From e13a8fec52694d16da2066f4f4d13942a203a601 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Mon, 15 Aug 2022 19:24:03 +0200
Subject: kubernetes/kubeadm: only use config files for init and join

---
 .../control-plane/templates/kubeadm-init.config.j2 | 56 ++++++++++++++++++++++
 .../control-plane/templates/kubeadm-join.config.j2 | 20 ++++++++
 .../control-plane/templates/kubeadm.config.j2      | 55 ---------------------
 3 files changed, 76 insertions(+), 55 deletions(-)
 create mode 100644 roles/kubernetes/kubeadm/control-plane/templates/kubeadm-init.config.j2
 create mode 100644 roles/kubernetes/kubeadm/control-plane/templates/kubeadm-join.config.j2
 delete mode 100644 roles/kubernetes/kubeadm/control-plane/templates/kubeadm.config.j2

(limited to 'roles/kubernetes/kubeadm/control-plane/templates')

diff --git a/roles/kubernetes/kubeadm/control-plane/templates/kubeadm-init.config.j2 b/roles/kubernetes/kubeadm/control-plane/templates/kubeadm-init.config.j2
new file mode 100644
index 00000000..d4fb26cf
--- /dev/null
+++ b/roles/kubernetes/kubeadm/control-plane/templates/kubeadm-init.config.j2
@@ -0,0 +1,56 @@
+{# https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3 #}
+{#  #}
+apiVersion: kubeadm.k8s.io/v1beta3
+kind: InitConfiguration
+{# it's easier to extract the bootstap token from separate `kubeadm token create` call #}
+{# so make sure the token created by init expires fast #}
+bootstrapTokens:
+- ttl: "1s"
+localAPIEndpoint:
+  bindPort: 6442
+{% if kubernetes_overlay_node_ip is defined %}
+  advertiseAddress: "{{ kubernetes_overlay_node_ip }}"
+{% endif %}
+{% if kubernetes_network_plugin_replaces_kube_proxy %}
+skipPhases:
+- addon/kube-proxy
+{% endif %}
+nodeRegistration:
+  name: "{{ inventory_hostname }}"
+  criSocket: "{{ kubernetes_cri_socket }}"
+---
+apiVersion: kubeadm.k8s.io/v1beta3
+kind: ClusterConfiguration
+kubernetesVersion: {{ kubernetes_version }}
+clusterName: "{{ kubernetes.cluster_name }}"
+imageRepository: k8s.gcr.io
+controlPlaneEndpoint: 127.0.0.1:6443
+networking:
+  dnsDomain: "{{ kubernetes.dns_domain | default('cluster.local') }}"
+  podSubnet: "{{ kubernetes.pod_ip_range }}"
+  serviceSubnet: "{{ kubernetes.service_ip_range }}"
+apiServer:
+  extraArgs:
+    encryption-provider-config: /etc/kubernetes/encryption/config
+  extraVolumes:
+  - name: encryption-config
+    hostPath: /etc/kubernetes/encryption
+    mountPath: /etc/kubernetes/encryption
+    readOnly: true
+    pathType: Directory
+{% if (kubernetes.api_extra_sans | default([]) | length) == 0 %}
+  certSANs: []
+{% else %}
+  certSANs:
+  {{ kubernetes.api_extra_sans | to_nice_yaml | indent(width=2) }}
+{% endif %}
+controllerManager:
+  extraArgs:
+    node-cidr-mask-size: "{{ kubernetes.pod_ip_range_size }}"
+scheduler: {}
+---
+apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+clusterDNS:
+- "{{ kubernetes_nodelocal_dnscache_ip }}"
+cgroupDriver: systemd
diff --git a/roles/kubernetes/kubeadm/control-plane/templates/kubeadm-join.config.j2 b/roles/kubernetes/kubeadm/control-plane/templates/kubeadm-join.config.j2
new file mode 100644
index 00000000..553463bb
--- /dev/null
+++ b/roles/kubernetes/kubeadm/control-plane/templates/kubeadm-join.config.j2
@@ -0,0 +1,20 @@
+{# https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3 #}
+{#  #}
+apiVersion: kubeadm.k8s.io/v1beta3
+kind: JoinConfiguration
+discovery:
+  bootstrapToken:
+    apiServerEndpoint: "127.0.0.1:6443"
+    token: "{{ kube_bootstrap_token }}"
+    caCertHashes:
+    - "{{ kube_bootstrap_ca_cert_hash }}"
+controlPlane:
+  certificateKey: "{{ kubeadm_upload_certs_key }}"
+  localAPIEndpoint:
+    bindPort: 6442
+{% if kubernetes_overlay_node_ip is defined %}
+    advertiseAddress: "{{ kubernetes_overlay_node_ip }}"
+{% endif %}
+nodeRegistration:
+  name: "{{ inventory_hostname }}"
+  criSocket: "{{ kubernetes_cri_socket }}"
diff --git a/roles/kubernetes/kubeadm/control-plane/templates/kubeadm.config.j2 b/roles/kubernetes/kubeadm/control-plane/templates/kubeadm.config.j2
deleted file mode 100644
index a0f3efe7..00000000
--- a/roles/kubernetes/kubeadm/control-plane/templates/kubeadm.config.j2
+++ /dev/null
@@ -1,55 +0,0 @@
-{# https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3 #}
-{#  #}
-apiVersion: kubeadm.k8s.io/v1beta3
-kind: InitConfiguration
-{# TODO: this is ugly but we want to create our own token so we can #}
-{# better control it's lifetime #}
-bootstrapTokens:
-- ttl: "1s"
-localAPIEndpoint:
-  bindPort: 6442
-{% if kubernetes_overlay_node_ip is defined %}
-  advertiseAddress: {{ kubernetes_overlay_node_ip }}
-{% endif %}
-{% if kubernetes_network_plugin_replaces_kube_proxy %}
-skipPhases:
-- addon/kube-proxy
-{% endif %}
-nodeRegistration:
-  criSocket: {{ kubernetes_cri_socket }}
----
-apiVersion: kubeadm.k8s.io/v1beta3
-kind: ClusterConfiguration
-kubernetesVersion: {{ kubernetes_version }}
-clusterName: {{ kubernetes.cluster_name }}
-imageRepository: k8s.gcr.io
-controlPlaneEndpoint: 127.0.0.1:6443
-networking:
-  dnsDomain: {{ kubernetes.dns_domain | default('cluster.local') }}
-  podSubnet: {{ kubernetes.pod_ip_range }}
-  serviceSubnet: {{ kubernetes.service_ip_range }}
-apiServer:
-  extraArgs:
-    encryption-provider-config: /etc/kubernetes/encryption/config
-  extraVolumes:
-  - name: encryption-config
-    hostPath: /etc/kubernetes/encryption
-    mountPath: /etc/kubernetes/encryption
-    readOnly: true
-    pathType: Directory
-{% if (kubernetes.api_extra_sans | default([]) | length) == 0 %}
-  certSANs: []
-{% else %}
-  certSANs:
-  {{ kubernetes.api_extra_sans | to_nice_yaml | indent(width=2) }}
-{% endif %}
-controllerManager:
-  extraArgs:
-    node-cidr-mask-size: "{{ kubernetes.pod_ip_range_size }}"
-scheduler: {}
----
-apiVersion: kubelet.config.k8s.io/v1beta1
-kind: KubeletConfiguration
-clusterDNS:
-- {{ kubernetes_nodelocal_dnscache_ip }}
-cgroupDriver: systemd
-- 
cgit v1.2.3