X-Git-Url: https://gerrit.akraino.org/r/gitweb?a=blobdiff_plain;f=site_type%2Fovsdpdk-a13%2Ftemplates%2Fpki%2Fpki-catalog.j2;fp=site_type%2Fovsdpdk-a13%2Ftemplates%2Fpki%2Fpki-catalog.j2;h=bea8a7d2578e73d69ff21258d477de137e1ff40b;hb=4ef0e0a733df21b39be32c773be73c688d4466af;hp=0000000000000000000000000000000000000000;hpb=267230d53447c489d10905f260f503f2e71d414f;p=yaml_builds.git diff --git a/site_type/ovsdpdk-a13/templates/pki/pki-catalog.j2 b/site_type/ovsdpdk-a13/templates/pki/pki-catalog.j2 new file mode 100644 index 0000000..bea8a7d --- /dev/null +++ b/site_type/ovsdpdk-a13/templates/pki/pki-catalog.j2 @@ -0,0 +1,270 @@ +--- +# The purpose of this file is to define the PKI certificates for the environment +# +# NOTE: When deploying a new site, this file should not be configured until +# baremetal/nodes.yaml is complete. +# +schema: promenade/PKICatalog/v1 +metadata: + schema: metadata/Document/v1 + name: cluster-certificates + layeringDefinition: + abstract: false + layer: site + storagePolicy: cleartext +data: + certificate_authorities: + kubernetes: + description: CA for Kubernetes components + certificates: + - document_name: apiserver + description: Service certificate for Kubernetes apiserver + common_name: apiserver + hosts: + - localhost + - 127.0.0.1 + # FIXME: Repetition of api_service_ip in common-addresses; use + # substitution + - {{yaml.kubernetes.api_service_ip}} + kubernetes_service_names: + - kubernetes.default.svc.cluster.local + + # NEWSITE-CHANGEME: The following should be a list of all the nodes in + # the environment (genesis, control plane, data plane, everything). + # Add/delete from this list as necessary until all nodes are listed. + # For each node, the `hosts` list should be comprised of: + # 1. The node's hostname, as already defined in baremetal/nodes.yaml + # 2. The node's oam IP address, as already defined in baremetal/nodes.yaml + # 3. The node's Calico IP address, as already defined in baremetal/nodes.yaml + # NOTE: This list also needs to include the Genesis node, which is not + # listed in baremetal/nodes.yaml, but by convention should be allocated + # the first non-reserved IP in each logical network allocation range + # defined in networks/physical/networks.yaml + # NOTE: The genesis node needs to be defined twice (the first two entries + # on this list) with all of the same paramters except the document_name. + # In the first case the document_name is `kubelet-genesis`, and in the + # second case the document_name format is `kubelete-YOUR_GENESIS_HOSTNAME`. + - document_name: kubelet-genesis + common_name: system:node:{{yaml.genesis.name}} + hosts: + - {{yaml.genesis.name}} + - {{yaml.genesis.host}} + - {{yaml.genesis.ksn}} + groups: + - system:nodes + - document_name: kubelet-{{yaml.genesis.name}} + common_name: system:node:{{yaml.genesis.name}} + hosts: + - {{yaml.genesis.name}} + - {{yaml.genesis.host}} + - {{yaml.genesis.ksn}} + groups: + - system:nodes +{% for server in yaml.masters %} + - document_name: kubelet-{{ server.name }} + common_name: system:node:{{ server.name }} + hosts: + - {{server.name}} + - {{server.host}} + - {{server.ksn}} + groups: + - system:nodes +{% endfor %} +{% if 'workers' in yaml %}{% for server in yaml.workers %} + - document_name: kubelet-{{ server.name }} + common_name: system:node:{{ server.name }} + hosts: + - {{server.name}} + - {{server.host}} + - {{server.ksn}} + groups: + - system:nodes +{% endfor %}{% endif %} + # End node list + - document_name: scheduler + description: Service certificate for Kubernetes scheduler + common_name: system:kube-scheduler + - document_name: controller-manager + description: certificate for controller-manager + common_name: system:kube-controller-manager + - document_name: admin + common_name: admin + groups: + - system:masters + - document_name: armada + common_name: armada + groups: + - system:masters + kubernetes-etcd: + description: Certificates for Kubernetes's etcd servers + certificates: + - document_name: apiserver-etcd + description: etcd client certificate for use by Kubernetes apiserver + common_name: apiserver + # NOTE(mark-burnett): hosts not required for client certificates + - document_name: kubernetes-etcd-anchor + description: anchor + common_name: anchor + # NEWSITE-CHANGEME: The following should be a list of the control plane + # nodes in the environment, including genesis. + # For each node, the `hosts` list should be comprised of: + # 1. The node's hostname, as already defined in baremetal/nodes.yaml + # 2. The node's oam IP address, as already defined in baremetal/nodes.yaml + # 3. The node's Calico IP address, as already defined in baremetal/nodes.yaml + # 4. 127.0.0.1 + # 5. localhost + # 6. kubernetes-etcd.kube-system.svc.cluster.local + # NOTE: This list also needs to include the Genesis node, which is not + # listed in baremetal/nodes.yaml, but by convention should be allocated + # the first non-reserved IP in each logical network allocation range + # defined in networks/physical/networks.yaml, except for the kubernetes + # service_cidr where it should start with the second IP in the range. + # NOTE: The genesis node is defined twice with the same `hosts` data: + # Once with its hostname in the common/document name, and once with + # `genesis` defined instead of the host. For now, this duplicated + # genesis definition is required. FIXME: Remove duplicate definition + # after Promenade addresses this issue. + - document_name: kubernetes-etcd-genesis + common_name: kubernetes-etcd-genesis + hosts: + - {{yaml.genesis.name}} + - {{yaml.genesis.host}} + - {{yaml.genesis.ksn}} + - 127.0.0.1 + - localhost + - kubernetes-etcd.kube-system.svc.cluster.local + - {{yaml.kubernetes.etcd_service_ip}} + - document_name: kubernetes-etcd-{{yaml.genesis.name}} + common_name: kubernetes-etcd-{{yaml.genesis.name}} + hosts: + - {{yaml.genesis.name}} + - {{yaml.genesis.host}} + - {{yaml.genesis.ksn}} + - 127.0.0.1 + - localhost + - kubernetes-etcd.kube-system.svc.cluster.local + - {{yaml.kubernetes.etcd_service_ip}} +{% for server in yaml.masters %} + - document_name: kubernetes-etcd-{{ server.name }} + common_name: kubernetes-etcd-{{ server.name }} + hosts: + - {{server.name}} + - {{server.host}} + - {{server.ksn}} + - 127.0.0.1 + - localhost + - kubernetes-etcd.kube-system.svc.cluster.local + - {{yaml.kubernetes.etcd_service_ip}} +{% endfor %} + # End node list + kubernetes-etcd-peer: + certificates: + # NEWSITE-CHANGEME: This list should be identical to the previous list, + # except that `-peer` has been appended to the document/common names. + - document_name: kubernetes-etcd-genesis-peer + common_name: kubernetes-etcd-genesis-peer + hosts: + - {{yaml.genesis.name}} + - {{yaml.genesis.host}} + - {{yaml.genesis.ksn}} + - 127.0.0.1 + - localhost + - kubernetes-etcd.kube-system.svc.cluster.local + - {{yaml.kubernetes.etcd_service_ip}} + - document_name: kubernetes-etcd-{{yaml.genesis.name}}-peer + common_name: kubernetes-etcd-{{yaml.genesis.name}}-peer + hosts: + - {{yaml.genesis.name}} + - {{yaml.genesis.host}} + - {{yaml.genesis.ksn}} + - 127.0.0.1 + - localhost + - kubernetes-etcd.kube-system.svc.cluster.local + - {{yaml.kubernetes.etcd_service_ip}} +{% for server in yaml.masters %} + - document_name: kubernetes-etcd-{{server.name}}-peer + common_name: kubernetes-etcd-{{server.name}}-peer + hosts: + - {{server.name}} + - {{server.host}} + - {{server.ksn}} + - 127.0.0.1 + - localhost + - kubernetes-etcd.kube-system.svc.cluster.local + - {{yaml.kubernetes.etcd_service_ip}} +{% endfor %} + # End node list + calico-etcd: + description: Certificates for Calico etcd client traffic + certificates: + - document_name: calico-etcd-anchor + description: anchor + common_name: anchor + # NEWSITE-CHANGEME: The following should be a list of the control plane + # nodes in the environment, including genesis. + # For each node, the `hosts` list should be comprised of: + # 1. The node's hostname, as already defined in baremetal/nodes.yaml + # 2. The node's oam IP address, as already defined in baremetal/nodes.yaml + # 3. The node's Calico IP address, as already defined in baremetal/nodes.yaml + # 4. 127.0.0.1 + # 5. localhost + # 6. The calico/etcd/service_ip defined in networks/common-addresses.yaml + # NOTE: This list also needs to include the Genesis node, which is not + # listed in baremetal/nodes.yaml, but by convention should be allocated + # the first non-reserved IP in each logical network allocation range + # defined in networks/physical/networks.yaml + - document_name: calico-etcd-{{yaml.genesis.name}} + common_name: calico-etcd-{{yaml.genesis.name}} + hosts: + - {{yaml.genesis.name}} + - {{yaml.genesis.host}} + - {{yaml.genesis.ksn}} + - 127.0.0.1 + - localhost + - 10.96.232.136 +{% for server in yaml.masters %} + - document_name: calico-etcd-{{server.name}} + common_name: calico-etcd-{{server.name}} + hosts: + - {{server.name}} + - {{server.host}} + - {{server.ksn}} + - 127.0.0.1 + - localhost + - 10.96.232.136 +{% endfor %} + - document_name: calico-node + common_name: calcico-node + # End node list + calico-etcd-peer: + description: Certificates for Calico etcd clients + certificates: + # NEWSITE-CHANGEME: This list should be identical to the previous list, + # except that `-peer` has been appended to the document/common names. + - document_name: calico-etcd-{{yaml.genesis.name}}-peer + common_name: calico-etcd-{{yaml.genesis.name}}-peer + hosts: + - {{yaml.genesis.name}} + - {{yaml.genesis.host}} + - {{yaml.genesis.ksn}} + - 127.0.0.1 + - localhost + - 10.96.232.136 +{% for server in yaml.masters %} + - document_name: calico-etcd-{{server.name}}-peer + common_name: calico-etcd-{{server.name}}-peer + hosts: + - {{server.name}} + - {{server.host}} + - {{server.ksn}} + - 127.0.0.1 + - localhost + - 10.96.232.136 +{% endfor %} + - document_name: calico-node-peer + common_name: calcico-node-peer + # End node list + keypairs: + - name: service-account + description: Service account signing key for use by Kubernetes controller-manager. +...