#cloud-config
write_files:
  - path: /etc/systemd/system/enable-kube-proxy.service
    owner: "root:root"
    permissions: "0644"
    content: |
      [Unit]
      Description=Configure Kubernetes Proxy

      [Service]
      Type=oneshot
      ExecStart=/etc/sysconfig/enable-kube-proxy-minion.sh

      [Install]
      WantedBy=multi-user.target

  - path: /etc/sysconfig/enable-kube-proxy-minion.sh
    owner: "root:root"
    permissions: "0755"
    content: |
      #!/bin/sh

      . /etc/sysconfig/heat-params
      myip=$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)

      KUBE_CERTS_PATH=/etc/kubernetes/ssl
      KUBE_CONFIG_PATH=/etc/kubernetes/config
      KUBE_PROTOCOL="https"
      KUBE_CONFIG="${KUBE_CONFIG_PATH}/worker-kubeconfig.yaml"
      if [ "${TLS_DISABLED}" == "True" ]; then
        KUBE_PROTOCOL="http"
        KUBE_CONFIG=
      fi
      KUBE_MASTER_URI="${KUBE_PROTOCOL}://${KUBE_MASTER_IP}:${KUBE_API_PORT}"

      TEMPLATE=/etc/kubernetes/manifests/kube-proxy.yaml
      mkdir -p $(dirname ${TEMPLATE})
      cat > ${TEMPLATE} <<EOF
      apiVersion: v1
      kind: Pod
      metadata:
        name: kube-proxy
        namespace: kube-system
      spec:
        hostNetwork: true
        containers:
        - name: kube-proxy
          image: gcr.io/google_containers/hyperkube:${KUBE_VERSION}
          command:
          - /hyperkube
          - proxy
          - --master=${KUBE_MASTER_URI}
          - --kubeconfig=${KUBE_CONFIG}
          - --logtostderr=true
          - --v=0
          securityContext:
            privileged: true
          volumeMounts:
            - mountPath: /etc/kubernetes/config
              name: "kubeconfig"
              readOnly: true
            - mountPath: /etc/kubernetes/ssl
              name: "etc-kube-ssl"
              readOnly: true
        volumes:
          - name: "kubeconfig"
            hostPath:
              path: ${KUBE_CONFIG_PATH}
          - name: "etc-kube-ssl"
            hostPath:
              path: ${KUBE_CERTS_PATH}
      EOF