mirror of https://github.com/kubernetes/kops.git
giving cf its own files, because it has hardcoded versions
This commit is contained in:
chrislovecnm
parent
5636dc3298
commit
48c6dfdad4
|
|
@ -73,7 +73,7 @@ func TestComplex(t *testing.T) {
|
|||
func TestMinimalCloudformation(t *testing.T) {
|
||||
//runTestCloudformation(t, "minimal.example.com", "../../tests/integration/minimal", "v1alpha0", false)
|
||||
//runTestCloudformation(t, "minimal.example.com", "../../tests/integration/minimal", "v1alpha1", false)
|
||||
runTestCloudformation(t, "minimal.example.com", "../../tests/integration/minimal", "v1alpha2", false)
|
||||
runTestCloudformation(t, "minimal.example.com", "../../tests/integration/cloudformation", "v1alpha2", false)
|
||||
}
|
||||
|
||||
// TestMinimal_141 runs the test on a configuration from 1.4.1 release
|
||||
|
|
|
|||
|
|
@ -0,0 +1,768 @@
|
|||
{
|
||||
"Resources": {
|
||||
"AWSAutoScalingAutoScalingGroupmasterustest1amastersminimalexamplecom": {
|
||||
"Type": "AWS::AutoScaling::AutoScalingGroup",
|
||||
"Properties": {
|
||||
"LaunchConfigurationName": {
|
||||
"Ref": "AWSAutoScalingLaunchConfigurationmasterustest1amastersminimalexamplecom"
|
||||
},
|
||||
"MaxSize": 1,
|
||||
"MinSize": 1,
|
||||
"VPCZoneIdentifier": [
|
||||
{
|
||||
"Ref": "AWSEC2Subnetustest1aminimalexamplecom"
|
||||
}
|
||||
],
|
||||
"Tags": [
|
||||
{
|
||||
"Key": "KubernetesCluster",
|
||||
"Value": "minimal.example.com",
|
||||
"PropagateAtLaunch": true
|
||||
},
|
||||
{
|
||||
"Key": "Name",
|
||||
"Value": "master-us-test-1a.masters.minimal.example.com",
|
||||
"PropagateAtLaunch": true
|
||||
},
|
||||
{
|
||||
"Key": "k8s.io/role/master",
|
||||
"Value": "1",
|
||||
"PropagateAtLaunch": true
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"AWSAutoScalingAutoScalingGroupnodesminimalexamplecom": {
|
||||
"Type": "AWS::AutoScaling::AutoScalingGroup",
|
||||
"Properties": {
|
||||
"LaunchConfigurationName": {
|
||||
"Ref": "AWSAutoScalingLaunchConfigurationnodesminimalexamplecom"
|
||||
},
|
||||
"MaxSize": 2,
|
||||
"MinSize": 2,
|
||||
"VPCZoneIdentifier": [
|
||||
{
|
||||
"Ref": "AWSEC2Subnetustest1aminimalexamplecom"
|
||||
}
|
||||
],
|
||||
"Tags": [
|
||||
{
|
||||
"Key": "KubernetesCluster",
|
||||
"Value": "minimal.example.com",
|
||||
"PropagateAtLaunch": true
|
||||
},
|
||||
{
|
||||
"Key": "Name",
|
||||
"Value": "nodes.minimal.example.com",
|
||||
"PropagateAtLaunch": true
|
||||
},
|
||||
{
|
||||
"Key": "k8s.io/role/node",
|
||||
"Value": "1",
|
||||
"PropagateAtLaunch": true
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"AWSAutoScalingLaunchConfigurationmasterustest1amastersminimalexamplecom": {
|
||||
"Type": "AWS::AutoScaling::LaunchConfiguration",
|
||||
"Properties": {
|
||||
"AssociatePublicIpAddress": true,
|
||||
"BlockDeviceMappings": [
|
||||
{
|
||||
"DeviceName": "/dev/xvda",
|
||||
"Ebs": {
|
||||
"VolumeType": "gp2",
|
||||
"VolumeSize": 64,
|
||||
"DeleteOnTermination": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"DeviceName": "/dev/sdc",
|
||||
"VirtualName": "ephemeral0"
|
||||
}
|
||||
],
|
||||
"IamInstanceProfile": {
|
||||
"Ref": "AWSIAMInstanceProfilemastersminimalexamplecom"
|
||||
},
|
||||
"ImageId": "ami-12345678",
|
||||
"InstanceType": "m3.medium",
|
||||
"KeyName": "kubernetes.minimal.example.com-c4:a6:ed:9a:a8:89:b9:e2:c3:9c:d6:63:eb:9c:71:57",
|
||||
"SecurityGroups": [
|
||||
{
|
||||
"Ref": "AWSEC2SecurityGroupmastersminimalexamplecom"
|
||||
}
|
||||
],
|
||||
"UserData": "extracted"
|
||||
}
|
||||
},
|
||||
"AWSAutoScalingLaunchConfigurationnodesminimalexamplecom": {
|
||||
"Type": "AWS::AutoScaling::LaunchConfiguration",
|
||||
"Properties": {
|
||||
"AssociatePublicIpAddress": true,
|
||||
"BlockDeviceMappings": [
|
||||
{
|
||||
"DeviceName": "/dev/xvda",
|
||||
"Ebs": {
|
||||
"VolumeType": "gp2",
|
||||
"VolumeSize": 128,
|
||||
"DeleteOnTermination": true
|
||||
}
|
||||
}
|
||||
],
|
||||
"IamInstanceProfile": {
|
||||
"Ref": "AWSIAMInstanceProfilenodesminimalexamplecom"
|
||||
},
|
||||
"ImageId": "ami-12345678",
|
||||
"InstanceType": "t2.medium",
|
||||
"KeyName": "kubernetes.minimal.example.com-c4:a6:ed:9a:a8:89:b9:e2:c3:9c:d6:63:eb:9c:71:57",
|
||||
"SecurityGroups": [
|
||||
{
|
||||
"Ref": "AWSEC2SecurityGroupnodesminimalexamplecom"
|
||||
}
|
||||
],
|
||||
"UserData": "extracted"
|
||||
}
|
||||
},
|
||||
"AWSEC2DHCPOptionsminimalexamplecom": {
|
||||
"Type": "AWS::EC2::DHCPOptions",
|
||||
"Properties": {
|
||||
"DomainName": "us-test-1.compute.internal",
|
||||
"DomainNameServers": [
|
||||
"AmazonProvidedDNS"
|
||||
],
|
||||
"Tags": [
|
||||
{
|
||||
"Key": "KubernetesCluster",
|
||||
"Value": "minimal.example.com"
|
||||
},
|
||||
{
|
||||
"Key": "Name",
|
||||
"Value": "minimal.example.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"AWSEC2InternetGatewayminimalexamplecom": {
|
||||
"Type": "AWS::EC2::InternetGateway",
|
||||
"Properties": {
|
||||
"Tags": [
|
||||
{
|
||||
"Key": "KubernetesCluster",
|
||||
"Value": "minimal.example.com"
|
||||
},
|
||||
{
|
||||
"Key": "Name",
|
||||
"Value": "minimal.example.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"AWSEC2Route00000": {
|
||||
"Type": "AWS::EC2::Route",
|
||||
"Properties": {
|
||||
"RouteTableId": {
|
||||
"Ref": "AWSEC2RouteTableminimalexamplecom"
|
||||
},
|
||||
"DestinationCidrBlock": "0.0.0.0/0",
|
||||
"GatewayId": {
|
||||
"Ref": "AWSEC2InternetGatewayminimalexamplecom"
|
||||
}
|
||||
}
|
||||
},
|
||||
"AWSEC2RouteTableminimalexamplecom": {
|
||||
"Type": "AWS::EC2::RouteTable",
|
||||
"Properties": {
|
||||
"VpcId": {
|
||||
"Ref": "AWSEC2VPCminimalexamplecom"
|
||||
},
|
||||
"Tags": [
|
||||
{
|
||||
"Key": "KubernetesCluster",
|
||||
"Value": "minimal.example.com"
|
||||
},
|
||||
{
|
||||
"Key": "Name",
|
||||
"Value": "minimal.example.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"AWSEC2SecurityGroupEgressmasteregress": {
|
||||
"Type": "AWS::EC2::SecurityGroupEgress",
|
||||
"Properties": {
|
||||
"GroupId": {
|
||||
"Ref": "AWSEC2SecurityGroupmastersminimalexamplecom"
|
||||
},
|
||||
"FromPort": 0,
|
||||
"ToPort": 0,
|
||||
"IpProtocol": "-1",
|
||||
"CidrIp": "0.0.0.0/0"
|
||||
}
|
||||
},
|
||||
"AWSEC2SecurityGroupEgressnodeegress": {
|
||||
"Type": "AWS::EC2::SecurityGroupEgress",
|
||||
"Properties": {
|
||||
"GroupId": {
|
||||
"Ref": "AWSEC2SecurityGroupnodesminimalexamplecom"
|
||||
},
|
||||
"FromPort": 0,
|
||||
"ToPort": 0,
|
||||
"IpProtocol": "-1",
|
||||
"CidrIp": "0.0.0.0/0"
|
||||
}
|
||||
},
|
||||
"AWSEC2SecurityGroupIngressallmastertomaster": {
|
||||
"Type": "AWS::EC2::SecurityGroupIngress",
|
||||
"Properties": {
|
||||
"GroupId": {
|
||||
"Ref": "AWSEC2SecurityGroupmastersminimalexamplecom"
|
||||
},
|
||||
"SourceSecurityGroupId": {
|
||||
"Ref": "AWSEC2SecurityGroupmastersminimalexamplecom"
|
||||
},
|
||||
"FromPort": 0,
|
||||
"ToPort": 0,
|
||||
"IpProtocol": "-1"
|
||||
}
|
||||
},
|
||||
"AWSEC2SecurityGroupIngressallmastertonode": {
|
||||
"Type": "AWS::EC2::SecurityGroupIngress",
|
||||
"Properties": {
|
||||
"GroupId": {
|
||||
"Ref": "AWSEC2SecurityGroupnodesminimalexamplecom"
|
||||
},
|
||||
"SourceSecurityGroupId": {
|
||||
"Ref": "AWSEC2SecurityGroupmastersminimalexamplecom"
|
||||
},
|
||||
"FromPort": 0,
|
||||
"ToPort": 0,
|
||||
"IpProtocol": "-1"
|
||||
}
|
||||
},
|
||||
"AWSEC2SecurityGroupIngressallnodetonode": {
|
||||
"Type": "AWS::EC2::SecurityGroupIngress",
|
||||
"Properties": {
|
||||
"GroupId": {
|
||||
"Ref": "AWSEC2SecurityGroupnodesminimalexamplecom"
|
||||
},
|
||||
"SourceSecurityGroupId": {
|
||||
"Ref": "AWSEC2SecurityGroupnodesminimalexamplecom"
|
||||
},
|
||||
"FromPort": 0,
|
||||
"ToPort": 0,
|
||||
"IpProtocol": "-1"
|
||||
}
|
||||
},
|
||||
"AWSEC2SecurityGroupIngresshttpsexternaltomaster00000": {
|
||||
"Type": "AWS::EC2::SecurityGroupIngress",
|
||||
"Properties": {
|
||||
"GroupId": {
|
||||
"Ref": "AWSEC2SecurityGroupmastersminimalexamplecom"
|
||||
},
|
||||
"FromPort": 443,
|
||||
"ToPort": 443,
|
||||
"IpProtocol": "tcp",
|
||||
"CidrIp": "0.0.0.0/0"
|
||||
}
|
||||
},
|
||||
"AWSEC2SecurityGroupIngressnodetomastertcp14000": {
|
||||
"Type": "AWS::EC2::SecurityGroupIngress",
|
||||
"Properties": {
|
||||
"GroupId": {
|
||||
"Ref": "AWSEC2SecurityGroupmastersminimalexamplecom"
|
||||
},
|
||||
"SourceSecurityGroupId": {
|
||||
"Ref": "AWSEC2SecurityGroupnodesminimalexamplecom"
|
||||
},
|
||||
"FromPort": 1,
|
||||
"ToPort": 4000,
|
||||
"IpProtocol": "tcp"
|
||||
}
|
||||
},
|
||||
"AWSEC2SecurityGroupIngressnodetomastertcp400365535": {
|
||||
"Type": "AWS::EC2::SecurityGroupIngress",
|
||||
"Properties": {
|
||||
"GroupId": {
|
||||
"Ref": "AWSEC2SecurityGroupmastersminimalexamplecom"
|
||||
},
|
||||
"SourceSecurityGroupId": {
|
||||
"Ref": "AWSEC2SecurityGroupnodesminimalexamplecom"
|
||||
},
|
||||
"FromPort": 4003,
|
||||
"ToPort": 65535,
|
||||
"IpProtocol": "tcp"
|
||||
}
|
||||
},
|
||||
"AWSEC2SecurityGroupIngressnodetomasterudp165535": {
|
||||
"Type": "AWS::EC2::SecurityGroupIngress",
|
||||
"Properties": {
|
||||
"GroupId": {
|
||||
"Ref": "AWSEC2SecurityGroupmastersminimalexamplecom"
|
||||
},
|
||||
"SourceSecurityGroupId": {
|
||||
"Ref": "AWSEC2SecurityGroupnodesminimalexamplecom"
|
||||
},
|
||||
"FromPort": 1,
|
||||
"ToPort": 65535,
|
||||
"IpProtocol": "udp"
|
||||
}
|
||||
},
|
||||
"AWSEC2SecurityGroupIngresssshexternaltomaster00000": {
|
||||
"Type": "AWS::EC2::SecurityGroupIngress",
|
||||
"Properties": {
|
||||
"GroupId": {
|
||||
"Ref": "AWSEC2SecurityGroupmastersminimalexamplecom"
|
||||
},
|
||||
"FromPort": 22,
|
||||
"ToPort": 22,
|
||||
"IpProtocol": "tcp",
|
||||
"CidrIp": "0.0.0.0/0"
|
||||
}
|
||||
},
|
||||
"AWSEC2SecurityGroupIngresssshexternaltonode00000": {
|
||||
"Type": "AWS::EC2::SecurityGroupIngress",
|
||||
"Properties": {
|
||||
"GroupId": {
|
||||
"Ref": "AWSEC2SecurityGroupnodesminimalexamplecom"
|
||||
},
|
||||
"FromPort": 22,
|
||||
"ToPort": 22,
|
||||
"IpProtocol": "tcp",
|
||||
"CidrIp": "0.0.0.0/0"
|
||||
}
|
||||
},
|
||||
"AWSEC2SecurityGroupmastersminimalexamplecom": {
|
||||
"Type": "AWS::EC2::SecurityGroup",
|
||||
"Properties": {
|
||||
"VpcId": {
|
||||
"Ref": "AWSEC2VPCminimalexamplecom"
|
||||
},
|
||||
"GroupDescription": "Security group for masters",
|
||||
"Tags": [
|
||||
{
|
||||
"Key": "KubernetesCluster",
|
||||
"Value": "minimal.example.com"
|
||||
},
|
||||
{
|
||||
"Key": "Name",
|
||||
"Value": "masters.minimal.example.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"AWSEC2SecurityGroupnodesminimalexamplecom": {
|
||||
"Type": "AWS::EC2::SecurityGroup",
|
||||
"Properties": {
|
||||
"VpcId": {
|
||||
"Ref": "AWSEC2VPCminimalexamplecom"
|
||||
},
|
||||
"GroupDescription": "Security group for nodes",
|
||||
"Tags": [
|
||||
{
|
||||
"Key": "KubernetesCluster",
|
||||
"Value": "minimal.example.com"
|
||||
},
|
||||
{
|
||||
"Key": "Name",
|
||||
"Value": "nodes.minimal.example.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"AWSEC2SubnetRouteTableAssociationustest1aminimalexamplecom": {
|
||||
"Type": "AWS::EC2::SubnetRouteTableAssociation",
|
||||
"Properties": {
|
||||
"SubnetId": {
|
||||
"Ref": "AWSEC2Subnetustest1aminimalexamplecom"
|
||||
},
|
||||
"RouteTableId": {
|
||||
"Ref": "AWSEC2RouteTableminimalexamplecom"
|
||||
}
|
||||
}
|
||||
},
|
||||
"AWSEC2Subnetustest1aminimalexamplecom": {
|
||||
"Type": "AWS::EC2::Subnet",
|
||||
"Properties": {
|
||||
"VpcId": {
|
||||
"Ref": "AWSEC2VPCminimalexamplecom"
|
||||
},
|
||||
"CidrBlock": "172.20.32.0/19",
|
||||
"AvailabilityZone": "us-test-1a",
|
||||
"Tags": [
|
||||
{
|
||||
"Key": "KubernetesCluster",
|
||||
"Value": "minimal.example.com"
|
||||
},
|
||||
{
|
||||
"Key": "Name",
|
||||
"Value": "us-test-1a.minimal.example.com"
|
||||
},
|
||||
{
|
||||
"Key": "kubernetes.io/cluster/minimal.example.com",
|
||||
"Value": "owned"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"AWSEC2VPCDHCPOptionsAssociationminimalexamplecom": {
|
||||
"Type": "AWS::EC2::VPCDHCPOptionsAssociation",
|
||||
"Properties": {
|
||||
"VpcId": {
|
||||
"Ref": "AWSEC2VPCminimalexamplecom"
|
||||
},
|
||||
"DhcpOptionsId": {
|
||||
"Ref": "AWSEC2DHCPOptionsminimalexamplecom"
|
||||
}
|
||||
}
|
||||
},
|
||||
"AWSEC2VPCGatewayAttachmentminimalexamplecom": {
|
||||
"Type": "AWS::EC2::VPCGatewayAttachment",
|
||||
"Properties": {
|
||||
"VpcId": {
|
||||
"Ref": "AWSEC2VPCminimalexamplecom"
|
||||
},
|
||||
"InternetGatewayId": {
|
||||
"Ref": "AWSEC2InternetGatewayminimalexamplecom"
|
||||
}
|
||||
}
|
||||
},
|
||||
"AWSEC2VPCminimalexamplecom": {
|
||||
"Type": "AWS::EC2::VPC",
|
||||
"Properties": {
|
||||
"CidrBlock": "172.20.0.0/16",
|
||||
"EnableDnsHostnames": true,
|
||||
"EnableDnsSupport": true,
|
||||
"Tags": [
|
||||
{
|
||||
"Key": "KubernetesCluster",
|
||||
"Value": "minimal.example.com"
|
||||
},
|
||||
{
|
||||
"Key": "Name",
|
||||
"Value": "minimal.example.com"
|
||||
},
|
||||
{
|
||||
"Key": "kubernetes.io/cluster/minimal.example.com",
|
||||
"Value": "owned"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"AWSEC2Volumeustest1aetcdeventsminimalexamplecom": {
|
||||
"Type": "AWS::EC2::Volume",
|
||||
"Properties": {
|
||||
"AvailabilityZone": "us-test-1a",
|
||||
"Size": 20,
|
||||
"VolumeType": "gp2",
|
||||
"Encrypted": false,
|
||||
"Tags": [
|
||||
{
|
||||
"Key": "KubernetesCluster",
|
||||
"Value": "minimal.example.com"
|
||||
},
|
||||
{
|
||||
"Key": "Name",
|
||||
"Value": "us-test-1a.etcd-events.minimal.example.com"
|
||||
},
|
||||
{
|
||||
"Key": "k8s.io/etcd/events",
|
||||
"Value": "us-test-1a/us-test-1a"
|
||||
},
|
||||
{
|
||||
"Key": "k8s.io/role/master",
|
||||
"Value": "1"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"AWSEC2Volumeustest1aetcdmainminimalexamplecom": {
|
||||
"Type": "AWS::EC2::Volume",
|
||||
"Properties": {
|
||||
"AvailabilityZone": "us-test-1a",
|
||||
"Size": 20,
|
||||
"VolumeType": "gp2",
|
||||
"Encrypted": false,
|
||||
"Tags": [
|
||||
{
|
||||
"Key": "KubernetesCluster",
|
||||
"Value": "minimal.example.com"
|
||||
},
|
||||
{
|
||||
"Key": "Name",
|
||||
"Value": "us-test-1a.etcd-main.minimal.example.com"
|
||||
},
|
||||
{
|
||||
"Key": "k8s.io/etcd/main",
|
||||
"Value": "us-test-1a/us-test-1a"
|
||||
},
|
||||
{
|
||||
"Key": "k8s.io/role/master",
|
||||
"Value": "1"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"AWSIAMInstanceProfilemastersminimalexamplecom": {
|
||||
"Type": "AWS::IAM::InstanceProfile",
|
||||
"Properties": {
|
||||
"Roles": [
|
||||
{
|
||||
"Ref": "AWSIAMRolemastersminimalexamplecom"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"AWSIAMInstanceProfilenodesminimalexamplecom": {
|
||||
"Type": "AWS::IAM::InstanceProfile",
|
||||
"Properties": {
|
||||
"Roles": [
|
||||
{
|
||||
"Ref": "AWSIAMRolenodesminimalexamplecom"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"AWSIAMPolicymastersminimalexamplecom": {
|
||||
"Type": "AWS::IAM::Policy",
|
||||
"Properties": {
|
||||
"PolicyName": "masters.minimal.example.com",
|
||||
"Roles": [
|
||||
{
|
||||
"Ref": "AWSIAMRolemastersminimalexamplecom"
|
||||
}
|
||||
],
|
||||
"PolicyDocument": {
|
||||
"Statement": [
|
||||
{
|
||||
"Action": [
|
||||
"ec2:*"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": [
|
||||
"*"
|
||||
],
|
||||
"Sid": "kopsK8sEC2MasterPermsFullAccess"
|
||||
},
|
||||
{
|
||||
"Action": [
|
||||
"autoscaling:DescribeAutoScalingGroups",
|
||||
"autoscaling:DescribeAutoScalingInstances",
|
||||
"autoscaling:DescribeLaunchConfigurations",
|
||||
"autoscaling:GetAsgForInstance",
|
||||
"autoscaling:SetDesiredCapacity",
|
||||
"autoscaling:TerminateInstanceInAutoScalingGroup",
|
||||
"autoscaling:UpdateAutoScalingGroup"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": [
|
||||
"*"
|
||||
],
|
||||
"Sid": "kopsK8sASMasterPerms"
|
||||
},
|
||||
{
|
||||
"Action": [
|
||||
"elasticloadbalancing:*"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": [
|
||||
"*"
|
||||
],
|
||||
"Sid": "kopsK8sELBMasterPermsFullAccess"
|
||||
},
|
||||
{
|
||||
"Action": [
|
||||
"iam:ListServerCertificates",
|
||||
"iam:GetServerCertificate"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": [
|
||||
"*"
|
||||
],
|
||||
"Sid": "kopsMasterCertIAMPerms"
|
||||
},
|
||||
{
|
||||
"Action": [
|
||||
"ecr:GetAuthorizationToken",
|
||||
"ecr:BatchCheckLayerAvailability",
|
||||
"ecr:GetDownloadUrlForLayer",
|
||||
"ecr:GetRepositoryPolicy",
|
||||
"ecr:DescribeRepositories",
|
||||
"ecr:ListImages",
|
||||
"ecr:BatchGetImage"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": [
|
||||
"*"
|
||||
],
|
||||
"Sid": "kopsK8sECR"
|
||||
},
|
||||
{
|
||||
"Action": [
|
||||
"route53:ChangeResourceRecordSets",
|
||||
"route53:ListResourceRecordSets",
|
||||
"route53:GetHostedZone"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": [
|
||||
"arn:aws:route53:::hostedzone/Z1AFAKE1ZON3YO"
|
||||
],
|
||||
"Sid": "kopsK8sRoute53Change"
|
||||
},
|
||||
{
|
||||
"Action": [
|
||||
"route53:GetChange"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": [
|
||||
"arn:aws:route53:::change/*"
|
||||
],
|
||||
"Sid": "kopsK8sRoute53GetChanges"
|
||||
},
|
||||
{
|
||||
"Action": [
|
||||
"route53:ListHostedZones"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": [
|
||||
"*"
|
||||
],
|
||||
"Sid": "kopsK8sRoute53ListZones"
|
||||
},
|
||||
{
|
||||
"Action": [
|
||||
"route53:ListHostedZones"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": [
|
||||
"*"
|
||||
],
|
||||
"Sid": ""
|
||||
}
|
||||
],
|
||||
"Version": "2012-10-17"
|
||||
}
|
||||
}
|
||||
},
|
||||
"AWSIAMPolicynodesminimalexamplecom": {
|
||||
"Type": "AWS::IAM::Policy",
|
||||
"Properties": {
|
||||
"PolicyName": "nodes.minimal.example.com",
|
||||
"Roles": [
|
||||
{
|
||||
"Ref": "AWSIAMRolenodesminimalexamplecom"
|
||||
}
|
||||
],
|
||||
"PolicyDocument": {
|
||||
"Statement": [
|
||||
{
|
||||
"Action": [
|
||||
"ec2:DescribeInstances"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": [
|
||||
"*"
|
||||
],
|
||||
"Sid": "kopsK8sEC2NodePerms"
|
||||
},
|
||||
{
|
||||
"Action": [
|
||||
"ecr:GetAuthorizationToken",
|
||||
"ecr:BatchCheckLayerAvailability",
|
||||
"ecr:GetDownloadUrlForLayer",
|
||||
"ecr:GetRepositoryPolicy",
|
||||
"ecr:DescribeRepositories",
|
||||
"ecr:ListImages",
|
||||
"ecr:BatchGetImage"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": [
|
||||
"*"
|
||||
],
|
||||
"Sid": "kopsK8sECR"
|
||||
},
|
||||
{
|
||||
"Action": [
|
||||
"route53:ChangeResourceRecordSets",
|
||||
"route53:ListResourceRecordSets",
|
||||
"route53:GetHostedZone"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": [
|
||||
"arn:aws:route53:::hostedzone/Z1AFAKE1ZON3YO"
|
||||
],
|
||||
"Sid": "kopsK8sRoute53Change"
|
||||
},
|
||||
{
|
||||
"Action": [
|
||||
"route53:GetChange"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": [
|
||||
"arn:aws:route53:::change/*"
|
||||
],
|
||||
"Sid": "kopsK8sRoute53GetChanges"
|
||||
},
|
||||
{
|
||||
"Action": [
|
||||
"route53:ListHostedZones"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": [
|
||||
"*"
|
||||
],
|
||||
"Sid": "kopsK8sRoute53ListZones"
|
||||
},
|
||||
{
|
||||
"Action": [
|
||||
"route53:ListHostedZones"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": [
|
||||
"*"
|
||||
],
|
||||
"Sid": ""
|
||||
}
|
||||
],
|
||||
"Version": "2012-10-17"
|
||||
}
|
||||
}
|
||||
},
|
||||
"AWSIAMRolemastersminimalexamplecom": {
|
||||
"Type": "AWS::IAM::Role",
|
||||
"Properties": {
|
||||
"RoleName": "masters.minimal.example.com",
|
||||
"AssumeRolePolicyDocument": {
|
||||
"Statement": [
|
||||
{
|
||||
"Action": "sts:AssumeRole",
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"Service": "ec2.amazonaws.com"
|
||||
}
|
||||
}
|
||||
],
|
||||
"Version": "2012-10-17"
|
||||
}
|
||||
}
|
||||
},
|
||||
"AWSIAMRolenodesminimalexamplecom": {
|
||||
"Type": "AWS::IAM::Role",
|
||||
"Properties": {
|
||||
"RoleName": "nodes.minimal.example.com",
|
||||
"AssumeRolePolicyDocument": {
|
||||
"Statement": [
|
||||
{
|
||||
"Action": "sts:AssumeRole",
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"Service": "ec2.amazonaws.com"
|
||||
}
|
||||
}
|
||||
],
|
||||
"Version": "2012-10-17"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,447 @@
|
|||
Resources.AWSAutoScalingLaunchConfigurationmasterustest1amastersminimalexamplecom.Properties.UserData: |
|
||||
#!/bin/bash
|
||||
# Copyright 2016 The Kubernetes Authors All rights reserved.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o errexit
|
||||
set -o nounset
|
||||
set -o pipefail
|
||||
|
||||
NODEUP_URL=https://kubeupv2.s3.amazonaws.com/kops/1.5.0/linux/amd64/nodeup
|
||||
NODEUP_HASH=
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
function ensure-install-dir() {
|
||||
INSTALL_DIR="/var/cache/kubernetes-install"
|
||||
# On ContainerOS, we install to /var/lib/toolbox install (because of noexec)
|
||||
if [[ -d /var/lib/toolbox ]]; then
|
||||
INSTALL_DIR="/var/lib/toolbox/kubernetes-install"
|
||||
fi
|
||||
mkdir -p ${INSTALL_DIR}
|
||||
cd ${INSTALL_DIR}
|
||||
}
|
||||
|
||||
# Retry a download until we get it. Takes a hash and a set of URLs.
|
||||
#
|
||||
# $1 is the sha1 of the URL. Can be "" if the sha1 is unknown.
|
||||
# $2+ are the URLs to download.
|
||||
download-or-bust() {
|
||||
local -r hash="$1"
|
||||
shift 1
|
||||
|
||||
urls=( $* )
|
||||
while true; do
|
||||
for url in "${urls[@]}"; do
|
||||
local file="${url##*/}"
|
||||
rm -f "${file}"
|
||||
if ! curl -f --ipv4 -Lo "${file}" --connect-timeout 20 --retry 6 --retry-delay 10 "${url}"; then
|
||||
echo "== Failed to download ${url}. Retrying. =="
|
||||
elif [[ -n "${hash}" ]] && ! validate-hash "${file}" "${hash}"; then
|
||||
echo "== Hash validation of ${url} failed. Retrying. =="
|
||||
else
|
||||
if [[ -n "${hash}" ]]; then
|
||||
echo "== Downloaded ${url} (SHA1 = ${hash}) =="
|
||||
else
|
||||
echo "== Downloaded ${url} =="
|
||||
fi
|
||||
return
|
||||
fi
|
||||
done
|
||||
|
||||
echo "All downloads failed; sleeping before retrying"
|
||||
sleep 60
|
||||
done
|
||||
}
|
||||
|
||||
validate-hash() {
|
||||
local -r file="$1"
|
||||
local -r expected="$2"
|
||||
local actual
|
||||
|
||||
actual=$(sha1sum ${file} | awk '{ print $1 }') || true
|
||||
if [[ "${actual}" != "${expected}" ]]; then
|
||||
echo "== ${file} corrupted, sha1 ${actual} doesn't match expected ${expected} =="
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
function split-commas() {
|
||||
echo $1 | tr "," "\n"
|
||||
}
|
||||
|
||||
function try-download-release() {
|
||||
# TODO(zmerlynn): Now we REALLY have no excuse not to do the reboot
|
||||
# optimization.
|
||||
|
||||
local -r nodeup_urls=( $(split-commas "${NODEUP_URL}") )
|
||||
local -r nodeup_filename="${nodeup_urls[0]##*/}"
|
||||
if [[ -n "${NODEUP_HASH:-}" ]]; then
|
||||
local -r nodeup_hash="${NODEUP_HASH}"
|
||||
else
|
||||
# TODO: Remove?
|
||||
echo "Downloading sha1 (not found in env)"
|
||||
download-or-bust "" "${nodeup_urls[@]/%/.sha1}"
|
||||
local -r nodeup_hash=$(cat "${nodeup_filename}.sha1")
|
||||
fi
|
||||
|
||||
echo "Downloading nodeup (${nodeup_urls[@]})"
|
||||
download-or-bust "${nodeup_hash}" "${nodeup_urls[@]}"
|
||||
|
||||
chmod +x nodeup
|
||||
}
|
||||
|
||||
function download-release() {
|
||||
# In case of failure checking integrity of release, retry.
|
||||
until try-download-release; do
|
||||
sleep 15
|
||||
echo "Couldn't download release. Retrying..."
|
||||
done
|
||||
|
||||
echo "Running nodeup"
|
||||
# We can't run in the foreground because of https://github.com/docker/docker/issues/23793
|
||||
( cd ${INSTALL_DIR}; ./nodeup --install-systemd-unit --conf=${INSTALL_DIR}/kube_env.yaml --v=8 )
|
||||
}
|
||||
|
||||
####################################################################################
|
||||
|
||||
/bin/systemd-machine-id-setup || echo "failed to set up ensure machine-id configured"
|
||||
|
||||
echo "== nodeup node config starting =="
|
||||
ensure-install-dir
|
||||
|
||||
cat > cluster_spec.yaml << '__EOF_CLUSTER_SPEC'
|
||||
cloudConfig: null
|
||||
docker:
|
||||
bridge: ""
|
||||
ipMasq: false
|
||||
ipTables: false
|
||||
logLevel: warn
|
||||
storage: overlay,aufs
|
||||
version: 1.11.2
|
||||
kubeAPIServer:
|
||||
address: 127.0.0.1
|
||||
admissionControl:
|
||||
- NamespaceLifecycle
|
||||
- LimitRanger
|
||||
- ServiceAccount
|
||||
- PersistentVolumeLabel
|
||||
- DefaultStorageClass
|
||||
- ResourceQuota
|
||||
allowPrivileged: true
|
||||
apiServerCount: 1
|
||||
authorizationMode: AlwaysAllow
|
||||
cloudProvider: aws
|
||||
etcdServers:
|
||||
- http://127.0.0.1:4001
|
||||
etcdServersOverrides:
|
||||
- /events#http://127.0.0.1:4002
|
||||
image: gcr.io/google_containers/kube-apiserver:v1.4.6
|
||||
insecurePort: 8080
|
||||
logLevel: 2
|
||||
securePort: 443
|
||||
serviceClusterIPRange: 100.64.0.0/13
|
||||
storageBackend: etcd2
|
||||
kubeControllerManager:
|
||||
allocateNodeCIDRs: true
|
||||
cloudProvider: aws
|
||||
clusterCIDR: 100.96.0.0/11
|
||||
clusterName: minimal.example.com
|
||||
configureCloudRoutes: true
|
||||
image: gcr.io/google_containers/kube-controller-manager:v1.4.6
|
||||
leaderElection:
|
||||
leaderElect: true
|
||||
logLevel: 2
|
||||
master: 127.0.0.1:8080
|
||||
kubeProxy:
|
||||
clusterCIDR: 100.96.0.0/11
|
||||
cpuRequest: 100m
|
||||
featureGates: null
|
||||
hostnameOverride: '@aws'
|
||||
image: gcr.io/google_containers/kube-proxy:v1.4.6
|
||||
logLevel: 2
|
||||
kubeScheduler:
|
||||
image: gcr.io/google_containers/kube-scheduler:v1.4.6
|
||||
leaderElection:
|
||||
leaderElect: true
|
||||
logLevel: 2
|
||||
master: http://127.0.0.1:8080
|
||||
kubelet:
|
||||
allowPrivileged: true
|
||||
apiServers: https://api.internal.minimal.example.com
|
||||
babysitDaemons: true
|
||||
cgroupRoot: docker
|
||||
cloudProvider: aws
|
||||
clusterDNS: 100.64.0.10
|
||||
clusterDomain: cluster.local
|
||||
enableDebuggingHandlers: true
|
||||
evictionHard: memory.available<100Mi,nodefs.available<10%,nodefs.inodesFree<5%,imagefs.available<10%,imagefs.inodesFree<5%
|
||||
hostnameOverride: '@aws'
|
||||
logLevel: 2
|
||||
networkPluginMTU: 9001
|
||||
networkPluginName: kubenet
|
||||
nonMasqueradeCIDR: 100.64.0.0/10
|
||||
podInfraContainerImage: gcr.io/google_containers/pause-amd64:3.0
|
||||
podManifestPath: /etc/kubernetes/manifests
|
||||
reconcileCIDR: true
|
||||
masterKubelet:
|
||||
allowPrivileged: true
|
||||
apiServers: http://127.0.0.1:8080
|
||||
babysitDaemons: true
|
||||
cgroupRoot: docker
|
||||
cloudProvider: aws
|
||||
clusterDNS: 100.64.0.10
|
||||
clusterDomain: cluster.local
|
||||
enableDebuggingHandlers: true
|
||||
evictionHard: memory.available<100Mi,nodefs.available<10%,nodefs.inodesFree<5%,imagefs.available<10%,imagefs.inodesFree<5%
|
||||
hostnameOverride: '@aws'
|
||||
logLevel: 2
|
||||
networkPluginMTU: 9001
|
||||
networkPluginName: kubenet
|
||||
nonMasqueradeCIDR: 100.64.0.0/10
|
||||
podCIDR: 10.123.45.0/28
|
||||
podInfraContainerImage: gcr.io/google_containers/pause-amd64:3.0
|
||||
podManifestPath: /etc/kubernetes/manifests
|
||||
reconcileCIDR: true
|
||||
registerSchedulable: false
|
||||
|
||||
__EOF_CLUSTER_SPEC
|
||||
|
||||
cat > ig_spec.yaml << '__EOF_IG_SPEC'
|
||||
kubelet: null
|
||||
nodeLabels: null
|
||||
taints: null
|
||||
|
||||
__EOF_IG_SPEC
|
||||
|
||||
cat > kube_env.yaml << '__EOF_KUBE_ENV'
|
||||
Assets:
|
||||
- 7d70e090951486cae52d9a82b7aaf5056f84f8ed@https://storage.googleapis.com/kubernetes-release/release/v1.4.6/bin/linux/amd64/kubelet
|
||||
- 9adcd120fdb7ad6e64c061e56a05fefc12e9618b@https://storage.googleapis.com/kubernetes-release/release/v1.4.6/bin/linux/amd64/kubectl
|
||||
- 19d49f7b2b99cd2493d5ae0ace896c64e289ccbb@https://storage.googleapis.com/kubernetes-release/network-plugins/cni-07a8a28637e97b22eb8dfe710eeae1344f69d16e.tar.gz
|
||||
- cbba856746a441c7d1a9e95e141c982a1b8864e6@https://kubeupv2.s3.amazonaws.com/kops/1.5.0/linux/amd64/utils.tar.gz
|
||||
ClusterName: minimal.example.com
|
||||
ConfigBase: memfs://clusters.example.com/minimal.example.com
|
||||
InstanceGroupName: master-us-test-1a
|
||||
Tags:
|
||||
- _automatic_upgrades
|
||||
- _aws
|
||||
- _kubernetes_master
|
||||
channels:
|
||||
- memfs://clusters.example.com/minimal.example.com/addons/bootstrap-channel.yaml
|
||||
protokubeImage:
|
||||
hash: 7c3a0ec0723fd350609b2958bc5b8ab02583851c
|
||||
name: protokube:1.5.0
|
||||
source: https://kubeupv2.s3.amazonaws.com/kops/1.5.0/images/protokube.tar.gz
|
||||
|
||||
__EOF_KUBE_ENV
|
||||
|
||||
download-release
|
||||
echo "== nodeup node config done =="
|
||||
Resources.AWSAutoScalingLaunchConfigurationnodesminimalexamplecom.Properties.UserData: |
|
||||
#!/bin/bash
|
||||
# Copyright 2016 The Kubernetes Authors All rights reserved.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o errexit
|
||||
set -o nounset
|
||||
set -o pipefail
|
||||
|
||||
NODEUP_URL=https://kubeupv2.s3.amazonaws.com/kops/1.5.0/linux/amd64/nodeup
|
||||
NODEUP_HASH=
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
function ensure-install-dir() {
|
||||
INSTALL_DIR="/var/cache/kubernetes-install"
|
||||
# On ContainerOS, we install to /var/lib/toolbox install (because of noexec)
|
||||
if [[ -d /var/lib/toolbox ]]; then
|
||||
INSTALL_DIR="/var/lib/toolbox/kubernetes-install"
|
||||
fi
|
||||
mkdir -p ${INSTALL_DIR}
|
||||
cd ${INSTALL_DIR}
|
||||
}
|
||||
|
||||
# Retry a download until we get it. Takes a hash and a set of URLs.
|
||||
#
|
||||
# $1 is the sha1 of the URL. Can be "" if the sha1 is unknown.
|
||||
# $2+ are the URLs to download.
|
||||
download-or-bust() {
|
||||
local -r hash="$1"
|
||||
shift 1
|
||||
|
||||
urls=( $* )
|
||||
while true; do
|
||||
for url in "${urls[@]}"; do
|
||||
local file="${url##*/}"
|
||||
rm -f "${file}"
|
||||
if ! curl -f --ipv4 -Lo "${file}" --connect-timeout 20 --retry 6 --retry-delay 10 "${url}"; then
|
||||
echo "== Failed to download ${url}. Retrying. =="
|
||||
elif [[ -n "${hash}" ]] && ! validate-hash "${file}" "${hash}"; then
|
||||
echo "== Hash validation of ${url} failed. Retrying. =="
|
||||
else
|
||||
if [[ -n "${hash}" ]]; then
|
||||
echo "== Downloaded ${url} (SHA1 = ${hash}) =="
|
||||
else
|
||||
echo "== Downloaded ${url} =="
|
||||
fi
|
||||
return
|
||||
fi
|
||||
done
|
||||
|
||||
echo "All downloads failed; sleeping before retrying"
|
||||
sleep 60
|
||||
done
|
||||
}
|
||||
|
||||
validate-hash() {
|
||||
local -r file="$1"
|
||||
local -r expected="$2"
|
||||
local actual
|
||||
|
||||
actual=$(sha1sum ${file} | awk '{ print $1 }') || true
|
||||
if [[ "${actual}" != "${expected}" ]]; then
|
||||
echo "== ${file} corrupted, sha1 ${actual} doesn't match expected ${expected} =="
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
function split-commas() {
|
||||
echo $1 | tr "," "\n"
|
||||
}
|
||||
|
||||
function try-download-release() {
|
||||
# TODO(zmerlynn): Now we REALLY have no excuse not to do the reboot
|
||||
# optimization.
|
||||
|
||||
local -r nodeup_urls=( $(split-commas "${NODEUP_URL}") )
|
||||
local -r nodeup_filename="${nodeup_urls[0]##*/}"
|
||||
if [[ -n "${NODEUP_HASH:-}" ]]; then
|
||||
local -r nodeup_hash="${NODEUP_HASH}"
|
||||
else
|
||||
# TODO: Remove?
|
||||
echo "Downloading sha1 (not found in env)"
|
||||
download-or-bust "" "${nodeup_urls[@]/%/.sha1}"
|
||||
local -r nodeup_hash=$(cat "${nodeup_filename}.sha1")
|
||||
fi
|
||||
|
||||
echo "Downloading nodeup (${nodeup_urls[@]})"
|
||||
download-or-bust "${nodeup_hash}" "${nodeup_urls[@]}"
|
||||
|
||||
chmod +x nodeup
|
||||
}
|
||||
|
||||
function download-release() {
|
||||
# In case of failure checking integrity of release, retry.
|
||||
until try-download-release; do
|
||||
sleep 15
|
||||
echo "Couldn't download release. Retrying..."
|
||||
done
|
||||
|
||||
echo "Running nodeup"
|
||||
# We can't run in the foreground because of https://github.com/docker/docker/issues/23793
|
||||
( cd ${INSTALL_DIR}; ./nodeup --install-systemd-unit --conf=${INSTALL_DIR}/kube_env.yaml --v=8 )
|
||||
}
|
||||
|
||||
####################################################################################
|
||||
|
||||
/bin/systemd-machine-id-setup || echo "failed to set up ensure machine-id configured"
|
||||
|
||||
echo "== nodeup node config starting =="
|
||||
ensure-install-dir
|
||||
|
||||
cat > cluster_spec.yaml << '__EOF_CLUSTER_SPEC'
|
||||
cloudConfig: null
|
||||
docker:
|
||||
bridge: ""
|
||||
ipMasq: false
|
||||
ipTables: false
|
||||
logLevel: warn
|
||||
storage: overlay,aufs
|
||||
version: 1.11.2
|
||||
kubeProxy:
|
||||
clusterCIDR: 100.96.0.0/11
|
||||
cpuRequest: 100m
|
||||
featureGates: null
|
||||
hostnameOverride: '@aws'
|
||||
image: gcr.io/google_containers/kube-proxy:v1.4.6
|
||||
logLevel: 2
|
||||
kubelet:
|
||||
allowPrivileged: true
|
||||
apiServers: https://api.internal.minimal.example.com
|
||||
babysitDaemons: true
|
||||
cgroupRoot: docker
|
||||
cloudProvider: aws
|
||||
clusterDNS: 100.64.0.10
|
||||
clusterDomain: cluster.local
|
||||
enableDebuggingHandlers: true
|
||||
evictionHard: memory.available<100Mi,nodefs.available<10%,nodefs.inodesFree<5%,imagefs.available<10%,imagefs.inodesFree<5%
|
||||
hostnameOverride: '@aws'
|
||||
logLevel: 2
|
||||
networkPluginMTU: 9001
|
||||
networkPluginName: kubenet
|
||||
nonMasqueradeCIDR: 100.64.0.0/10
|
||||
podInfraContainerImage: gcr.io/google_containers/pause-amd64:3.0
|
||||
podManifestPath: /etc/kubernetes/manifests
|
||||
reconcileCIDR: true
|
||||
|
||||
__EOF_CLUSTER_SPEC
|
||||
|
||||
cat > ig_spec.yaml << '__EOF_IG_SPEC'
|
||||
kubelet: null
|
||||
nodeLabels: null
|
||||
taints: null
|
||||
|
||||
__EOF_IG_SPEC
|
||||
|
||||
cat > kube_env.yaml << '__EOF_KUBE_ENV'
|
||||
Assets:
|
||||
- 7d70e090951486cae52d9a82b7aaf5056f84f8ed@https://storage.googleapis.com/kubernetes-release/release/v1.4.6/bin/linux/amd64/kubelet
|
||||
- 9adcd120fdb7ad6e64c061e56a05fefc12e9618b@https://storage.googleapis.com/kubernetes-release/release/v1.4.6/bin/linux/amd64/kubectl
|
||||
- 19d49f7b2b99cd2493d5ae0ace896c64e289ccbb@https://storage.googleapis.com/kubernetes-release/network-plugins/cni-07a8a28637e97b22eb8dfe710eeae1344f69d16e.tar.gz
|
||||
- cbba856746a441c7d1a9e95e141c982a1b8864e6@https://kubeupv2.s3.amazonaws.com/kops/1.5.0/linux/amd64/utils.tar.gz
|
||||
ClusterName: minimal.example.com
|
||||
ConfigBase: memfs://clusters.example.com/minimal.example.com
|
||||
InstanceGroupName: nodes
|
||||
Tags:
|
||||
- _automatic_upgrades
|
||||
- _aws
|
||||
channels:
|
||||
- memfs://clusters.example.com/minimal.example.com/addons/bootstrap-channel.yaml
|
||||
protokubeImage:
|
||||
hash: 7c3a0ec0723fd350609b2958bc5b8ab02583851c
|
||||
name: protokube:1.5.0
|
||||
source: https://kubeupv2.s3.amazonaws.com/kops/1.5.0/images/protokube.tar.gz
|
||||
|
||||
__EOF_KUBE_ENV
|
||||
|
||||
download-release
|
||||
echo "== nodeup node config done =="
|
||||
|
|
@ -0,0 +1 @@
|
|||
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQCtWu40XQo8dczLsCq0OWV+hxm9uV3WxeH9Kgh4sMzQxNtoU1pvW0XdjpkBesRKGoolfWeCLXWxpyQb1IaiMkKoz7MdhQ/6UKjMjP66aFWWp3pwD0uj0HuJ7tq4gKHKRYGTaZIRWpzUiANBrjugVgA+Sd7E/mYwc/DMXkIyRZbvhQ==
|
||||
|
|
@ -0,0 +1,77 @@
|
|||
apiVersion: kops/v1alpha2
|
||||
kind: Cluster
|
||||
metadata:
|
||||
creationTimestamp: "2016-12-10T22:42:27Z"
|
||||
name: minimal.example.com
|
||||
spec:
|
||||
kubernetesApiAccess:
|
||||
- 0.0.0.0/0
|
||||
channel: stable
|
||||
cloudProvider: aws
|
||||
configBase: memfs://clusters.example.com/minimal.example.com
|
||||
etcdClusters:
|
||||
- etcdMembers:
|
||||
- instanceGroup: master-us-test-1a
|
||||
name: us-test-1a
|
||||
name: main
|
||||
- etcdMembers:
|
||||
- instanceGroup: master-us-test-1a
|
||||
name: us-test-1a
|
||||
name: events
|
||||
kubernetesVersion: v1.4.6
|
||||
masterInternalName: api.internal.minimal.example.com
|
||||
masterPublicName: api.minimal.example.com
|
||||
networkCIDR: 172.20.0.0/16
|
||||
networking:
|
||||
kubenet: {}
|
||||
nonMasqueradeCIDR: 100.64.0.0/10
|
||||
sshAccess:
|
||||
- 0.0.0.0/0
|
||||
topology:
|
||||
masters: public
|
||||
nodes: public
|
||||
subnets:
|
||||
- cidr: 172.20.32.0/19
|
||||
name: us-test-1a
|
||||
type: Public
|
||||
zone: us-test-1a
|
||||
|
||||
---
|
||||
|
||||
apiVersion: kops/v1alpha2
|
||||
kind: InstanceGroup
|
||||
metadata:
|
||||
creationTimestamp: "2016-12-10T22:42:28Z"
|
||||
name: nodes
|
||||
labels:
|
||||
kops.k8s.io/cluster: minimal.example.com
|
||||
spec:
|
||||
associatePublicIp: true
|
||||
image: kope.io/k8s-1.4-debian-jessie-amd64-hvm-ebs-2016-10-21
|
||||
machineType: t2.medium
|
||||
maxSize: 2
|
||||
minSize: 2
|
||||
role: Node
|
||||
subnets:
|
||||
- us-test-1a
|
||||
|
||||
---
|
||||
|
||||
apiVersion: kops/v1alpha2
|
||||
kind: InstanceGroup
|
||||
metadata:
|
||||
creationTimestamp: "2016-12-10T22:42:28Z"
|
||||
name: master-us-test-1a
|
||||
labels:
|
||||
kops.k8s.io/cluster: minimal.example.com
|
||||
spec:
|
||||
associatePublicIp: true
|
||||
image: kope.io/k8s-1.4-debian-jessie-amd64-hvm-ebs-2016-10-21
|
||||
machineType: m3.medium
|
||||
maxSize: 1
|
||||
minSize: 1
|
||||
role: Master
|
||||
subnets:
|
||||
- us-test-1a
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,400 @@
|
|||
output "cluster_name" {
|
||||
value = "minimal.example.com"
|
||||
}
|
||||
|
||||
output "master_security_group_ids" {
|
||||
value = ["${aws_security_group.masters-minimal-example-com.id}"]
|
||||
}
|
||||
|
||||
output "masters_role_arn" {
|
||||
value = "${aws_iam_role.masters-minimal-example-com.arn}"
|
||||
}
|
||||
|
||||
output "masters_role_name" {
|
||||
value = "${aws_iam_role.masters-minimal-example-com.name}"
|
||||
}
|
||||
|
||||
output "node_security_group_ids" {
|
||||
value = ["${aws_security_group.nodes-minimal-example-com.id}"]
|
||||
}
|
||||
|
||||
output "node_subnet_ids" {
|
||||
value = ["${aws_subnet.us-test-1a-minimal-example-com.id}"]
|
||||
}
|
||||
|
||||
output "nodes_role_arn" {
|
||||
value = "${aws_iam_role.nodes-minimal-example-com.arn}"
|
||||
}
|
||||
|
||||
output "nodes_role_name" {
|
||||
value = "${aws_iam_role.nodes-minimal-example-com.name}"
|
||||
}
|
||||
|
||||
output "region" {
|
||||
value = "us-test-1"
|
||||
}
|
||||
|
||||
output "vpc_id" {
|
||||
value = "${aws_vpc.minimal-example-com.id}"
|
||||
}
|
||||
|
||||
provider "aws" {
|
||||
region = "us-test-1"
|
||||
}
|
||||
|
||||
resource "aws_autoscaling_group" "master-us-test-1a-masters-minimal-example-com" {
|
||||
name = "master-us-test-1a.masters.minimal.example.com"
|
||||
launch_configuration = "${aws_launch_configuration.master-us-test-1a-masters-minimal-example-com.id}"
|
||||
max_size = 1
|
||||
min_size = 1
|
||||
vpc_zone_identifier = ["${aws_subnet.us-test-1a-minimal-example-com.id}"]
|
||||
|
||||
tag = {
|
||||
key = "KubernetesCluster"
|
||||
value = "minimal.example.com"
|
||||
propagate_at_launch = true
|
||||
}
|
||||
|
||||
tag = {
|
||||
key = "Name"
|
||||
value = "master-us-test-1a.masters.minimal.example.com"
|
||||
propagate_at_launch = true
|
||||
}
|
||||
|
||||
tag = {
|
||||
key = "k8s.io/role/master"
|
||||
value = "1"
|
||||
propagate_at_launch = true
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_autoscaling_group" "nodes-minimal-example-com" {
|
||||
name = "nodes.minimal.example.com"
|
||||
launch_configuration = "${aws_launch_configuration.nodes-minimal-example-com.id}"
|
||||
max_size = 2
|
||||
min_size = 2
|
||||
vpc_zone_identifier = ["${aws_subnet.us-test-1a-minimal-example-com.id}"]
|
||||
|
||||
tag = {
|
||||
key = "KubernetesCluster"
|
||||
value = "minimal.example.com"
|
||||
propagate_at_launch = true
|
||||
}
|
||||
|
||||
tag = {
|
||||
key = "Name"
|
||||
value = "nodes.minimal.example.com"
|
||||
propagate_at_launch = true
|
||||
}
|
||||
|
||||
tag = {
|
||||
key = "k8s.io/role/node"
|
||||
value = "1"
|
||||
propagate_at_launch = true
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_ebs_volume" "us-test-1a-etcd-events-minimal-example-com" {
|
||||
availability_zone = "us-test-1a"
|
||||
size = 20
|
||||
type = "gp2"
|
||||
encrypted = false
|
||||
|
||||
tags = {
|
||||
KubernetesCluster = "minimal.example.com"
|
||||
Name = "us-test-1a.etcd-events.minimal.example.com"
|
||||
"k8s.io/etcd/events" = "us-test-1a/us-test-1a"
|
||||
"k8s.io/role/master" = "1"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_ebs_volume" "us-test-1a-etcd-main-minimal-example-com" {
|
||||
availability_zone = "us-test-1a"
|
||||
size = 20
|
||||
type = "gp2"
|
||||
encrypted = false
|
||||
|
||||
tags = {
|
||||
KubernetesCluster = "minimal.example.com"
|
||||
Name = "us-test-1a.etcd-main.minimal.example.com"
|
||||
"k8s.io/etcd/main" = "us-test-1a/us-test-1a"
|
||||
"k8s.io/role/master" = "1"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_iam_instance_profile" "masters-minimal-example-com" {
|
||||
name = "masters.minimal.example.com"
|
||||
role = "${aws_iam_role.masters-minimal-example-com.name}"
|
||||
}
|
||||
|
||||
resource "aws_iam_instance_profile" "nodes-minimal-example-com" {
|
||||
name = "nodes.minimal.example.com"
|
||||
role = "${aws_iam_role.nodes-minimal-example-com.name}"
|
||||
}
|
||||
|
||||
resource "aws_iam_role" "masters-minimal-example-com" {
|
||||
name = "masters.minimal.example.com"
|
||||
assume_role_policy = "${file("${path.module}/data/aws_iam_role_masters.minimal.example.com_policy")}"
|
||||
}
|
||||
|
||||
resource "aws_iam_role" "nodes-minimal-example-com" {
|
||||
name = "nodes.minimal.example.com"
|
||||
assume_role_policy = "${file("${path.module}/data/aws_iam_role_nodes.minimal.example.com_policy")}"
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy" "masters-minimal-example-com" {
|
||||
name = "masters.minimal.example.com"
|
||||
role = "${aws_iam_role.masters-minimal-example-com.name}"
|
||||
policy = "${file("${path.module}/data/aws_iam_role_policy_masters.minimal.example.com_policy")}"
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy" "nodes-minimal-example-com" {
|
||||
name = "nodes.minimal.example.com"
|
||||
role = "${aws_iam_role.nodes-minimal-example-com.name}"
|
||||
policy = "${file("${path.module}/data/aws_iam_role_policy_nodes.minimal.example.com_policy")}"
|
||||
}
|
||||
|
||||
resource "aws_internet_gateway" "minimal-example-com" {
|
||||
vpc_id = "${aws_vpc.minimal-example-com.id}"
|
||||
|
||||
tags = {
|
||||
KubernetesCluster = "minimal.example.com"
|
||||
Name = "minimal.example.com"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_key_pair" "kubernetes-minimal-example-com-c4a6ed9aa889b9e2c39cd663eb9c7157" {
|
||||
key_name = "kubernetes.minimal.example.com-c4:a6:ed:9a:a8:89:b9:e2:c3:9c:d6:63:eb:9c:71:57"
|
||||
public_key = "${file("${path.module}/data/aws_key_pair_kubernetes.minimal.example.com-c4a6ed9aa889b9e2c39cd663eb9c7157_public_key")}"
|
||||
}
|
||||
|
||||
resource "aws_launch_configuration" "master-us-test-1a-masters-minimal-example-com" {
|
||||
name_prefix = "master-us-test-1a.masters.minimal.example.com-"
|
||||
image_id = "ami-12345678"
|
||||
instance_type = "m3.medium"
|
||||
key_name = "${aws_key_pair.kubernetes-minimal-example-com-c4a6ed9aa889b9e2c39cd663eb9c7157.id}"
|
||||
iam_instance_profile = "${aws_iam_instance_profile.masters-minimal-example-com.id}"
|
||||
security_groups = ["${aws_security_group.masters-minimal-example-com.id}"]
|
||||
associate_public_ip_address = true
|
||||
user_data = "${file("${path.module}/data/aws_launch_configuration_master-us-test-1a.masters.minimal.example.com_user_data")}"
|
||||
|
||||
root_block_device = {
|
||||
volume_type = "gp2"
|
||||
volume_size = 64
|
||||
delete_on_termination = true
|
||||
}
|
||||
|
||||
ephemeral_block_device = {
|
||||
device_name = "/dev/sdc"
|
||||
virtual_name = "ephemeral0"
|
||||
}
|
||||
|
||||
lifecycle = {
|
||||
create_before_destroy = true
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_launch_configuration" "nodes-minimal-example-com" {
|
||||
name_prefix = "nodes.minimal.example.com-"
|
||||
image_id = "ami-12345678"
|
||||
instance_type = "t2.medium"
|
||||
key_name = "${aws_key_pair.kubernetes-minimal-example-com-c4a6ed9aa889b9e2c39cd663eb9c7157.id}"
|
||||
iam_instance_profile = "${aws_iam_instance_profile.nodes-minimal-example-com.id}"
|
||||
security_groups = ["${aws_security_group.nodes-minimal-example-com.id}"]
|
||||
associate_public_ip_address = true
|
||||
user_data = "${file("${path.module}/data/aws_launch_configuration_nodes.minimal.example.com_user_data")}"
|
||||
|
||||
root_block_device = {
|
||||
volume_type = "gp2"
|
||||
volume_size = 128
|
||||
delete_on_termination = true
|
||||
}
|
||||
|
||||
lifecycle = {
|
||||
create_before_destroy = true
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_route" "0-0-0-0--0" {
|
||||
route_table_id = "${aws_route_table.minimal-example-com.id}"
|
||||
destination_cidr_block = "0.0.0.0/0"
|
||||
gateway_id = "${aws_internet_gateway.minimal-example-com.id}"
|
||||
}
|
||||
|
||||
resource "aws_route_table" "minimal-example-com" {
|
||||
vpc_id = "${aws_vpc.minimal-example-com.id}"
|
||||
|
||||
tags = {
|
||||
KubernetesCluster = "minimal.example.com"
|
||||
Name = "minimal.example.com"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_route_table_association" "us-test-1a-minimal-example-com" {
|
||||
subnet_id = "${aws_subnet.us-test-1a-minimal-example-com.id}"
|
||||
route_table_id = "${aws_route_table.minimal-example-com.id}"
|
||||
}
|
||||
|
||||
resource "aws_security_group" "masters-minimal-example-com" {
|
||||
name = "masters.minimal.example.com"
|
||||
vpc_id = "${aws_vpc.minimal-example-com.id}"
|
||||
description = "Security group for masters"
|
||||
|
||||
tags = {
|
||||
KubernetesCluster = "minimal.example.com"
|
||||
Name = "masters.minimal.example.com"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_security_group" "nodes-minimal-example-com" {
|
||||
name = "nodes.minimal.example.com"
|
||||
vpc_id = "${aws_vpc.minimal-example-com.id}"
|
||||
description = "Security group for nodes"
|
||||
|
||||
tags = {
|
||||
KubernetesCluster = "minimal.example.com"
|
||||
Name = "nodes.minimal.example.com"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "all-master-to-master" {
|
||||
type = "ingress"
|
||||
security_group_id = "${aws_security_group.masters-minimal-example-com.id}"
|
||||
source_security_group_id = "${aws_security_group.masters-minimal-example-com.id}"
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
protocol = "-1"
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "all-master-to-node" {
|
||||
type = "ingress"
|
||||
security_group_id = "${aws_security_group.nodes-minimal-example-com.id}"
|
||||
source_security_group_id = "${aws_security_group.masters-minimal-example-com.id}"
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
protocol = "-1"
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "all-node-to-node" {
|
||||
type = "ingress"
|
||||
security_group_id = "${aws_security_group.nodes-minimal-example-com.id}"
|
||||
source_security_group_id = "${aws_security_group.nodes-minimal-example-com.id}"
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
protocol = "-1"
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "https-external-to-master-0-0-0-0--0" {
|
||||
type = "ingress"
|
||||
security_group_id = "${aws_security_group.masters-minimal-example-com.id}"
|
||||
from_port = 443
|
||||
to_port = 443
|
||||
protocol = "tcp"
|
||||
cidr_blocks = ["0.0.0.0/0"]
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "master-egress" {
|
||||
type = "egress"
|
||||
security_group_id = "${aws_security_group.masters-minimal-example-com.id}"
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
protocol = "-1"
|
||||
cidr_blocks = ["0.0.0.0/0"]
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "node-egress" {
|
||||
type = "egress"
|
||||
security_group_id = "${aws_security_group.nodes-minimal-example-com.id}"
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
protocol = "-1"
|
||||
cidr_blocks = ["0.0.0.0/0"]
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "node-to-master-tcp-1-4000" {
|
||||
type = "ingress"
|
||||
security_group_id = "${aws_security_group.masters-minimal-example-com.id}"
|
||||
source_security_group_id = "${aws_security_group.nodes-minimal-example-com.id}"
|
||||
from_port = 1
|
||||
to_port = 4000
|
||||
protocol = "tcp"
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "node-to-master-tcp-4003-65535" {
|
||||
type = "ingress"
|
||||
security_group_id = "${aws_security_group.masters-minimal-example-com.id}"
|
||||
source_security_group_id = "${aws_security_group.nodes-minimal-example-com.id}"
|
||||
from_port = 4003
|
||||
to_port = 65535
|
||||
protocol = "tcp"
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "node-to-master-udp-1-65535" {
|
||||
type = "ingress"
|
||||
security_group_id = "${aws_security_group.masters-minimal-example-com.id}"
|
||||
source_security_group_id = "${aws_security_group.nodes-minimal-example-com.id}"
|
||||
from_port = 1
|
||||
to_port = 65535
|
||||
protocol = "udp"
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "ssh-external-to-master-0-0-0-0--0" {
|
||||
type = "ingress"
|
||||
security_group_id = "${aws_security_group.masters-minimal-example-com.id}"
|
||||
from_port = 22
|
||||
to_port = 22
|
||||
protocol = "tcp"
|
||||
cidr_blocks = ["0.0.0.0/0"]
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "ssh-external-to-node-0-0-0-0--0" {
|
||||
type = "ingress"
|
||||
security_group_id = "${aws_security_group.nodes-minimal-example-com.id}"
|
||||
from_port = 22
|
||||
to_port = 22
|
||||
protocol = "tcp"
|
||||
cidr_blocks = ["0.0.0.0/0"]
|
||||
}
|
||||
|
||||
resource "aws_subnet" "us-test-1a-minimal-example-com" {
|
||||
vpc_id = "${aws_vpc.minimal-example-com.id}"
|
||||
cidr_block = "172.20.32.0/19"
|
||||
availability_zone = "us-test-1a"
|
||||
|
||||
tags = {
|
||||
KubernetesCluster = "minimal.example.com"
|
||||
Name = "us-test-1a.minimal.example.com"
|
||||
"kubernetes.io/cluster/minimal.example.com" = "owned"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_vpc" "minimal-example-com" {
|
||||
cidr_block = "172.20.0.0/16"
|
||||
enable_dns_hostnames = true
|
||||
enable_dns_support = true
|
||||
|
||||
tags = {
|
||||
KubernetesCluster = "minimal.example.com"
|
||||
Name = "minimal.example.com"
|
||||
"kubernetes.io/cluster/minimal.example.com" = "owned"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_vpc_dhcp_options" "minimal-example-com" {
|
||||
domain_name = "us-test-1.compute.internal"
|
||||
domain_name_servers = ["AmazonProvidedDNS"]
|
||||
|
||||
tags = {
|
||||
KubernetesCluster = "minimal.example.com"
|
||||
Name = "minimal.example.com"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_vpc_dhcp_options_association" "minimal-example-com" {
|
||||
vpc_id = "${aws_vpc.minimal-example-com.id}"
|
||||
dhcp_options_id = "${aws_vpc_dhcp_options.minimal-example-com.id}"
|
||||
}
|
||||
|
||||
terraform = {
|
||||
required_version = ">= 0.9.3"
|
||||
}
|
||||
Loading…
Reference in New Issue