forked from kubernetes/kops
-
Notifications
You must be signed in to change notification settings - Fork 0
/
template_functions.go
305 lines (245 loc) · 8.31 KB
/
template_functions.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
package cloudup
import (
"encoding/base64"
"encoding/binary"
"fmt"
"github.com/golang/glog"
"k8s.io/kops/upup/pkg/api"
"k8s.io/kops/util/pkg/vfs"
"math/big"
"net"
"sort"
"strings"
"text/template"
)
type TemplateFunctions struct {
cluster *api.Cluster
instanceGroups []*api.InstanceGroup
tags map[string]struct{}
region string
}
func (tf *TemplateFunctions) WellKnownServiceIP(id int) (net.IP, error) {
_, cidr, err := net.ParseCIDR(tf.cluster.Spec.ServiceClusterIPRange)
if err != nil {
return nil, fmt.Errorf("error parsing ServiceClusterIPRange %q: %v", tf.cluster.Spec.ServiceClusterIPRange, err)
}
ip4 := cidr.IP.To4()
if ip4 != nil {
n := binary.BigEndian.Uint32(ip4)
n += uint32(id)
serviceIP := make(net.IP, len(ip4))
binary.BigEndian.PutUint32(serviceIP, n)
return serviceIP, nil
}
ip6 := cidr.IP.To16()
if ip6 != nil {
baseIPInt := big.NewInt(0)
baseIPInt.SetBytes(ip6)
serviceIPInt := big.NewInt(0)
serviceIPInt.Add(big.NewInt(int64(id)), baseIPInt)
serviceIP := make(net.IP, len(ip6))
serviceIPBytes := serviceIPInt.Bytes()
for i := range serviceIPBytes {
serviceIP[len(serviceIP)-len(serviceIPBytes)+i] = serviceIPBytes[i]
}
return serviceIP, nil
}
return nil, fmt.Errorf("Unexpected IP address type for ServiceClusterIPRange: %s", tf.cluster.Spec.ServiceClusterIPRange)
}
func (tf *TemplateFunctions) AddTo(dest template.FuncMap) {
dest["EtcdClusterMemberTags"] = tf.EtcdClusterMemberTags
dest["SharedVPC"] = tf.SharedVPC
dest["SharedZone"] = tf.SharedZone
dest["WellKnownServiceIP"] = tf.WellKnownServiceIP
dest["AdminCIDR"] = tf.AdminCIDR
dest["Base64Encode"] = func(s string) string {
return base64.StdEncoding.EncodeToString([]byte(s))
}
dest["replace"] = func(s, find, replace string) string {
return strings.Replace(s, find, replace, -1)
}
dest["join"] = func(a []string, sep string) string {
return strings.Join(a, sep)
}
dest["ClusterName"] = func() string {
return tf.cluster.Name
}
dest["HasTag"] = tf.HasTag
dest["IAMServiceEC2"] = tf.IAMServiceEC2
dest["Image"] = tf.Image
dest["IAMMasterPolicy"] = func() (string, error) {
return tf.buildAWSIAMPolicy(api.InstanceGroupRoleMaster)
}
dest["IAMNodePolicy"] = func() (string, error) {
return tf.buildAWSIAMPolicy(api.InstanceGroupRoleNode)
}
dest["WithDefaultBool"] = func(v *bool, defaultValue bool) bool {
if v != nil {
return *v
}
return defaultValue
}
dest["GetInstanceGroup"] = tf.GetInstanceGroup
dest["CloudTags"] = tf.CloudTags
dest["APIServerCount"] = tf.APIServerCount
dest["KubeDNS"] = func() *api.KubeDNSConfig {
return tf.cluster.Spec.KubeDNS
}
dest["DnsControllerArgv"] = tf.DnsControllerArgv
}
func (tf *TemplateFunctions) EtcdClusterMemberTags(etcd *api.EtcdClusterSpec, m *api.EtcdMemberSpec) map[string]string {
tags := make(map[string]string)
var allMembers []string
for _, m := range etcd.Members {
allMembers = append(allMembers, m.Name)
}
sort.Strings(allMembers)
// This is the configuration of the etcd cluster
tags["k8s.io/etcd/"+etcd.Name] = m.Name + "/" + strings.Join(allMembers, ",")
// This says "only mount on a master"
tags["k8s.io/role/master"] = "1"
return tags
}
// SharedVPC is a simple helper function which makes the templates for a shared VPC clearer
func (tf *TemplateFunctions) SharedVPC() bool {
return tf.cluster.SharedVPC()
}
// SharedZone is a simple helper function which makes the templates for a shared Zone clearer
func (tf *TemplateFunctions) SharedZone(zone *api.ClusterZoneSpec) bool {
return zone.ProviderID != ""
}
// AdminCIDR returns the single CIDR that is allowed access to the admin ports of the cluster (22, 443 on master)
func (tf *TemplateFunctions) AdminCIDR() (string, error) {
if len(tf.cluster.Spec.AdminAccess) == 0 {
return "0.0.0.0/0", nil
}
if len(tf.cluster.Spec.AdminAccess) == 1 {
return tf.cluster.Spec.AdminAccess[0], nil
}
return "", fmt.Errorf("Multiple AdminAccess rules are not (currently) supported")
}
// IAMServiceEC2 returns the name of the IAM service for EC2 in the current region
// it is ec2.amazonaws.com everywhere but in cn-north, where it is ec2.amazonaws.com.cn
func (tf *TemplateFunctions) IAMServiceEC2() string {
switch tf.region {
case "cn-north-1":
return "ec2.amazonaws.com.cn"
default:
return "ec2.amazonaws.com"
}
}
// Image returns the docker image name for the specified component
func (tf *TemplateFunctions) Image(component string) (string, error) {
if component == "kube-dns" {
// TODO: Once we are shipping different versions, start to use them
return "gcr.io/google_containers/kubedns-amd64:1.3", nil
}
if !isBaseURL(tf.cluster.Spec.KubernetesVersion) {
return "gcr.io/google_containers/" + component + ":" + "v" + tf.cluster.Spec.KubernetesVersion, nil
}
baseURL := tf.cluster.Spec.KubernetesVersion
baseURL = strings.TrimSuffix(baseURL, "/")
tagURL := baseURL + "/bin/linux/amd64/" + component + ".docker_tag"
glog.V(2).Infof("Downloading docker tag for %s from: %s", component, tagURL)
b, err := vfs.Context.ReadFile(tagURL)
if err != nil {
return "", fmt.Errorf("error reading tag file %q: %v", tagURL, err)
}
tag := strings.TrimSpace(string(b))
glog.V(2).Infof("Found tag %q for %q", tag, component)
return "gcr.io/google_containers/" + component + ":" + tag, nil
}
// HasTag returns true if the specified tag is set
func (tf *TemplateFunctions) HasTag(tag string) bool {
_, found := tf.tags[tag]
return found
}
// buildAWSIAMPolicy produces the AWS IAM policy for the given role
func (tf *TemplateFunctions) buildAWSIAMPolicy(role api.InstanceGroupRole) (string, error) {
b := &IAMPolicyBuilder{
Cluster: tf.cluster,
Role: role,
Region: tf.region,
}
policy, err := b.BuildAWSIAMPolicy()
if err != nil {
return "", fmt.Errorf("error building IAM policy: %v", err)
}
json, err := policy.AsJSON()
if err != nil {
return "", fmt.Errorf("error building IAM policy: %v", err)
}
return json, nil
}
// CloudTags computes the tags to apply to instances in the specified InstanceGroup
func (tf *TemplateFunctions) CloudTags(ig *api.InstanceGroup) (map[string]string, error) {
labels := make(map[string]string)
// Apply any user-specified labels
for k, v := range ig.Spec.CloudLabels {
labels[k] = v
}
// The system tags take priority because the cluster likely breaks without them...
if ig.Spec.Role == api.InstanceGroupRoleMaster {
labels["k8s.io/role/master"] = "1"
}
if ig.Spec.Role == api.InstanceGroupRoleNode {
labels["k8s.io/role/node"] = "1"
}
return labels, nil
}
// GetInstanceGroup returns the instance group with the specified name
func (tf *TemplateFunctions) GetInstanceGroup(name string) (*api.InstanceGroup, error) {
for _, ig := range tf.instanceGroups {
if ig.Name == name {
return ig, nil
}
}
return nil, fmt.Errorf("InstanceGroup %q not found", name)
}
// APIServerCount returns the value for the apiserver --apiserver-count flag
func (tf *TemplateFunctions) APIServerCount() int {
// The --apiserver-count flag is (generally agreed) to be something we need to get rid of in k8s
// We should do something like this:
//count := 0
//for _, ig := range b.InstanceGroups {
// if !ig.IsMaster() {
// continue
// }
// size := fi.IntValue(ig.Spec.MaxSize)
// if size == 0 {
// size = fi.IntValue(ig.Spec.MinSize)
// }
// count += size
//}
// But if we do, we end up with a weird dependency on InstanceGroups. We actually could tolerate
// that in kops, but we don't really want to.
// So instead, we assume that the etcd cluster size is the API Server Count.
// We can re-examine this when we allow separate etcd clusters - at which time hopefully
// the flag won't exist
counts := make(map[string]int)
for _, etcdCluster := range tf.cluster.Spec.EtcdClusters {
counts[etcdCluster.Name] = len(etcdCluster.Members)
}
count := counts["main"]
return count
}
func (tf *TemplateFunctions) DnsControllerArgv() ([]string, error) {
var argv []string
argv = append(argv, "/usr/bin/dns-controller")
argv = append(argv, "--watch-ingress=false")
argv = append(argv, "--dns=aws-route53")
zone := tf.cluster.Spec.DNSZone
if zone != "" {
if strings.Contains(zone, ".") {
// match by name
argv = append(argv, "--zone="+zone)
} else {
// match by id
argv = append(argv, "--zone=*/"+zone)
}
}
// permit wildcard updates
argv = append(argv, "--zone=*/*")
argv = append(argv, "-v=8")
return argv, nil
}