Merge pull request #45032 from everett-toews/rm-rackspace

cluster/rackspace/authorization.sh

-#!/bin/bash
-
-# Copyright 2015 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Create generic token following GCE standard
-create_token() {
-  echo $(cat /dev/urandom | base64 | tr -d "=+/" | dd bs=32 count=1 2> /dev/null)
-}
-
-get_tokens_from_csv() {
-  KUBE_BEARER_TOKEN=$(awk -F, '/admin/ {print $1}' ${KUBE_TEMP}/${1}_tokens.csv)
-  KUBELET_TOKEN=$(awk -F, '/kubelet/ {print $1}' ${KUBE_TEMP}/${1}_tokens.csv)
-  KUBE_PROXY_TOKEN=$(awk -F, '/kube_proxy/ {print $1}' ${KUBE_TEMP}/${1}_tokens.csv)
-}
-
-generate_admin_token() {
-  echo "$(create_token),admin,admin" >> ${KUBE_TEMP}/known_tokens.csv
-}
-
-# Creates a csv file each time called (i.e one per kubelet).
-generate_kubelet_tokens() {
-  echo "$(create_token),kubelet,kubelet" > ${KUBE_TEMP}/${1}_tokens.csv
-  echo "$(create_token),kube_proxy,kube_proxy" >> ${KUBE_TEMP}/${1}_tokens.csv
-}

cluster/rackspace/cloud-config/master-cloud-config.yaml

-#cloud-config
-
-write_files:
-  - path: /etc/cloud.conf
-    permissions: 0600
-    content: |
-      [Global]
-      auth-url = OS_AUTH_URL
-      username = OS_USERNAME
-      api-key = OS_PASSWORD
-      tenant-id = OS_TENANT_NAME
-      region = OS_REGION_NAME
-      [LoadBalancer]
-      subnet-id = 11111111-1111-1111-1111-111111111111
-  - path: /opt/bin/git-kubernetes-nginx.sh
-    permissions: 0755
-    content: |
-      #!/bin/bash
-      git clone https://github.com/thommay/kubernetes_nginx /opt/kubernetes_nginx
-      /usr/bin/cp /opt/.kubernetes_auth /opt/kubernetes_nginx/.kubernetes_auth
-      /opt/kubernetes_nginx/git-kubernetes-nginx.sh
-  - path: /opt/bin/download-release.sh
-    permissions: 0755
-    content: |
-      #!/bin/bash
-      # This temp URL is only good for the length of time specified at cluster creation time.
-      # Afterward, it will result in a 403.
-      OBJECT_URL="CLOUD_FILES_URL"
-      if [ ! -s /opt/kubernetes.tar.gz ]
-      then
-        echo "Downloading release ($OBJECT_URL)"
-        wget "${OBJECT_URL}" -O /opt/kubernetes.tar.gz
-        echo "Unpacking release"
-        rm -rf /opt/kubernetes || false
-        tar xzf /opt/kubernetes.tar.gz -C /opt/
-      else
-        echo "kubernetes release found. Skipping download."
-      fi
-  - path: /opt/.kubernetes_auth
-    permissions: 0600
-    content: |
-      KUBE_USER:KUBE_PASSWORD
-
-coreos:
-  etcd2:
-    discovery: https://discovery.etcd.io/DISCOVERY_ID
-    advertise-client-urls: http://$private_ipv4:2379,http://$private_ipv4:4001
-    initial-advertise-peer-urls: http://$private_ipv4:2380
-    listen-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001
-    listen-peer-urls: http://$private_ipv4:2380,http://$private_ipv4:7001
-
-  flannel:
-    ip_masq: true
-    interface: eth2
-
-  fleet:
-    public-ip: $private_ipv4
-    metadata: kubernetes_role=master
-
-  update:
-    reboot-strategy: off
-
-  units:
-    - name: etcd2.service
-      command: start
-    - name: fleet.service
-      command: start
-    - name: flanneld.service
-      drop-ins:
-        - name: 50-flannel.conf
-          content: |
-            [Unit]
-            Requires=etcd2.service
-            After=etcd2.service
-
-            [Service]
-            ExecStartPre=-/usr/bin/etcdctl mk /coreos.com/network/config '{"Network":"KUBE_NETWORK", "Backend": {"Type": "host-gw"}}'
-      command: start
-    - name: generate-serviceaccount-key.service
-      command: start
-      content: |
-        [Unit]
-        Description=Generate service-account key file
-
-        [Service]
-        ExecStartPre=-/usr/bin/mkdir -p /var/run/kubernetes/
-        ExecStart=/bin/openssl genrsa -out /var/run/kubernetes/kube-serviceaccount.key 2048 2>/dev/null
-        RemainAfterExit=yes
-        Type=oneshot
-    - name: docker.service
-      command: start
-      drop-ins:
-        - name: 51-docker-mirror.conf
-          content: |
-            [Unit]
-            # making sure that flanneld finished startup, otherwise containers
-            # won't land in flannel's network...
-            Requires=flanneld.service
-            After=flanneld.service
-            Restart=Always
-    - name: download-release.service
-      command: start
-      content: |
-        [Unit]
-        Description=Downloads Kubernetes Release
-        After=network-online.target
-        Requires=network-online.target
-        [Service]
-        Type=oneshot
-        RemainAfterExit=yes
-        ExecStart=/usr/bin/bash /opt/bin/download-release.sh
-    - name: kube-apiserver.service
-      command: start
-      content: |
-        [Unit]
-        Description=Kubernetes API Server
-        Documentation=https://github.com/kubernetes/kubernetes
-        After=network-online.target
-        Requires=network-online.target
-        After=download-release.service
-        Requires=download-release.service
-        Requires=generate-serviceaccount-key.service
-        After=generate-serviceaccount-key.service
-        [Service]
-        ExecStartPre=/usr/bin/ln -sf /opt/kubernetes/server/bin/kube-apiserver /opt/bin/kube-apiserver
-        ExecStartPre=/usr/bin/mkdir -p /var/lib/kube-apiserver
-        ExecStart=/opt/bin/kube-apiserver \
-        --address=127.0.0.1 \
-        --cloud-provider=rackspace \
-        --cloud-config=/etc/cloud.conf \
-        --etcd-servers=http://127.0.0.1:4001 \
-        --logtostderr=true \
-        --port=8080 \
-        --service-cluster-ip-range=SERVICE_CLUSTER_IP_RANGE \
-        --token-auth-file=/var/lib/kube-apiserver/known_tokens.csv \
-        --v=2 \
-        --service-account-key-file=/var/run/kubernetes/kube-serviceaccount.key \
-        --service-account-lookup=true \
-        --admission-control=NamespaceLifecycle,NamespaceAutoProvision,LimitRanger,SecurityContextDeny,ServiceAccount,DefaultTolerationSeconds,ResourceQuota
-        Restart=always
-        RestartSec=5
-    - name: apiserver-advertiser.service
-      command: start
-      content: |
-        [Unit]
-        Description=Kubernetes Apiserver Advertiser
-        After=etcd2.service
-        Requires=etcd2.service
-        After=master-apiserver.service
-        [Service]
-        ExecStart=/bin/sh -c 'etcdctl set /corekube/apiservers/$public_ipv4 $public_ipv4'
-        Restart=always
-        RestartSec=120
-    - name: kube-controller-manager.service
-      command: start
-      content: |
-        [Unit]
-        Description=Kubernetes Controller Manager
-        Documentation=https://github.com/kubernetes/kubernetes
-        After=network-online.target
-        Requires=network-online.target
-        After=kube-apiserver.service
-        Requires=kube-apiserver.service
-        [Service]
-        ExecStartPre=/usr/bin/ln -sf /opt/kubernetes/server/bin/kube-controller-manager /opt/bin/kube-controller-manager
-        ExecStart=/opt/bin/kube-controller-manager \
-        --cloud-provider=rackspace \
-        --cloud-config=/etc/cloud.conf \
-        --logtostderr=true \
-        --master=127.0.0.1:8080 \
-        --v=2 \
-        --service-account-private-key-file=/var/run/kubernetes/kube-serviceaccount.key \
-        --root-ca-file=/run/kubernetes/apiserver.crt
-        Restart=always
-        RestartSec=5
-    - name: kube-scheduler.service
-      command: start
-      content: |
-        [Unit]
-        Description=Kubernetes Scheduler
-        Documentation=https://github.com/kubernetes/kubernetes
-        After=network-online.target
-        Requires=network-online.target
-        After=kube-apiserver.service
-        Requires=kube-apiserver.service
-        [Service]
-        ExecStartPre=/usr/bin/ln -sf /opt/kubernetes/server/bin/kube-scheduler /opt/bin/kube-scheduler
-        ExecStart=/opt/bin/kube-scheduler \
-        --logtostderr=true \
-        --master=127.0.0.1:8080
-        Restart=always
-        RestartSec=5
-    #Running nginx service with --net="host" is a necessary evil until running all k8s services in docker.
-    - name: kubernetes-nginx.service
-      command: start
-      content: |
-        [Unit]
-        Description=Kubernetes Nginx Service
-        After=network-online.target
-        Requires=network-online.target
-        After=docker.service
-        Requires=docker.service
-        [Service]
-        ExecStartPre=/opt/bin/git-kubernetes-nginx.sh
-        ExecStartPre=-/usr/bin/docker rm kubernetes_nginx
-        ExecStart=/usr/bin/docker run --rm --net="host" -p "443:443" -t --name "kubernetes_nginx" kubernetes_nginx
-        ExecStop=/usr/bin/docker stop kubernetes_nginx
-        Restart=always
-        RestartSec=15

cluster/rackspace/cloud-config/node-cloud-config.yaml

-#cloud-config
-
-write_files:
-  - path: /opt/bin/regen-apiserver-list.sh
-    permissions: 0755
-    content: |
-      #!/bin/sh
-      m=$(echo $(etcdctl ls --recursive /corekube/apiservers | cut -d/ -f4 | sort) | tr ' ' ,)
-      mkdir -p /run/kubelet
-      echo "APISERVER_IPS=$m" > /run/kubelet/apiservers.env
-      echo "FIRST_APISERVER_URL=https://${m%%\,*}:6443" >> /run/kubelet/apiservers.env
-  - path: /opt/bin/download-release.sh
-    permissions: 0755
-    content: |
-      #!/bin/bash
-      # This temp URL is only good for the length of time specified at cluster creation time.
-      # Afterward, it will result in a 403.
-      OBJECT_URL="CLOUD_FILES_URL"
-      if [ ! -s /opt/kubernetes.tar.gz ]
-      then
-        echo "Downloading release ($OBJECT_URL)"
-        wget "${OBJECT_URL}" -O /opt/kubernetes.tar.gz
-        echo "Unpacking release"
-        rm -rf /opt/kubernetes || false
-        tar xzf /opt/kubernetes.tar.gz -C /opt/
-      else
-        echo "kubernetes release found. Skipping download."
-      fi
-  - path: /run/config-kubelet.sh
-    permissions: 0755
-    content: |
-      #!/bin/bash -e
-      set -x
-      /usr/bin/mkdir -p /var/lib/kubelet
-      cat > /var/lib/kubelet/kubeconfig << EOF
-      apiVersion: v1
-      kind: Config
-      users:
-      - name: kubelet
-        user:
-          token: KUBELET_TOKEN
-      clusters:
-      - name: local
-        cluster:
-          insecure-skip-tls-verify: true
-      contexts:
-      - context:
-          cluster: local
-          user: kubelet
-        name: service-account-context
-      current-context: service-account-context
-      EOF
-  - path: /run/config-kube-proxy.sh
-    permissions: 0755
-    content: |
-      #!/bin/bash -e
-      set -x
-      /usr/bin/mkdir -p /var/lib/kube-proxy
-      cat > /var/lib/kube-proxy/kubeconfig << EOF
-      apiVersion: v1
-      kind: Config
-      users:
-      - name: kube-proxy
-        user:
-          token: KUBE_PROXY_TOKEN
-      clusters:
-      - name: local
-        cluster:
-          insecure-skip-tls-verify: true
-      contexts:
-      - context:
-          cluster: local
-          user: kube-proxy
-        name: service-account-context
-      current-context: service-account-context
-      EOF
-
-coreos:
-  etcd2:
-    discovery: https://discovery.etcd.io/DISCOVERY_ID
-    advertise-client-urls: http://$private_ipv4:2379,http://$private_ipv4:4001
-    initial-advertise-peer-urls: http://$private_ipv4:2380
-    listen-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001
-    listen-peer-urls: http://$private_ipv4:2380,http://$private_ipv4:7001
-
-  flannel:
-    ip_masq: true
-    interface: eth2
-
-  fleet:
-    public-ip: $private_ipv4
-    metadata: kubernetes_role=minion
-
-  update:
-    reboot-strategy: off
-
-  units:
-    - name: etcd2.service
-      command: start
-    - name: fleet.service
-      command: start
-    - name: flanneld.service
-      drop-ins:
-        - name: 50-flannel.conf
-          content: |
-            [Unit]
-            Requires=etcd2.service
-            After=etcd2.service
-
-            [Service]
-            ExecStartPre=-/usr/bin/etcdctl mk /coreos.com/network/config '{"Network":"KUBE_NETWORK", "Backend": {"Type": "host-gw"}}'
-      command: start
-    - name: docker.service
-      command: start
-      drop-ins:
-        - name: 51-docker-mirror.conf
-          content: |
-            [Unit]
-            # making sure that flanneld finished startup, otherwise containers
-            # won't land in flannel's network...
-            Requires=flanneld.service
-            After=flanneld.service
-            Restart=Always
-    - name: download-release.service
-      command: start
-      content: |
-        [Unit]
-        Description=Downloads Kubernetes Release
-        After=network-online.target
-        Requires=network-online.target
-        [Service]
-        Type=oneshot
-        RemainAfterExit=yes
-        ExecStart=/usr/bin/bash /opt/bin/download-release.sh
-    - name: kubelet.service
-      command: start
-      content: |
-        [Unit]
-        Description=Kubernetes Kubelet
-        Documentation=https://github.com/kubernetes/kubernetes
-        After=network-online.target
-        Requires=network-online.target
-        After=docker.service
-        Requires=docker.service
-        After=download-release.service
-        Requires=download-release.service
-        After=apiserver-finder.service
-        Requires=apiserver-finder.service
-        [Service]
-        EnvironmentFile=/run/kubelet/apiservers.env
-        ExecStartPre=/run/config-kubelet.sh
-        ExecStartPre=/usr/bin/ln -sf /opt/kubernetes/server/bin/kubelet /opt/bin/kubelet
-        ExecStart=/opt/bin/kubelet \
-        --address=$private_ipv4 \
-        --api-servers=${FIRST_APISERVER_URL} \
-        --cluster-dns=DNS_SERVER_IP \
-        --cluster-domain=DNS_DOMAIN \
-        --healthz-bind-address=$private_ipv4 \
-        --hostname-override=$private_ipv4 \
-        --logtostderr=true \
-        --v=2
-        Restart=always
-        RestartSec=5
-        KillMode=process
-    - name: kube-proxy.service
-      command: start
-      content: |
-        [Unit]
-        Description=Kubernetes Proxy
-        Documentation=https://github.com/kubernetes/kubernetes
-        After=network-online.target
-        Requires=network-online.target
-        After=docker.service
-        Requires=docker.service
-        After=download-release.service
-        Requires=download-release.service
-        After=apiserver-finder.service
-        Requires=apiserver-finder.service
-        [Service]
-        EnvironmentFile=/run/kubelet/apiservers.env
-        ExecStartPre=/run/config-kube-proxy.sh
-        ExecStartPre=/usr/bin/ln -sf /opt/kubernetes/server/bin/kube-proxy /opt/bin/kube-proxy
-        ExecStart=/opt/bin/kube-proxy \
-        --bind-address=$private_ipv4 \
-        --kubeconfig=/var/lib/kube-proxy/kubeconfig \
-        --logtostderr=true \
-        --hostname-override=$private_ipv4 \
-        --master=${FIRST_APISERVER_URL}
-        Restart=always
-        RestartSec=5
-    - name: apiserver-finder.service
-      command: start
-      content: |
-        [Unit]
-        Description=Kubernetes Apiserver finder
-        After=network-online.target
-        Requires=network-online.target
-        After=etcd2.service
-        Requires=etcd2.service
-        [Service]
-        ExecStartPre=/opt/bin/regen-apiserver-list.sh
-        ExecStart=/usr/bin/etcdctl exec-watch --recursive /corekube/apiservers -- /opt/bin/regen-apiserver-list.sh
-        Restart=always
-        RestartSec=30
-    - name: cbr0.netdev
-      command: start
-      content: |
-        [NetDev]
-        Kind=bridge
-        Name=cbr0
-    - name: cbr0.network
-      command: start
-      content: |
-        [Match]
-        Name=cbr0
-
-        [Network]
-        Address=10.240.INDEX.1/24
-    - name: nat.service
-      command: start
-      content: |
-        [Unit]
-        Description=NAT container->outside traffic
-
-        [Service]
-        ExecStart=/usr/sbin/iptables -t nat -A POSTROUTING -o eth0 -s 10.240.INDEX.0/24 -j MASQUERADE
-        ExecStart=/usr/sbin/iptables -t nat -A POSTROUTING -o eth1 -s 10.240.INDEX.0/24 -j MASQUERADE
-        RemainAfterExit=yes
-        Type=oneshot

cluster/rackspace/config-default.sh

-#!/bin/bash
-
-# Copyright 2014 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Sane defaults for dev environments. The following variables can be easily overriden
-# by setting each as a ENV variable ahead of time:
-# KUBE_IMAGE, KUBE_MASTER_FLAVOR, KUBE_NODE_FLAVOR, NUM_NODES, NOVA_NETWORK and SSH_KEY_NAME
-
-# Shared
-KUBE_IMAGE="${KUBE_IMAGE-3eba4fbb-51da-4233-b699-8a4030561add}" # CoreOS (Stable)
-SSH_KEY_NAME="${SSH_KEY_NAME-id_kubernetes}"
-NOVA_NETWORK_LABEL="kubernetes-pool-net"
-NOVA_NETWORK_CIDR="${NOVA_NETWORK-192.168.0.0/24}"
-INSTANCE_PREFIX="kubernetes"
-
-# Master
-KUBE_MASTER_FLAVOR="${KUBE_MASTER_FLAVOR-general1-1}"
-MASTER_NAME="${INSTANCE_PREFIX}-master"
-MASTER_TAG="tags=${INSTANCE_PREFIX}-master"
-
-# Node
-KUBE_NODE_FLAVOR="${KUBE_NODE_FLAVOR-general1-2}"
-NUM_NODES="${NUM_NODES-4}"
-NODE_TAG="tags=${INSTANCE_PREFIX}-node"
-NODE_NAMES=($(eval echo ${INSTANCE_PREFIX}-node-{1..${NUM_NODES}}))
-KUBE_NETWORK="10.240.0.0/16"
-SERVICE_CLUSTER_IP_RANGE="10.0.0.0/16"  # formerly PORTAL_NET
-
-# Optional: Enable node logging.
-ENABLE_NODE_LOGGING=false
-LOGGING_DESTINATION=elasticsearch
-
-# Optional: When set to true, Elasticsearch and Kibana will be setup as part of the cluster bring up.
-ENABLE_CLUSTER_LOGGING=false
-ELASTICSEARCH_LOGGING_REPLICAS=1
-
-# Optional: Cluster monitoring to setup as part of the cluster bring up:
-#   none     - No cluster monitoring setup
-#   influxdb - Heapster, InfluxDB, and Grafana
-#   google   - Heapster, Google Cloud Monitoring, and Google Cloud Logging
-ENABLE_CLUSTER_MONITORING="${KUBE_ENABLE_CLUSTER_MONITORING:-influxdb}"
-
-# Optional: Install cluster DNS.
-ENABLE_CLUSTER_DNS="${KUBE_ENABLE_CLUSTER_DNS:-true}"
-DNS_SERVER_IP="10.0.0.10"
-DNS_DOMAIN="cluster.local"
-
-# Optional: Enable DNS horizontal autoscaler
-ENABLE_DNS_HORIZONTAL_AUTOSCALER="${KUBE_ENABLE_DNS_HORIZONTAL_AUTOSCALER:-false}"
-
-# Optional: Install Kubernetes UI
-ENABLE_CLUSTER_UI="${KUBE_ENABLE_CLUSTER_UI:-true}"

cluster/rackspace/kube-up.sh

-#!/bin/bash
-
-# Copyright 2014 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Bring up a Kubernetes cluster.
-#
-# If the full release name (gs://<bucket>/<release>) is passed in then we take
-# that directly.  If not then we assume we are doing development stuff and take
-# the defaults in the release config.
-
-# exit on any error
-set -e
-
-source $(dirname $0)/../kube-util.sh
-
-echo "Starting cluster using provider: $KUBERNETES_PROVIDER"
-
-verify-prereqs
-kube-up
-
-# skipping validation for now until since machines show up as private IPs
-# source $(dirname $0)/validate-cluster.sh
-
-echo "Done"