krib-kubeadm.cfg.tmpl

apiVersion: kubeadm.k8s.io/v1beta1
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: {{ .Param "krib/cluster-master-vip" }}
  bindPort: {{ .Param "krib/cluster-api-port" }}
bootstrapTokens:
- groups:
    - system:bootstrappers:kubeadm:default-node-token
  ttl: 24h0m0s
  usages:
  - signing
  - authentication
nodeRegistration:
  criSocket: "{{ .Param "krib/cluster-cri-socket" }}"
  name: {{ .Machine.Name }}
  taints:
  - effect: NoSchedule
    key: node-role.kubernetes.io/master
---
apiVersion: kubeadm.k8s.io/v1beta1
kind: ClusterConfiguration
apiServer:
  certSANs:
  - 127.0.0.1
  - {{ .Param "krib/cluster-master-vip" }}
  {{ range $elem := .Param "krib/cluster-masters" -}}
  - {{ $elem.Address }}
  - {{ $elem.Name }}
  {{ end -}}
  {{ if .ParamExists "krib/apiserver-extra-SANs" -}}
  {{ range $san := .Param "krib/apiserver-extra-SANs" -}}
  - {{ $san.SAN }}
  {{ end }}
  {{ end }}
  extraArgs:
    audit-log-path: /var/log/kubernetes/audit
    audit-log-maxage: "2"
    endpoint-reconciler-type: "lease"
    {{ if .ParamExists "krib/sign-kubelet-server-certs" -}}{{ if eq (.Param "krib/sign-kubelet-server-certs") true -}}
    kubelet-certificate-authority: "/etc/kubernetes/pki/ca.crt"
    {{ end -}}
    {{ end -}}
    {{ if .ParamExists "krib/apiserver-extra-args" -}}
    {{ range $key, $value  := .Param "krib/apiserver-extra-args" -}}
    {{ $key }}: {{ $value }}
    {{ end }}
    {{ end }}
certificatesDir: /etc/kubernetes/pki
clusterName: {{ .Param "krib/cluster-name" }}
{{ $ha := ne (int 1) (int (.Param "krib/cluster-master-count")) -}}
{{ if $ha -}}
controlPlaneEndpoint: {{ .Param "krib/cluster-master-vip" }}:{{ .Param "krib/cluster-api-vip-port" }}
{{ else -}}
controlPlaneEndpoint: {{ .Param "krib/cluster-master-vip" }}:{{ .Param "krib/cluster-api-port" }}
{{ end -}}
imageRepository: {{ .Param "krib/cluster-image-repository" }}
etcd:
  external:
    caFile: /etc/kubernetes/pki/etcd/server-ca.pem
    certFile: /etc/kubernetes/pki/etcd/client.pem
    keyFile: /etc/kubernetes/pki/etcd/client-key.pem
    endpoints:
{{if and $ha (.ParamExists "krib/cluster-master-vip") (.ParamExists "etcd/cluster-client-vip-port") }}
      - https://{{ .Param "krib/cluster-master-vip" }}:{{ .Param "etcd/cluster-client-vip-port" }}
{{else}}
  {{ $port := .Param "etcd/client-port" -}}
  {{- range $elem := .Param "etcd/servers"}}
      - https://{{ $elem.Address }}:{{ $port }}
  {{ end -}}
{{ end -}}
useHyperKubeImage: true
kubernetesVersion: {{ .Param "krib/cluster-kubernetes-version" }}
networking:
  dnsDomain: "{{ .Param "krib/cluster-service-dns-domain" }}"
  podSubnet: "{{ .Param "krib/cluster-pod-subnet" }}"
  serviceSubnet: "{{ .Param "krib/cluster-service-subnet" }}"
---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
bindAddress: 0.0.0.0
clientConnection:
  acceptContentTypes: ""
  burst: 10
  contentType: application/vnd.kubernetes.protobuf
  kubeconfig: /var/lib/kube-proxy/kubeconfig.conf
  qps: 5
clusterCIDR: ""
configSyncPeriod: 15m0s
conntrack:
  max: null
  maxPerCore: 32768
  min: 131072
  tcpCloseWaitTimeout: 1h0m0s
  tcpEstablishedTimeout: 24h0m0s
enableProfiling: false
healthzBindAddress: 0.0.0.0:10256
hostnameOverride: ""
iptables:
  masqueradeAll: false
  masqueradeBit: 14
  minSyncPeriod: 0s
  syncPeriod: 30s
ipvs:
  excludeCIDRs: null
  minSyncPeriod: 0s
  scheduler: ""
  syncPeriod: 30s
metricsBindAddress: 127.0.0.1:10249
mode: ""
nodePortAddresses: null
oomScoreAdj: -999
portRange: ""
resourceContainer: /kube-proxy
udpIdleTimeout: 250ms
---
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
address: 0.0.0.0
authentication:
  anonymous:
    enabled: false
  webhook:
    cacheTTL: 2m0s
    enabled: true
  x509:
    clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
  mode: Webhook
  webhook:
    cacheAuthorizedTTL: 5m0s
    cacheUnauthorizedTTL: 30s
cgroupDriver: cgroupfs
cgroupsPerQOS: true
clusterDNS:
- {{ .Param "krib/cluster-dns" }}
clusterDomain: {{ .Param "krib/cluster-domain" }}
configMapAndSecretChangeDetectionStrategy: Watch
containerLogMaxFiles: 5
containerLogMaxSize: 10Mi
contentType: application/vnd.kubernetes.protobuf
cpuCFSQuota: true
cpuCFSQuotaPeriod: 100ms
cpuManagerPolicy: none
cpuManagerReconcilePeriod: 10s
enableControllerAttachDetach: true
enableDebuggingHandlers: true
enforceNodeAllocatable:
- pods
eventBurst: 10
eventRecordQPS: 5
evictionHard:
  imagefs.available: 15%
  memory.available: 100Mi
  nodefs.available: 10%
  nodefs.inodesFree: 5%
evictionPressureTransitionPeriod: 5m0s
failSwapOn: true
fileCheckFrequency: 20s
hairpinMode: promiscuous-bridge
healthzBindAddress: 127.0.0.1
healthzPort: 10248
httpCheckFrequency: 20s
imageGCHighThresholdPercent: 85
imageGCLowThresholdPercent: 80
imageMinimumGCAge: 2m0s
iptablesDropBit: 15
iptablesMasqueradeBit: 14
kubeAPIBurst: 10
kubeAPIQPS: 5
makeIPTablesUtilChains: true
maxOpenFiles: 1000000
maxPods: 110
nodeLeaseDurationSeconds: 40
nodeStatusUpdateFrequency: 10s
oomScoreAdj: -999
podPidsLimit: -1
port: 10250
registryBurst: 10
registryPullQPS: 5
resolvConf: /etc/resolv.conf
rotateCertificates: true
runtimeRequestTimeout: 2m0s
serializeImagePulls: true
{{ if .ParamExists "krib/sign-kubelet-server-certs" -}}{{ if eq (.Param "krib/sign-kubelet-server-certs") true -}}
serverTLSBootstrap: true
{{ end -}}
{{ end -}}
streamingConnectionIdleTimeout: 4h0m0s
syncFrequency: 1m0s
volumeStatsAggPeriod: 1m0s