---
apiVersion: bootstrap.cluster.x-k8s.io/v1alpha4
kind: KubeadmConfigTemplate
metadata:
  name: {{ .Values.clusterName }}-workers
spec:
  template:
    spec:
      joinConfiguration:
        nodeRegistration:
          kubeletExtraArgs:
            node-labels: metal3.io/uuid={{ "{{" }} ds.meta_data.uuid {{ "}}" }}
            cpu-manager-policy: static
            topology-manager-policy: best-effort
            kube-reserved: cpu=100m,memory=256Mi
          name: '{{ "{{" }} ds.meta_data.name {{ "}}" }}'
      preKubeadmCommands:
{{- if .Values.networks }}
      # Without touching up /etc/hosts, kubeadm may pick the wrong
      # (i.e. provisioning network) address for the node IP
      - sed -i "1i $(ip -4 addr show dev {{ .Values.networks.baremetal.interface }} | grep -oP '(?<=inet\s)\d+(\.\d+){3}' | head -1) $(hostname)" /etc/hosts
{{- end }}
      - curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
      - add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
      - curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
      - add-apt-repository "deb https://apt.kubernetes.io/ kubernetes-xenial main"
      - apt-get update -y
      - apt-get install -y ca-certificates
      - /usr/local/bin/install-container-runtime.sh
      - apt-get install -y kubelet={{ .Values.kubeVersion }} kubeadm={{ .Values.kubeVersion }} kubectl={{ .Values.kubeVersion }}
      - systemctl enable --now kubelet
      postKubeadmCommands:
      - /usr/local/bin/harden_os.sh
      # This must be done after kubeadm as the cabpk provider relies
      # on files in /var/run, which won't persist after a reboot
      - /usr/local/bin/set_kernel_cmdline.sh
      files:
{{ include "cluster.containerRuntime" .Values | indent 6 }}
      - path: /etc/systemd/system/containerd.service.d/override.conf
        content: |
{{ $.Files.Get "resources/override.conf" | indent 10 }}
      - path: /usr/local/bin/harden_os.sh
        permissions: '0777'
        content: |
{{ $.Files.Get "resources/harden_os.sh" | indent 10 }}
      - path: /usr/local/bin/set_kernel_cmdline.sh
        permissions: '0777'
        content: |
{{ $.Files.Get "resources/set_kernel_cmdline.sh" | indent 10 }}
{{- if .Values.userData }}
      users:
      - name: {{ .Values.userData.name }}
        shell: /bin/bash
        lockPassword: False # Necessary to allow password login
        passwd: {{ .Values.userData.hashedPassword }}
        sshAuthorizedKeys:
        - {{ .Values.userData.sshAuthorizedKey }}
        sudo: "ALL=(ALL) NOPASSWD:ALL"
        groups: sudo # Necessary to allow SSH logins (see /etc/ssh/sshd_config)
      - name: root
        sshAuthorizedKeys:
        - {{ .Values.userData.sshAuthorizedKey }}
{{- end }}