treasuremap/global/profiles/kubernetes-host.yaml

---
schema: promenade/HostSystem/v1
metadata:
  schema: metadata/Document/v1
  name: host-system
  layeringDefinition:
    abstract: false
    layer: global
  storagePolicy: cleartext
  substitutions:
    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
        path: .images.kubernetes.hyperkube
      dest:
        path: .files[0].docker_image

    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
        path: .files.kubernetes
      dest:
        - path: .files[1].tar_url
        - path: .files[2].tar_url

    # Initial CoreDNS image (used during node Genesis and node join)
    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
        path: .images.kubernetes.coredns.coredns
      dest:
        path: .images.coredns

    # Initial CoreDNS image (used during node Genesis and node join)
    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
        path: .images.kubernetes.haproxy.haproxy
      dest:
        path: .images.haproxy

    # Operational tools
    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
        path: .images.ucp.armada.helm
      dest:
        path: .images.helm.helm

    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
        path: .images.kubernetes.hyperkube
      dest:
        path: .images.kubernetes.hyperkube

    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
        path: .images.ucp.promenade.monitoring_image
      dest:
        path: .images.monitoring_image

    # System packages
    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
        path: .packages.named.docker
      dest:
        path: .packages.common.required.docker
    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
        path: .packages.named.socat
      dest:
        path: .packages.common.required.socat
    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
        path: .packages.named.socat
      dest:
        path: .packages.genesis.required.socat
    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
        path: .packages.named.socat
      dest:
        path: .packages.join.required.socat
    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
        path: .packages.unnamed
      dest:
        path: .packages.common.additional

    # Docker authorization
    - src:
        schema: deckhand/Passphrase/v1
        path: .
        name: private_docker_key
      dest:
        path: .files[4].content
        pattern: DH_SUB_PRIVATE_DOCKER_KEY

    # Genesis validation image
    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
        path: .images.kubernetes.validation
      dest:
        path: .validation

data:
  files:
    - path: /opt/kubernetes/bin/hyperkube
      file_path: /hyperkube
      mode: 0555
    - path: /opt/kubernetes/bin/kubelet
      tar_path: kubernetes/node/bin/kubelet
      mode: 0555
    - path: /usr/local/bin/kubectl
      tar_path: kubernetes/node/bin/kubectl
      mode: 0555
    - path: /etc/logrotate.d/json-logrotate
      mode: 0444
      content: |-
        /var/lib/docker/containers/*/*-json.log
        {
            compress
            copytruncate
            create 0644 root root
            weekly
            dateext
            dateformat -%Y%m%d-%s
            maxsize 100M
            missingok
            notifempty
            su root root
            rotate 1
        }        
    - path: /var/lib/kubelet/.dockercfg
      mode: 0400
      # NOTE: Sample key, this repo does not exist
      content: |-
        {
           "https://private.registry.com": {
             "auth": "DH_SUB_PRIVATE_DOCKER_KEY"
           }
        }        
      # Make sure that promjoin script does not run on every boot,
      # otherwise it may downgrade current versions of Docker & Kubelet.
    - path: /var/lib/prom.done
      mode: 0444
      content: ""
    - path: /etc/profile.d/kubeconfig.sh
      mode: 0744
      content: |-
        export KUBECONFIG=/etc/kubernetes/admin/kubeconfig.yaml        
  packages:
    common:
      repositories:
        - deb https://download.docker.com/linux/ubuntu/ xenial stable
      keys:
        - |-
          -----BEGIN PGP PUBLIC KEY BLOCK-----

          mQINBFit2ioBEADhWpZ8/wvZ6hUTiXOwQHXMAlaFHcPH9hAtr4F1y2+OYdbtMuth
          lqqwp028AqyY+PRfVMtSYMbjuQuu5byyKR01BbqYhuS3jtqQmljZ/bJvXqnmiVXh
          38UuLa+z077PxyxQhu5BbqntTPQMfiyqEiU+BKbq2WmANUKQf+1AmZY/IruOXbnq
          L4C1+gJ8vfmXQt99npCaxEjaNRVYfOS8QcixNzHUYnb6emjlANyEVlZzeqo7XKl7
          UrwV5inawTSzWNvtjEjj4nJL8NsLwscpLPQUhTQ+7BbQXAwAmeHCUTQIvvWXqw0N
          cmhh4HgeQscQHYgOJjjDVfoY5MucvglbIgCqfzAHW9jxmRL4qbMZj+b1XoePEtht
          ku4bIQN1X5P07fNWzlgaRL5Z4POXDDZTlIQ/El58j9kp4bnWRCJW0lya+f8ocodo
          vZZ+Doi+fy4D5ZGrL4XEcIQP/Lv5uFyf+kQtl/94VFYVJOleAv8W92KdgDkhTcTD
          G7c0tIkVEKNUq48b3aQ64NOZQW7fVjfoKwEZdOqPE72Pa45jrZzvUFxSpdiNk2tZ
          XYukHjlxxEgBdC/J3cMMNRE1F4NCA3ApfV1Y7/hTeOnmDuDYwr9/obA8t016Yljj
          q5rdkywPf4JF8mXUW5eCN1vAFHxeg9ZWemhBtQmGxXnw9M+z6hWwc6ahmwARAQAB
          tCtEb2NrZXIgUmVsZWFzZSAoQ0UgZGViKSA8ZG9ja2VyQGRvY2tlci5jb20+iQI3
          BBMBCgAhBQJYrefAAhsvBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEI2BgDwO
          v82IsskP/iQZo68flDQmNvn8X5XTd6RRaUH33kXYXquT6NkHJciS7E2gTJmqvMqd
          tI4mNYHCSEYxI5qrcYV5YqX9P6+Ko+vozo4nseUQLPH/ATQ4qL0Zok+1jkag3Lgk
          jonyUf9bwtWxFp05HC3GMHPhhcUSexCxQLQvnFWXD2sWLKivHp2fT8QbRGeZ+d3m
          6fqcd5Fu7pxsqm0EUDK5NL+nPIgYhN+auTrhgzhK1CShfGccM/wfRlei9Utz6p9P
          XRKIlWnXtT4qNGZNTN0tR+NLG/6Bqd8OYBaFAUcue/w1VW6JQ2VGYZHnZu9S8LMc
          FYBa5Ig9PxwGQOgq6RDKDbV+PqTQT5EFMeR1mrjckk4DQJjbxeMZbiNMG5kGECA8
          g383P3elhn03WGbEEa4MNc3Z4+7c236QI3xWJfNPdUbXRaAwhy/6rTSFbzwKB0Jm
          ebwzQfwjQY6f55MiI/RqDCyuPj3r3jyVRkK86pQKBAJwFHyqj9KaKXMZjfVnowLh
          9svIGfNbGHpucATqREvUHuQbNnqkCx8VVhtYkhDb9fEP2xBu5VvHbR+3nfVhMut5
          G34Ct5RS7Jt6LIfFdtcn8CaSas/l1HbiGeRgc70X/9aYx/V/CEJv0lIe8gP6uDoW
          FPIZ7d6vH+Vro6xuWEGiuMaiznap2KhZmpkgfupyFmplh0s6knymuQINBFit2ioB
          EADneL9S9m4vhU3blaRjVUUyJ7b/qTjcSylvCH5XUE6R2k+ckEZjfAMZPLpO+/tF
          M2JIJMD4SifKuS3xck9KtZGCufGmcwiLQRzeHF7vJUKrLD5RTkNi23ydvWZgPjtx
          Q+DTT1Zcn7BrQFY6FgnRoUVIxwtdw1bMY/89rsFgS5wwuMESd3Q2RYgb7EOFOpnu
          w6da7WakWf4IhnF5nsNYGDVaIHzpiqCl+uTbf1epCjrOlIzkZ3Z3Yk5CM/TiFzPk
          z2lLz89cpD8U+NtCsfagWWfjd2U3jDapgH+7nQnCEWpROtzaKHG6lA3pXdix5zG8
          eRc6/0IbUSWvfjKxLLPfNeCS2pCL3IeEI5nothEEYdQH6szpLog79xB9dVnJyKJb
          VfxXnseoYqVrRz2VVbUI5Blwm6B40E3eGVfUQWiux54DspyVMMk41Mx7QJ3iynIa
          1N4ZAqVMAEruyXTRTxc9XW0tYhDMA/1GYvz0EmFpm8LzTHA6sFVtPm/ZlNCX6P1X
          zJwrv7DSQKD6GGlBQUX+OeEJ8tTkkf8QTJSPUdh8P8YxDFS5EOGAvhhpMBYD42kQ
          pqXjEC+XcycTvGI7impgv9PDY1RCC1zkBjKPa120rNhv/hkVk/YhuGoajoHyy4h7
          ZQopdcMtpN2dgmhEegny9JCSwxfQmQ0zK0g7m6SHiKMwjwARAQABiQQ+BBgBCAAJ
          BQJYrdoqAhsCAikJEI2BgDwOv82IwV0gBBkBCAAGBQJYrdoqAAoJEH6gqcPyc/zY
          1WAP/2wJ+R0gE6qsce3rjaIz58PJmc8goKrir5hnElWhPgbq7cYIsW5qiFyLhkdp
          YcMmhD9mRiPpQn6Ya2w3e3B8zfIVKipbMBnke/ytZ9M7qHmDCcjoiSmwEXN3wKYI
          mD9VHONsl/CG1rU9Isw1jtB5g1YxuBA7M/m36XN6x2u+NtNMDB9P56yc4gfsZVES
          KA9v+yY2/l45L8d/WUkUi0YXomn6hyBGI7JrBLq0CX37GEYP6O9rrKipfz73XfO7
          JIGzOKZlljb/D9RX/g7nRbCn+3EtH7xnk+TK/50euEKw8SMUg147sJTcpQmv6UzZ
          cM4JgL0HbHVCojV4C/plELwMddALOFeYQzTif6sMRPf+3DSj8frbInjChC3yOLy0
          6br92KFom17EIj2CAcoeq7UPhi2oouYBwPxh5ytdehJkoo+sN7RIWua6P2WSmon5
          U888cSylXC0+ADFdgLX9K2zrDVYUG1vo8CX0vzxFBaHwN6Px26fhIT1/hYUHQR1z
          VfNDcyQmXqkOnZvvoMfz/Q0s9BhFJ/zU6AgQbIZE/hm1spsfgvtsD1frZfygXJ9f
          irP+MSAI80xHSf91qSRZOj4Pl3ZJNbq4yYxv0b1pkMqeGdjdCYhLU+LZ4wbQmpCk
          SVe2prlLureigXtmZfkqevRz7FrIZiu9ky8wnCAPwC7/zmS18rgP/17bOtL4/iIz
          QhxAAoAMWVrGyJivSkjhSGx1uCojsWfsTAm11P7jsruIL61ZzMUVE2aM3Pmj5G+W
          9AcZ58Em+1WsVnAXdUR//bMmhyr8wL/G1YO1V3JEJTRdxsSxdYa4deGBBY/Adpsw
          24jxhOJR+lsJpqIUeb999+R8euDhRHG9eFO7DRu6weatUJ6suupoDTRWtr/4yGqe
          dKxV3qQhNLSnaAzqW/1nA3iUB4k7kCaKZxhdhDbClf9P37qaRW467BLCVO/coL3y
          Vm50dwdrNtKpMBh3ZpbB1uJvgi9mXtyBOMJ3v8RZeDzFiG8HdCtg9RvIt/AIFoHR
          H3S+U79NT6i0KPzLImDfs8T7RlpyuMc4Ufs8ggyg9v3Ae6cN3eQyxcK3w0cbBwsh
          /nQNfsA6uu+9H7NhbehBMhYnpNZyrHzCmzyXkauwRAqoCbGCNykTRwsur9gS41TQ
          M8ssD1jFheOJf3hODnkKU+HKjvMROl1DK7zdmLdNzA1cvtZH/nCC9KPj1z8QC47S
          xx+dTZSx4ONAhwbS/LN3PoKtn8LPjY9NP9uDWI+TWYquS2U+KHDrBDlsgozDbs/O
          jCxcpDzNmXpWQHEtHU7649OXHP7UeNST1mCUCH5qdank0V1iejF6/CfTFU4MfcrG
          YT90qFF93M3v01BbxP+EIY2/9tiIPbrd
          =0YYh
          -----END PGP PUBLIC KEY BLOCK-----          
...