Skip to content

Commit 207d473

Browse files
abhay-nutanixabhay-nutanix
committed
fix: examples.sync changes
1 parent f2f4831 commit 207d473

File tree

10 files changed

+394
-28
lines changed

10 files changed

+394
-28
lines changed

‎charts/cluster-api-runtime-extensions-nutanix/defaultclusterclasses/nutanix-cluster-class.yaml‎

Lines changed: 370 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,370 @@
1+
apiVersion: bootstrap.cluster.x-k8s.io/v1beta1
2+
kind: KubeadmConfigTemplate
3+
metadata:
4+
labels:
5+
cluster.x-k8s.io/provider: nutanix
6+
name: nutanix-quick-start-kcfg-0
7+
spec:
8+
template:
9+
spec:
10+
files:
11+
- content: |
12+
apiVersion: kubelet.config.k8s.io/v1beta1
13+
kind: KubeletConfiguration
14+
evictionHard:
15+
nodefs.available: "10%"
16+
nodefs.inodesFree: "5%"
17+
imagefs.available: "15%"
18+
memory.available: "100Mi"
19+
imagefs.inodesFree: "10%"
20+
path: /etc/kubernetes/patches/kubeletconfiguration0+strategic.json
21+
permissions: "0600"
22+
- content: |
23+
apiVersion: kubelet.config.k8s.io/v1beta1
24+
kind: KubeletConfiguration
25+
# 4.2.4 Ensure that the --read-only-port argument is set to 0
26+
readOnlyPort: 0
27+
# 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0
28+
# Recommendation: Set to 5m instead of 4h as per CIS guidelines
29+
streamingConnectionIdleTimeout: "5m"
30+
# 4.2.8 Ensure that the event-qps argument is set to a level which ensures appropriate event capture
31+
eventRecordQPS: 5
32+
# 4.2.12 Updated with recommended strong cipher suites
33+
tlsCipherSuites: [TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384]
34+
# 4.2.13 Ensure that a limit is set on pod PIDs
35+
podPidsLimit: 4096
36+
path: /etc/kubernetes/patches/kubeletconfiguration1+strategic.json
37+
permissions: "0600"
38+
joinConfiguration:
39+
nodeRegistration:
40+
kubeletExtraArgs:
41+
cloud-provider: external
42+
patches:
43+
directory: /etc/kubernetes/patches
44+
postKubeadmCommands:
45+
- echo "after kubeadm call" > /var/log/postkubeadm.log
46+
- chmod 600 "$(systemctl show -P FragmentPath kubelet.service)"
47+
- chmod 600 $(systemctl show -P DropInPaths kubelet.service)
48+
- chmod 600 /var/lib/kubelet/config.yaml
49+
preKubeadmCommands:
50+
- echo "before kubeadm call" > /var/log/prekubeadm.log
51+
- hostnamectl set-hostname "{{ ds.meta_data.hostname }}"
52+
verbosity: 10
53+
---
54+
apiVersion: cluster.x-k8s.io/v1beta1
55+
kind: ClusterClass
56+
metadata:
57+
labels:
58+
cluster.x-k8s.io/provider: nutanix
59+
name: nutanix-quick-start
60+
spec:
61+
controlPlane:
62+
machineHealthCheck:
63+
maxUnhealthy: 40%
64+
nodeStartupTimeout: 10m
65+
unhealthyConditions:
66+
- status: "False"
67+
timeout: 300s
68+
type: Ready
69+
- status: Unknown
70+
timeout: 300s
71+
type: Ready
72+
- status: "True"
73+
timeout: 300s
74+
type: MemoryPressure
75+
- status: "True"
76+
timeout: 300s
77+
type: DiskPressure
78+
- status: "True"
79+
timeout: 300s
80+
type: PIDPressure
81+
- status: "True"
82+
timeout: 300s
83+
type: NetworkUnavailable
84+
machineInfrastructure:
85+
ref:
86+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
87+
kind: NutanixMachineTemplate
88+
name: nutanix-quick-start-cp-nmt
89+
ref:
90+
apiVersion: controlplane.cluster.x-k8s.io/v1beta1
91+
kind: KubeadmControlPlaneTemplate
92+
name: nutanix-quick-start-kcpt
93+
infrastructure:
94+
ref:
95+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
96+
kind: NutanixClusterTemplate
97+
name: nutanix-quick-start-nct
98+
patches:
99+
- external:
100+
discoverVariablesExtension: nutanixclusterconfigvars-dv.cluster-api-runtime-extensions-nutanix
101+
generateExtension: nutanixclusterv4configpatch-gp.cluster-api-runtime-extensions-nutanix
102+
name: cluster-config
103+
- external:
104+
discoverVariablesExtension: nutanixworkerconfigvars-dv.cluster-api-runtime-extensions-nutanix
105+
generateExtension: nutanixworkerv4configpatch-gp.cluster-api-runtime-extensions-nutanix
106+
name: worker-config
107+
workers:
108+
machineDeployments:
109+
- class: default-worker
110+
machineHealthCheck:
111+
maxUnhealthy: 40%
112+
nodeStartupTimeout: 10m
113+
unhealthyConditions:
114+
- status: "False"
115+
timeout: 300s
116+
type: Ready
117+
- status: Unknown
118+
timeout: 300s
119+
type: Ready
120+
- status: "True"
121+
timeout: 300s
122+
type: MemoryPressure
123+
- status: "True"
124+
timeout: 300s
125+
type: DiskPressure
126+
- status: "True"
127+
timeout: 300s
128+
type: PIDPressure
129+
- status: "True"
130+
timeout: 300s
131+
type: NetworkUnavailable
132+
template:
133+
bootstrap:
134+
ref:
135+
apiVersion: bootstrap.cluster.x-k8s.io/v1beta1
136+
kind: KubeadmConfigTemplate
137+
name: nutanix-quick-start-kcfg-0
138+
infrastructure:
139+
ref:
140+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
141+
kind: NutanixMachineTemplate
142+
name: nutanix-quick-start-md-nmt
143+
---
144+
apiVersion: controlplane.cluster.x-k8s.io/v1beta1
145+
kind: KubeadmControlPlaneTemplate
146+
metadata:
147+
labels:
148+
cluster.x-k8s.io/provider: nutanix
149+
name: nutanix-quick-start-kcpt
150+
spec:
151+
template:
152+
spec:
153+
kubeadmConfigSpec:
154+
clusterConfiguration:
155+
apiServer:
156+
extraArgs:
157+
admission-control-config-file: /etc/kubernetes/admission.yaml
158+
enable-admission-plugins: DenyServiceExternalIPs,EventRateLimit,NodeRestriction
159+
profiling: "false"
160+
service-account-lookup: "true"
161+
extraVolumes:
162+
- hostPath: /etc/kubernetes/admission.yaml
163+
mountPath: /etc/kubernetes/admission.yaml
164+
name: admission-config
165+
pathType: File
166+
readOnly: true
167+
- hostPath: /etc/kubernetes/eventratelimit-config.yaml
168+
mountPath: /etc/kubernetes/eventratelimit-config.yaml
169+
name: eventratelimit-config
170+
pathType: File
171+
readOnly: true
172+
controllerManager:
173+
extraArgs:
174+
cloud-provider: external
175+
profiling: "false"
176+
terminated-pod-gc-threshold: "10000"
177+
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
178+
scheduler:
179+
extraArgs:
180+
profiling: "false"
181+
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
182+
files:
183+
- content: |-
184+
apiVersion: v1
185+
kind: Pod
186+
metadata:
187+
name: kube-vip
188+
namespace: kube-system
189+
spec:
190+
containers:
191+
- args:
192+
- manager
193+
env:
194+
- name: vip_arp
195+
value: "true"
196+
- name: port
197+
value: '{{ .Port }}'
198+
- name: vip_nodename
199+
valueFrom:
200+
fieldRef:
201+
fieldPath: spec.nodeName
202+
- name: vip_subnet
203+
value: "32"
204+
- name: dns_mode
205+
value: first
206+
- name: cp_enable
207+
value: "true"
208+
- name: cp_namespace
209+
value: kube-system
210+
- name: vip_leaderelection
211+
value: "true"
212+
- name: vip_leasename
213+
value: plndr-cp-lock
214+
- name: vip_leaseduration
215+
value: "15"
216+
- name: vip_renewdeadline
217+
value: "10"
218+
- name: vip_retryperiod
219+
value: "2"
220+
- name: address
221+
value: '{{ .Address }}'
222+
- name: prometheus_server
223+
image: ghcr.io/kube-vip/kube-vip:v0.9.2
224+
imagePullPolicy: IfNotPresent
225+
name: kube-vip
226+
resources: {}
227+
securityContext:
228+
capabilities:
229+
add:
230+
- NET_ADMIN
231+
- NET_RAW
232+
drop:
233+
- ALL
234+
volumeMounts:
235+
- mountPath: /etc/kubernetes/admin.conf
236+
name: kubeconfig
237+
hostAliases:
238+
- hostnames:
239+
- kubernetes
240+
ip: 127.0.0.1
241+
hostNetwork: true
242+
volumes:
243+
- hostPath:
244+
path: /etc/kubernetes/admin.conf
245+
name: kubeconfig
246+
path: /etc/kubernetes/manifests/kube-vip.yaml
247+
- content: |
248+
apiVersion: kubelet.config.k8s.io/v1beta1
249+
kind: KubeletConfiguration
250+
evictionHard:
251+
nodefs.available: "10%"
252+
nodefs.inodesFree: "5%"
253+
imagefs.available: "15%"
254+
memory.available: "100Mi"
255+
imagefs.inodesFree: "10%"
256+
path: /etc/kubernetes/patches/kubeletconfiguration0+strategic.json
257+
permissions: "0600"
258+
- content: |
259+
apiVersion: kubelet.config.k8s.io/v1beta1
260+
kind: KubeletConfiguration
261+
# 4.2.4 Ensure that the --read-only-port argument is set to 0
262+
readOnlyPort: 0
263+
# 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0
264+
# Recommendation: Set to 5m instead of 4h as per CIS guidelines
265+
streamingConnectionIdleTimeout: "5m"
266+
# 4.2.8 Ensure that the event-qps argument is set to a level which ensures appropriate event capture
267+
eventRecordQPS: 5
268+
# 4.2.12 Updated with recommended strong cipher suites
269+
tlsCipherSuites: [TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384]
270+
# 4.2.13 Ensure that a limit is set on pod PIDs
271+
podPidsLimit: 4096
272+
path: /etc/kubernetes/patches/kubeletconfiguration1+strategic.json
273+
permissions: "0600"
274+
- content: |
275+
apiVersion: apiserver.config.k8s.io/v1
276+
kind: AdmissionConfiguration
277+
plugins:
278+
- name: EventRateLimit
279+
path: /etc/kubernetes/eventratelimit-config.yaml
280+
path: /etc/kubernetes/admission.yaml
281+
permissions: "0600"
282+
- content: |
283+
apiVersion: eventratelimit.admission.k8s.io/v1alpha1
284+
kind: Configuration
285+
limits:
286+
- type: Server
287+
qps: 10000
288+
burst: 40000
289+
path: /etc/kubernetes/eventratelimit-config.yaml
290+
permissions: "0600"
291+
initConfiguration:
292+
nodeRegistration:
293+
kubeletExtraArgs:
294+
cloud-provider: external
295+
patches:
296+
directory: /etc/kubernetes/patches
297+
joinConfiguration:
298+
nodeRegistration:
299+
kubeletExtraArgs:
300+
cloud-provider: external
301+
patches:
302+
directory: /etc/kubernetes/patches
303+
postKubeadmCommands:
304+
- chmod 600 "$(systemctl show -P FragmentPath kubelet.service)"
305+
- chmod 600 $(systemctl show -P DropInPaths kubelet.service)
306+
- chmod 600 /var/lib/kubelet/config.yaml
307+
preKubeadmCommands:
308+
- echo "before kubeadm call" > /var/log/prekubeadm.log
309+
- hostnamectl set-hostname "{{ ds.meta_data.hostname }}"
310+
- echo "::1 ipv6-localhost ipv6-loopback" >/etc/hosts
311+
- echo "127.0.0.1 localhost" >>/etc/hosts
312+
- echo "127.0.0.1 {{ ds.meta_data.hostname }}" >> /etc/hosts
313+
useExperimentalRetryJoin: true
314+
verbosity: 10
315+
---
316+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
317+
kind: NutanixClusterTemplate
318+
metadata:
319+
labels:
320+
cluster.x-k8s.io/provider: nutanix
321+
name: nutanix-quick-start-nct
322+
spec:
323+
template:
324+
spec:
325+
controlPlaneEndpoint:
326+
host: PLACEHOLDER
327+
port: 6443
328+
prismCentral:
329+
address: PLACEHOLDER
330+
credentialRef:
331+
kind: Secret
332+
name: PLACEHOLDER
333+
namespace: default
334+
port: 9440
335+
---
336+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
337+
kind: NutanixMachineTemplate
338+
metadata:
339+
labels:
340+
cluster.x-k8s.io/provider: nutanix
341+
name: nutanix-quick-start-cp-nmt
342+
spec:
343+
template:
344+
spec:
345+
bootType: legacy
346+
image:
347+
name: placeholder-image
348+
type: name
349+
memorySize: 4Gi
350+
systemDiskSize: 40Gi
351+
vcpuSockets: 2
352+
vcpusPerSocket: 1
353+
---
354+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
355+
kind: NutanixMachineTemplate
356+
metadata:
357+
labels:
358+
cluster.x-k8s.io/provider: nutanix
359+
name: nutanix-quick-start-md-nmt
360+
spec:
361+
template:
362+
spec:
363+
bootType: legacy
364+
image:
365+
name: placeholder-image
366+
type: name
367+
memorySize: 4Gi
368+
systemDiskSize: 40Gi
369+
vcpuSockets: 2
370+
vcpusPerSocket: 1

‎examples/capi-quick-start/aws-cluster-calico-crs.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ spec:
4949
lookup:
5050
baseOS: ${AMI_LOOKUP_BASEOS}
5151
format: ${AMI_LOOKUP_FORMAT}
52-
org: ${AMI_LOOKUP_ORG}
52+
org: "${AMI_LOOKUP_ORG}"
5353
dns:
5454
coreDNS: {}
5555
encryptionAtRest:
@@ -62,13 +62,13 @@ spec:
6262
lookup:
6363
baseOS: ${AMI_LOOKUP_BASEOS}
6464
format: ${AMI_LOOKUP_FORMAT}
65-
org: ${AMI_LOOKUP_ORG}
65+
org: "${AMI_LOOKUP_ORG}"
6666
version: ${KUBERNETES_VERSION}
6767
workers:
6868
machineDeployments:
6969
- class: default-worker
7070
metadata:
7171
annotations:
72-
cluster.x-k8s.io/cluster-api-autoscaler-node-group-max-size: ${WORKER_MACHINE_COUNT}
73-
cluster.x-k8s.io/cluster-api-autoscaler-node-group-min-size: ${WORKER_MACHINE_COUNT}
72+
cluster.x-k8s.io/cluster-api-autoscaler-node-group-max-size: "${WORKER_MACHINE_COUNT}"
73+
cluster.x-k8s.io/cluster-api-autoscaler-node-group-min-size: "${WORKER_MACHINE_COUNT}"
7474
name: md-0

0 commit comments

Comments
 (0)