jhlim
/
nd002test
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
nd002test/on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/pkg/systemtemplate/template.go

507 lines
12 KiB
Go
Raw Blame History

package systemtemplate
var templateSource = `
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: proxy-clusterrole-kubeapiserver
rules:
- apiGroups: [""]
resources:
- nodes/metrics
- nodes/proxy
- nodes/stats
- nodes/log
- nodes/spec
verbs: ["get", "list", "watch", "create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: proxy-role-binding-kubernetes-master
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: proxy-clusterrole-kubeapiserver
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: kube-apiserver
---
apiVersion: v1
kind: Namespace
metadata:
name: cattle-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: cattle
namespace: cattle-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: cattle-admin-binding
namespace: cattle-system
labels:
cattle.io/creator: "norman"
subjects:
- kind: ServiceAccount
name: cattle
namespace: cattle-system
roleRef:
kind: ClusterRole
name: cattle-admin
apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: Secret
metadata:
name: cattle-credentials-{{.TokenKey}}
namespace: cattle-system
type: Opaque
data:
url: "{{.URL}}"
token: "{{.Token}}"
namespace: "{{.Namespace}}"
---
{{- if .PrivateRegistryConfig}}
apiVersion: v1
kind: Secret
metadata:
name: cattle-private-registry
namespace: cattle-system
type: kubernetes.io/dockerconfigjson
data:
.dockerconfigjson: "{{.PrivateRegistryConfig}}"
---
{{- end }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: cattle-admin
labels:
cattle.io/creator: "norman"
rules:
- apiGroups:
- '*'
resources:
- '*'
verbs:
- '*'
- nonResourceURLs:
- '*'
verbs:
- '*'
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: cattle-cluster-agent
namespace: cattle-system
annotations:
management.cattle.io/scale-available: "2"
spec:
selector:
matchLabels:
app: cattle-cluster-agent
template:
metadata:
labels:
app: cattle-cluster-agent
spec:
{{- if .Affinity }}
affinity:
{{ .Affinity | indent 8 }}
{{- end }}
serviceAccountName: cattle
tolerations:
{{- if .Tolerations }}
# Tolerations added based on found taints on controlplane nodes
{{ .Tolerations | indent 6 }}
{{- else }}
# No taints or no controlplane nodes found, added defaults
- effect: NoSchedule
key: node-role.kubernetes.io/controlplane
value: "true"
- effect: NoSchedule
key: "node-role.kubernetes.io/control-plane"
operator: "Exists"
- effect: NoSchedule
key: "node-role.kubernetes.io/master"
operator: "Exists"
{{- end }}
{{- if .AppendTolerations }}
{{ .AppendTolerations | indent 6 }}
{{- end }}
containers:
- name: cluster-register
imagePullPolicy: IfNotPresent
{{- if .ResourceRequirements }}
resources:
{{ .ResourceRequirements | indent 12 }}
{{- end }}
env:
{{- if ne .Features "" }}
- name: CATTLE_FEATURES
value: "{{.Features}}"
{{- end }}
- name: CATTLE_IS_RKE
value: "{{.IsRKE}}"
- name: CATTLE_SERVER
value: "{{.URLPlain}}"
- name: CATTLE_CA_CHECKSUM
value: "{{.CAChecksum}}"
- name: CATTLE_CLUSTER
value: "true"
- name: CATTLE_K8S_MANAGED
value: "true"
- name: CATTLE_CLUSTER_REGISTRY
value: "{{.ClusterRegistry}}"
{{- if .AgentEnvVars}}
{{ .AgentEnvVars | indent 10 }}
{{- end }}
image: {{.AgentImage}}
volumeMounts:
- name: cattle-credentials
mountPath: /cattle-credentials
readOnly: true
{{- if .PrivateRegistryConfig}}
imagePullSecrets:
- name: cattle-private-registry
{{- end }}
volumes:
- name: cattle-credentials
secret:
secretName: cattle-credentials-{{.TokenKey}}
defaultMode: 320
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 0
maxSurge: 1
{{ if .IsRKE }}
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: cattle-node-agent
namespace: cattle-system
spec:
selector:
matchLabels:
app: cattle-agent
template:
metadata:
labels:
app: cattle-agent
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: beta.kubernetes.io/os
operator: NotIn
values:
- windows
hostNetwork: true
serviceAccountName: cattle
tolerations:
- operator: Exists
containers:
- name: agent
image: {{.AgentImage}}
imagePullPolicy: IfNotPresent
env:
- name: CATTLE_NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
- name: CATTLE_SERVER
value: "{{.URLPlain}}"
- name: CATTLE_CA_CHECKSUM
value: "{{.CAChecksum}}"
- name: CATTLE_CLUSTER
value: "false"
- name: CATTLE_K8S_MANAGED
value: "true"
- name: CATTLE_AGENT_CONNECT
value: "true"
{{- if .AgentEnvVars}}
{{ .AgentEnvVars | indent 8 }}
{{- end }}
volumeMounts:
- name: cattle-credentials
mountPath: /cattle-credentials
readOnly: true
- name: k8s-ssl
mountPath: /etc/kubernetes
- name: var-run
mountPath: /var/run
mountPropagation: HostToContainer
- name: run
mountPath: /run
mountPropagation: HostToContainer
- name: docker-certs
mountPath: /etc/docker/certs.d
securityContext:
privileged: true
{{- if .PrivateRegistryConfig}}
imagePullSecrets:
- name: cattle-private-registry
{{- end }}
volumes:
- name: k8s-ssl
hostPath:
path: /etc/kubernetes
type: DirectoryOrCreate
- name: var-run
hostPath:
path: /var/run
type: DirectoryOrCreate
- name: run
hostPath:
path: /run
type: DirectoryOrCreate
- name: cattle-credentials
secret:
secretName: cattle-credentials-{{.TokenKey}}
defaultMode: 320
- hostPath:
path: /etc/docker/certs.d
type: DirectoryOrCreate
name: docker-certs
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 50%
{{- end }}
{{- if .IsWindowsCluster}}
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: cattle-node-agent-windows
namespace: cattle-system
spec:
selector:
matchLabels:
app: cattle-agent-windows
template:
metadata:
labels:
app: cattle-agent-windows
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: beta.kubernetes.io/os
operator: NotIn
values:
- linux
serviceAccountName: cattle
tolerations:
- operator: Exists
containers:
- name: agent
image: {{.AgentImage}}
imagePullPolicy: IfNotPresent
env:
- name: CATTLE_NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
- name: CATTLE_SERVER
value: "{{.URLPlain}}"
- name: CATTLE_CA_CHECKSUM
value: "{{.CAChecksum}}"
- name: CATTLE_CLUSTER
value: "false"
- name: CATTLE_K8S_MANAGED
value: "true"
- name: CATTLE_AGENT_CONNECT
value: "true"
volumeMounts:
- name: cattle-credentials
mountPath: c:/cattle-credentials
readOnly: true
- name: k8s-ssl
mountPath: c:/etc/kubernetes
- name: run
mountPath: c:/run
- name: docker-certs
mountPath: c:/etc/docker/certs.d
- name: docker-pipe
mountPath: \\.\pipe\docker_engine
- name: wins-pipe
mountPath: \\.\pipe\rancher_wins
- name: wins-config
mountPath: c:/etc/rancher/wins
volumes:
- name: k8s-ssl
hostPath:
path: c:/etc/kubernetes
type: DirectoryOrCreate
- name: run
hostPath:
path: c:/run
type: DirectoryOrCreate
- name: cattle-credentials
secret:
secretName: cattle-credentials-{{.TokenKey}}
- name: docker-certs
hostPath:
path: c:/ProgramData/docker/certs.d
type: DirectoryOrCreate
- name: docker-pipe
hostPath:
path: \\.\pipe\docker_engine
- name: wins-pipe
hostPath:
path: \\.\pipe\rancher_wins
- name: wins-config
hostPath:
path: c:/etc/rancher/wins
type: DirectoryOrCreate
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 50%
{{- end }}
{{- if .AuthImage}}
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: kube-api-auth
namespace: cattle-system
spec:
selector:
matchLabels:
app: kube-api-auth
template:
metadata:
labels:
app: kube-api-auth
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: beta.kubernetes.io/os
operator: NotIn
values:
- windows
- key: node-role.kubernetes.io/controlplane
operator: In
values:
- "true"
- matchExpressions:
- key: beta.kubernetes.io/os
operator: NotIn
values:
- windows
- key: node-role.kubernetes.io/control-plane
operator: In
values:
- "true"
- matchExpressions:
- key: beta.kubernetes.io/os
operator: NotIn
values:
- windows
- key: node-role.kubernetes.io/master
operator: In
values:
- "true"
hostNetwork: true
serviceAccountName: cattle
tolerations:
- operator: Exists
containers:
- name: kube-api-auth
image: {{.AuthImage}}
imagePullPolicy: IfNotPresent
volumeMounts:
- name: k8s-ssl
mountPath: /etc/kubernetes
securityContext:
privileged: true
{{- if .PrivateRegistryConfig}}
imagePullSecrets:
- name: cattle-private-registry
{{- end }}
volumes:
- name: k8s-ssl
hostPath:
path: /etc/kubernetes
type: DirectoryOrCreate
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 25%
{{- end }}
---
apiVersion: v1
kind: Service
metadata:
name: cattle-cluster-agent
namespace: cattle-system
spec:
ports:
- port: 80
targetPort: 80
protocol: TCP
name: http
- port: 443
targetPort: 444
protocol: TCP
name: https-internal
selector:
app: cattle-cluster-agent
`
var (
AuthDaemonSet = `
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: kube-api-auth
namespace: cattle-system
`
NodeAgentDaemonSet = `
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: cattle-node-agent
namespace: cattle-system
`
)
Reference in New Issue View Git Blame Copy Permalink