------------- /basetemplates/tls/service-account.pub: -------------------------------------------------------------------------------- 1 | -----BEGIN PUBLIC KEY----- 2 | MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA73X2AS+mikLt+O9g+uDx 3 | Ka0wgQSWOPbn1+/yJywvvOYARifFQMFhP5/4oNuff4xacZjVC+fth0wYmlKHCtec 4 | psb8xHgVPXKyTqCAXC8pteTy265c53ov/qopOgZjZA/IGnpwQNyLRvEra31DBkvV 5 | jvdAQZV/SnVhhtGS2NLRElmGXJEaDigd8gE2HHHDdNAT/sbhNErjpWAgxob7KoKT 6 | ZTbTjNmOIr2hOAZStpnbL7GazrnGns4VtSjOXR2DdMBqQHK6JyntWu72qH3GWk9K 7 | nEnXnaNuG2sAYicOIOQbRm8IMtdNDHZiyA2HUGKRE9g5K6sZqhtBThxrsT+ZRAKe 8 | 8QIDAQAB 9 | -----END PUBLIC KEY----- 10 | -------------------------------------------------------------------------------- /bin/apply: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /bin/bastion: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /bin/ec: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /bin/k: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /bin/ka: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /bin/kd: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /bin/ks: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /bin/kurl: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /bin/lbaas: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /bin/migrate: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /bin/n: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /bin/os/os_debug: -------------------------------------------------------------------------------- 1 | # Copyright (c) 2017 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file 2 | # 3 | # Licensed under the Apache License, Version 2.0 (the "License"); 4 | # you may not use this file except in compliance with the License. 5 | # You may obtain a copy of the License at 6 | # 7 | # http://www.apache.org/licenses/LICENSE-2.0 8 | # 9 | # Unless required by applicable law or agreed to in writing, software 10 | # distributed under the License is distributed on an "AS IS" BASIS, 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 | # See the License for the specific language governing permissions and 13 | # limitations under the License. 14 | 15 | export TF_LOG=DEBUG 16 | export OS_DEBUG=1 17 | "$@" 18 | -------------------------------------------------------------------------------- /bin/plan: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /bin/prepare: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /bin/recreate: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /bin/roll: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /bin/tf: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /bin/update: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /bin/utils/render_images: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # 3 | # Copyright (c) 2017 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file 4 | # 5 | # Licensed under the Apache License, Version 2.0 (the "License"); 6 | # you may not use this file except in compliance with the License. 7 | # You may obtain a copy of the License at 8 | # 9 | # http://www.apache.org/licenses/LICENSE-2.0 10 | # 11 | # Unless required by applicable law or agreed to in writing, software 12 | # distributed under the License is distributed on an "AS IS" BASIS, 13 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 | # See the License for the specific language governing permissions and 15 | # limitations under the License. 16 | 17 | set -e 18 | 19 | ROOT="$(dirname "$0")/../../../" 20 | IMAGES_FILE=$ROOT/images_list 21 | IMAGES_FILE_UNIQUE=$ROOT/images_list_unique 22 | 23 | # Clear file if exists 24 | if [ -s "$IMAGES_FILE" ] 25 | then 26 | rm $IMAGES_FILE 27 | fi 28 | 29 | # Grep all images from generated manifests 30 | grep -R "image: " $ROOT/gen/ | grep -v "gen/tmp" | grep -v ".zip" | while read -r line ; do 31 | echo "${line#*image:}" | sed -e 's/^[ \t]*//' >> $IMAGES_FILE 32 | done 33 | 34 | # Keep only unique value 35 | sort -u $IMAGES_FILE > $IMAGES_FILE_UNIQUE 36 | mv $IMAGES_FILE_UNIQUE $IMAGES_FILE -------------------------------------------------------------------------------- /bin/worker: -------------------------------------------------------------------------------- 1 | master -------------------------------------------------------------------------------- /docs/azure.md: -------------------------------------------------------------------------------- 1 | ### Azure Deployment of Kubernetes 2 | 3 | The azure variant for kubernetes is deployed into a predefined azure tenant and subscription. 4 | So far, it uses the AWS route53 service for providing DNS names. 5 | 6 | 7 | #### Configuration Settings 8 | 9 | |Name|Meaning|Optional| 10 | |--|--|--| 11 | |az_client_id|Azure client id|required| 12 | |az_client_secret|Azure client secreat|required| 13 | |az_tenant_id|Azure tenant id|required| 14 | |az_subscription_id|Azure subscription id|required| 15 | |az_region|Azure region name|required| 16 | 17 | #### Image Handling 18 | 19 | On azure the given image names are quadrupel (///). 20 | -------------------------------------------------------------------------------- /docs/etcd_migration.md: -------------------------------------------------------------------------------- 1 | ### Migrating a self-hosted Etcd Cluster to Static Etcds 2 | 3 | The etcd mode is selecting in the configuartion by the `selfhosted_etcd` parameter. Setting it to `false` will enable the static etcd mode. This is simply possible for new clusters. Existing clusters must explicitly be migrated. Unfortunately this migration cannot be done just by switching the value for this parameter. 4 | 5 | The migration is only possible using a cluster recovery. The following steps 6 | must be performed: 7 | 8 | - Save the latest etcd backup file somewhere near the terraform project 9 | - Set the following parameters in `terraform.tfvars`: 10 | 11 | |Name|Value| 12 | |---|---| 13 | |selfhosted_etcd|false| 14 | |recover_cluster|true| 15 | |recover_redeploy|true| 16 | |etcd_backup_file|"file path of the backup file"| 17 | 18 | - Because of a misbehaving terraform the terraform state must be adapted manually before applying the changes: 19 | 20 | - remove a used resource for `module.instance.module.seed.null_resource.manifests`: `template_dir.bootkube-self`. 21 | 22 | This can be done with the following terraform command from the landscape folder 23 | 24 | ```bash 25 | $ terraform state rm module.instance.module.seed.template_dir.bootkube-self 26 | ``` 27 | 28 | - Now the changes can be applied by `terraform apply variant` 29 | 30 | - Afterwards the recovery options must be removed again. 31 | -------------------------------------------------------------------------------- /docs/kubify.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/gardener-attic/kubify/5ca79368ee043ec3c30e5b8f9f7df7a8e3763d7e/docs/kubify.png -------------------------------------------------------------------------------- /docs/kubify@20x.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/gardener-attic/kubify/5ca79368ee043ec3c30e5b8f9f7df7a8e3763d7e/docs/kubify@20x.png -------------------------------------------------------------------------------- /docs/kubify@2x.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/gardener-attic/kubify/5ca79368ee043ec3c30e5b8f9f7df7a8e3763d7e/docs/kubify@2x.png -------------------------------------------------------------------------------- /docs/manifests/etcdctl.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: etcdctl 5 | spec: 6 | containers: 7 | - image: quay.io/coreos/etcd:v3.2 8 | name: etcdctl 9 | command: 10 | - sleep 11 | - "10000000" 12 | volumeMounts: 13 | - mountPath: /tls 14 | name: etcd-tls 15 | volumes: 16 | - name: etcd-tls 17 | secret: 18 | secretName: etcd-client-tls -------------------------------------------------------------------------------- /docs/presentations/Static-ETCD-Setup.pptx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/gardener-attic/kubify/5ca79368ee043ec3c30e5b8f9f7df7a8e3763d7e/docs/presentations/Static-ETCD-Setup.pptx -------------------------------------------------------------------------------- /modules/access/aws/variables.tf: -------------------------------------------------------------------------------- 1 | # Copyright (c) 2017 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file 2 | # 3 | # Licensed under the Apache License, Version 2.0 (the "License"); 4 | # you may not use this file except in compliance with the License. 5 | # You may obtain a copy of the License at 6 | # 7 | # http://www.apache.org/licenses/LICENSE-2.0 8 | # 9 | # Unless required by applicable law or agreed to in writing, software 10 | # distributed under the License is distributed on an "AS IS" BASIS, 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 | # See the License for the specific language governing permissions and 13 | # limitations under the License. 14 | 15 | variable "secret_key" { 16 | type = "string" 17 | default = "" 18 | } 19 | variable "access_key" { 20 | type = "string" 21 | default = "" 22 | } 23 | variable "region" { 24 | type = "string" 25 | default = "" 26 | } 27 | -------------------------------------------------------------------------------- /modules/access/azure/variables.tf: -------------------------------------------------------------------------------- 1 | # Copyright (c) 2017 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file 2 | # 3 | # Licensed under the Apache License, Version 2.0 (the "License"); 4 | # you may not use this file except in compliance with the License. 5 | # You may obtain a copy of the License at 6 | # 7 | # http://www.apache.org/licenses/LICENSE-2.0 8 | # 9 | # Unless required by applicable law or agreed to in writing, software 10 | # distributed under the License is distributed on an "AS IS" BASIS, 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 | # See the License for the specific language governing permissions and 13 | # limitations under the License. 14 | 15 | variable "client_id" { 16 | default = "" 17 | } 18 | variable "client_secret" { 19 | default = "" 20 | } 21 | variable "tenant_id" { 22 | default = "" 23 | } 24 | variable "subscription_id" { 25 | default = "" 26 | } 27 | variable "region" { 28 | default = "" 29 | } 30 | -------------------------------------------------------------------------------- /modules/access/node_config/create.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash -e 2 | COPYRIGHT='# 3 | # Copyright (c) 2017 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file 4 | # 5 | # Licensed under the Apache License, Version 2.0 (the "License"); 6 | # you may not use this file except in compliance with the License. 7 | # You may obtain a copy of the License at 8 | # 9 | # http://www.apache.org/licenses/LICENSE-2.0 10 | # 11 | # Unless required by applicable law or agreed to in writing, software 12 | # distributed under the License is distributed on an "AS IS" BASIS, 13 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 | # See the License for the specific language governing permissions and 15 | # limitations under the License. 16 | ' 17 | 18 | header="$COPYRIGHT 19 | 20 | ############################################################################## 21 | # node config handling 22 | # generated by create.sh based on local variables.tf 23 | ##############################################################################" 24 | 25 | variable="node_config" 26 | locals=X 27 | 28 | cd "$(dirname "$0")" 29 | source ../create.sh 30 | -------------------------------------------------------------------------------- /modules/access/node_config/variables.tf: -------------------------------------------------------------------------------- 1 | # Copyright (c) 2017 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file 2 | # 3 | # Licensed under the Apache License, Version 2.0 (the "License"); 4 | # you may not use this file except in compliance with the License. 5 | # You may obtain a copy of the License at 6 | # 7 | # http://www.apache.org/licenses/LICENSE-2.0 8 | # 9 | # Unless required by applicable law or agreed to in writing, software 10 | # distributed under the License is distributed on an "AS IS" BASIS, 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 | # See the License for the specific language governing permissions and 13 | # limitations under the License. 14 | 15 | variable "count" { 16 | type = "string" 17 | default = "" 18 | } 19 | 20 | variable "image_name" { 21 | type = "string" 22 | default = "" 23 | } 24 | 25 | variable "flavor_name" { 26 | type = "string" 27 | default = "" 28 | } 29 | 30 | variable "user_name" { 31 | type = "string" 32 | default = "" 33 | } 34 | 35 | variable "update_mode" { 36 | type = "string" 37 | default = "" 38 | } 39 | 40 | variable "generation" { 41 | type = "string" 42 | default = "" 43 | } 44 | 45 | variable "assign_fips" { 46 | type = "string" 47 | default = "" 48 | } 49 | 50 | variable "root_volume_size" { 51 | type = "string" 52 | default = "" 53 | } 54 | 55 | variable "volume_size" { 56 | type = "string" 57 | default = "" 58 | } 59 | -------------------------------------------------------------------------------- /modules/b64var/variable.tf: -------------------------------------------------------------------------------- 1 | # Copyright 2017 The Gardener Authors. 2 | # 3 | # Licensed under the Apache License, Version 2.0 (the "License"); 4 | # you may not use this file except in compliance with the License. 5 | # You may obtain a copy of the License at 6 | # 7 | # http://www.apache.org/licenses/LICENSE-2.0 8 | # 9 | # Unless required by applicable law or agreed to in writing, software 10 | # distributed under the License is distributed on an "AS IS" BASIS, 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 | # See the License for the specific language governing permissions and 13 | # limitations under the License. 14 | 15 | 16 | variable "value" { 17 | } 18 | 19 | variable "default" { 20 | default = "" 21 | } 22 | 23 | output "value" { 24 | value = "${length(var.value) == 0 ? var.default : var.value}" 25 | } 26 | 27 | output "b64" { 28 | value = "${base64encode(length(var.value) == 0 ? var.default : var.value)}" 29 | } 30 | 31 | -------------------------------------------------------------------------------- /modules/cfgvar/cfgvar.tf: -------------------------------------------------------------------------------- 1 | # Copyright (c) 2017 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file 2 | # 3 | # Licensed under the Apache License, Version 2.0 (the "License"); 4 | # you may not use this file except in compliance with the License. 5 | # You may obtain a copy of the License at 6 | # 7 | # http://www.apache.org/licenses/LICENSE-2.0 8 | # 9 | # Unless required by applicable law or agreed to in writing, software 10 | # distributed under the License is distributed on an "AS IS" BASIS, 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 | # See the License for the specific language governing permissions and 13 | # limitations under the License. 14 | 15 | 16 | variable "default" { 17 | default ="" 18 | } 19 | 20 | variable "name" { 21 | } 22 | 23 | variable "config" { 24 | type = "map" 25 | } 26 | 27 | module "value" { 28 | source = "../variable" 29 | value = "${lookup(var.config,var.name,var.default)}" 30 | default = "${var.default}" 31 | } 32 | 33 | output "value" { 34 | value = "${module.value.value}" 35 | } 36 | -------------------------------------------------------------------------------- /modules/cluster/templates/cluster-info: -------------------------------------------------------------------------------- 1 | CLUSTER_NAME=${cluster_name} 2 | CLUSTER_DOMAIN=${cluster_domain} 3 | BOOTSTRAP_ETCD_SERVICE_IP=${bootstrap_etcd_service_ip} 4 | ETCD_SERVICE_IP=${etcd_service_ip} 5 | DNS_SERVICE_IP=${dns_service_ip} 6 | API_SERVICE_IP=${api_service_ip} 7 | SERVICE_CIDR=${service_cidr} 8 | POD_CIDR=${service_cidr} 9 | API_DNS_NAME=${api_dns_name} 10 | -------------------------------------------------------------------------------- /modules/condlist/condlist.tf: -------------------------------------------------------------------------------- 1 | # Copyright 2017 The Gardener Authors. 2 | # 3 | # Licensed under the Apache License, Version 2.0 (the "License"); 4 | # you may not use this file except in compliance with the License. 5 | # You may obtain a copy of the License at 6 | # 7 | # http://www.apache.org/licenses/LICENSE-2.0 8 | # 9 | # Unless required by applicable law or agreed to in writing, software 10 | # distributed under the License is distributed on an "AS IS" BASIS, 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 | # See the License for the specific language governing permissions and 13 | # limitations under the License. 14 | 15 | variable "if" { 16 | type = "string" 17 | } 18 | 19 | variable "then" { 20 | type = "list" 21 | } 22 | variable "else" { 23 | type = "list" 24 | } 25 | 26 | module "case" { 27 | source = "../flag" 28 | option = "${var.if}" 29 | } 30 | 31 | locals { 32 | select= { 33 | "true" = "${var.then}" 34 | "false" = "${var.else}" 35 | } 36 | } 37 | 38 | 39 | output "value" { 40 | value = "${local.select[module.case.value]}" 41 | } 42 | -------------------------------------------------------------------------------- /modules/condmap/condmap.tf: -------------------------------------------------------------------------------- 1 | # Copyright (c) 2017 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file 2 | # 3 | # Licensed under the Apache License, Version 2.0 (the "License"); 4 | # you may not use this file except in compliance with the License. 5 | # You may obtain a copy of the License at 6 | # 7 | # http://www.apache.org/licenses/LICENSE-2.0 8 | # 9 | # Unless required by applicable law or agreed to in writing, software 10 | # distributed under the License is distributed on an "AS IS" BASIS, 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 | # See the License for the specific language governing permissions and 13 | # limitations under the License. 14 | 15 | variable "if" { 16 | type = "string" 17 | } 18 | 19 | variable "then" { 20 | type = "map" 21 | } 22 | variable "else" { 23 | type = "map" 24 | } 25 | 26 | module "case" { 27 | source = "../flag" 28 | option = "${var.if}" 29 | } 30 | 31 | locals { 32 | select= { 33 | "true" = "${var.then}" 34 | "false" = "${var.else}" 35 | } 36 | } 37 | 38 | 39 | output "value" { 40 | value = "${local.select[module.case.value]}" 41 | } 42 | -------------------------------------------------------------------------------- /modules/defaults/defaults.tf: -------------------------------------------------------------------------------- 1 | # Copyright (c) 2017 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file 2 | # 3 | # Licensed under the Apache License, Version 2.0 (the "License"); 4 | # you may not use this file except in compliance with the License. 5 | # You may obtain a copy of the License at 6 | # 7 | # http://www.apache.org/licenses/LICENSE-2.0 8 | # 9 | # Unless required by applicable law or agreed to in writing, software 10 | # distributed under the License is distributed on an "AS IS" BASIS, 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 | # See the License for the specific language governing permissions and 13 | # limitations under the License. 14 | 15 | 16 | variable "values" { 17 | type = "list" 18 | } 19 | 20 | variable "optional" { 21 | default=false 22 | } 23 | 24 | locals { 25 | options = { 26 | optional = [ "" ] 27 | non_optional = [] 28 | } 29 | } 30 | 31 | output "value" { 32 | value = "${element(concat(compact(concat(var.values,list(""))),local.options[var.optional ? "optional" : "non_optional"]),0)}" 33 | } 34 | -------------------------------------------------------------------------------- /modules/faketls/faketls.tf: -------------------------------------------------------------------------------- 1 | # Copyright (c) 2017 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file 2 | # 3 | # Licensed under the Apache License, Version 2.0 (the "License"); 4 | # you may not use this file except in compliance with the License. 5 | # You may obtain a copy of the License at 6 | # 7 | # http://www.apache.org/licenses/LICENSE-2.0 8 | # 9 | # Unless required by applicable law or agreed to in writing, software 10 | # distributed under the License is distributed on an "AS IS" BASIS, 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 | # See the License for the specific language governing permissions and 13 | # limitations under the License. 14 | 15 | variable "private_key_pem" { 16 | type = "string" 17 | } 18 | variable "cert_pem" { 19 | type = "string" 20 | } 21 | variable "ca_cert" { 22 | type = "string" 23 | } 24 | variable "ca_key" { 25 | type = "string" 26 | } 27 | variable "file_base" { 28 | type = "string" 29 | } 30 | resource "local_file" "cert" { 31 | content = "${var.cert_pem}" 32 | filename = "${var.file_base}.crt" 33 | } 34 | resource "local_file" "api_key" { 35 | content = "${var.private_key_pem}" 36 | filename = "${var.file_base}.key" 37 | } 38 | 39 | output "private_key_pem" { 40 | value = "${var.private_key_pem}" 41 | } 42 | output "cert_pem" { 43 | value = "${var.cert_pem}" 44 | } 45 | output "ca_cert" { 46 | value = "${var.ca_cert}" 47 | } 48 | output "ca_key" { 49 | value = "${var.ca_key}" 50 | } 51 | output "private_key_pem_b64" { 52 | value = "${base64encode(var.private_key_pem)}" 53 | } 54 | output "cert_pem_b64" { 55 | value = "${base64encode(var.cert_pem)}" 56 | } 57 | output "ca_cert_b64" { 58 | value = "${base64encode(var.ca_cert)}" 59 | } 60 | output "ca_key_b64" { 61 | value = "${base64encode(var.ca_key)}" 62 | } 63 | -------------------------------------------------------------------------------- /modules/file/file.tf: -------------------------------------------------------------------------------- 1 | # Copyright (c) 2017 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file 2 | # 3 | # Licensed under the Apache License, Version 2.0 (the "License"); 4 | # you may not use this file except in compliance with the License. 5 | # You may obtain a copy of the License at 6 | # 7 | # http://www.apache.org/licenses/LICENSE-2.0 8 | # 9 | # Unless required by applicable law or agreed to in writing, software 10 | # distributed under the License is distributed on an "AS IS" BASIS, 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 | # See the License for the specific language governing permissions and 13 | # limitations under the License. 14 | 15 | variable "path" { 16 | type = "string" 17 | } 18 | 19 | variable "default" { 20 | default = "" 21 | } 22 | 23 | variable "prefix" { 24 | default = "" 25 | } 26 | 27 | variable "suffix" { 28 | default = "" 29 | } 30 | 31 | variable "indent" { 32 | default = 0 33 | } 34 | 35 | module "content" { 36 | source = "../b64var" 37 | value = "${file(var.path == "" ? "${path.module}/resources/empty" : var.path)}" 38 | default = "${var.default}" 39 | } 40 | 41 | locals { 42 | content = "${module.content.value == "" ? "" : "${var.prefix}${module.content.value}${var.suffix}"}" 43 | } 44 | 45 | output "content" { 46 | value = "${local.content}" 47 | } 48 | 49 | output "b64" { 50 | value = "${module.content.b64}" 51 | } 52 | 53 | output "indented" { 54 | value = "${indent(var.indent,local.content)}" 55 | } 56 | -------------------------------------------------------------------------------- /modules/file/resources/empty: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/gardener-attic/kubify/5ca79368ee043ec3c30e5b8f9f7df7a8e3763d7e/modules/file/resources/empty -------------------------------------------------------------------------------- /modules/flag/flag.tf: -------------------------------------------------------------------------------- 1 | # Copyright (c) 2017 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file 2 | # 3 | # Licensed under the Apache License, Version 2.0 (the "License"); 4 | # you may not use this file except in compliance with the License. 5 | # You may obtain a copy of the License at 6 | # 7 | # http://www.apache.org/licenses/LICENSE-2.0 8 | # 9 | # Unless required by applicable law or agreed to in writing, software 10 | # distributed under the License is distributed on an "AS IS" BASIS, 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 | # See the License for the specific language governing permissions and 13 | # limitations under the License. 14 | 15 | 16 | variable "option" { 17 | type = "string" 18 | default = "off" 19 | } 20 | 21 | variable "on" { 22 | type = "string" 23 | default = "true" 24 | } 25 | 26 | variable "off" { 27 | type = "string" 28 | default = "false" 29 | } 30 | 31 | variable "map" { 32 | type = "map" 33 | default = {} 34 | } 35 | 36 | module "values" { 37 | source = "../mapvar" 38 | 39 | value = "${merge(var.map, map("true", var.on, "1", var.on, "yes", var.on, "false", var.off, "0", var.off, "no", var.off))}" 40 | } 41 | 42 | output "value" { 43 | value = "${lookup(module.values.value, var.option)}" 44 | } 45 | 46 | output "flag" { 47 | value = "${lookup(module.values.value, var.option) == var.on ? 1 : 0}" 48 | } 49 | 50 | output "if_active" { 51 | value = "${lookup(module.values.value, var.option) == var.on ? 1 : 0}" 52 | } 53 | output "if_not_active" { 54 | value = "${lookup(module.values.value, var.option) == var.on ? 0 : 1}" 55 | } 56 | -------------------------------------------------------------------------------- /modules/instance/resources/bin/azure-meta: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | curl -H Metadata:true "http://169.254.169.254/metadata/instance?api-version=2017-04-02&format=json" 4 | -------------------------------------------------------------------------------- /modules/instance/resources/bin/bootstrap.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash -e 2 | 3 | mkdir -p /etc/kubernetes/bootstrap-secrets 4 | cp -r /opt/bootkube/assets/tls/. /etc/kubernetes/bootstrap-secrets/. 5 | 6 | mkdir -p /etc/kubernetes/manifests/ 7 | cp -r /opt/bootkube/assets/bootstrap-manifests/* /etc/kubernetes/manifests/ 8 | 9 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /modules/instance/resources/bin/busybox: -------------------------------------------------------------------------------- 1 | #!/bin/bash -e 2 | 3 | source "$(dirname "$0")"/source_me 4 | 5 | kubectl delete pod busybox || true 6 | kubectl run -it busybox --image busybox --restart=Never /bin/sh 7 | -------------------------------------------------------------------------------- /modules/instance/resources/bin/cleanup_etcd: -------------------------------------------------------------------------------- 1 | #!/bin/bash -e 2 | 3 | d() 4 | { 5 | if [ $# -gt 1 ]; then 6 | docker "$@" 7 | fi 8 | } 9 | 10 | sudo rm -f /etc/kubernetes/manifests/kube-etcd.yaml 11 | d kill $(docker ps -q) 12 | d rm $(docker ps -aq) 13 | sudo rm -Rf /var/etcd/kube-system-kube-etcd-00* 14 | -------------------------------------------------------------------------------- /modules/instance/resources/bin/complete-cluster: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | DIR="$(dirname "$0")" 4 | BOOT=/opt/bootkube/assets 5 | echo finalizing cluster setup 6 | 7 | source "$(dirname "$0")"/source_me 8 | 9 | TMP="/tmp/pods$$" 10 | MSG="waiting for bootstrap control plane to be deleted..." 11 | while true; do 12 | if ks get pods >"$TMP"; then 13 | if ! grep bootstrap <"$TMP" >/dev/null; then 14 | break 15 | fi 16 | else 17 | echo "api server no reachable" 18 | fi 19 | if [ -n "$MSG" ]; then 20 | echo "$MSG" 21 | MSG= 22 | fi 23 | sleep 10 24 | done 25 | rm -f "$TMP" 26 | if [ -z "$MSG" ]; then 27 | echo "bootstrap control plane deleted" 28 | fi 29 | 30 | "$DIR/completeetcd.sh" 31 | 32 | if [ -d "$BOOT/addons" ]; then 33 | for d in "$BOOT/addons"/*; do 34 | if [ -d "$d" ]; then 35 | if [ -x "$d/deploy" ]; then 36 | echo "deploying addon $(basename "$d") with handler ..." 37 | ( cd "$d" 38 | ./deploy 39 | ) 40 | else 41 | echo "deploying addon $(basename "$d") from manifests ..." 42 | for f in "$d/manifests"/*.{yaml,yml}; do 43 | if [ -f "$f" ]; then 44 | kubectl apply -f "$f" 45 | fi 46 | done 47 | fi 48 | fi 49 | done 50 | fi 51 | echo "cluster setup done" 52 | -------------------------------------------------------------------------------- /modules/instance/resources/bin/complete.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash -e 2 | 3 | source "$(dirname "$0")"/source_me 4 | 5 | for f in kube-system-rbac-role-binding kube-proxy kube-dns-svc kube-dns-deployment kube-flannel-rbac kube-flannel-cfg kube-flannel pod-checkpointer; do 6 | kubectl create -f /opt/bootkube/assets/manifests/$f.yaml || true 7 | done 8 | kubectl create -f /opt/bootkube/assets/etcd/bootstrap-etcd-service.json 9 | -------------------------------------------------------------------------------- /modules/instance/resources/bin/completeetcd.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash -e 2 | 3 | ETCD=kube-etcd-0000.kube-etcd.kube-system.svc.cluster.local 4 | BOOT=/opt/bootkube/assets 5 | BACKUP="$BOOT/etcd/backup.json" 6 | 7 | check() 8 | { 9 | MSG="$1" 10 | shift 11 | while ! "$@" >/dev/null 2>&1; do 12 | if [ -n "$MSG" ]; then 13 | echo "waiting for $MSG..." 14 | MSG= 15 | fi 16 | sleep 5 17 | done 18 | } 19 | 20 | source "$(dirname "$0")"/source_me 21 | 22 | if [ -f "$BOOT/cluster-info" ]; then 23 | source "$BOOT/cluster-info" 24 | fi 25 | if [ -z "$DNS_SERVICE_IP" ]; then 26 | DNS_SERVICE_IP=10.241.0.10 27 | fi 28 | 29 | 30 | if [ -f "$BOOT/manifests/kube-etcd-svc.yaml" ]; then 31 | echo "applying etcd service" 32 | ks apply -f "$BOOT/manifests/kube-etcd-svc.yaml" 33 | fi 34 | 35 | check "etcd dns resolution" nslookup kube-etcd-0000.kube-etcd.kube-system.svc.cluster.local $DNS_SERVICE_IP 36 | IP="$(dig +short @$DNS_SERVICE_IP kube-etcd-0000.kube-etcd.kube-system.svc.cluster.local)" 37 | echo "IP for etcd 0 is $IP" 38 | 39 | check "etcd kube proxy access for $IP" wget -O - http://$IP:2380 40 | echo "etcd now reachable" 41 | 42 | ks delete storageclass etcd-backup-gce-pd 2>/dev/null|| true 43 | 44 | n=0 45 | while [ $n -eq 0 ]; do 46 | n="$(ks get nodes | grep master | wc -l)" 47 | sleep 5 48 | done 49 | if [ $(( $n / 2 * 2)) == $n ]; then 50 | echo "invalid master count ($n)" 51 | n=1 52 | fi 53 | 54 | if ks get EtcdCluster kube-etcd >/dev/null; then 55 | echo "scaling etcd cluster" 56 | ks patch EtcdCluster kube-etcd --type merge -p '{ "spec": { "size": '$n' } }' 57 | 58 | if [ -f "$BACKUP" ]; then 59 | echo "configure etcd cluster backup" 60 | ks patch EtcdCluster kube-etcd --type merge -p "$(cat "$BACKUP")" 61 | else 62 | echo "no etcd cluster backup configured" 63 | fi 64 | else 65 | echo "no self hosting etcd enabled" 66 | fi 67 | -------------------------------------------------------------------------------- /modules/instance/resources/bin/ctlp.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash -e 2 | 3 | source "$(dirname "$0")"/source_me 4 | 5 | for f in kube-apiserver-secret kube-apiserver kube-controller-manager-disruption kube-controller-manager-secret kube-controller-manager kube-scheduler-disruption kube-scheduler; do 6 | kubectl create -f /opt/bootkube/assets/manifests/$f.yaml || true 7 | done 8 | -------------------------------------------------------------------------------- /modules/instance/resources/bin/ec: -------------------------------------------------------------------------------- 1 | #!/bin/bash -e 2 | 3 | if [ -f /opt/bootkube/assets/cluster-info ]; then 4 | source /opt/bootkube/assets/cluster-info 5 | fi 6 | if [ -z "$BOOTSTRAP_ETCD_SERVICE_IP" ]; then 7 | BOOTSTRAP_ETCD_SERVICE_IP=10.241.0.20 8 | fi 9 | if [ -z "$ETCD_SERVICE_IP" ]; then 10 | ETCD_SERVICE_IP=10.241.0.15 11 | fi 12 | 13 | 14 | case "$1" in 15 | S) endpoint="--endpoints https://localhost:2379" // static etcd 16 | shift;; 17 | B) endpoint="--endpoints https://localhost:12379" // bootstrap etcd 18 | shift;; 19 | BS) endpoint="--endpoints https://$BOOTSTRAP_ETCD_SERVICE_IP:12379" // bootstrap etcd service 20 | shift;; 21 | C) endpoint="--endpoints https://$ETCD_SERVICE_IP:2379" // etcd cluster service ip 22 | shift;; 23 | esac 24 | 25 | echo docker run --net="host" -it --rm -v /opt/bootkube/assets/tls:/tls quay.io/coreos/etcd:v3.2 /bin/sh -c "export ETCDCTL_API=3 && /usr/local/bin/etcdctl --cert /tls/etcd-client.crt --key /tls/etcd-client.key --cacert /tls/ca.crt $endpoint $*" 26 | docker run --net="host" -it --rm -v /opt/bootkube/assets/tls:/tls quay.io/coreos/etcd:v3.2 /bin/sh -c "export ETCDCTL_API=3 && /usr/local/bin/etcdctl --cert /tls/etcd-client.crt --key /tls/etcd-client.key --cacert /tls/ca.crt $endpoint $*" 27 | -------------------------------------------------------------------------------- /modules/instance/resources/bin/etcd.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash -e 2 | 3 | source "$(dirname "$0")"/source_me 4 | kubectl create -f /opt/bootkube/assets/etcd/migrate-etcd-cluster.json 5 | -------------------------------------------------------------------------------- /modules/instance/resources/bin/ks: -------------------------------------------------------------------------------- 1 | #!/bin/bash -e 2 | 3 | source "$(dirname "$0")"/source_me 4 | kubectl -n kube-system "$@" 5 | -------------------------------------------------------------------------------- /modules/instance/resources/bin/operator.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash -e 2 | 3 | source "$(dirname "$0")"/source_me 4 | for f in etcd-client-tls etcd-peer-tls etcd-server-tls etcd-service etcd-operator; do 5 | kubectl create -f /opt/bootkube/assets/manifests/$f.yaml || true 6 | done 7 | -------------------------------------------------------------------------------- /modules/instance/resources/bin/source_me: -------------------------------------------------------------------------------- 1 | export KUBECONFIG=/etc/kubernetes/kubeconfig 2 | export PATH=$PATH:/opt/bin:/opt/bootkube/bin 3 | -------------------------------------------------------------------------------- /modules/instance/resources/bin/wdocker.sh: -------------------------------------------------------------------------------- 1 | #/bin/bash -e 2 | 3 | watch docker ps 4 | -------------------------------------------------------------------------------- /modules/instance/resources/bin/wpods.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash -e 2 | 3 | source "$(dirname "$0")"/source_me 4 | watch kubectl get pods --all-namespaces -o wide 5 | -------------------------------------------------------------------------------- /modules/instance/roll.tf: -------------------------------------------------------------------------------- 1 | # Copyright (c) 2017 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file 2 | # 3 | # Licensed under the Apache License, Version 2.0 (the "License"); 4 | # you may not use this file except in compliance with the License. 5 | # You may obtain a copy of the License at 6 | # 7 | # http://www.apache.org/licenses/LICENSE-2.0 8 | # 9 | # Unless required by applicable law or agreed to in writing, software 10 | # distributed under the License is distributed on an "AS IS" BASIS, 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 | # See the License for the specific language governing permissions and 13 | # limitations under the License. 14 | 15 | ########################################### 16 | # state handling 17 | # 18 | 19 | resource "local_file" "state" { 20 | content = <