Add missing kubelet config to HA control plane
[icn.git] / deploy / cluster / templates / kubeadmcontrolplane.yaml
1 ---
2 apiVersion: controlplane.cluster.x-k8s.io/v1alpha4
3 kind: KubeadmControlPlane
4 metadata:
5   name: {{ .Values.clusterName }}
6 spec:
7   kubeadmConfigSpec:
8     clusterConfiguration:
9       apiServer:
10         extraArgs:
11           enable-admission-plugins: NodeRestriction,PodSecurityPolicy
12     initConfiguration:
13       nodeRegistration:
14         kubeletExtraArgs:
15           node-labels: metal3.io/uuid={{ "{{" }} ds.meta_data.uuid {{ "}}" }}
16           cpu-manager-policy: static
17           topology-manager-policy: best-effort
18           kube-reserved: cpu=200m,memory=512Mi
19         name: '{{ "{{" }} ds.meta_data.name {{ "}}" }}'
20     joinConfiguration:
21       controlPlane: {}
22       nodeRegistration:
23         kubeletExtraArgs:
24           node-labels: metal3.io/uuid={{ "{{" }} ds.meta_data.uuid {{ "}}" }}
25           cpu-manager-policy: static
26           topology-manager-policy: best-effort
27           kube-reserved: cpu=200m,memory=512Mi
28         name: '{{ "{{" }} ds.meta_data.name {{ "}}" }}'
29     preKubeadmCommands:
30 {{- if .Values.networks }}
31     # Without touching up /etc/hosts, kubeadm may pick the wrong
32     # (i.e. provisioning network) address for the node IP
33     - sed -i "1i $(ip -4 addr show dev {{ .Values.networks.baremetal.interface }} | grep -oP '(?<=inet\s)\d+(\.\d+){3}' | head -1) $(hostname)" /etc/hosts
34 {{- end }}
35     - curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
36     - add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
37     - curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
38     - add-apt-repository "deb https://apt.kubernetes.io/ kubernetes-xenial main"
39     - apt update -y
40     - apt-get install -y ca-certificates
41 {{- if .Values.keepalived }}
42     - apt-get install -y keepalived
43     - systemctl enable --now keepalived
44 {{- end }}
45     - /usr/local/bin/install-container-runtime.sh
46     - apt-get install -y kubelet={{ .Values.kubeVersion }} kubeadm={{ .Values.kubeVersion }} kubectl={{ .Values.kubeVersion }}
47     - systemctl enable --now kubelet
48     postKubeadmCommands:
49     - mkdir -p /home/ubuntu/.kube
50     - cp /etc/kubernetes/admin.conf /home/ubuntu/.kube/config
51     - chown ubuntu:ubuntu /home/ubuntu/.kube/config
52     - mkdir -p /root/.kube
53     - cp /etc/kubernetes/admin.conf /root/.kube/config
54     - /usr/local/bin/harden_os.sh
55     # Normally any bootstrap resources needed would be applied with a
56     # ClusterResourceSet.  However instead of apply, replace must be
57     # used to harden K8s.
58     - /usr/local/bin/harden_k8s.sh
59     # This must be done after kubeadm as the cabpk provider relies on
60     # files in /var/run, which won't persist after a reboot
61     - /usr/local/bin/set_kernel_cmdline.sh
62     files:
63 {{ include "cluster.keepalived" .Values | indent 4 }}
64 {{ include "cluster.containerRuntime" .Values | indent 4 }}
65     - path: /etc/systemd/system/containerd.service.d/override.conf
66       content: |
67 {{ $.Files.Get "resources/override.conf" | indent 8 }}
68     - path: /usr/local/bin/harden_os.sh
69       permissions: '0777'
70       content: |
71 {{ $.Files.Get "resources/harden_os.sh" | indent 8 }}
72     - path: /usr/local/bin/harden_k8s.sh
73       permissions: '0777'
74       content: |
75 {{ $.Files.Get "resources/harden_k8s.sh" | indent 8 }}
76     - path: /usr/local/bin/set_kernel_cmdline.sh
77       permissions: '0777'
78       content: |
79 {{ $.Files.Get "resources/set_kernel_cmdline.sh" | indent 8 }}
80     users:
81     - name: {{ .Values.userData.name }}
82       shell: /bin/bash
83       lockPassword: False # Necessary to allow password login
84       passwd: {{ .Values.userData.hashedPassword }}
85       sshAuthorizedKeys:
86       - {{ .Values.userData.sshAuthorizedKey }}
87       sudo: "ALL=(ALL) NOPASSWD:ALL"
88       groups: sudo # Necessary to allow SSH logins (see /etc/ssh/sshd_config)
89     - name: root
90       sshAuthorizedKeys:
91       - {{ .Values.userData.sshAuthorizedKey }}
92   machineTemplate:
93     infrastructureRef:
94       apiVersion: infrastructure.cluster.x-k8s.io/v1alpha5
95       kind: Metal3MachineTemplate
96       name: {{ .Values.clusterName }}-controlplane
97     nodeDrainTimeout: 0s
98   replicas: {{ .Values.numControlPlaneMachines }}
99   rolloutStrategy:
100     rollingUpdate:
101       maxSurge: 1
102     type: RollingUpdate
103   version: {{ .Values.k8sVersion }}