From dee398d5e9b127f9031130daf2bf4a2c2b613752 Mon Sep 17 00:00:00 2001 From: Mark Burnett Date: Mon, 19 Jun 2017 22:07:11 -0500 Subject: [PATCH] add templates for certs and keys --- promenade/config.py | 23 +++++++ promenade/generator.py | 26 ++++++-- .../kubelet/manifests/kube-proxy.yaml | 4 +- .../etc/kubernetes/kubelet/pki/cluster-ca.pem | 1 + .../kubernetes/kubelet/pki/kubelet-key.pem | 1 + .../etc/kubernetes/kubelet/pki/kubelet.pem | 1 + .../proxy/{config => }/kubeconfig.yaml | 6 +- .../etc/kubernetes/proxy/pki/cluster-ca.pem | 1 + .../etc/kubernetes/proxy/pki/proxy-key.pem | 1 + .../common/etc/kubernetes/proxy/pki/proxy.pem | 1 + .../kubernetes/asset-loader/kubeconfig.yaml | 6 +- .../asset-loader/pki/asset-loader-key.pem | 1 + .../asset-loader/pki/asset-loader.pem | 1 + .../asset-loader/pki/cluster-ca.pem | 1 + .../auxiliary-etcd-0/pki/client-ca.pem | 1 + .../auxiliary-etcd-0/pki/etcd-client-key.pem | 1 + .../auxiliary-etcd-0/pki/etcd-client.pem | 1 + .../auxiliary-etcd-0/pki/etcd-peer-key.pem | 1 + .../auxiliary-etcd-0/pki/etcd-peer.pem | 1 + .../auxiliary-etcd-0/pki/peer-ca.pem | 1 + .../auxiliary-etcd-1/pki/client-ca.pem | 1 + .../auxiliary-etcd-1/pki/etcd-client-key.pem | 1 + .../auxiliary-etcd-1/pki/etcd-client.pem | 1 + .../auxiliary-etcd-1/pki/etcd-peer-key.pem | 1 + .../auxiliary-etcd-1/pki/etcd-peer.pem | 1 + .../auxiliary-etcd-1/pki/peer-ca.pem | 1 + .../etc/kubernetes/genesis/kubeconfig.yaml | 6 +- .../kubelet/manifests/asset-loader.yaml | 6 +- .../kubelet/manifests/auxiliary-etcd.yaml | 63 +++++++++++-------- .../etc/kubernetes/admin/pki/admin-key.pem | 1 + .../master/etc/kubernetes/admin/pki/admin.pem | 1 + .../etc/kubernetes/admin/pki/cluster-ca.pem | 1 + .../apiserver/pki/apiserver-key.pem | 1 + .../kubernetes/apiserver/pki/apiserver.pem | 1 + .../kubernetes/apiserver/pki/cluster-ca.pem | 1 + .../apiserver/pki/etcd-client-ca.pem | 1 + .../apiserver/pki/etcd-client-key.pem | 1 + .../kubernetes/apiserver/pki/etcd-client.pem | 1 + .../apiserver/pki/service-account.pub | 1 + .../controller-manager/kubeconfig.yaml | 6 +- .../controller-manager/pki/cluster-ca-key.pem | 1 + .../controller-manager/pki/cluster-ca.pem | 1 + .../pki/controller-manager-key.pem | 1 + .../pki/controller-manager.pem | 1 + .../pki/service-account.key | 1 + .../etc/kubernetes/etcd/pki/client-ca.pem | 1 + .../kubernetes/etcd/pki/etcd-client-key.pem | 1 + .../etc/kubernetes/etcd/pki/etcd-client.pem | 1 + .../etc/kubernetes/etcd/pki/etcd-peer-key.pem | 1 + .../etc/kubernetes/etcd/pki/etcd-peer.pem | 1 + .../etc/kubernetes/etcd/pki/peer-ca.pem | 1 + .../kubelet/manifests/kube-apiserver.yaml | 8 +-- .../manifests/kube-controller-manager.yaml | 12 ++-- .../kubelet/manifests/kube-etcd.yaml | 14 ++--- .../kubelet/manifests/kube-scheduler.yaml | 4 +- .../etc/kubernetes/scheduler/kubeconfig.yaml | 6 +- .../kubernetes/scheduler/pki/cluster-ca.pem | 1 + .../scheduler/pki/scheduler-key.pem | 1 + .../kubernetes/scheduler/pki/scheduler.pem | 1 + 59 files changed, 164 insertions(+), 71 deletions(-) create mode 100644 promenade/templates/common/etc/kubernetes/kubelet/pki/cluster-ca.pem create mode 100644 promenade/templates/common/etc/kubernetes/kubelet/pki/kubelet-key.pem create mode 100644 promenade/templates/common/etc/kubernetes/kubelet/pki/kubelet.pem rename promenade/templates/common/etc/kubernetes/proxy/{config => }/kubeconfig.yaml (59%) create mode 100644 promenade/templates/common/etc/kubernetes/proxy/pki/cluster-ca.pem create mode 100644 promenade/templates/common/etc/kubernetes/proxy/pki/proxy-key.pem create mode 100644 promenade/templates/common/etc/kubernetes/proxy/pki/proxy.pem create mode 100644 promenade/templates/genesis/etc/kubernetes/asset-loader/pki/asset-loader-key.pem create mode 100644 promenade/templates/genesis/etc/kubernetes/asset-loader/pki/asset-loader.pem create mode 100644 promenade/templates/genesis/etc/kubernetes/asset-loader/pki/cluster-ca.pem create mode 100644 promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/client-ca.pem create mode 100644 promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/etcd-client-key.pem create mode 100644 promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/etcd-client.pem create mode 100644 promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/etcd-peer-key.pem create mode 100644 promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/etcd-peer.pem create mode 100644 promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/peer-ca.pem create mode 100644 promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/client-ca.pem create mode 100644 promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/etcd-client-key.pem create mode 100644 promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/etcd-client.pem create mode 100644 promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/etcd-peer-key.pem create mode 100644 promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/etcd-peer.pem create mode 100644 promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/peer-ca.pem create mode 100644 promenade/templates/master/etc/kubernetes/admin/pki/admin-key.pem create mode 100644 promenade/templates/master/etc/kubernetes/admin/pki/admin.pem create mode 100644 promenade/templates/master/etc/kubernetes/admin/pki/cluster-ca.pem create mode 100644 promenade/templates/master/etc/kubernetes/apiserver/pki/apiserver-key.pem create mode 100644 promenade/templates/master/etc/kubernetes/apiserver/pki/apiserver.pem create mode 100644 promenade/templates/master/etc/kubernetes/apiserver/pki/cluster-ca.pem create mode 100644 promenade/templates/master/etc/kubernetes/apiserver/pki/etcd-client-ca.pem create mode 100644 promenade/templates/master/etc/kubernetes/apiserver/pki/etcd-client-key.pem create mode 100644 promenade/templates/master/etc/kubernetes/apiserver/pki/etcd-client.pem create mode 100644 promenade/templates/master/etc/kubernetes/apiserver/pki/service-account.pub create mode 100644 promenade/templates/master/etc/kubernetes/controller-manager/pki/cluster-ca-key.pem create mode 100644 promenade/templates/master/etc/kubernetes/controller-manager/pki/cluster-ca.pem create mode 100644 promenade/templates/master/etc/kubernetes/controller-manager/pki/controller-manager-key.pem create mode 100644 promenade/templates/master/etc/kubernetes/controller-manager/pki/controller-manager.pem create mode 100644 promenade/templates/master/etc/kubernetes/controller-manager/pki/service-account.key create mode 100644 promenade/templates/master/etc/kubernetes/etcd/pki/client-ca.pem create mode 100644 promenade/templates/master/etc/kubernetes/etcd/pki/etcd-client-key.pem create mode 100644 promenade/templates/master/etc/kubernetes/etcd/pki/etcd-client.pem create mode 100644 promenade/templates/master/etc/kubernetes/etcd/pki/etcd-peer-key.pem create mode 100644 promenade/templates/master/etc/kubernetes/etcd/pki/etcd-peer.pem create mode 100644 promenade/templates/master/etc/kubernetes/etcd/pki/peer-ca.pem create mode 100644 promenade/templates/master/etc/kubernetes/scheduler/pki/cluster-ca.pem create mode 100644 promenade/templates/master/etc/kubernetes/scheduler/pki/scheduler-key.pem create mode 100644 promenade/templates/master/etc/kubernetes/scheduler/pki/scheduler.pem diff --git a/promenade/config.py b/promenade/config.py index 63777e86..05bdba68 100644 --- a/promenade/config.py +++ b/promenade/config.py @@ -41,6 +41,7 @@ class Document: raise AssertionError('Did not get expected keys') assert data['apiVersion'] == 'promenade/v1' assert data['kind'] in self.SUPPORTED_KINDS + assert data['metadata']['name'] self.data = data @@ -48,6 +49,10 @@ class Document: def kind(self): return self.data['kind'] + @property + def name(self): + return self.metadata['name'] + @property def target(self): return self.metadata.get('target') @@ -64,6 +69,19 @@ class Configuration: def __init__(self, documents): self.documents = sorted(documents, key=attrgetter('kind', 'target')) + self.validate() + + def validate(self): + identifiers = set() + for document in self.documents: + identifier = (document.kind, document.name) + if identifier in identifiers: + LOG.error('Found duplicate document in config: kind=%s name=%s', + document.kind, document.name) + raise RuntimeError('Duplicate document') + else: + identifiers.add(identifier) + def __getitem__(self, key): results = [d for d in self.documents if d.kind == key] if len(results) < 1: @@ -73,6 +91,11 @@ class Configuration: else: return results[0] + def get(self, *, kind, name): + for document in self.documents: + if document.kind == kind and document.name == name: + return document + def iterate(self, *, kind=None, target=None): if target: docs = self._iterate_with_target(target) diff --git a/promenade/generator.py b/promenade/generator.py index 90b3fb81..297011ac 100644 --- a/promenade/generator.py +++ b/promenade/generator.py @@ -123,6 +123,7 @@ class Generator: role_specific_documents.extend([ admin_cert, admin_cert_key, + cluster_ca_key, etcd_client_ca, etcd_peer_ca, sa_priv, @@ -140,7 +141,7 @@ class Generator: role_specific_documents.extend(_genesis_config(hostname, data, masters, network, keys)) role_specific_documents.append(_genesis_etcd_config(cluster_name, hostname)) - node.data['is_genesis'] = True + node.data['spec']['is_genesis'] = True c = config.Configuration(common_documents + role_specific_documents) c.write(os.path.join(output_dir, hostname + '.yaml')) @@ -156,6 +157,7 @@ class Generator: 'kind': 'Masters', 'metadata': { 'cluster': cluster_name, + 'name': cluster_name, 'target': 'all', }, 'spec': { @@ -172,7 +174,8 @@ def _master_etcd_config(cluster_name, genesis_hostname, hostname, masters): 'auxiliary-etcd-0=https://%s:12380' % genesis_hostname, 'auxiliary-etcd-1=https://%s:22380' % genesis_hostname, ]) - return _etcd_config(cluster_name, target=hostname, + return _etcd_config(cluster_name, name='master-etcd', + target=hostname, initial_cluster=initial_cluster, initial_cluster_state='existing') @@ -183,18 +186,20 @@ def _genesis_etcd_config(cluster_name, hostname): 'auxiliary-etcd-0=https://%s:12380' % hostname, 'auxiliary-etcd-1=https://%s:22380' % hostname, ] - return _etcd_config(cluster_name, target=hostname, + return _etcd_config(cluster_name, name='genesis-etcd', + target=hostname, initial_cluster=initial_cluster, initial_cluster_state='new') -def _etcd_config(cluster_name, *, target, +def _etcd_config(cluster_name, *, name, target, initial_cluster, initial_cluster_state): return config.Document({ 'apiVersion': 'promenade/v1', 'kind': 'Etcd', 'metadata': { 'cluster': cluster_name, + 'name': name, 'target': target, }, 'spec': { @@ -221,6 +226,13 @@ def _master_config(hostname, host_data, masters, network, keys): hosts=kube_domains + [hostname, host_data['ip']], target=hostname, )) + docs.extend(keys.generate_certificate( + alias='etcd-apiserver-client', + name='etcd:client:apiserver:%s' % hostname, + ca_name='etcd-client', + hosts=[hostname, host_data['ip']], + target=hostname, + )) docs.extend(keys.generate_certificate( alias='etcd-peer', name='etcd:peer:%s' % hostname, @@ -271,13 +283,14 @@ def _genesis_config(hostname, host_data, masters, network, keys): for i in range(2): docs.extend(keys.generate_certificate( - name='auxiliary-etcd-client-%d' % i, + name='auxiliary-etcd-%d-client' % i, ca_name='etcd-client', hosts=[hostname, host_data['ip']], target=hostname, )) + docs.extend(keys.generate_certificate( - name='auxiliary-etcd-client-%d' % i, + name='auxiliary-etcd-%d-peer' % i, ca_name='etcd-peer', hosts=[hostname, host_data['ip']], target=hostname, @@ -299,6 +312,7 @@ def _construct_node_config(cluster_name, hostname, data): 'kind': 'Node', 'metadata': { 'cluster': cluster_name, + 'name': hostname, 'target': hostname, }, 'spec': spec, diff --git a/promenade/templates/common/etc/kubernetes/kubelet/manifests/kube-proxy.yaml b/promenade/templates/common/etc/kubernetes/kubelet/manifests/kube-proxy.yaml index 6617b9ab..17053925 100644 --- a/promenade/templates/common/etc/kubernetes/kubelet/manifests/kube-proxy.yaml +++ b/promenade/templates/common/etc/kubernetes/kubelet/manifests/kube-proxy.yaml @@ -18,7 +18,7 @@ spec: - proxy - --cluster-cidr={{ config['Network']['pod_ip_cidr'] }} - --hostname-override=$(NODE_NAME) - - --kubeconfig=/etc/kubernetes/config/kubeconfig.yaml + - --kubeconfig=/etc/kubernetes/proxy/kubeconfig.yaml - --proxy-mode=iptables - --v=5 env: @@ -30,7 +30,7 @@ spec: privileged: true volumeMounts: - name: config - mountPath: /etc/kubernetes + mountPath: /etc/kubernetes/proxy readOnly: true hostNetwork: true volumes: diff --git a/promenade/templates/common/etc/kubernetes/kubelet/pki/cluster-ca.pem b/promenade/templates/common/etc/kubernetes/kubelet/pki/cluster-ca.pem new file mode 100644 index 00000000..51adb572 --- /dev/null +++ b/promenade/templates/common/etc/kubernetes/kubelet/pki/cluster-ca.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateAuthority', name='cluster')['data'] }} diff --git a/promenade/templates/common/etc/kubernetes/kubelet/pki/kubelet-key.pem b/promenade/templates/common/etc/kubernetes/kubelet/pki/kubelet-key.pem new file mode 100644 index 00000000..4292cfb7 --- /dev/null +++ b/promenade/templates/common/etc/kubernetes/kubelet/pki/kubelet-key.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateKey', name='kubelet')['data'] }} diff --git a/promenade/templates/common/etc/kubernetes/kubelet/pki/kubelet.pem b/promenade/templates/common/etc/kubernetes/kubelet/pki/kubelet.pem new file mode 100644 index 00000000..2cf83517 --- /dev/null +++ b/promenade/templates/common/etc/kubernetes/kubelet/pki/kubelet.pem @@ -0,0 +1 @@ +{{ config.get(kind='Certificate', name='kubelet')['data'] }} diff --git a/promenade/templates/common/etc/kubernetes/proxy/config/kubeconfig.yaml b/promenade/templates/common/etc/kubernetes/proxy/kubeconfig.yaml similarity index 59% rename from promenade/templates/common/etc/kubernetes/proxy/config/kubeconfig.yaml rename to promenade/templates/common/etc/kubernetes/proxy/kubeconfig.yaml index 3889f1c9..c38da35d 100644 --- a/promenade/templates/common/etc/kubernetes/proxy/config/kubeconfig.yaml +++ b/promenade/templates/common/etc/kubernetes/proxy/kubeconfig.yaml @@ -3,7 +3,7 @@ apiVersion: v1 clusters: - cluster: server: https://kubernetes - certificate-authority: /etc/kubernetes/pki/cluster-ca.pem + certificate-authority: /etc/kubernetes/proxy/pki/cluster-ca.pem name: kubernetes contexts: - context: @@ -16,5 +16,5 @@ preferences: {} users: - name: proxy user: - client-certificate: /etc/kubernetes/pki/proxy.pem - client-key: /etc/kubernetes/pki/proxy-key.pem + client-certificate: /etc/kubernetes/proxy/pki/proxy.pem + client-key: /etc/kubernetes/proxy/pki/proxy-key.pem diff --git a/promenade/templates/common/etc/kubernetes/proxy/pki/cluster-ca.pem b/promenade/templates/common/etc/kubernetes/proxy/pki/cluster-ca.pem new file mode 100644 index 00000000..51adb572 --- /dev/null +++ b/promenade/templates/common/etc/kubernetes/proxy/pki/cluster-ca.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateAuthority', name='cluster')['data'] }} diff --git a/promenade/templates/common/etc/kubernetes/proxy/pki/proxy-key.pem b/promenade/templates/common/etc/kubernetes/proxy/pki/proxy-key.pem new file mode 100644 index 00000000..2e388910 --- /dev/null +++ b/promenade/templates/common/etc/kubernetes/proxy/pki/proxy-key.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateKey', name='proxy')['data'] }} diff --git a/promenade/templates/common/etc/kubernetes/proxy/pki/proxy.pem b/promenade/templates/common/etc/kubernetes/proxy/pki/proxy.pem new file mode 100644 index 00000000..7841403a --- /dev/null +++ b/promenade/templates/common/etc/kubernetes/proxy/pki/proxy.pem @@ -0,0 +1 @@ +{{ config.get(kind='Certificate', name='proxy')['data'] }} diff --git a/promenade/templates/genesis/etc/kubernetes/asset-loader/kubeconfig.yaml b/promenade/templates/genesis/etc/kubernetes/asset-loader/kubeconfig.yaml index 56a747a1..4509a40d 100644 --- a/promenade/templates/genesis/etc/kubernetes/asset-loader/kubeconfig.yaml +++ b/promenade/templates/genesis/etc/kubernetes/asset-loader/kubeconfig.yaml @@ -3,7 +3,7 @@ apiVersion: v1 clusters: - cluster: server: https://kubernetes - certificate-authority: /etc/kubernetes/pki/cluster-ca.pem + certificate-authority: /etc/kubernetes/asset-loader/pki/cluster-ca.pem name: kubernetes contexts: - context: @@ -16,5 +16,5 @@ preferences: {} users: - name: asset-loader user: - client-certificate: /etc/kubernetes/pki/asset-loader.pem - client-key: /etc/kubernetes/pki/asset-loader-key.pem + client-certificate: /etc/kubernetes/asset-loader/pki/asset-loader.pem + client-key: /etc/kubernetes/asset-loader/pki/asset-loader-key.pem diff --git a/promenade/templates/genesis/etc/kubernetes/asset-loader/pki/asset-loader-key.pem b/promenade/templates/genesis/etc/kubernetes/asset-loader/pki/asset-loader-key.pem new file mode 100644 index 00000000..a9dfb2dd --- /dev/null +++ b/promenade/templates/genesis/etc/kubernetes/asset-loader/pki/asset-loader-key.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateKey', name='admin')['data'] }} diff --git a/promenade/templates/genesis/etc/kubernetes/asset-loader/pki/asset-loader.pem b/promenade/templates/genesis/etc/kubernetes/asset-loader/pki/asset-loader.pem new file mode 100644 index 00000000..3cfb3dc9 --- /dev/null +++ b/promenade/templates/genesis/etc/kubernetes/asset-loader/pki/asset-loader.pem @@ -0,0 +1 @@ +{{ config.get(kind='Certificate', name='admin')['data'] }} diff --git a/promenade/templates/genesis/etc/kubernetes/asset-loader/pki/cluster-ca.pem b/promenade/templates/genesis/etc/kubernetes/asset-loader/pki/cluster-ca.pem new file mode 100644 index 00000000..51adb572 --- /dev/null +++ b/promenade/templates/genesis/etc/kubernetes/asset-loader/pki/cluster-ca.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateAuthority', name='cluster')['data'] }} diff --git a/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/client-ca.pem b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/client-ca.pem new file mode 100644 index 00000000..6f6fbed3 --- /dev/null +++ b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/client-ca.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateAuthority', name='etcd-client')['data'] }} diff --git a/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/etcd-client-key.pem b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/etcd-client-key.pem new file mode 100644 index 00000000..9073d56b --- /dev/null +++ b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/etcd-client-key.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateKey', name='auxiliary-etcd-0-client')['data'] }} diff --git a/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/etcd-client.pem b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/etcd-client.pem new file mode 100644 index 00000000..ebd8c5e7 --- /dev/null +++ b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/etcd-client.pem @@ -0,0 +1 @@ +{{ config.get(kind='Certificate', name='auxiliary-etcd-0-client')['data'] }} diff --git a/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/etcd-peer-key.pem b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/etcd-peer-key.pem new file mode 100644 index 00000000..b5ce1958 --- /dev/null +++ b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/etcd-peer-key.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateKey', name='auxiliary-etcd-0-peer')['data'] }} diff --git a/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/etcd-peer.pem b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/etcd-peer.pem new file mode 100644 index 00000000..92076936 --- /dev/null +++ b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/etcd-peer.pem @@ -0,0 +1 @@ +{{ config.get(kind='Certificate', name='auxiliary-etcd-0-peer')['data'] }} diff --git a/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/peer-ca.pem b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/peer-ca.pem new file mode 100644 index 00000000..04003625 --- /dev/null +++ b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-0/pki/peer-ca.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateAuthority', name='etcd-peer')['data'] }} diff --git a/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/client-ca.pem b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/client-ca.pem new file mode 100644 index 00000000..6f6fbed3 --- /dev/null +++ b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/client-ca.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateAuthority', name='etcd-client')['data'] }} diff --git a/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/etcd-client-key.pem b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/etcd-client-key.pem new file mode 100644 index 00000000..65821b61 --- /dev/null +++ b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/etcd-client-key.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateKey', name='auxiliary-etcd-1-client')['data'] }} diff --git a/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/etcd-client.pem b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/etcd-client.pem new file mode 100644 index 00000000..602dcd29 --- /dev/null +++ b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/etcd-client.pem @@ -0,0 +1 @@ +{{ config.get(kind='Certificate', name='auxiliary-etcd-1-client')['data'] }} diff --git a/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/etcd-peer-key.pem b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/etcd-peer-key.pem new file mode 100644 index 00000000..3ebf84f7 --- /dev/null +++ b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/etcd-peer-key.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateKey', name='auxiliary-etcd-1-peer')['data'] }} diff --git a/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/etcd-peer.pem b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/etcd-peer.pem new file mode 100644 index 00000000..66b11820 --- /dev/null +++ b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/etcd-peer.pem @@ -0,0 +1 @@ +{{ config.get(kind='Certificate', name='auxiliary-etcd-1-peer')['data'] }} diff --git a/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/peer-ca.pem b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/peer-ca.pem new file mode 100644 index 00000000..04003625 --- /dev/null +++ b/promenade/templates/genesis/etc/kubernetes/auxiliary-etcd-1/pki/peer-ca.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateAuthority', name='etcd-peer')['data'] }} diff --git a/promenade/templates/genesis/etc/kubernetes/genesis/kubeconfig.yaml b/promenade/templates/genesis/etc/kubernetes/genesis/kubeconfig.yaml index 6595050e..9df887fb 100644 --- a/promenade/templates/genesis/etc/kubernetes/genesis/kubeconfig.yaml +++ b/promenade/templates/genesis/etc/kubernetes/genesis/kubeconfig.yaml @@ -3,7 +3,7 @@ apiVersion: v1 clusters: - cluster: server: https://127.0.0.1 - certificate-authority: /target/etc/kubernetes/genesis/pki/cluster-ca.pem + certificate-authority: /target/etc/kubernetes/admin/pki/cluster-ca.pem name: kubernetes contexts: - context: @@ -16,5 +16,5 @@ preferences: {} users: - name: genesis user: - client-certificate: /target/etc/kubernetes/genesis/pki/genesis.pem - client-key: /target/etc/kubernetes/genesis/pki/genesis-key.pem + client-certificate: /target/etc/kubernetes/admin/pki/admin.pem + client-key: /target/etc/kubernetes/admin/pki/admin-key.pem diff --git a/promenade/templates/genesis/etc/kubernetes/kubelet/manifests/asset-loader.yaml b/promenade/templates/genesis/etc/kubernetes/kubelet/manifests/asset-loader.yaml index db7fb163..a5232ac8 100644 --- a/promenade/templates/genesis/etc/kubernetes/kubelet/manifests/asset-loader.yaml +++ b/promenade/templates/genesis/etc/kubernetes/kubelet/manifests/asset-loader.yaml @@ -21,12 +21,12 @@ spec: while true; do sleep 60 /kubectl \ - --kubeconfig /etc/kubernetes/kubeconfig.yaml \ - apply -f /etc/kubernetes/assets + --kubeconfig /etc/kubernetes/asset-loader/kubeconfig.yaml \ + apply -f /etc/kubernetes/asset-loader/assets done volumeMounts: - name: config - mountPath: /etc/kubernetes + mountPath: /etc/kubernetes/asset-loader readOnly: true volumes: - name: config diff --git a/promenade/templates/genesis/etc/kubernetes/kubelet/manifests/auxiliary-etcd.yaml b/promenade/templates/genesis/etc/kubernetes/kubelet/manifests/auxiliary-etcd.yaml index ce19a87a..7a8ed07a 100644 --- a/promenade/templates/genesis/etc/kubernetes/kubelet/manifests/auxiliary-etcd.yaml +++ b/promenade/templates/genesis/etc/kubernetes/kubelet/manifests/auxiliary-etcd.yaml @@ -22,21 +22,21 @@ spec: - name: ETCD_DATA_DIR value: /var/lib/auxiliary-etcd-0 - name: ETCD_TRUSTED_CA_FILE - value: /etc/etcd-pki/cluster-ca.pem + value: /etc/kubernetes/auxiliary-etcd-0/pki/client-ca.pem - name: ETCD_CERT_FILE - value: /etc/etcd-pki/etcd.pem + value: /etc/kubernetes/auxiliary-etcd-0/pki/etcd-client.pem - name: ETCD_KEY_FILE - value: /etc/etcd-pki/etcd-key.pem + value: /etc/kubernetes/auxiliary-etcd-0/pki/etcd-client-key.pem - name: ETCD_PEER_TRUSTED_CA_FILE - value: /etc/etcd-pki/cluster-ca.pem + value: /etc/kubernetes/auxiliary-etcd-0/pki/peer-ca.pem - name: ETCD_PEER_CERT_FILE - value: /etc/etcd-pki/etcd.pem + value: /etc/kubernetes/auxiliary-etcd-0/pki/etcd-peer.pem - name: ETCD_PEER_KEY_FILE - value: /etc/etcd-pki/etcd-key.pem + value: /etc/kubernetes/auxiliary-etcd-0/pki/etcd-peer-key.pem - name: ETCD_ADVERTISE_CLIENT_URLS - value: https://$(ETCD_NAME):12379 + value: https://{{ config['Node']['hostname'] }}:12379 - name: ETCD_INITIAL_ADVERTISE_PEER_URLS - value: https://$(ETCD_NAME):12380 + value: https://{{ config['Node']['hostname'] }}:12380 - name: ETCD_INITIAL_CLUSTER_TOKEN value: promenade-kube-etcd-token - name: ETCD_LISTEN_CLIENT_URLS @@ -60,8 +60,8 @@ spec: volumeMounts: - name: data-0 mountPath: /var/lib/auxiliary-etcd-0 - - name: pki - mountPath: /etc/etcd-pki + - name: pki-0 + mountPath: /etc/kubernetes/auxiliary-etcd-0/pki readOnly: true - name: auxiliary-etcd-1 image: quay.io/coreos/etcd:v3.0.17 @@ -75,21 +75,21 @@ spec: - name: ETCD_DATA_DIR value: /var/lib/auxiliary-etcd-1 - name: ETCD_TRUSTED_CA_FILE - value: /etc/etcd-pki/cluster-ca.pem + value: /etc/kubernetes/auxiliary-etcd-1/pki/client-ca.pem - name: ETCD_CERT_FILE - value: /etc/etcd-pki/etcd.pem + value: /etc/kubernetes/auxiliary-etcd-1/pki/etcd-client.pem - name: ETCD_KEY_FILE - value: /etc/etcd-pki/etcd-key.pem + value: /etc/kubernetes/auxiliary-etcd-1/pki/etcd-client-key.pem - name: ETCD_PEER_TRUSTED_CA_FILE - value: /etc/etcd-pki/cluster-ca.pem + value: /etc/kubernetes/auxiliary-etcd-1/pki/peer-ca.pem - name: ETCD_PEER_CERT_FILE - value: /etc/etcd-pki/etcd.pem + value: /etc/kubernetes/auxiliary-etcd-1/pki/etcd-peer.pem - name: ETCD_PEER_KEY_FILE - value: /etc/etcd-pki/etcd-key.pem + value: /etc/kubernetes/auxiliary-etcd-1/pki/etcd-peer-key.pem - name: ETCD_ADVERTISE_CLIENT_URLS - value: https://$(ETCD_NAME):22379 + value: https://{{ config['Node']['hostname'] }}:22379 - name: ETCD_INITIAL_ADVERTISE_PEER_URLS - value: https://$(ETCD_NAME):22380 + value: https://{{ config['Node']['hostname'] }}:22380 - name: ETCD_INITIAL_CLUSTER_TOKEN value: promenade-kube-etcd-token - name: ETCD_LISTEN_CLIENT_URLS @@ -113,8 +113,8 @@ spec: volumeMounts: - name: data-1 mountPath: /var/lib/auxiliary-etcd-1 - - name: pki - mountPath: /etc/etcd-pki + - name: pki-1 + mountPath: /etc/kubernetes/auxiliary-etcd-1/pki readOnly: true - name: cluster-monitor image: quay.io/coreos/etcd:v3.0.17 @@ -137,7 +137,12 @@ spec: etcdctl member remove $(etcdctl member list | grep auxiliary-etcd-1 | cut -d , -f 1) etcdctl member remove $(etcdctl member list | grep auxiliary-etcd-0 | cut -d , -f 1) sleep 60 - rm -rf /var/lib/auxiliary-etcd-0 /var/lib/auxiliary-etcd-1 /etc/kubernetes/kubelet/manifests/auxiliary-etcd.yaml + rm -rf \ + /var/lib/auxiliary-etcd-0 \ + /var/lib/auxiliary-etcd-1 \ + /etc/kubernetes/auxiliary-etcd-0 \ + /etc/kubernetes/auxiliary-etcd-1 \ + /etc/kubernetes/kubelet/manifests/auxiliary-etcd.yaml sleep 10000 fi done @@ -150,16 +155,16 @@ spec: - name: ETCDCTL_API value: "3" - name: ETCDCTL_CACERT - value: /etc/etcd-pki/cluster-ca.pem + value: /etc/kubernetes/etcd/pki/client-ca.pem - name: ETCDCTL_CERT - value: /etc/etcd-pki/etcd.pem + value: /etc/kubernetes/etcd/pki/etcd-client.pem - name: ETCDCTL_ENDPOINTS - value: https://127.0.0.1:12379 + value: https://{{ config['Node']['ip'] }}:2379 - name: ETCDCTL_KEY - value: /etc/etcd-pki/etcd-key.pem + value: /etc/kubernetes/etcd/pki/etcd-client-key.pem volumeMounts: - name: pki - mountPath: /etc/etcd-pki + mountPath: /etc/kubernetes/etcd/pki readOnly: true - name: manifests mountPath: /etc/kubernetes/kubelet/manifests @@ -175,6 +180,12 @@ spec: - name: pki hostPath: path: /etc/kubernetes/etcd/pki + - name: pki-0 + hostPath: + path: /etc/kubernetes/auxiliary-etcd-0/pki + - name: pki-1 + hostPath: + path: /etc/kubernetes/auxiliary-etcd-1/pki - name: manifests hostPath: path: /etc/kubernetes/kubelet/manifests diff --git a/promenade/templates/master/etc/kubernetes/admin/pki/admin-key.pem b/promenade/templates/master/etc/kubernetes/admin/pki/admin-key.pem new file mode 100644 index 00000000..a9dfb2dd --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/admin/pki/admin-key.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateKey', name='admin')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/admin/pki/admin.pem b/promenade/templates/master/etc/kubernetes/admin/pki/admin.pem new file mode 100644 index 00000000..3cfb3dc9 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/admin/pki/admin.pem @@ -0,0 +1 @@ +{{ config.get(kind='Certificate', name='admin')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/admin/pki/cluster-ca.pem b/promenade/templates/master/etc/kubernetes/admin/pki/cluster-ca.pem new file mode 100644 index 00000000..51adb572 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/admin/pki/cluster-ca.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateAuthority', name='cluster')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/apiserver/pki/apiserver-key.pem b/promenade/templates/master/etc/kubernetes/apiserver/pki/apiserver-key.pem new file mode 100644 index 00000000..6b161631 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/apiserver/pki/apiserver-key.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateKey', name='apiserver')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/apiserver/pki/apiserver.pem b/promenade/templates/master/etc/kubernetes/apiserver/pki/apiserver.pem new file mode 100644 index 00000000..ef52b8c3 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/apiserver/pki/apiserver.pem @@ -0,0 +1 @@ +{{ config.get(kind='Certificate', name='apiserver')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/apiserver/pki/cluster-ca.pem b/promenade/templates/master/etc/kubernetes/apiserver/pki/cluster-ca.pem new file mode 100644 index 00000000..51adb572 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/apiserver/pki/cluster-ca.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateAuthority', name='cluster')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/apiserver/pki/etcd-client-ca.pem b/promenade/templates/master/etc/kubernetes/apiserver/pki/etcd-client-ca.pem new file mode 100644 index 00000000..6f6fbed3 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/apiserver/pki/etcd-client-ca.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateAuthority', name='etcd-client')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/apiserver/pki/etcd-client-key.pem b/promenade/templates/master/etc/kubernetes/apiserver/pki/etcd-client-key.pem new file mode 100644 index 00000000..71669eac --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/apiserver/pki/etcd-client-key.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateKey', name='etcd-apiserver-client')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/apiserver/pki/etcd-client.pem b/promenade/templates/master/etc/kubernetes/apiserver/pki/etcd-client.pem new file mode 100644 index 00000000..eb432bfd --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/apiserver/pki/etcd-client.pem @@ -0,0 +1 @@ +{{ config.get(kind='Certificate', name='etcd-apiserver-client')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/apiserver/pki/service-account.pub b/promenade/templates/master/etc/kubernetes/apiserver/pki/service-account.pub new file mode 100644 index 00000000..30866284 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/apiserver/pki/service-account.pub @@ -0,0 +1 @@ +{{ config.get(kind='PublicKey', name='service-account')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/controller-manager/kubeconfig.yaml b/promenade/templates/master/etc/kubernetes/controller-manager/kubeconfig.yaml index 17275f1f..ee6b4e02 100644 --- a/promenade/templates/master/etc/kubernetes/controller-manager/kubeconfig.yaml +++ b/promenade/templates/master/etc/kubernetes/controller-manager/kubeconfig.yaml @@ -3,7 +3,7 @@ apiVersion: v1 clusters: - cluster: server: https://kubernetes - certificate-authority: /etc/kubernetes/pki/cluster-ca.pem + certificate-authority: /etc/kubernetes/controller-manager/pki/cluster-ca.pem name: kubernetes contexts: - context: @@ -16,5 +16,5 @@ preferences: {} users: - name: controller-manager user: - client-certificate: /etc/kubernetes/pki/controller-manager.pem - client-key: /etc/kubernetes/pki/controller-manager-key.pem + client-certificate: /etc/kubernetes/controller-manager/pki/controller-manager.pem + client-key: /etc/kubernetes/controller-manager/pki/controller-manager-key.pem diff --git a/promenade/templates/master/etc/kubernetes/controller-manager/pki/cluster-ca-key.pem b/promenade/templates/master/etc/kubernetes/controller-manager/pki/cluster-ca-key.pem new file mode 100644 index 00000000..58a75ff2 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/controller-manager/pki/cluster-ca-key.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateAuthorityKey', name='cluster')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/controller-manager/pki/cluster-ca.pem b/promenade/templates/master/etc/kubernetes/controller-manager/pki/cluster-ca.pem new file mode 100644 index 00000000..51adb572 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/controller-manager/pki/cluster-ca.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateAuthority', name='cluster')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/controller-manager/pki/controller-manager-key.pem b/promenade/templates/master/etc/kubernetes/controller-manager/pki/controller-manager-key.pem new file mode 100644 index 00000000..994f3871 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/controller-manager/pki/controller-manager-key.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateKey', name='controller-manager')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/controller-manager/pki/controller-manager.pem b/promenade/templates/master/etc/kubernetes/controller-manager/pki/controller-manager.pem new file mode 100644 index 00000000..c4a560c5 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/controller-manager/pki/controller-manager.pem @@ -0,0 +1 @@ +{{ config.get(kind='Certificate', name='controller-manager')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/controller-manager/pki/service-account.key b/promenade/templates/master/etc/kubernetes/controller-manager/pki/service-account.key new file mode 100644 index 00000000..cc5068aa --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/controller-manager/pki/service-account.key @@ -0,0 +1 @@ +{{ config.get(kind='PrivateKey', name='service-account')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/etcd/pki/client-ca.pem b/promenade/templates/master/etc/kubernetes/etcd/pki/client-ca.pem new file mode 100644 index 00000000..6f6fbed3 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/etcd/pki/client-ca.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateAuthority', name='etcd-client')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/etcd/pki/etcd-client-key.pem b/promenade/templates/master/etc/kubernetes/etcd/pki/etcd-client-key.pem new file mode 100644 index 00000000..9dc5c126 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/etcd/pki/etcd-client-key.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateKey', name='etcd-client')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/etcd/pki/etcd-client.pem b/promenade/templates/master/etc/kubernetes/etcd/pki/etcd-client.pem new file mode 100644 index 00000000..82f9534d --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/etcd/pki/etcd-client.pem @@ -0,0 +1 @@ +{{ config.get(kind='Certificate', name='etcd-client')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/etcd/pki/etcd-peer-key.pem b/promenade/templates/master/etc/kubernetes/etcd/pki/etcd-peer-key.pem new file mode 100644 index 00000000..38e507e7 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/etcd/pki/etcd-peer-key.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateKey', name='etcd-peer')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/etcd/pki/etcd-peer.pem b/promenade/templates/master/etc/kubernetes/etcd/pki/etcd-peer.pem new file mode 100644 index 00000000..12e325b6 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/etcd/pki/etcd-peer.pem @@ -0,0 +1 @@ +{{ config.get(kind='Certificate', name='etcd-peer')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/etcd/pki/peer-ca.pem b/promenade/templates/master/etc/kubernetes/etcd/pki/peer-ca.pem new file mode 100644 index 00000000..04003625 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/etcd/pki/peer-ca.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateAuthority', name='etcd-peer')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/kubelet/manifests/kube-apiserver.yaml b/promenade/templates/master/etc/kubernetes/kubelet/manifests/kube-apiserver.yaml index 35ea29fb..a7049e33 100644 --- a/promenade/templates/master/etc/kubernetes/kubelet/manifests/kube-apiserver.yaml +++ b/promenade/templates/master/etc/kubernetes/kubelet/manifests/kube-apiserver.yaml @@ -27,12 +27,12 @@ spec: - --secure-port=443 - --allow-privileged=true - --etcd-servers=https://kubernetes:2379 - - --etcd-cafile=/etc/kubernetes/pki/cluster-ca.pem - - --etcd-certfile=/etc/kubernetes/pki/apiserver.pem - - --etcd-keyfile=/etc/kubernetes/pki/apiserver-key.pem + - --etcd-cafile=/etc/kubernetes/pki/etcd-client-ca.pem + - --etcd-certfile=/etc/kubernetes/pki/etcd-client.pem + - --etcd-keyfile=/etc/kubernetes/pki/etcd-client-key.pem - --service-cluster-ip-range={{ config['Network']['service_ip_cidr'] }} - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname - - --service-account-key-file=/etc/kubernetes/pki/sa.pem + - --service-account-key-file=/etc/kubernetes/pki/service-account.pub - --tls-cert-file=/etc/kubernetes/pki/apiserver.pem - --tls-private-key-file=/etc/kubernetes/pki/apiserver-key.pem - --v=5 diff --git a/promenade/templates/master/etc/kubernetes/kubelet/manifests/kube-controller-manager.yaml b/promenade/templates/master/etc/kubernetes/kubelet/manifests/kube-controller-manager.yaml index 3ab1c816..5d678bf1 100644 --- a/promenade/templates/master/etc/kubernetes/kubelet/manifests/kube-controller-manager.yaml +++ b/promenade/templates/master/etc/kubernetes/kubelet/manifests/kube-controller-manager.yaml @@ -20,19 +20,19 @@ spec: - controller-manager - --allocate-node-cidrs=true - --cluster-cidr={{ config['Network']['pod_ip_cidr'] }} - - --cluster-signing-cert-file=/etc/kubernetes/pki/cluster-ca.pem - - --cluster-signing-key-file=/etc/kubernetes/pki/cluster-ca-key.pem + - --cluster-signing-cert-file=/etc/kubernetes/controller-manager/pki/cluster-ca.pem + - --cluster-signing-key-file=/etc/kubernetes/controller-manager/pki/cluster-ca-key.pem - --configure-cloud-routes=false - --leader-elect=true - - --kubeconfig=/etc/kubernetes/kubeconfig.yaml - - --root-ca-file=/etc/kubernetes/pki/cluster-ca.pem - - --service-account-private-key-file=/etc/kubernetes/pki/sa-key.pem + - --kubeconfig=/etc/kubernetes/controller-manager/kubeconfig.yaml + - --root-ca-file=/etc/kubernetes/controller-manager/pki/cluster-ca.pem + - --service-account-private-key-file=/etc/kubernetes/controller-manager/pki/service-account.key - --service-cluster-ip-range={{ config['Network']['service_ip_cidr'] }} - --use-service-account-credentials=true - --v=5 volumeMounts: - name: config - mountPath: /etc/kubernetes + mountPath: /etc/kubernetes/controller-manager readOnly: true volumes: - name: config diff --git a/promenade/templates/master/etc/kubernetes/kubelet/manifests/kube-etcd.yaml b/promenade/templates/master/etc/kubernetes/kubelet/manifests/kube-etcd.yaml index 7cdd9ac9..6f862c62 100644 --- a/promenade/templates/master/etc/kubernetes/kubelet/manifests/kube-etcd.yaml +++ b/promenade/templates/master/etc/kubernetes/kubelet/manifests/kube-etcd.yaml @@ -24,17 +24,17 @@ spec: - name: ETCD_DATA_DIR value: /var/lib/kube-etcd - name: ETCD_TRUSTED_CA_FILE - value: /etc/etcd-pki/cluster-ca.pem + value: /etc/kubernetes/etcd/pki/client-ca.pem - name: ETCD_CERT_FILE - value: /etc/etcd-pki/etcd.pem + value: /etc/kubernetes/etcd/pki/etcd-client.pem - name: ETCD_KEY_FILE - value: /etc/etcd-pki/etcd-key.pem + value: /etc/kubernetes/etcd/pki/etcd-client-key.pem - name: ETCD_PEER_TRUSTED_CA_FILE - value: /etc/etcd-pki/cluster-ca.pem + value: /etc/kubernetes/etcd/pki/peer-ca.pem - name: ETCD_PEER_CERT_FILE - value: /etc/etcd-pki/etcd.pem + value: /etc/kubernetes/etcd/pki/etcd-peer.pem - name: ETCD_PEER_KEY_FILE - value: /etc/etcd-pki/etcd-key.pem + value: /etc/kubernetes/etcd/pki/etcd-peer-key.pem - name: ETCD_ADVERTISE_CLIENT_URLS value: https://$(ETCD_NAME):2379 - name: ETCD_INITIAL_ADVERTISE_PEER_URLS @@ -58,7 +58,7 @@ spec: - name: data mountPath: /var/lib/kube-etcd - name: pki - mountPath: /etc/etcd-pki + mountPath: /etc/kubernetes/etcd/pki volumes: - name: data hostPath: diff --git a/promenade/templates/master/etc/kubernetes/kubelet/manifests/kube-scheduler.yaml b/promenade/templates/master/etc/kubernetes/kubelet/manifests/kube-scheduler.yaml index 5160514d..9c451996 100644 --- a/promenade/templates/master/etc/kubernetes/kubelet/manifests/kube-scheduler.yaml +++ b/promenade/templates/master/etc/kubernetes/kubelet/manifests/kube-scheduler.yaml @@ -18,11 +18,11 @@ spec: - ./hyperkube - scheduler - --leader-elect=true - - --kubeconfig=/etc/kubernetes/kubeconfig.yaml + - --kubeconfig=/etc/kubernetes/scheduler/kubeconfig.yaml - --v=5 volumeMounts: - name: config - mountPath: /etc/kubernetes + mountPath: /etc/kubernetes/scheduler volumes: - name: config hostPath: diff --git a/promenade/templates/master/etc/kubernetes/scheduler/kubeconfig.yaml b/promenade/templates/master/etc/kubernetes/scheduler/kubeconfig.yaml index 59577f72..4f215d0d 100644 --- a/promenade/templates/master/etc/kubernetes/scheduler/kubeconfig.yaml +++ b/promenade/templates/master/etc/kubernetes/scheduler/kubeconfig.yaml @@ -3,7 +3,7 @@ apiVersion: v1 clusters: - cluster: server: https://kubernetes - certificate-authority: /etc/kubernetes/pki/cluster-ca.pem + certificate-authority: /etc/kubernetes/scheduler/pki/cluster-ca.pem name: kubernetes contexts: - context: @@ -16,5 +16,5 @@ preferences: {} users: - name: scheduler user: - client-certificate: /etc/kubernetes/pki/scheduler.pem - client-key: /etc/kubernetes/pki/scheduler-key.pem + client-certificate: /etc/kubernetes/scheduler/pki/scheduler.pem + client-key: /etc/kubernetes/scheduler/pki/scheduler-key.pem diff --git a/promenade/templates/master/etc/kubernetes/scheduler/pki/cluster-ca.pem b/promenade/templates/master/etc/kubernetes/scheduler/pki/cluster-ca.pem new file mode 100644 index 00000000..51adb572 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/scheduler/pki/cluster-ca.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateAuthority', name='cluster')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/scheduler/pki/scheduler-key.pem b/promenade/templates/master/etc/kubernetes/scheduler/pki/scheduler-key.pem new file mode 100644 index 00000000..2aa13e4d --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/scheduler/pki/scheduler-key.pem @@ -0,0 +1 @@ +{{ config.get(kind='CertificateKey', name='scheduler')['data'] }} diff --git a/promenade/templates/master/etc/kubernetes/scheduler/pki/scheduler.pem b/promenade/templates/master/etc/kubernetes/scheduler/pki/scheduler.pem new file mode 100644 index 00000000..d5f8d631 --- /dev/null +++ b/promenade/templates/master/etc/kubernetes/scheduler/pki/scheduler.pem @@ -0,0 +1 @@ +{{ config.get(kind='Certificate', name='scheduler')['data'] }}