CadolesKube
/
typhoon
mirror of https://github.com/puppetmaster/typhoon.git
7
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Move control plane static pod TLS assets to /etc/kubernetes/pki 

* Change control plane static pods to mount `/etc/kubernetes/pki`,
instead of `/etc/kubernetes/bootstrap-secrets` to better reflect
their purpose and match some loose conventions upstream
* Place control plane and bootstrap TLS assets and kubeconfig's
in `/etc/kubernetes/pki`
* Mount to `/etc/kubernetes/pki` (rather than `/etc/kubernetes/secrets`)
to match the host location (less surprise)

Rel: https://github.com/poseidon/terraform-render-bootstrap/pull/233
This commit is contained in:
Dalton Hubble 2020-12-02 23:22:34 -08:00
parent 804dfea0f9
commit 4fd4a0f540
10 changed files with 65 additions and 65 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
aws/fedora-coreos/kubernetes/fcc/controller.yaml
View File

@ -115,7 +115,7 @@ systemd:
ExecStartPre=-/usr/bin/podman rm bootstrap ExecStartPre=-/usr/bin/podman rm bootstrap
ExecStart=/usr/bin/podman run --name bootstrap \ ExecStart=/usr/bin/podman run --name bootstrap \
--network host \ --network host \
--volume /etc/kubernetes/bootstrap-secrets:/etc/kubernetes/secrets:ro,z \ --volume /etc/kubernetes/pki:/etc/kubernetes/pki:ro,z \
--volume /opt/bootstrap/assets:/assets:ro,Z \ --volume /opt/bootstrap/assets:/assets:ro,Z \
--volume /opt/bootstrap/apply:/apply:ro,Z \ --volume /opt/bootstrap/apply:/apply:ro,Z \
--entrypoint=/apply \ --entrypoint=/apply \
@ -142,26 +142,26 @@ storage:
mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking
awk '/#####/ {filename=$2; next} {print > filename}' assets awk '/#####/ {filename=$2; next} {print > filename}' assets
mkdir -p /etc/ssl/etcd/etcd mkdir -p /etc/ssl/etcd/etcd
mkdir -p /etc/kubernetes/bootstrap-secrets mkdir -p /etc/kubernetes/pki
mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/ mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/
mv tls/etcd/etcd-client* /etc/kubernetes/bootstrap-secrets/ mv tls/etcd/etcd-client* /etc/kubernetes/pki/
chown -R etcd:etcd /etc/ssl/etcd chown -R etcd:etcd /etc/ssl/etcd
chmod -R 500 /etc/ssl/etcd chmod -R 500 /etc/ssl/etcd
mv auth/* /etc/kubernetes/bootstrap-secrets/ mv auth/* /etc/kubernetes/pki/
mv tls/k8s/* /etc/kubernetes/bootstrap-secrets/ mv tls/k8s/* /etc/kubernetes/pki/
mkdir -p /etc/kubernetes/manifests mkdir -p /etc/kubernetes/manifests
mv static-manifests/* /etc/kubernetes/manifests/ mv static-manifests/* /etc/kubernetes/manifests/
mkdir -p /opt/bootstrap/assets mkdir -p /opt/bootstrap/assets
mv manifests /opt/bootstrap/assets/manifests mv manifests /opt/bootstrap/assets/manifests
mv manifests-networking/* /opt/bootstrap/assets/manifests/ mv manifests-networking/* /opt/bootstrap/assets/manifests/
rm -rf assets auth static-manifests tls manifests-networking rm -rf assets auth static-manifests tls manifests-networking
chcon -R -u system_u -t container_file_t /etc/kubernetes/bootstrap-secrets chcon -R -u system_u -t container_file_t /etc/kubernetes/pki
- path: /opt/bootstrap/apply - path: /opt/bootstrap/apply
mode: 0544 mode: 0544
contents: contents:
inline: | inline: |
#!/bin/bash -e #!/bin/bash -e
export KUBECONFIG=/etc/kubernetes/secrets/admin.conf export KUBECONFIG=/etc/kubernetes/pki/admin.conf
until kubectl version; do until kubectl version; do
echo "Waiting for static pod control plane" echo "Waiting for static pod control plane"
sleep 5 sleep 5

12
aws/flatcar-linux/kubernetes/cl/controller.yaml
View File

@ -119,7 +119,7 @@ systemd:
WorkingDirectory=/opt/bootstrap WorkingDirectory=/opt/bootstrap
Environment=KUBELET_IMAGE=quay.io/poseidon/kubelet:v1.19.4 Environment=KUBELET_IMAGE=quay.io/poseidon/kubelet:v1.19.4
ExecStart=/usr/bin/docker run \ ExecStart=/usr/bin/docker run \
-v /etc/kubernetes/bootstrap-secrets:/etc/kubernetes/secrets:ro \ -v /etc/kubernetes/pki:/etc/kubernetes/pki:ro \
-v /opt/bootstrap/assets:/assets:ro \ -v /opt/bootstrap/assets:/assets:ro \
-v /opt/bootstrap/apply:/apply:ro \ -v /opt/bootstrap/apply:/apply:ro \
--entrypoint=/apply \ --entrypoint=/apply \
@ -149,14 +149,14 @@ storage:
mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking
awk '/#####/ {filename=$2; next} {print > filename}' assets awk '/#####/ {filename=$2; next} {print > filename}' assets
mkdir -p /etc/ssl/etcd/etcd mkdir -p /etc/ssl/etcd/etcd
mkdir -p /etc/kubernetes/bootstrap-secrets mkdir -p /etc/kubernetes/pki
mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/ mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/
mv tls/etcd/etcd-client* /etc/kubernetes/bootstrap-secrets/ mv tls/etcd/etcd-client* /etc/kubernetes/pki/
chown -R etcd:etcd /etc/ssl/etcd chown -R etcd:etcd /etc/ssl/etcd
chmod -R 500 /etc/ssl/etcd chmod -R 500 /etc/ssl/etcd
chmod -R 700 /var/lib/etcd chmod -R 700 /var/lib/etcd
mv auth/* /etc/kubernetes/bootstrap-secrets/ mv auth/* /etc/kubernetes/pki/
mv tls/k8s/* /etc/kubernetes/bootstrap-secrets/ mv tls/k8s/* /etc/kubernetes/pki/
mkdir -p /etc/kubernetes/manifests mkdir -p /etc/kubernetes/manifests
mv static-manifests/* /etc/kubernetes/manifests/ mv static-manifests/* /etc/kubernetes/manifests/
mkdir -p /opt/bootstrap/assets mkdir -p /opt/bootstrap/assets
@ -169,7 +169,7 @@ storage:
contents: contents:
inline: | inline: |
#!/bin/bash -e #!/bin/bash -e
export KUBECONFIG=/etc/kubernetes/secrets/admin.conf export KUBECONFIG=/etc/kubernetes/pki/admin.conf
until kubectl version; do until kubectl version; do
echo "Waiting for static pod control plane" echo "Waiting for static pod control plane"
sleep 5 sleep 5

14
azure/fedora-coreos/kubernetes/fcc/controller.yaml
View File

@ -114,7 +114,7 @@ systemd:
ExecStartPre=-/usr/bin/podman rm bootstrap ExecStartPre=-/usr/bin/podman rm bootstrap
ExecStart=/usr/bin/podman run --name bootstrap \ ExecStart=/usr/bin/podman run --name bootstrap \
--network host \ --network host \
--volume /etc/kubernetes/bootstrap-secrets:/etc/kubernetes/secrets:ro,z \ --volume /etc/kubernetes/pki:/etc/kubernetes/pki:ro,z \
--volume /opt/bootstrap/assets:/assets:ro,Z \ --volume /opt/bootstrap/assets:/assets:ro,Z \
--volume /opt/bootstrap/apply:/apply:ro,Z \ --volume /opt/bootstrap/apply:/apply:ro,Z \
--entrypoint=/apply \ --entrypoint=/apply \
@ -141,26 +141,26 @@ storage:
mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking
awk '/#####/ {filename=$2; next} {print > filename}' assets awk '/#####/ {filename=$2; next} {print > filename}' assets
mkdir -p /etc/ssl/etcd/etcd mkdir -p /etc/ssl/etcd/etcd
mkdir -p /etc/kubernetes/bootstrap-secrets mkdir -p /etc/kubernetes/pki
mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/ mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/
mv tls/etcd/etcd-client* /etc/kubernetes/bootstrap-secrets/ mv tls/etcd/etcd-client* /etc/kubernetes/pki/
chown -R etcd:etcd /etc/ssl/etcd chown -R etcd:etcd /etc/ssl/etcd
chmod -R 500 /etc/ssl/etcd chmod -R 500 /etc/ssl/etcd
mv auth/* /etc/kubernetes/bootstrap-secrets/ mv auth/* /etc/kubernetes/pki/
mv tls/k8s/* /etc/kubernetes/bootstrap-secrets/ mv tls/k8s/* /etc/kubernetes/pki/
mkdir -p /etc/kubernetes/manifests mkdir -p /etc/kubernetes/manifests
mv static-manifests/* /etc/kubernetes/manifests/ mv static-manifests/* /etc/kubernetes/manifests/
mkdir -p /opt/bootstrap/assets mkdir -p /opt/bootstrap/assets
mv manifests /opt/bootstrap/assets/manifests mv manifests /opt/bootstrap/assets/manifests
mv manifests-networking/* /opt/bootstrap/assets/manifests/ mv manifests-networking/* /opt/bootstrap/assets/manifests/
rm -rf assets auth static-manifests tls manifests-networking rm -rf assets auth static-manifests tls manifests-networking
chcon -R -u system_u -t container_file_t /etc/kubernetes/bootstrap-secrets chcon -R -u system_u -t container_file_t /etc/kubernetes/pki
- path: /opt/bootstrap/apply - path: /opt/bootstrap/apply
mode: 0544 mode: 0544
contents: contents:
inline: | inline: |
#!/bin/bash -e #!/bin/bash -e
export KUBECONFIG=/etc/kubernetes/secrets/admin.conf export KUBECONFIG=/etc/kubernetes/pki/admin.conf
until kubectl version; do until kubectl version; do
echo "Waiting for static pod control plane" echo "Waiting for static pod control plane"
sleep 5 sleep 5

12
azure/flatcar-linux/kubernetes/cl/controller.yaml
View File

@ -119,7 +119,7 @@ systemd:
WorkingDirectory=/opt/bootstrap WorkingDirectory=/opt/bootstrap
Environment=KUBELET_IMAGE=quay.io/poseidon/kubelet:v1.19.4 Environment=KUBELET_IMAGE=quay.io/poseidon/kubelet:v1.19.4
ExecStart=/usr/bin/docker run \ ExecStart=/usr/bin/docker run \
-v /etc/kubernetes/bootstrap-secrets:/etc/kubernetes/secrets:ro \ -v /etc/kubernetes/pki:/etc/kubernetes/pki:ro \
-v /opt/bootstrap/assets:/assets:ro \ -v /opt/bootstrap/assets:/assets:ro \
-v /opt/bootstrap/apply:/apply:ro \ -v /opt/bootstrap/apply:/apply:ro \
--entrypoint=/apply \ --entrypoint=/apply \
@ -149,14 +149,14 @@ storage:
mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking
awk '/#####/ {filename=$2; next} {print > filename}' assets awk '/#####/ {filename=$2; next} {print > filename}' assets
mkdir -p /etc/ssl/etcd/etcd mkdir -p /etc/ssl/etcd/etcd
mkdir -p /etc/kubernetes/bootstrap-secrets mkdir -p /etc/kubernetes/pki
mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/ mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/
mv tls/etcd/etcd-client* /etc/kubernetes/bootstrap-secrets/ mv tls/etcd/etcd-client* /etc/kubernetes/pki/
chown -R etcd:etcd /etc/ssl/etcd chown -R etcd:etcd /etc/ssl/etcd
chmod -R 500 /etc/ssl/etcd chmod -R 500 /etc/ssl/etcd
chmod -R 700 /var/lib/etcd chmod -R 700 /var/lib/etcd
mv auth/* /etc/kubernetes/bootstrap-secrets/ mv auth/* /etc/kubernetes/pki/
mv tls/k8s/* /etc/kubernetes/bootstrap-secrets/ mv tls/k8s/* /etc/kubernetes/pki/
mkdir -p /etc/kubernetes/manifests mkdir -p /etc/kubernetes/manifests
mv static-manifests/* /etc/kubernetes/manifests/ mv static-manifests/* /etc/kubernetes/manifests/
mkdir -p /opt/bootstrap/assets mkdir -p /opt/bootstrap/assets
@ -169,7 +169,7 @@ storage:
contents: contents:
inline: | inline: |
#!/bin/bash -e #!/bin/bash -e
export KUBECONFIG=/etc/kubernetes/secrets/admin.conf export KUBECONFIG=/etc/kubernetes/pki/admin.conf
until kubectl version; do until kubectl version; do
echo "Waiting for static pod control plane" echo "Waiting for static pod control plane"
sleep 5 sleep 5

14
bare-metal/fedora-coreos/kubernetes/fcc/controller.yaml
View File

@ -125,7 +125,7 @@ systemd:
ExecStartPre=-/usr/bin/podman rm bootstrap ExecStartPre=-/usr/bin/podman rm bootstrap
ExecStart=/usr/bin/podman run --name bootstrap \ ExecStart=/usr/bin/podman run --name bootstrap \
--network host \ --network host \
--volume /etc/kubernetes/bootstrap-secrets:/etc/kubernetes/secrets:ro,z \ --volume /etc/kubernetes/pki:/etc/kubernetes/pki:ro,z \
--volume /opt/bootstrap/assets:/assets:ro,Z \ --volume /opt/bootstrap/assets:/assets:ro,Z \
--volume /opt/bootstrap/apply:/apply:ro,Z \ --volume /opt/bootstrap/apply:/apply:ro,Z \
--entrypoint=/apply \ --entrypoint=/apply \
@ -152,26 +152,26 @@ storage:
mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking
awk '/#####/ {filename=$2; next} {print > filename}' assets awk '/#####/ {filename=$2; next} {print > filename}' assets
mkdir -p /etc/ssl/etcd/etcd mkdir -p /etc/ssl/etcd/etcd
mkdir -p /etc/kubernetes/bootstrap-secrets mkdir -p /etc/kubernetes/pki
mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/ mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/
mv tls/etcd/etcd-client* /etc/kubernetes/bootstrap-secrets/ mv tls/etcd/etcd-client* /etc/kubernetes/pki/
chown -R etcd:etcd /etc/ssl/etcd chown -R etcd:etcd /etc/ssl/etcd
chmod -R 500 /etc/ssl/etcd chmod -R 500 /etc/ssl/etcd
mv auth/* /etc/kubernetes/bootstrap-secrets/ mv auth/* /etc/kubernetes/pki/
mv tls/k8s/* /etc/kubernetes/bootstrap-secrets/ mv tls/k8s/* /etc/kubernetes/pki/
mkdir -p /etc/kubernetes/manifests mkdir -p /etc/kubernetes/manifests
mv static-manifests/* /etc/kubernetes/manifests/ mv static-manifests/* /etc/kubernetes/manifests/
mkdir -p /opt/bootstrap/assets mkdir -p /opt/bootstrap/assets
mv manifests /opt/bootstrap/assets/manifests mv manifests /opt/bootstrap/assets/manifests
mv manifests-networking/* /opt/bootstrap/assets/manifests/ mv manifests-networking/* /opt/bootstrap/assets/manifests/
rm -rf assets auth static-manifests tls manifests-networking rm -rf assets auth static-manifests tls manifests-networking
chcon -R -u system_u -t container_file_t /etc/kubernetes/bootstrap-secrets chcon -R -u system_u -t container_file_t /etc/kubernetes/pki
- path: /opt/bootstrap/apply - path: /opt/bootstrap/apply
mode: 0544 mode: 0544
contents: contents:
inline: | inline: |
#!/bin/bash -e #!/bin/bash -e
export KUBECONFIG=/etc/kubernetes/secrets/admin.conf export KUBECONFIG=/etc/kubernetes/pki/admin.conf
until kubectl version; do until kubectl version; do
echo "Waiting for static pod control plane" echo "Waiting for static pod control plane"
sleep 5 sleep 5

12
bare-metal/flatcar-linux/kubernetes/cl/controller.yaml
View File

@ -130,7 +130,7 @@ systemd:
WorkingDirectory=/opt/bootstrap WorkingDirectory=/opt/bootstrap
Environment=KUBELET_IMAGE=quay.io/poseidon/kubelet:v1.19.4 Environment=KUBELET_IMAGE=quay.io/poseidon/kubelet:v1.19.4
ExecStart=/usr/bin/docker run \ ExecStart=/usr/bin/docker run \
-v /etc/kubernetes/bootstrap-secrets:/etc/kubernetes/secrets:ro \ -v /etc/kubernetes/pki:/etc/kubernetes/pki:ro \
-v /opt/bootstrap/assets:/assets:ro \ -v /opt/bootstrap/assets:/assets:ro \
-v /opt/bootstrap/apply:/apply:ro \ -v /opt/bootstrap/apply:/apply:ro \
--entrypoint=/apply \ --entrypoint=/apply \
@ -163,14 +163,14 @@ storage:
mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking
awk '/#####/ {filename=$2; next} {print > filename}' assets awk '/#####/ {filename=$2; next} {print > filename}' assets
mkdir -p /etc/ssl/etcd/etcd mkdir -p /etc/ssl/etcd/etcd
mkdir -p /etc/kubernetes/bootstrap-secrets mkdir -p /etc/kubernetes/pki
mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/ mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/
mv tls/etcd/etcd-client* /etc/kubernetes/bootstrap-secrets/ mv tls/etcd/etcd-client* /etc/kubernetes/pki/
chown -R etcd:etcd /etc/ssl/etcd chown -R etcd:etcd /etc/ssl/etcd
chmod -R 500 /etc/ssl/etcd chmod -R 500 /etc/ssl/etcd
chmod -R 700 /var/lib/etcd chmod -R 700 /var/lib/etcd
mv auth/* /etc/kubernetes/bootstrap-secrets/ mv auth/* /etc/kubernetes/pki/
mv tls/k8s/* /etc/kubernetes/bootstrap-secrets/ mv tls/k8s/* /etc/kubernetes/pki/
mkdir -p /etc/kubernetes/manifests mkdir -p /etc/kubernetes/manifests
mv static-manifests/* /etc/kubernetes/manifests/ mv static-manifests/* /etc/kubernetes/manifests/
mkdir -p /opt/bootstrap/assets mkdir -p /opt/bootstrap/assets
@ -183,7 +183,7 @@ storage:
contents: contents:
inline: | inline: |
#!/bin/bash -e #!/bin/bash -e
export KUBECONFIG=/etc/kubernetes/secrets/admin.conf export KUBECONFIG=/etc/kubernetes/pki/admin.conf
until kubectl version; do until kubectl version; do
echo "Waiting for static pod control plane" echo "Waiting for static pod control plane"
sleep 5 sleep 5

14
digital-ocean/fedora-coreos/kubernetes/fcc/controller.yaml
View File

@ -126,7 +126,7 @@ systemd:
ExecStartPre=-/usr/bin/podman rm bootstrap ExecStartPre=-/usr/bin/podman rm bootstrap
ExecStart=/usr/bin/podman run --name bootstrap \ ExecStart=/usr/bin/podman run --name bootstrap \
--network host \ --network host \
--volume /etc/kubernetes/bootstrap-secrets:/etc/kubernetes/secrets:ro,z \ --volume /etc/kubernetes/pki:/etc/kubernetes/pki:ro,z \
--volume /opt/bootstrap/assets:/assets:ro,Z \ --volume /opt/bootstrap/assets:/assets:ro,Z \
--volume /opt/bootstrap/apply:/apply:ro,Z \ --volume /opt/bootstrap/apply:/apply:ro,Z \
--entrypoint=/apply \ --entrypoint=/apply \
@ -148,26 +148,26 @@ storage:
mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking
awk '/#####/ {filename=$2; next} {print > filename}' assets awk '/#####/ {filename=$2; next} {print > filename}' assets
mkdir -p /etc/ssl/etcd/etcd mkdir -p /etc/ssl/etcd/etcd
mkdir -p /etc/kubernetes/bootstrap-secrets mkdir -p /etc/kubernetes/pki
mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/ mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/
mv tls/etcd/etcd-client* /etc/kubernetes/bootstrap-secrets/ mv tls/etcd/etcd-client* /etc/kubernetes/pki/
chown -R etcd:etcd /etc/ssl/etcd chown -R etcd:etcd /etc/ssl/etcd
chmod -R 500 /etc/ssl/etcd chmod -R 500 /etc/ssl/etcd
mv auth/* /etc/kubernetes/bootstrap-secrets/ mv auth/* /etc/kubernetes/pki/
mv tls/k8s/* /etc/kubernetes/bootstrap-secrets/ mv tls/k8s/* /etc/kubernetes/pki/
mkdir -p /etc/kubernetes/manifests mkdir -p /etc/kubernetes/manifests
mv static-manifests/* /etc/kubernetes/manifests/ mv static-manifests/* /etc/kubernetes/manifests/
mkdir -p /opt/bootstrap/assets mkdir -p /opt/bootstrap/assets
mv manifests /opt/bootstrap/assets/manifests mv manifests /opt/bootstrap/assets/manifests
mv manifests-networking/* /opt/bootstrap/assets/manifests/ mv manifests-networking/* /opt/bootstrap/assets/manifests/
rm -rf assets auth static-manifests tls manifests-networking rm -rf assets auth static-manifests tls manifests-networking
chcon -R -u system_u -t container_file_t /etc/kubernetes/bootstrap-secrets chcon -R -u system_u -t container_file_t /etc/kubernetes/pki
- path: /opt/bootstrap/apply - path: /opt/bootstrap/apply
mode: 0544 mode: 0544
contents: contents:
inline: | inline: |
#!/bin/bash -e #!/bin/bash -e
export KUBECONFIG=/etc/kubernetes/secrets/admin.conf export KUBECONFIG=/etc/kubernetes/pki/admin.conf
until kubectl version; do until kubectl version; do
echo "Waiting for static pod control plane" echo "Waiting for static pod control plane"
sleep 5 sleep 5

12
digital-ocean/flatcar-linux/kubernetes/cl/controller.yaml
View File

@ -129,7 +129,7 @@ systemd:
WorkingDirectory=/opt/bootstrap WorkingDirectory=/opt/bootstrap
Environment=KUBELET_IMAGE=quay.io/poseidon/kubelet:v1.19.4 Environment=KUBELET_IMAGE=quay.io/poseidon/kubelet:v1.19.4
ExecStart=/usr/bin/docker run \ ExecStart=/usr/bin/docker run \
-v /etc/kubernetes/bootstrap-secrets:/etc/kubernetes/secrets:ro \ -v /etc/kubernetes/pki:/etc/kubernetes/pki:ro \
-v /opt/bootstrap/assets:/assets:ro \ -v /opt/bootstrap/assets:/assets:ro \
-v /opt/bootstrap/apply:/apply:ro \ -v /opt/bootstrap/apply:/apply:ro \
--entrypoint=/apply \ --entrypoint=/apply \
@ -156,14 +156,14 @@ storage:
mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking
awk '/#####/ {filename=$2; next} {print > filename}' assets awk '/#####/ {filename=$2; next} {print > filename}' assets
mkdir -p /etc/ssl/etcd/etcd mkdir -p /etc/ssl/etcd/etcd
mkdir -p /etc/kubernetes/bootstrap-secrets mkdir -p /etc/kubernetes/pki
mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/ mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/
mv tls/etcd/etcd-client* /etc/kubernetes/bootstrap-secrets/ mv tls/etcd/etcd-client* /etc/kubernetes/pki/
chown -R etcd:etcd /etc/ssl/etcd chown -R etcd:etcd /etc/ssl/etcd
chmod -R 500 /etc/ssl/etcd chmod -R 500 /etc/ssl/etcd
chmod -R 700 /var/lib/etcd chmod -R 700 /var/lib/etcd
mv auth/* /etc/kubernetes/bootstrap-secrets/ mv auth/* /etc/kubernetes/pki/
mv tls/k8s/* /etc/kubernetes/bootstrap-secrets/ mv tls/k8s/* /etc/kubernetes/pki/
mkdir -p /etc/kubernetes/manifests mkdir -p /etc/kubernetes/manifests
mv static-manifests/* /etc/kubernetes/manifests/ mv static-manifests/* /etc/kubernetes/manifests/
mkdir -p /opt/bootstrap/assets mkdir -p /opt/bootstrap/assets
@ -176,7 +176,7 @@ storage:
contents: contents:
inline: | inline: |
#!/bin/bash -e #!/bin/bash -e
export KUBECONFIG=/etc/kubernetes/secrets/admin.conf export KUBECONFIG=/etc/kubernetes/pki/admin.conf
until kubectl version; do until kubectl version; do
echo "Waiting for static pod control plane" echo "Waiting for static pod control plane"
sleep 5 sleep 5

14
google-cloud/fedora-coreos/kubernetes/fcc/controller.yaml
View File

@ -114,7 +114,7 @@ systemd:
ExecStartPre=-/usr/bin/podman rm bootstrap ExecStartPre=-/usr/bin/podman rm bootstrap
ExecStart=/usr/bin/podman run --name bootstrap \ ExecStart=/usr/bin/podman run --name bootstrap \
--network host \ --network host \
--volume /etc/kubernetes/bootstrap-secrets:/etc/kubernetes/secrets:ro,z \ --volume /etc/kubernetes/pki:/etc/kubernetes/pki:ro,z \
--volume /opt/bootstrap/assets:/assets:ro,Z \ --volume /opt/bootstrap/assets:/assets:ro,Z \
--volume /opt/bootstrap/apply:/apply:ro,Z \ --volume /opt/bootstrap/apply:/apply:ro,Z \
--entrypoint=/apply \ --entrypoint=/apply \
@ -141,26 +141,26 @@ storage:
mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking
awk '/#####/ {filename=$2; next} {print > filename}' assets awk '/#####/ {filename=$2; next} {print > filename}' assets
mkdir -p /etc/ssl/etcd/etcd mkdir -p /etc/ssl/etcd/etcd
mkdir -p /etc/kubernetes/bootstrap-secrets mkdir -p /etc/kubernetes/pki
mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/ mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/
mv tls/etcd/etcd-client* /etc/kubernetes/bootstrap-secrets/ mv tls/etcd/etcd-client* /etc/kubernetes/pki/
chown -R etcd:etcd /etc/ssl/etcd chown -R etcd:etcd /etc/ssl/etcd
chmod -R 500 /etc/ssl/etcd chmod -R 500 /etc/ssl/etcd
mv auth/* /etc/kubernetes/bootstrap-secrets/ mv auth/* /etc/kubernetes/pki/
mv tls/k8s/* /etc/kubernetes/bootstrap-secrets/ mv tls/k8s/* /etc/kubernetes/pki/
mkdir -p /etc/kubernetes/manifests mkdir -p /etc/kubernetes/manifests
mv static-manifests/* /etc/kubernetes/manifests/ mv static-manifests/* /etc/kubernetes/manifests/
mkdir -p /opt/bootstrap/assets mkdir -p /opt/bootstrap/assets
mv manifests /opt/bootstrap/assets/manifests mv manifests /opt/bootstrap/assets/manifests
mv manifests-networking/* /opt/bootstrap/assets/manifests/ mv manifests-networking/* /opt/bootstrap/assets/manifests/
rm -rf assets auth static-manifests tls manifests-networking rm -rf assets auth static-manifests tls manifests-networking
chcon -R -u system_u -t container_file_t /etc/kubernetes/bootstrap-secrets chcon -R -u system_u -t container_file_t /etc/kubernetes/pki
- path: /opt/bootstrap/apply - path: /opt/bootstrap/apply
mode: 0544 mode: 0544
contents: contents:
inline: | inline: |
#!/bin/bash -e #!/bin/bash -e
export KUBECONFIG=/etc/kubernetes/secrets/admin.conf export KUBECONFIG=/etc/kubernetes/pki/admin.conf
until kubectl version; do until kubectl version; do
echo "Waiting for static pod control plane" echo "Waiting for static pod control plane"
sleep 5 sleep 5

12
google-cloud/flatcar-linux/kubernetes/cl/controller.yaml
View File

@ -117,7 +117,7 @@ systemd:
WorkingDirectory=/opt/bootstrap WorkingDirectory=/opt/bootstrap
Environment=KUBELET_IMAGE=quay.io/poseidon/kubelet:v1.19.4 Environment=KUBELET_IMAGE=quay.io/poseidon/kubelet:v1.19.4
ExecStart=/usr/bin/docker run \ ExecStart=/usr/bin/docker run \
-v /etc/kubernetes/bootstrap-secrets:/etc/kubernetes/secrets:ro \ -v /etc/kubernetes/pki:/etc/kubernetes/pki:ro \
-v /opt/bootstrap/assets:/assets:ro \ -v /opt/bootstrap/assets:/assets:ro \
-v /opt/bootstrap/apply:/apply:ro \ -v /opt/bootstrap/apply:/apply:ro \
--entrypoint=/apply \ --entrypoint=/apply \
@ -147,14 +147,14 @@ storage:
mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking mkdir -p -- auth tls/etcd tls/k8s static-manifests manifests/coredns manifests-networking
awk '/#####/ {filename=$2; next} {print > filename}' assets awk '/#####/ {filename=$2; next} {print > filename}' assets
mkdir -p /etc/ssl/etcd/etcd mkdir -p /etc/ssl/etcd/etcd
mkdir -p /etc/kubernetes/bootstrap-secrets mkdir -p /etc/kubernetes/pki
mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/ mv tls/etcd/{peer*,server*} /etc/ssl/etcd/etcd/
mv tls/etcd/etcd-client* /etc/kubernetes/bootstrap-secrets/ mv tls/etcd/etcd-client* /etc/kubernetes/pki/
chown -R etcd:etcd /etc/ssl/etcd chown -R etcd:etcd /etc/ssl/etcd
chmod -R 500 /etc/ssl/etcd chmod -R 500 /etc/ssl/etcd
chmod -R 700 /var/lib/etcd chmod -R 700 /var/lib/etcd
mv auth/* /etc/kubernetes/bootstrap-secrets/ mv auth/* /etc/kubernetes/pki/
mv tls/k8s/* /etc/kubernetes/bootstrap-secrets/ mv tls/k8s/* /etc/kubernetes/pki/
mkdir -p /etc/kubernetes/manifests mkdir -p /etc/kubernetes/manifests
mv static-manifests/* /etc/kubernetes/manifests/ mv static-manifests/* /etc/kubernetes/manifests/
mkdir -p /opt/bootstrap/assets mkdir -p /opt/bootstrap/assets
@ -167,7 +167,7 @@ storage:
contents: contents:
inline: | inline: |
#!/bin/bash -e #!/bin/bash -e
export KUBECONFIG=/etc/kubernetes/secrets/admin.conf export KUBECONFIG=/etc/kubernetes/pki/admin.conf
until kubectl version; do until kubectl version; do
echo "Waiting for static pod control plane" echo "Waiting for static pod control plane"
sleep 5 sleep 5