2c635692ae
The 2 k8s atomic drivers we currently support are added to the same driver. This breaks ironic support with the stevedore work I'm currently doing. With stevedore, we can choose only one driver based on the server_type, os and coe. We won't be able to pick a driver and then choose an implementation bases on server_type. Partially-Implements: blueprint magnum-baremetal-full-support Co-Authored-By: Spyros Trigazis <strigazi@gmail.com> Change-Id: Ic1b8103551f48f85baa2ed9ff32d5b70b1fab84e
440 lines
13 KiB
YAML
440 lines
13 KiB
YAML
heat_template_version: 2014-10-16
|
|
|
|
description: >
|
|
This is a nested stack that defines a single Kubernetes minion, This stack is
|
|
included by an AutoScalingGroup resource in the parent template
|
|
(kubecluster.yaml).
|
|
|
|
parameters:
|
|
|
|
server_image:
|
|
type: string
|
|
description: glance image used to boot the server
|
|
|
|
minion_flavor:
|
|
type: string
|
|
description: flavor to use when booting the server
|
|
|
|
ssh_key_name:
|
|
type: string
|
|
description: name of ssh key to be provisioned on our server
|
|
|
|
external_network:
|
|
type: string
|
|
description: uuid/name of a network to use for floating ip addresses
|
|
|
|
kube_allow_priv:
|
|
type: string
|
|
description: >
|
|
whether or not kubernetes should permit privileged containers.
|
|
constraints:
|
|
- allowed_values: ["true", "false"]
|
|
|
|
docker_volume_size:
|
|
type: number
|
|
description: >
|
|
size of a cinder volume to allocate to docker for container/image
|
|
storage
|
|
|
|
docker_storage_driver:
|
|
type: string
|
|
description: docker storage driver name
|
|
default: "devicemapper"
|
|
constraints:
|
|
- allowed_values: ["devicemapper", "overlay"]
|
|
|
|
tls_disabled:
|
|
type: boolean
|
|
description: whether or not to enable TLS
|
|
|
|
kubernetes_port:
|
|
type: number
|
|
description: >
|
|
The port which are used by kube-apiserver to provide Kubernetes
|
|
service.
|
|
|
|
cluster_uuid:
|
|
type: string
|
|
description: identifier for the cluster this template is generating
|
|
|
|
magnum_url:
|
|
type: string
|
|
description: endpoint to retrieve TLS certs from
|
|
|
|
kube_master_ip:
|
|
type: string
|
|
description: IP address of the Kubernetes master server.
|
|
|
|
etcd_server_ip:
|
|
type: string
|
|
description: IP address of the Etcd server.
|
|
|
|
fixed_network:
|
|
type: string
|
|
description: Network from which to allocate fixed addresses.
|
|
|
|
fixed_subnet:
|
|
type: string
|
|
description: Subnet from which to allocate fixed addresses.
|
|
|
|
network_driver:
|
|
type: string
|
|
description: network driver to use for instantiating container networks
|
|
|
|
flannel_network_cidr:
|
|
type: string
|
|
description: network range for flannel overlay network
|
|
|
|
wait_condition_timeout:
|
|
type: number
|
|
description : >
|
|
timeout for the Wait Conditions
|
|
|
|
registry_enabled:
|
|
type: boolean
|
|
description: >
|
|
Indicates whether the docker registry is enabled.
|
|
|
|
registry_port:
|
|
type: number
|
|
description: port of registry service
|
|
|
|
swift_region:
|
|
type: string
|
|
description: region of swift service
|
|
|
|
registry_container:
|
|
type: string
|
|
description: >
|
|
name of swift container which docker registry stores images in
|
|
|
|
registry_insecure:
|
|
type: boolean
|
|
description: >
|
|
indicates whether to skip TLS verification between registry and backend storage
|
|
|
|
registry_chunksize:
|
|
type: number
|
|
description: >
|
|
size fo the data segments for the swift dynamic large objects
|
|
|
|
secgroup_kube_minion_id:
|
|
type: string
|
|
description: ID of the security group for kubernetes minion.
|
|
|
|
volume_driver:
|
|
type: string
|
|
description: volume driver to use for container storage
|
|
|
|
region_name:
|
|
type: string
|
|
description: A logically separate section of the cluster
|
|
|
|
tenant_name:
|
|
type: string
|
|
description: an alternative term for a project
|
|
|
|
username:
|
|
type: string
|
|
description: >
|
|
user account
|
|
|
|
password:
|
|
type: string
|
|
description: >
|
|
user password, not set in current implementation, only used to
|
|
fill in for Kubernetes config file
|
|
hidden: true
|
|
|
|
http_proxy:
|
|
type: string
|
|
description: http proxy address for docker
|
|
|
|
https_proxy:
|
|
type: string
|
|
description: https proxy address for docker
|
|
|
|
no_proxy:
|
|
type: string
|
|
description: no proxies for docker
|
|
|
|
kube_version:
|
|
type: string
|
|
description: version of kubernetes used for kubernetes cluster
|
|
|
|
trustee_domain_id:
|
|
type: string
|
|
description: domain id of the trustee
|
|
|
|
trustee_user_id:
|
|
type: string
|
|
description: user id of the trustee
|
|
|
|
trustee_username:
|
|
type: string
|
|
description: username of the trustee
|
|
|
|
trustee_password:
|
|
type: string
|
|
description: password of the trustee
|
|
hidden: true
|
|
|
|
trust_id:
|
|
type: string
|
|
description: id of the trust which is used by the trustee
|
|
hidden: true
|
|
|
|
auth_url:
|
|
type: string
|
|
description: >
|
|
url for keystone, must be v2 since k8s backend only support v2
|
|
at this point
|
|
|
|
insecure_registry_url:
|
|
type: string
|
|
description: insecure registry url
|
|
|
|
resources:
|
|
|
|
minion_wait_handle:
|
|
type: OS::Heat::WaitConditionHandle
|
|
|
|
minion_wait_condition:
|
|
type: OS::Heat::WaitCondition
|
|
depends_on: kube-minion
|
|
properties:
|
|
handle: {get_resource: minion_wait_handle}
|
|
timeout: {get_param: wait_condition_timeout}
|
|
|
|
######################################################################
|
|
#
|
|
# software configs. these are components that are combined into
|
|
# a multipart MIME user-data archive.
|
|
#
|
|
|
|
write_heat_params:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config:
|
|
str_replace:
|
|
template: {get_file: ../../common/templates/kubernetes/fragments/write-heat-params.yaml}
|
|
params:
|
|
$KUBE_ALLOW_PRIV: {get_param: kube_allow_priv}
|
|
$KUBE_MASTER_IP: {get_param: kube_master_ip}
|
|
$KUBE_API_PORT: {get_param: kubernetes_port}
|
|
$KUBE_NODE_PUBLIC_IP: {get_attr: [kube_minion_floating, floating_ip_address]}
|
|
$KUBE_NODE_IP: {get_attr: [kube_minion_eth0, fixed_ips, 0, ip_address]}
|
|
$ETCD_SERVER_IP: {get_param: etcd_server_ip}
|
|
$DOCKER_VOLUME: {get_resource: docker_volume}
|
|
$DOCKER_STORAGE_DRIVER: {get_param: docker_storage_driver}
|
|
$NETWORK_DRIVER: {get_param: network_driver}
|
|
$REGISTRY_ENABLED: {get_param: registry_enabled}
|
|
$REGISTRY_PORT: {get_param: registry_port}
|
|
$SWIFT_REGION: {get_param: swift_region}
|
|
$REGISTRY_CONTAINER: {get_param: registry_container}
|
|
$REGISTRY_INSECURE: {get_param: registry_insecure}
|
|
$REGISTRY_CHUNKSIZE: {get_param: registry_chunksize}
|
|
$TLS_DISABLED: {get_param: tls_disabled}
|
|
$CLUSTER_UUID: {get_param: cluster_uuid}
|
|
$MAGNUM_URL: {get_param: magnum_url}
|
|
$USERNAME: {get_param: username}
|
|
$PASSWORD: {get_param: password}
|
|
$VOLUME_DRIVER: {get_param: volume_driver}
|
|
$REGION_NAME: {get_param: region_name}
|
|
$TENANT_NAME: {get_param: tenant_name}
|
|
$HTTP_PROXY: {get_param: http_proxy}
|
|
$HTTPS_PROXY: {get_param: https_proxy}
|
|
$NO_PROXY: {get_param: no_proxy}
|
|
$KUBE_VERSION: {get_param: kube_version}
|
|
$WAIT_CURL: {get_attr: [minion_wait_handle, curl_cli]}
|
|
$TRUSTEE_DOMAIN_ID: {get_param: trustee_domain_id}
|
|
$TRUSTEE_USER_ID: {get_param: trustee_user_id}
|
|
$TRUSTEE_USERNAME: {get_param: trustee_username}
|
|
$TRUSTEE_PASSWORD: {get_param: trustee_password}
|
|
$TRUST_ID: {get_param: trust_id}
|
|
$AUTH_URL: {get_param: auth_url}
|
|
$INSECURE_REGISTRY_URL: {get_param: insecure_registry_url}
|
|
|
|
write_kubeconfig:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/kubernetes/fragments/write-kubeconfig.yaml}
|
|
|
|
make_cert:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/kubernetes/fragments/make-cert-client.sh}
|
|
|
|
configure_docker_storage:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config:
|
|
str_replace:
|
|
params:
|
|
$configure_docker_storage_driver: {get_file: ../../common/templates/fragments/configure_docker_storage_driver_atomic.sh}
|
|
template: {get_file: ../../common/templates/fragments/configure-docker-storage.sh}
|
|
|
|
configure_docker_registry:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/fragments/configure-docker-registry.sh}
|
|
|
|
configure_kubernetes_minion:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/kubernetes/fragments/configure-kubernetes-minion.sh}
|
|
|
|
kube_examples:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/kubernetes/fragments/kube-examples.yaml}
|
|
|
|
network_service:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/kubernetes/fragments/network-service.sh}
|
|
|
|
enable_services:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/kubernetes/fragments/enable-services-minion.sh}
|
|
|
|
enable_docker_registry:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/fragments/enable-docker-registry.sh}
|
|
|
|
enable_kube_proxy:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/kubernetes/fragments/enable-kube-proxy-minion.sh}
|
|
|
|
minion_wc_notify:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config:
|
|
str_replace:
|
|
template: |
|
|
#!/bin/bash -v
|
|
wc_notify --data-binary '{"status": "SUCCESS"}'
|
|
params:
|
|
wc_notify: {get_attr: [minion_wait_handle, curl_cli]}
|
|
|
|
disable_selinux:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/kubernetes/fragments/disable-selinux.sh}
|
|
|
|
add_proxy:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/kubernetes/fragments/add-proxy.sh}
|
|
|
|
kube_minion_init:
|
|
type: OS::Heat::MultipartMime
|
|
properties:
|
|
parts:
|
|
- config: {get_resource: disable_selinux}
|
|
- config: {get_resource: write_heat_params}
|
|
- config: {get_resource: write_kubeconfig}
|
|
- config: {get_resource: make_cert}
|
|
- config: {get_resource: kube_examples}
|
|
- config: {get_resource: configure_docker_storage}
|
|
- config: {get_resource: configure_docker_registry}
|
|
- config: {get_resource: configure_kubernetes_minion}
|
|
- config: {get_resource: network_service}
|
|
- config: {get_resource: add_proxy}
|
|
- config: {get_resource: enable_services}
|
|
- config: {get_resource: enable_kube_proxy}
|
|
- config: {get_resource: enable_docker_registry}
|
|
- config: {get_resource: minion_wc_notify}
|
|
|
|
######################################################################
|
|
#
|
|
# a single kubernetes minion.
|
|
# Important: the name for the heat resource kube-minion below must
|
|
# not contain "_" (underscore) because it will be used in the
|
|
# hostname. Because DNS domain name does not allow "_", the "_"
|
|
# will be converted to a "-" and this will make the hostname different
|
|
# from the Nova instance name. This in turn will break the load
|
|
# balancer feature in Kubernetes.
|
|
#
|
|
|
|
kube-minion:
|
|
type: OS::Nova::Server
|
|
properties:
|
|
image: {get_param: server_image}
|
|
flavor: {get_param: minion_flavor}
|
|
key_name: {get_param: ssh_key_name}
|
|
user_data_format: RAW
|
|
user_data: {get_resource: kube_minion_init}
|
|
networks:
|
|
- port: {get_resource: kube_minion_eth0}
|
|
|
|
kube_minion_eth0:
|
|
type: OS::Neutron::Port
|
|
properties:
|
|
network: {get_param: fixed_network}
|
|
security_groups:
|
|
- get_param: secgroup_kube_minion_id
|
|
fixed_ips:
|
|
- subnet: {get_param: fixed_subnet}
|
|
allowed_address_pairs:
|
|
- ip_address: {get_param: flannel_network_cidr}
|
|
replacement_policy: AUTO
|
|
|
|
kube_minion_floating:
|
|
type: Magnum::Optional::KubeMinion::Neutron::FloatingIP
|
|
properties:
|
|
floating_network: {get_param: external_network}
|
|
port_id: {get_resource: kube_minion_eth0}
|
|
|
|
######################################################################
|
|
#
|
|
# docker storage. This allocates a cinder volume and attaches it
|
|
# to the minion.
|
|
#
|
|
|
|
docker_volume:
|
|
type: OS::Cinder::Volume
|
|
properties:
|
|
size: {get_param: docker_volume_size}
|
|
|
|
docker_volume_attach:
|
|
type: OS::Cinder::VolumeAttachment
|
|
properties:
|
|
instance_uuid: {get_resource: kube-minion}
|
|
volume_id: {get_resource: docker_volume}
|
|
mountpoint: /dev/vdb
|
|
|
|
outputs:
|
|
|
|
kube_minion_ip:
|
|
value: {get_attr: [kube_minion_eth0, fixed_ips, 0, ip_address]}
|
|
description: >
|
|
This is the "public" IP address of the Kubernetes minion node.
|
|
|
|
kube_minion_external_ip:
|
|
value: {get_attr: [kube_minion_floating, floating_ip_address]}
|
|
description: >
|
|
This is the "public" IP address of the Kubernetes minion node.
|
|
|
|
OS::stack_id:
|
|
value: {get_param: "OS::stack_id"}
|
|
description: >
|
|
This is a id of the stack which creates from this template.
|