You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
363 lines
11 KiB
363 lines
11 KiB
heat_template_version: 2014-10-16
|
|
|
|
description: >
|
|
This is a nested stack that defines software configs for Kubernetes minions.
|
|
|
|
parameters:
|
|
|
|
kube_allow_priv:
|
|
type: string
|
|
description: >
|
|
whether or not kubernetes should permit privileged containers.
|
|
constraints:
|
|
- allowed_values: ["true", "false"]
|
|
|
|
docker_volume_size:
|
|
type: number
|
|
description: >
|
|
size of a cinder volume to allocate to docker for container/image
|
|
storage
|
|
|
|
docker_storage_driver:
|
|
type: string
|
|
description: docker storage driver name
|
|
default: "devicemapper"
|
|
|
|
tls_disabled:
|
|
type: boolean
|
|
description: whether or not to enable TLS
|
|
|
|
verify_ca:
|
|
type: boolean
|
|
description: whether or not to validate certificate authority
|
|
|
|
kubernetes_port:
|
|
type: number
|
|
description: >
|
|
The port which are used by kube-apiserver to provide Kubernetes
|
|
service.
|
|
|
|
cluster_uuid:
|
|
type: string
|
|
description: identifier for the cluster this template is generating
|
|
|
|
magnum_url:
|
|
type: string
|
|
description: endpoint to retrieve TLS certs from
|
|
|
|
prometheus_monitoring:
|
|
type: boolean
|
|
description: >
|
|
whether or not to have the node-exporter running on the node
|
|
|
|
kube_master_ip:
|
|
type: string
|
|
description: IP address of the Kubernetes master server.
|
|
|
|
etcd_server_ip:
|
|
type: string
|
|
description: IP address of the Etcd server.
|
|
|
|
network_driver:
|
|
type: string
|
|
description: network driver to use for instantiating container networks
|
|
|
|
registry_enabled:
|
|
type: boolean
|
|
description: >
|
|
Indicates whether the docker registry is enabled.
|
|
|
|
registry_port:
|
|
type: number
|
|
description: port of registry service
|
|
|
|
swift_region:
|
|
type: string
|
|
description: region of swift service
|
|
|
|
registry_container:
|
|
type: string
|
|
description: >
|
|
name of swift container which docker registry stores images in
|
|
|
|
registry_insecure:
|
|
type: boolean
|
|
description: >
|
|
indicates whether to skip TLS verification between registry and backend storage
|
|
|
|
registry_chunksize:
|
|
type: number
|
|
description: >
|
|
size fo the data segments for the swift dynamic large objects
|
|
|
|
volume_driver:
|
|
type: string
|
|
description: volume driver to use for container storage
|
|
|
|
region_name:
|
|
type: string
|
|
description: A logically separate section of the cluster
|
|
|
|
username:
|
|
type: string
|
|
description: >
|
|
user account
|
|
|
|
password:
|
|
type: string
|
|
description: >
|
|
user password, not set in current implementation, only used to
|
|
fill in for Kubernetes config file
|
|
hidden: true
|
|
|
|
http_proxy:
|
|
type: string
|
|
description: http proxy address for docker
|
|
|
|
https_proxy:
|
|
type: string
|
|
description: https proxy address for docker
|
|
|
|
no_proxy:
|
|
type: string
|
|
description: no proxies for docker
|
|
|
|
kube_tag:
|
|
type: string
|
|
description: tag of the k8s containers used to provision the kubernetes cluster
|
|
|
|
kube_version:
|
|
type: string
|
|
description: version of kubernetes used for kubernetes cluster
|
|
|
|
trustee_domain_id:
|
|
type: string
|
|
description: domain id of the trustee
|
|
|
|
trustee_user_id:
|
|
type: string
|
|
description: user id of the trustee
|
|
|
|
trustee_username:
|
|
type: string
|
|
description: username of the trustee
|
|
|
|
trustee_password:
|
|
type: string
|
|
description: password of the trustee
|
|
hidden: true
|
|
|
|
trust_id:
|
|
type: string
|
|
description: id of the trust which is used by the trustee
|
|
hidden: true
|
|
|
|
auth_url:
|
|
type: string
|
|
description: >
|
|
url for keystone, must be v2 since k8s backend only support v2
|
|
at this point
|
|
|
|
insecure_registry_url:
|
|
type: string
|
|
description: insecure registry url
|
|
|
|
container_infra_prefix:
|
|
type: string
|
|
description: >
|
|
prefix of container images used in the cluster, kubernetes components,
|
|
kubernetes-dashboard, coredns etc
|
|
|
|
wc_curl_cli:
|
|
type: string
|
|
description : >
|
|
Wait condition notify command for Minion.
|
|
|
|
openstack_ca:
|
|
type: string
|
|
description: The OpenStack CA certificate to install on the node.
|
|
|
|
octavia_enabled:
|
|
type: boolean
|
|
description: >
|
|
whether or not to use Octavia for LoadBalancer type service.
|
|
default: False
|
|
|
|
resources:
|
|
|
|
######################################################################
|
|
#
|
|
# software configs. these are components that are combined into
|
|
# a multipart MIME user-data archive.
|
|
#
|
|
|
|
write_heat_params:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config:
|
|
str_replace:
|
|
template: {get_file: ../../common/templates/kubernetes/fragments/write-heat-params.yaml}
|
|
params:
|
|
$PROMETHEUS_MONITORING: {get_param: prometheus_monitoring}
|
|
$KUBE_ALLOW_PRIV: {get_param: kube_allow_priv}
|
|
$KUBE_MASTER_IP: {get_param: kube_master_ip}
|
|
$KUBE_API_PORT: {get_param: kubernetes_port}
|
|
$ETCD_SERVER_IP: {get_param: etcd_server_ip}
|
|
$DOCKER_VOLUME: 'None'
|
|
$DOCKER_VOLUME_SIZE: {get_param: docker_volume_size}
|
|
$DOCKER_STORAGE_DRIVER: {get_param: docker_storage_driver}
|
|
$NETWORK_DRIVER: {get_param: network_driver}
|
|
$REGISTRY_ENABLED: {get_param: registry_enabled}
|
|
$REGISTRY_PORT: {get_param: registry_port}
|
|
$SWIFT_REGION: {get_param: swift_region}
|
|
$REGISTRY_CONTAINER: {get_param: registry_container}
|
|
$REGISTRY_INSECURE: {get_param: registry_insecure}
|
|
$REGISTRY_CHUNKSIZE: {get_param: registry_chunksize}
|
|
$TLS_DISABLED: {get_param: tls_disabled}
|
|
$VERIFY_CA: {get_param: verify_ca}
|
|
$CLUSTER_UUID: {get_param: cluster_uuid}
|
|
$MAGNUM_URL: {get_param: magnum_url}
|
|
$USERNAME: {get_param: username}
|
|
$PASSWORD: {get_param: password}
|
|
$VOLUME_DRIVER: {get_param: volume_driver}
|
|
$REGION_NAME: {get_param: region_name}
|
|
$HTTP_PROXY: {get_param: http_proxy}
|
|
$HTTPS_PROXY: {get_param: https_proxy}
|
|
$NO_PROXY: {get_param: no_proxy}
|
|
$KUBE_TAG: {get_param: kube_tag}
|
|
$KUBE_VERSION: {get_param: kube_version}
|
|
$WAIT_CURL: {get_param: wc_curl_cli}
|
|
$TRUSTEE_DOMAIN_ID: {get_param: trustee_domain_id}
|
|
$TRUSTEE_USER_ID: {get_param: trustee_user_id}
|
|
$TRUSTEE_USERNAME: {get_param: trustee_username}
|
|
$TRUSTEE_PASSWORD: {get_param: trustee_password}
|
|
$TRUST_ID: {get_param: trust_id}
|
|
$AUTH_URL: {get_param: auth_url}
|
|
$INSECURE_REGISTRY_URL: {get_param: insecure_registry_url}
|
|
$CONTAINER_INFRA_PREFIX: {get_param: container_infra_prefix}
|
|
$ENABLE_CINDER: "False"
|
|
$OCTAVIA_ENABLED: {get_param: octavia_enabled}
|
|
|
|
install_openstack_ca:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config:
|
|
str_replace:
|
|
params:
|
|
$OPENSTACK_CA: {get_param: openstack_ca}
|
|
template: {get_file: ../../common/templates/fragments/atomic-install-openstack-ca.sh}
|
|
|
|
make_cert:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/kubernetes/fragments/make-cert-client.sh}
|
|
|
|
configure_docker_storage:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config:
|
|
str_replace:
|
|
params:
|
|
$configure_docker_storage_driver: {get_file: ../../common/templates/fragments/configure_docker_storage_driver_atomic.sh}
|
|
template: {get_file: ../../common/templates/fragments/configure-docker-storage.sh}
|
|
|
|
configure_docker_registry:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/fragments/configure-docker-registry.sh}
|
|
|
|
configure_kubernetes_minion:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/kubernetes/fragments/configure-kubernetes-minion.sh}
|
|
|
|
flannel_service:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/kubernetes/fragments/flannel-service.sh}
|
|
|
|
enable_services:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/kubernetes/fragments/enable-services-minion.sh}
|
|
|
|
enable_docker_registry:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/fragments/enable-docker-registry.sh}
|
|
|
|
enable_kube_proxy:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/kubernetes/fragments/enable-kube-proxy-minion.sh}
|
|
|
|
enable_node_exporter:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/kubernetes/fragments/enable-node-exporter.sh}
|
|
|
|
minion_wc_notify:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config:
|
|
str_replace:
|
|
template: |
|
|
#!/bin/bash -v
|
|
if [ "verify_ca" == "True" ]; then
|
|
VERIFY_CA=""
|
|
else
|
|
VERIFY_CA="-k"
|
|
fi
|
|
wc_notify $VERIFY_CA --data-binary '{"status": "SUCCESS"}'
|
|
params:
|
|
wc_notify: {get_param: wc_curl_cli}
|
|
verify_ca: {get_param: verify_ca}
|
|
|
|
disable_selinux:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/kubernetes/fragments/disable-selinux.sh}
|
|
|
|
add_proxy:
|
|
type: OS::Heat::SoftwareConfig
|
|
properties:
|
|
group: ungrouped
|
|
config: {get_file: ../../common/templates/kubernetes/fragments/add-proxy.sh}
|
|
|
|
kube_minion_init:
|
|
type: OS::Heat::MultipartMime
|
|
properties:
|
|
parts:
|
|
- config: {get_resource: install_openstack_ca}
|
|
- config: {get_resource: disable_selinux}
|
|
- config: {get_resource: write_heat_params}
|
|
- config: {get_resource: make_cert}
|
|
- config: {get_resource: configure_docker_storage}
|
|
- config: {get_resource: configure_docker_registry}
|
|
- config: {get_resource: configure_kubernetes_minion}
|
|
- config: {get_resource: flannel_service}
|
|
- config: {get_resource: add_proxy}
|
|
- config: {get_resource: enable_services}
|
|
- config: {get_resource: enable_kube_proxy}
|
|
- config: {get_resource: enable_node_exporter}
|
|
- config: {get_resource: enable_docker_registry}
|
|
- config: {get_resource: minion_wc_notify}
|
|
|
|
outputs:
|
|
kube_minion_init:
|
|
value: {get_resource: kube_minion_init}
|
|
description: ID of the multipart mime for kubeminion.
|