#cloud-config
write_files:
  - path: /etc/systemd/system/enable-kube-proxy.service
    owner: "root:root"
    permissions: "0644"
    content: |
      [Unit]
      Description=Configure Kubernetes Proxy

      [Service]
      Type=oneshot
      ExecStart=/etc/sysconfig/enable-kube-proxy-minion.sh

      [Install]
      WantedBy=multi-user.target

  - path: /etc/sysconfig/enable-kube-proxy-minion.sh
    owner: "root:root"
    permissions: "0755"
    content: |
      #!/bin/sh

      . /etc/sysconfig/heat-params
      myip=$(ip addr show eth0 |
             awk '$1 == "inet" {print $2}' | cut -f1 -d/)

      # TODO(hongbin): enable TLS
      HOST_CERTS_PATH=/usr/share/ca-certificates
      KUBE_CERTS_PATH=/etc/kubernetes/ssl
      KUBE_PROTOCOL="http"
      KUBE_MASTER_URI="$KUBE_PROTOCOL://$KUBE_MASTER_IP:$KUBE_API_PORT"

      TEMPLATE=/etc/kubernetes/manifests/kube-proxy.yaml
      mkdir -p $(dirname ${TEMPLATE})
      cat > ${TEMPLATE} <<EOF
      apiVersion: v1
      kind: Pod
      metadata:
        name: kube-proxy
        namespace: kube-system
      spec:
        hostNetwork: true
        containers:
        - name: kube-proxy
          image: gcr.io/google_containers/hyperkube:${KUBE_VERSION}
          command:
          - /hyperkube
          - proxy
          - --master=${KUBE_MASTER_URI}
          - --logtostderr=true
          - --v=0
          securityContext:
            privileged: true
          volumeMounts:
            - mountPath: /etc/ssl/certs
              name: "ssl-certs"
            - mountPath: /etc/kubernetes/ssl
              name: "etc-kube-ssl"
              readOnly: true
        volumes:
          - name: "ssl-certs"
            hostPath:
              path: ${HOST_CERTS_PATH}
          - name: "etc-kube-ssl"
            hostPath:
              path: ${KUBE_CERTS_PATH}
      EOF