cluster.tpl.yaml

# Copyright 2019 Sony Mobile Communications Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: kops/v1alpha2
kind: Cluster
metadata:
  name: {{.clusterFqdn}}
spec:
  api:
    loadBalancer:
      type: Public
  authorization:
    rbac: {}
  channel: stable
  cloudProvider: aws
  configBase: s3://{{.kopsStateStore}}/{{.clusterFqdn}}
  etcdClusters:
  - name: main
    etcdMembers:
{{- range .master.availabilityZones }}
    - name: {{ . }}
      instanceGroup: master-{{ $.awsRegion }}{{ . }}
      encryptedVolume: {{ $.master.etcd.encryptedVolume }}
{{- end }}
  - name: events
    etcdMembers:
{{- range .master.availabilityZones }}
    - name: {{ . }}
      instanceGroup: master-{{ $.awsRegion }}{{ . }}
      encryptedVolume: {{ $.master.etcd.encryptedVolume }}
{{- end }}
  iam:
    allowContainerRegistry: true
    legacy: false
  kubernetesApiAccess:
{{- range .externalAccess }}
  - {{ . }}
{{- end}}
  kubernetesVersion: {{.kubernetesVersion}}
  masterInternalName: api.internal.{{.clusterFqdn}}
  masterPublicName: api.{{.clusterFqdn}}
  networkCIDR: 172.20.0.0/16
  networking:
    calico: {}
  nonMasqueradeCIDR: 100.64.0.0/10
  sshAccess:
{{- range .externalAccess }}
  - {{ . }}
{{- end}}
  subnets:
{{- range .subnets }}
  - type: Private
    name: {{ $.awsRegion }}{{ .availabilityZone }}
    zone: {{ $.awsRegion }}{{ .availabilityZone }}
    cidr: {{ .privateIpRange }}
  - type: Utility
    name: utility-{{ $.awsRegion }}{{ .availabilityZone }}
    zone: {{ $.awsRegion }}{{ .availabilityZone }}
    cidr: {{ .utilityIpRange }}
{{- end }}
  topology:
    bastion:
      bastionPublicName: bastion.{{.clusterFqdn}}
    dns:
      type: Public
    masters: private
    nodes: private
  kubeAPIServer:
    authenticationTokenWebhookConfigFile: /srv/kubernetes/aws-iam-authenticator/kubeconfig.yaml
  hooks:
  - name: kops-hook-authenticator-config.service
    before:
      - kubelet.service
    roles: [Master]
    manifest: |
      [Unit]
      Description=Download AWS Authenticator configs from S3
      [Service]
      Type=oneshot
      ExecStart=/bin/mkdir -p /srv/kubernetes/aws-iam-authenticator
      ExecStart=/usr/local/bin/aws s3 cp --recursive s3://{{.kopsStateStore}}/{{.clusterFqdn}}/addons/authenticator /srv/kubernetes/aws-iam-authenticator/
  additionalPolicies:
    master: |
      [
        {
          "Effect": "Allow",
          "Action": [
            "autoscaling:DescribeAutoScalingGroups",
            "autoscaling:DescribeAutoScalingInstances",
            "autoscaling:SetDesiredCapacity",
            "autoscaling:DescribeLaunchConfigurations",
            "autoscaling:DescribeTags",
            "autoscaling:TerminateInstanceInAutoScalingGroup"
          ],
          "Resource": ["*"]
        }
      ]
    node: |
      [
        {
          "Action": [
              "sts:AssumeRole"
          ],
          "Effect": "Allow",
          "Resource": "*"
        },
        {
          "Effect": "Allow",
          "Action": [
            "route53:ChangeResourceRecordSets"
          ],
          "Resource": [
            "arn:aws:route53:::hostedzone/*"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "route53:ListHostedZones",
            "route53:ListResourceRecordSets"
          ],
          "Resource": [
            "*"
          ]
        }
      ]

---

apiVersion: kops/v1alpha2
kind: InstanceGroup
metadata:
  name: bastions
  labels:
    kops.k8s.io/cluster: {{.clusterFqdn}}
spec:
  role: Bastion
  nodeLabels:
    kops.k8s.io/instancegroup: bastions
  subnets:
{{- range .subnets }}
  - utility-{{ $.awsRegion }}{{ .availabilityZone }}
{{- end }}
  machineType: t2.micro
  maxSize: {{.bastionCount}}
  minSize: {{.bastionCount}}

{{- range .master.availabilityZones }}
---

apiVersion: kops/v1alpha2
kind: InstanceGroup
metadata:
  name: master-{{ $.awsRegion }}{{ . }}
  labels:
    kops.k8s.io/cluster: {{ $.clusterFqdn }}
spec:
  role: Master
  nodeLabels:
    kops.k8s.io/instancegroup: {{ $.awsRegion }}{{ . }}
  subnets:
  - {{ $.awsRegion }}{{ . }}
  machineType: {{ $.master.machineType }}
  minSize: 1
  maxSize: 1
{{- end }}

---

apiVersion: kops/v1alpha2
kind: InstanceGroup
metadata:
  name: nodes
  labels:
    kops.k8s.io/cluster: {{.clusterFqdn}}
spec:
  role: Node
  nodeLabels:
    kops.k8s.io/instancegroup: nodes
  cloudLabels:
    k8s.io/cluster-autoscaler/enabled:
    kubernetes.io/cluster/{{.clusterFqdn}}:
  subnets:
{{- range .subnets }}
  - {{ $.awsRegion }}{{ .availabilityZone }}
{{- end }}
  machineType: {{.node.machineType}}
  minSize: {{.node.minSize}}
  maxSize: {{.node.maxSize}}
{{- if .node.useSpotMarket }}
  maxPrice: "{{ .node.maxPrice }}"
{{- end}}

---

apiVersion: kops/v1alpha2
kind: InstanceGroup
metadata:
  name: spots
  labels:
    kops.k8s.io/cluster: {{.clusterFqdn}}
spec:
  role: Node
  nodeLabels:
    kops.k8s.io/instancegroup: spots
  cloudLabels:
    k8s.io/cluster-autoscaler/enabled:
    kubernetes.io/cluster/{{.clusterFqdn}}:
  subnets:
{{- range .subnets }}
  - {{ $.awsRegion }}{{ .availabilityZone }}
{{- end }}
  machineType: {{.spot.machineType}}
  minSize: {{.spot.minSize}}
  maxSize: {{.spot.maxSize}}
{{- if .spot.useSpotMarket }}
  maxPrice: "{{ .spot.maxPrice }}"
{{- end}}