|
| 1 | +#cloud-config |
| 2 | +hostname: node1 |
| 3 | + |
| 4 | +ssh_pwauth: no |
| 5 | + |
| 6 | +write_files: |
| 7 | +- path: "/etc/systemd/journald.conf.d/max_disk_use.conf" |
| 8 | + content: | |
| 9 | + [Journal] |
| 10 | + SystemMaxUse=5G |
| 11 | + |
| 12 | + |
| 13 | +- path: "/etc/modules-load.d/k8s.conf" |
| 14 | + content: | |
| 15 | + ip_vs |
| 16 | + ip_vs_rr |
| 17 | + ip_vs_wrr |
| 18 | + ip_vs_sh |
| 19 | + nf_conntrack_ipv4 |
| 20 | + |
| 21 | + |
| 22 | +- path: "/etc/sysctl.d/k8s.conf" |
| 23 | + content: | |
| 24 | + net.bridge.bridge-nf-call-ip6tables = 1 |
| 25 | + net.bridge.bridge-nf-call-iptables = 1 |
| 26 | + kernel.panic_on_oops = 1 |
| 27 | + kernel.panic = 10 |
| 28 | + net.ipv4.ip_forward = 1 |
| 29 | + vm.overcommit_memory = 1 |
| 30 | + |
| 31 | + |
| 32 | +- path: /etc/sysconfig/selinux |
| 33 | + content: | |
| 34 | + # This file controls the state of SELinux on the system. |
| 35 | + # SELINUX= can take one of these three values: |
| 36 | + # enforcing - SELinux security policy is enforced. |
| 37 | + # permissive - SELinux prints warnings instead of enforcing. |
| 38 | + # disabled - No SELinux policy is loaded. |
| 39 | + SELINUX=permissive |
| 40 | + # SELINUXTYPE= can take one of three two values: |
| 41 | + # targeted - Targeted processes are protected, |
| 42 | + # minimum - Modification of targeted policy. Only selected processes are protected. |
| 43 | + # mls - Multi Level Security protection. |
| 44 | + SELINUXTYPE=targeted |
| 45 | + |
| 46 | +- path: "/opt/bin/setup" |
| 47 | + permissions: "0777" |
| 48 | + content: | |
| 49 | + #!/bin/bash |
| 50 | + set -xeuo pipefail |
| 51 | + |
| 52 | + setenforce 0 || true |
| 53 | + |
| 54 | + # As we added some modules and don't want to reboot, restart the service |
| 55 | + systemctl restart systemd-modules-load.service |
| 56 | + sysctl --system |
| 57 | + |
| 58 | + # The normal way of setting it via cloud-init is broken: |
| 59 | + # https://bugs.launchpad.net/cloud-init/+bug/1662542 |
| 60 | + hostnamectl set-hostname node1 |
| 61 | + |
| 62 | + yum install -y docker-1.13.1 \ |
| 63 | + ebtables \ |
| 64 | + ethtool \ |
| 65 | + nfs-utils \ |
| 66 | + bash-completion \ |
| 67 | + sudo \ |
| 68 | + socat \ |
| 69 | + wget \ |
| 70 | + curl \ |
| 71 | + ipvsadm \ |
| 72 | + open-vm-tools |
| 73 | + |
| 74 | + #setup some common directories |
| 75 | + mkdir -p /opt/bin/ |
| 76 | + mkdir -p /var/lib/calico |
| 77 | + mkdir -p /etc/kubernetes/manifests |
| 78 | + mkdir -p /etc/cni/net.d |
| 79 | + mkdir -p /opt/cni/bin |
| 80 | + |
| 81 | + # cni |
| 82 | + if [ ! -f /opt/cni/bin/loopback ]; then |
| 83 | + curl -L https://github.com/containernetworking/plugins/releases/download/v0.6.0/cni-plugins-amd64-v0.6.0.tgz | tar -xvzC /opt/cni/bin -f - |
| 84 | + fi |
| 85 | + # kubelet |
| 86 | + if [ ! -f /opt/bin/kubelet ]; then |
| 87 | + curl -Lfo /opt/bin/kubelet https://storage.googleapis.com/kubernetes-release/release/v1.12.0/bin/linux/amd64/kubelet |
| 88 | + chmod +x /opt/bin/kubelet |
| 89 | + fi |
| 90 | + |
| 91 | + if [[ ! -x /opt/bin/health-monitor.sh ]]; then |
| 92 | + curl -Lfo /opt/bin/health-monitor.sh https://raw.githubusercontent.com/kubermatic/machine-controller/8b5b66e4910a6228dfaecccaa0a3b05ec4902f8e/pkg/userdata/scripts/health-monitor.sh |
| 93 | + chmod +x /opt/bin/health-monitor.sh |
| 94 | + fi |
| 95 | + |
| 96 | + systemctl enable --now vmtoolsd.service |
| 97 | + systemctl enable --now docker |
| 98 | + systemctl enable --now kubelet |
| 99 | + systemctl enable --now --no-block kubelet-healthcheck.service |
| 100 | + systemctl enable --now --no-block docker-healthcheck.service |
| 101 | + |
| 102 | +- path: "/opt/bin/supervise.sh" |
| 103 | + permissions: "0755" |
| 104 | + content: | |
| 105 | + #!/bin/bash |
| 106 | + set -xeuo pipefail |
| 107 | + while ! "$@"; do |
| 108 | + sleep 1 |
| 109 | + done |
| 110 | + |
| 111 | +- path: "/etc/systemd/system/kubelet.service" |
| 112 | + content: | |
| 113 | + [Unit] |
| 114 | + After=docker.service |
| 115 | + Requires=docker.service |
| 116 | + |
| 117 | + Description=kubelet: The Kubernetes Node Agent |
| 118 | + Documentation=https://kubernetes.io/docs/home/ |
| 119 | + |
| 120 | + [Service] |
| 121 | + Restart=always |
| 122 | + StartLimitInterval=0 |
| 123 | + RestartSec=10 |
| 124 | + |
| 125 | + Environment="PATH=/opt/bin:/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin/" |
| 126 | + |
| 127 | + ExecStart=/opt/bin/kubelet $KUBELET_EXTRA_ARGS \ |
| 128 | + --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf \ |
| 129 | + --kubeconfig=/etc/kubernetes/kubelet.conf \ |
| 130 | + --pod-manifest-path=/etc/kubernetes/manifests \ |
| 131 | + --allow-privileged=true \ |
| 132 | + --network-plugin=cni \ |
| 133 | + --cni-conf-dir=/etc/cni/net.d \ |
| 134 | + --cni-bin-dir=/opt/cni/bin \ |
| 135 | + --authorization-mode=Webhook \ |
| 136 | + --client-ca-file=/etc/kubernetes/pki/ca.crt \ |
| 137 | + --rotate-certificates=true \ |
| 138 | + --cert-dir=/etc/kubernetes/pki \ |
| 139 | + --authentication-token-webhook=true \ |
| 140 | + --cloud-provider=vsphere \ |
| 141 | + --cloud-config=/etc/kubernetes/cloud-config \ |
| 142 | + --hostname-override=node1 \ |
| 143 | + --read-only-port=0 \ |
| 144 | + --exit-on-lock-contention \ |
| 145 | + --lock-file=/tmp/kubelet.lock \ |
| 146 | + --anonymous-auth=false \ |
| 147 | + --protect-kernel-defaults=true \ |
| 148 | + --cluster-dns= \ |
| 149 | + --cluster-domain=cluster.local |
| 150 | + |
| 151 | + [Install] |
| 152 | + WantedBy=multi-user.target |
| 153 | + |
| 154 | +- path: "/etc/systemd/system/kubelet.service.d/extras.conf" |
| 155 | + content: | |
| 156 | + [Service] |
| 157 | + Environment="KUBELET_EXTRA_ARGS=--cgroup-driver=systemd" |
| 158 | + |
| 159 | +- path: "/etc/kubernetes/cloud-config" |
| 160 | + content: | |
| 161 | + {config:true} |
| 162 | + |
| 163 | +- path: "/etc/kubernetes/bootstrap-kubelet.conf" |
| 164 | + content: | |
| 165 | + apiVersion: v1 |
| 166 | + clusters: |
| 167 | + - cluster: |
| 168 | + certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVXakNDQTBLZ0F3SUJBZ0lKQUxmUmxXc0k4WVFITUEwR0NTcUdTSWIzRFFFQkJRVUFNSHN4Q3pBSkJnTlYKQkFZVEFsVlRNUXN3Q1FZRFZRUUlFd0pEUVRFV01CUUdBMVVFQnhNTlUyRnVJRVp5WVc1amFYTmpiekVVTUJJRwpBMVVFQ2hNTFFuSmhaR1pwZEhwcGJtTXhFakFRQmdOVkJBTVRDV3h2WTJGc2FHOXpkREVkTUJzR0NTcUdTSWIzCkRRRUpBUllPWW5KaFpFQmtZVzVuWVM1amIyMHdIaGNOTVRRd056RTFNakEwTmpBMVdoY05NVGN3TlRBME1qQTAKTmpBMVdqQjdNUXN3Q1FZRFZRUUdFd0pWVXpFTE1Ba0dBMVVFQ0JNQ1EwRXhGakFVQmdOVkJBY1REVk5oYmlCRwpjbUZ1WTJselkyOHhGREFTQmdOVkJBb1RDMEp5WVdSbWFYUjZhVzVqTVJJd0VBWURWUVFERXdsc2IyTmhiR2h2CmMzUXhIVEFiQmdrcWhraUc5dzBCQ1FFV0RtSnlZV1JBWkdGdVoyRXVZMjl0TUlJQklqQU5CZ2txaGtpRzl3MEIKQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBdDVmQWpwNGZUY2VrV1VUZnpzcDBreWloMU9ZYnNHTDBLWDFlUmJTUwpSOE9kMCs5UTYySHlueStHRndNVGI0QS9LVThtc3NvSHZjY2VTQUFid2ZieEZLLytzNTFUb2JxVW5PUlpyT29UClpqa1V5Z2J5WERTSzk5WUJiY1IxUGlwOHZ3TVRtNFhLdUx0Q2lnZUJCZGpqQVFkZ1VPMjhMRU5HbHNNbm1lWWsKSmZPRFZHblZtcjVMdGI5QU5BOElLeVRmc25ISjRpT0NTL1BsUGJVajJxN1lub1ZMcG9zVUJNbGdVYi9DeWtYMwptT29MYjR5SkpReUEvaVNUNlp4aUlFajM2RDR5V1o1bGc3WUpsK1VpaUJRSEdDblBkR3lpcHFWMDZleDBoZVlXCmNhaVc4TFdaU1VROTNqUStXVkNIOGhUN0RRTzFkbXN2VW1YbHEvSmVBbHdRL1FJREFRQUJvNEhnTUlIZE1CMEcKQTFVZERnUVdCQlJjQVJPdGhTNFA0VTd2VGZqQnlDNTY5UjdFNkRDQnJRWURWUjBqQklHbE1JR2lnQlJjQVJPdApoUzRQNFU3dlRmakJ5QzU2OVI3RTZLRi9wSDB3ZXpFTE1Ba0dBMVVFQmhNQ1ZWTXhDekFKQmdOVkJBZ1RBa05CCk1SWXdGQVlEVlFRSEV3MVRZVzRnUm5KaGJtTnBjMk52TVJRd0VnWURWUVFLRXd0Q2NtRmtabWwwZW1sdVl6RVMKTUJBR0ExVUVBeE1KYkc5allXeG9iM04wTVIwd0d3WUpLb1pJaHZjTkFRa0JGZzVpY21Ga1FHUmhibWRoTG1OdgpiWUlKQUxmUmxXc0k4WVFITUF3R0ExVWRFd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVGQlFBRGdnRUJBRzZoClU5ZjlzTkgwLzZvQmJHR3kyRVZVMFVnSVRVUUlyRldvOXJGa3JXNWsvWGtEalFtKzNsempUMGlHUjRJeEUvQW8KZVU2c1FodWE3d3JXZUZFbjQ3R0w5OGxuQ3NKZEQ3b1pOaEZtUTk1VGIvTG5EVWpzNVlqOWJyUDBOV3pYZllVNApVSzJabklOSlJjSnBCOGlSQ2FDeEU4RGRjVUYwWHFJRXE2cEEyNzJzbm9MbWlYTE12Tmwza1lFZG0ramU2dm9ECjU4U05WRVVzenR6UXlYbUpFaENwd1ZJMEE2UUNqelhqK3F2cG13M1paSGk4SndYZWk4WlpCTFRTRkJraThaN24Kc0g5QkJIMzgvU3pVbUFONFFIU1B5MWdqcW0wME9BRThOYVlEa2gvYnpFNGQ3bUxHR01XcC9XRTNLUFN1ODJIRgprUGU2WG9TYmlMbS9reGszMlQwPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t |
| 169 | + server: https://server:443 |
| 170 | + name: "" |
| 171 | + contexts: [] |
| 172 | + current-context: "" |
| 173 | + kind: Config |
| 174 | + preferences: {} |
| 175 | + users: |
| 176 | + - name: "" |
| 177 | + user: |
| 178 | + token: my-token |
| 179 | + |
| 180 | + |
| 181 | +- path: "/etc/kubernetes/pki/ca.crt" |
| 182 | + content: | |
| 183 | + -----BEGIN CERTIFICATE----- |
| 184 | + MIIEWjCCA0KgAwIBAgIJALfRlWsI8YQHMA0GCSqGSIb3DQEBBQUAMHsxCzAJBgNV |
| 185 | + BAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEUMBIG |
| 186 | + A1UEChMLQnJhZGZpdHppbmMxEjAQBgNVBAMTCWxvY2FsaG9zdDEdMBsGCSqGSIb3 |
| 187 | + DQEJARYOYnJhZEBkYW5nYS5jb20wHhcNMTQwNzE1MjA0NjA1WhcNMTcwNTA0MjA0 |
| 188 | + NjA1WjB7MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFjAUBgNVBAcTDVNhbiBG |
| 189 | + cmFuY2lzY28xFDASBgNVBAoTC0JyYWRmaXR6aW5jMRIwEAYDVQQDEwlsb2NhbGhv |
| 190 | + c3QxHTAbBgkqhkiG9w0BCQEWDmJyYWRAZGFuZ2EuY29tMIIBIjANBgkqhkiG9w0B |
| 191 | + AQEFAAOCAQ8AMIIBCgKCAQEAt5fAjp4fTcekWUTfzsp0kyih1OYbsGL0KX1eRbSS |
| 192 | + R8Od0+9Q62Hyny+GFwMTb4A/KU8mssoHvcceSAAbwfbxFK/+s51TobqUnORZrOoT |
| 193 | + ZjkUygbyXDSK99YBbcR1Pip8vwMTm4XKuLtCigeBBdjjAQdgUO28LENGlsMnmeYk |
| 194 | + JfODVGnVmr5Ltb9ANA8IKyTfsnHJ4iOCS/PlPbUj2q7YnoVLposUBMlgUb/CykX3 |
| 195 | + mOoLb4yJJQyA/iST6ZxiIEj36D4yWZ5lg7YJl+UiiBQHGCnPdGyipqV06ex0heYW |
| 196 | + caiW8LWZSUQ93jQ+WVCH8hT7DQO1dmsvUmXlq/JeAlwQ/QIDAQABo4HgMIHdMB0G |
| 197 | + A1UdDgQWBBRcAROthS4P4U7vTfjByC569R7E6DCBrQYDVR0jBIGlMIGigBRcAROt |
| 198 | + hS4P4U7vTfjByC569R7E6KF/pH0wezELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNB |
| 199 | + MRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRQwEgYDVQQKEwtCcmFkZml0emluYzES |
| 200 | + MBAGA1UEAxMJbG9jYWxob3N0MR0wGwYJKoZIhvcNAQkBFg5icmFkQGRhbmdhLmNv |
| 201 | + bYIJALfRlWsI8YQHMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAG6h |
| 202 | + U9f9sNH0/6oBbGGy2EVU0UgITUQIrFWo9rFkrW5k/XkDjQm+3lzjT0iGR4IxE/Ao |
| 203 | + eU6sQhua7wrWeFEn47GL98lnCsJdD7oZNhFmQ95Tb/LnDUjs5Yj9brP0NWzXfYU4 |
| 204 | + UK2ZnINJRcJpB8iRCaCxE8DdcUF0XqIEq6pA272snoLmiXLMvNl3kYEdm+je6voD |
| 205 | + 58SNVEUsztzQyXmJEhCpwVI0A6QCjzXj+qvpmw3ZZHi8JwXei8ZZBLTSFBki8Z7n |
| 206 | + sH9BBH38/SzUmAN4QHSPy1gjqm00OAE8NaYDkh/bzE4d7mLGGMWp/WE3KPSu82HF |
| 207 | + kPe6XoSbiLm/kxk32T0= |
| 208 | + -----END CERTIFICATE----- |
| 209 | + |
| 210 | +- path: "/etc/systemd/system/setup.service" |
| 211 | + permissions: "0644" |
| 212 | + content: | |
| 213 | + [Install] |
| 214 | + WantedBy=multi-user.target |
| 215 | + |
| 216 | + [Unit] |
| 217 | + Requires=network-online.target |
| 218 | + After=network-online.target |
| 219 | + |
| 220 | + [Service] |
| 221 | + Type=oneshot |
| 222 | + RemainAfterExit=true |
| 223 | + ExecStart=/opt/bin/supervise.sh /opt/bin/setup |
| 224 | + |
| 225 | +- path: "/etc/profile.d/opt-bin-path.sh" |
| 226 | + permissions: "0644" |
| 227 | + content: | |
| 228 | + export PATH="/opt/bin:$PATH" |
| 229 | + |
| 230 | +- path: /etc/systemd/system/kubelet-healthcheck.service |
| 231 | + permissions: "0644" |
| 232 | + content: | |
| 233 | + [Unit] |
| 234 | + Requires=kubelet.service |
| 235 | + After=kubelet.service |
| 236 | + |
| 237 | + [Service] |
| 238 | + ExecStart=/opt/bin/health-monitor.sh kubelet |
| 239 | + |
| 240 | + [Install] |
| 241 | + WantedBy=multi-user.target |
| 242 | + |
| 243 | + |
| 244 | +- path: /etc/systemd/system/docker-healthcheck.service |
| 245 | + permissions: "0644" |
| 246 | + content: | |
| 247 | + [Unit] |
| 248 | + Requires=docker.service |
| 249 | + After=docker.service |
| 250 | + |
| 251 | + [Service] |
| 252 | + ExecStart=/opt/bin/health-monitor.sh container-runtime |
| 253 | + |
| 254 | + [Install] |
| 255 | + WantedBy=multi-user.target |
| 256 | + |
| 257 | + |
| 258 | +runcmd: |
| 259 | +- systemctl enable --now setup.service |
0 commit comments