heat_template_version: 2014-10-16 description: > This is a nested stack that defines a single Kubernetes minion, based on a CoreOS cloud image. This stack is included by a ResourceGroup resource in the parent template (kubecluster.yaml). parameters: server_image: type: string description: glance image used to boot the server minion_flavor: type: string description: flavor to use when booting the server ssh_key_name: type: string description: name of ssh key to be provisioned on our server external_network: type: string description: uuid/name of a network to use for floating ip addresses kube_allow_priv: type: string description: > whether or not kubernetes should permit privileged containers. constraints: - allowed_values: ["true", "false"] network_driver: type: string description: network driver to use for instantiating container networks tls_disabled: type: boolean description: whether or not to enable TLS kubernetes_port: type: number description: > The port which are used by kube-apiserver to provide Kubernetes service. default: 6443 bay_uuid: type: string description: identifier for the bay this template is generating magnum_url: type: string description: endpoint to retrieve TLS certs from kube_version: type: string description: version of kubernetes used for kubernetes cluster kube_master_ip: type: string description: IP address of the Kubernetes master server. etcd_server_ip: type: string description: IP address of the Etcd server. fixed_network: type: string description: Network from which to allocate fixed addresses. fixed_subnet: type: string description: Subnet from which to allocate fixed addresses. flannel_network_cidr: type: string description: network range for flannel overlay network wait_condition_timeout: type: number description: > timeout for the Wait Conditions trustee_user_id: type: string description: user id of the trustee default: "" trustee_password: type: string description: password of the trustee default: "" hidden: true trust_id: type: string description: id of the trust which is used by the trustee default: "" hidden: true auth_url: type: string description: url for keystone resources: minion_wait_handle: type: OS::Heat::WaitConditionHandle minion_wait_condition: type: OS::Heat::WaitCondition depends_on: kube-minion properties: handle: {get_resource: minion_wait_handle} timeout: {get_param: wait_condition_timeout} ###################################################################### # # security groups. we need to permit network traffic of various # sorts. # secgroup_all_open: type: OS::Neutron::SecurityGroup properties: rules: - protocol: icmp - protocol: tcp - protocol: udp ###################################################################### # # software configs. these are components that are combined into # a multipart MIME user-data archive. # write_heat_params: type: OS::Heat::SoftwareConfig properties: group: ungrouped config: str_replace: template: {get_file: fragments/write-heat-params.yaml} params: $KUBE_ALLOW_PRIV: {get_param: kube_allow_priv} $KUBE_MASTER_IP: {get_param: kube_master_ip} $KUBE_NODE_PUBLIC_IP: {get_attr: [kube_minion_floating, floating_ip_address]} $KUBE_NODE_IP: {get_attr: [kube_minion_eth0, fixed_ips, 0, ip_address]} $WAIT_CURL: {get_attr: [minion_wait_handle, curl_cli]} $KUBE_API_PORT: {get_param: kubernetes_port} $TLS_DISABLED: {get_param: tls_disabled} $NETWORK_DRIVER: {get_param: network_driver} $ETCD_SERVER_IP: {get_param: etcd_server_ip} $KUBE_VERSION: {get_param: kube_version} $BAY_UUID: {get_param: bay_uuid} $MAGNUM_URL: {get_param: magnum_url} $TRUSTEE_USER_ID: {get_param: trustee_user_id} $TRUSTEE_PASSWORD: {get_param: trustee_password} $TRUST_ID: {get_param: trust_id} $AUTH_URL: {get_param: auth_url} write_kubeconfig: type: OS::Heat::SoftwareConfig properties: group: ungrouped config: {get_file: fragments/write-kubeconfig.yaml} make_cert: type: OS::Heat::SoftwareConfig properties: group: ungrouped config: {get_file: fragments/make-cert-client.yaml} enable_network_service: type: OS::Heat::SoftwareConfig properties: group: ungrouped config: {get_file: fragments/enable-network-service.yaml} enable_kubelet: type: OS::Heat::SoftwareConfig properties: group: ungrouped config: {get_file: fragments/enable-kubelet-minion.yaml} enable_kube_proxy: type: OS::Heat::SoftwareConfig properties: group: ungrouped config: {get_file: fragments/enable-kube-proxy-minion.yaml} wc_notify: type: OS::Heat::SoftwareConfig properties: group: ungrouped config: {get_file: fragments/wc-notify.yaml} kube_minion_init: type: OS::Heat::SoftwareConfig properties: group: ungrouped config: str_replace: template: | $write_heat_params $write_kubeconfig $make_cert $enable_network_service $enable_kubelet $enable_kube_proxy $wc_notify coreos: units: - name: "make-cert.service" command: "start" - name: "enable-network-service.service" command: "start" - name: "enable-kubelet.service" command: "start" - name: "enable-kube-proxy.service" command: "start" - name: "wc-notify.service" command: "start" params: "$write_heat_params": {get_attr: [write_heat_params, config]} "$write_kubeconfig": {get_attr: [write_kubeconfig, config]} "$make_cert": {get_attr: [make_cert, config]} "$enable_network_service": {get_attr: [enable_network_service, config]} "$enable_kubelet": {get_attr: [enable_kubelet, config]} "$enable_kube_proxy": {get_attr: [enable_kube_proxy, config]} "$wc_notify": {get_attr: [wc_notify, config]} # Important: the name for the heat resource kube-minion below must # not contain "_" (underscore) because it will be used in the # hostname. Because DNS domain name does not allow "_", the "_" # will be converted to a "-" and this will make the hostname different # from the Nova instance name. This in turn will break the load # balancer feature in Kubernetes. kube-minion: type: OS::Nova::Server properties: image: {get_param: server_image} flavor: {get_param: minion_flavor} key_name: {get_param: ssh_key_name} user_data_format: RAW user_data: {get_resource: kube_minion_init} networks: - port: {get_resource: kube_minion_eth0} kube_minion_eth0: type: OS::Neutron::Port properties: network: {get_param: fixed_network} security_groups: - get_resource: secgroup_all_open fixed_ips: - subnet: {get_param: fixed_subnet} allowed_address_pairs: - ip_address: {get_param: flannel_network_cidr} replacement_policy: AUTO kube_minion_floating: type: OS::Neutron::FloatingIP properties: floating_network: {get_param: external_network} port_id: {get_resource: kube_minion_eth0} outputs: kube_minion_ip: value: {get_attr: [kube_minion_eth0, fixed_ips, 0, ip_address]} description: > This is the "private" IP address of the Kubernetes minion node. kube_minion_external_ip: value: {get_attr: [kube_minion_floating, floating_ip_address]} description: > This is the "public" IP address of the Kubernetes minion node. OS::stack_id: value: {get_param: "OS::stack_id"} description: > This is a id of the stack which creates from this template.