Merge pull request #15790 from mikedanese/azure-bankruptcy

cluster/azure/config-default.sh

-#!/bin/bash
-
-# Copyright 2014 The Kubernetes Authors All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-INSTANCE_PREFIX=kubernetes
-AZ_LOCATION='West US'
-TAG=testing
-AZ_CS_PREFIX=kube
-AZ_VNET=MyVnet
-AZ_SUBNET=Subnet-1
-AZ_IMAGE=b39f27a8b8c64d52b05eac6a62ebad85__Ubuntu-14_04_1-LTS-amd64-server-20140927-en-us-30GB
-AZ_CS="" # is set in azure/util.sh verify-prereqs
-
-AZ_SSH_KEY=$HOME/.ssh/azure_rsa
-AZ_SSH_CERT=$HOME/.ssh/azure.pem
-
-NUM_MINIONS=4
-
-MASTER_NAME="${INSTANCE_PREFIX}-master"
-MASTER_TAG="${INSTANCE_PREFIX}-master"
-MINION_TAG="${INSTANCE_PREFIX}-minion"
-MINION_NAMES=($(eval echo ${INSTANCE_PREFIX}-minion-{1..${NUM_MINIONS}}))
-MINION_IP_RANGES=($(eval echo "10.244.{1..${NUM_MINIONS}}.0/24"))
-MINION_SCOPES=""
-
-SERVICE_CLUSTER_IP_RANGE="10.250.0.0/16"  # formerly PORTAL_NET
-
-# Optional: Install node logging
-ENABLE_NODE_LOGGING=false
-LOGGING_DESTINATION=elasticsearch # options: elasticsearch, gcp
-
-# Optional: When set to true, Elasticsearch and Kibana will be setup as part of the cluster bring up.
-ENABLE_CLUSTER_LOGGING=false
-ELASTICSEARCH_LOGGING_REPLICAS=1
-
-# Optional: Cluster monitoring to setup as part of the cluster bring up:
-#   none     - No cluster monitoring setup 
-#   influxdb - Heapster, InfluxDB, and Grafana 
-#   google   - Heapster, Google Cloud Monitoring, and Google Cloud Logging
-ENABLE_CLUSTER_MONITORING="${KUBE_ENABLE_CLUSTER_MONITORING:-influxdb}"
-
-# Optional: Install Kubernetes UI
-ENABLE_CLUSTER_UI="${KUBE_ENABLE_CLUSTER_UI:-true}"
-
-# Admission Controllers to invoke prior to persisting objects in cluster
-ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota

cluster/azure/templates/common.sh

-#!/bin/bash
-
-# Copyright 2014 The Kubernetes Authors All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Retry a download until we get it.
-#
-# $1 is the URL to download
-download-or-bust() {
-  local -r url="$1"
-  local -r file="${url##*/}"
-  rm -f "$file"
-  until [[ -e "${file}" ]]; do
-    curl --ipv4 -Lo "$file" --connect-timeout 20 --retry 6 --retry-delay 10 "$url"
-    md5sum "$file"
-  done
-}
-
-# Install salt from GCS.  See README.md for instructions on how to update these
-# debs.
-#
-# $1 If set to --master, also install the master
-install-salt() {
-  apt-get update
-
-  mkdir -p /var/cache/salt-install
-  cd /var/cache/salt-install
-
-  TARS=(
-    libzmq3_3.2.3+dfsg-1~bpo70~dst+1_amd64.deb
-    python-zmq_13.1.0-1~bpo70~dst+1_amd64.deb
-    salt-common_2014.1.13+ds-1~bpo70+1_all.deb
-    salt-minion_2014.1.13+ds-1~bpo70+1_all.deb
-  )
-  if [[ ${1-} == '--master' ]]; then
-    TARS+=(salt-master_2014.1.13+ds-1~bpo70+1_all.deb)
-  fi
-  URL_BASE="https://storage.googleapis.com/kubernetes-release/salt"
-
-  for tar in "${TARS[@]}"; do
-    download-or-bust "${URL_BASE}/${tar}"
-    dpkg -i "${tar}"
-  done
-
-  # This will install any of the unmet dependencies from above.
-  apt-get install -f -y
-}

cluster/azure/templates/create-dynamic-salt-files.sh

-#!/bin/bash
-
-# Copyright 2014 The Kubernetes Authors All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Create the overlay files for the salt tree.  We create these in a separate
-# place so that we can blow away the rest of the salt configs on a kube-push and
-# re-apply these.
-
-mkdir -p /srv/salt-overlay/pillar
-cat <<EOF >/srv/salt-overlay/pillar/cluster-params.sls
-instance_prefix: '$(echo "$INSTANCE_PREFIX" | sed -e "s/'/''/g")'
-node_instance_prefix: $NODE_INSTANCE_PREFIX
-service_cluster_ip_range: $SERVICE_CLUSTER_IP_RANGE
-admission_control: '$(echo "$ADMISSION_CONTROL" | sed -e "s/'/''/g")'
-EOF
-
-mkdir -p /srv/salt-overlay/salt/nginx
-echo $MASTER_HTPASSWD > /srv/salt-overlay/salt/nginx/htpasswd

cluster/azure/templates/download-release.sh

-#!/bin/bash
-
-# Copyright 2014 The Kubernetes Authors All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Download and install release
-
-# This script assumes that the environment variable MASTER_RELEASE_TAR contains
-# the release tar to download and unpack.  It is meant to be pushed to the
-# master and run.
-
-
-echo "Downloading binary release tar ($SERVER_BINARY_TAR_URL)"
-download-or-bust "$SERVER_BINARY_TAR_URL"
-
-echo "Downloading binary release tar ($SALT_TAR_URL)"
-download-or-bust "$SALT_TAR_URL"
-
-echo "Unpacking Salt tree"
-rm -rf kubernetes
-tar xzf "${SALT_TAR_URL##*/}"
-
-echo "Running release install script"
-sudo kubernetes/saltbase/install.sh "${SERVER_BINARY_TAR_URL##*/}"

cluster/azure/templates/salt-master.sh

-#!/bin/bash
-
-# Copyright 2014 The Kubernetes Authors All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Prepopulate the name of the Master
-mkdir -p /etc/salt/minion.d
-echo "master: $MASTER_NAME" > /etc/salt/minion.d/master.conf
-
-cat <<EOF >/etc/salt/minion.d/grains.conf
-grains:
-  roles:
-    - kubernetes-master
-  cloud: azure
-EOF
-
-# Auto accept all keys from minions that try to join
-mkdir -p /etc/salt/master.d
-cat <<EOF >/etc/salt/master.d/auto-accept.conf
-auto_accept: True
-EOF
-
-cat <<EOF >/etc/salt/master.d/reactor.conf
-# React to new minions starting by running highstate on them.
-reactor:
-  - 'salt/minion/*/start':
-    - /srv/reactor/highstate-new.sls
-EOF
-
-mkdir -p /srv/salt/nginx
-echo $MASTER_HTPASSWD > /srv/salt/nginx/htpasswd
-
-mkdir -p /etc/openvpn
-umask=$(umask)
-umask 0066
-echo "$CA_CRT" > /etc/openvpn/ca.crt
-echo "$SERVER_CRT" > /etc/openvpn/server.crt
-echo "$SERVER_KEY" > /etc/openvpn/server.key
-umask $umask
-
-cat <<EOF >/etc/salt/minion.d/log-level-debug.conf
-log_level: debug
-log_level_logfile: debug
-EOF
-
-cat <<EOF >/etc/salt/master.d/log-level-debug.conf
-log_level: debug
-log_level_logfile: debug
-EOF
-
-install-salt --master
-
-# Wait a few minutes and trigger another Salt run to better recover from
-# any transient errors.
-echo "Sleeping 180"
-sleep 180
-salt-call state.highstate || true

cluster/azure/templates/salt-minion.sh

-#!/bin/bash
-
-# Copyright 2014 The Kubernetes Authors All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-mkdir -p /etc/openvpn
-umask=$(umask)
-umask 0066
-echo "$CA_CRT" > /etc/openvpn/ca.crt
-echo "$CLIENT_CRT" > /etc/openvpn/client.crt
-echo "$CLIENT_KEY" > /etc/openvpn/client.key
-umask $umask
-
-# Prepopulate the name of the Master
-mkdir -p /etc/salt/minion.d
-echo "master: $MASTER_NAME" > /etc/salt/minion.d/master.conf
-
-cat <<EOF >/etc/salt/minion.d/log-level-debug.conf
-log_level: debug
-log_level_logfile: debug
-EOF
-
-hostnamef=$(uname -n)
-apt-get install -y ipcalc
-netmask=$(ipcalc $MINION_IP_RANGE | grep Netmask | awk '{ print $2 }')
-network=$(ipcalc $MINION_IP_RANGE | grep Address | awk '{ print $2 }')
-cbrstring="$network $netmask"
-
-# Our minions will have a pool role to distinguish them from the master.
-cat <<EOF >/etc/salt/minion.d/grains.conf
-grains:
-  roles:
-    - kubernetes-pool
-  cbr-cidr: $MINION_IP_RANGE
-  cloud: azure
-  hostnamef: $hostnamef
-  cbr-string: $cbrstring
-EOF
-
-install-salt
-
-# Wait a few minutes and trigger another Salt run to better recover from
-# any transient errors.
-echo "Sleeping 180"
-sleep 180
-salt-call state.highstate || true

cluster/get-kube.sh

@@ -28,8 +28,6 @@
 #   * export KUBERNETES_PROVIDER=gke; wget -q -O - https://get.k8s.io | bash
 #  Amazon EC2
 #   * export KUBERNETES_PROVIDER=aws; wget -q -O - https://get.k8s.io | bash
-#  Microsoft Azure
-#   * export KUBERNETES_PROVIDER=azure; wget -q -O - https://get.k8s.io | bash
 #  Vagrant (local virtual machines)
 #   * export KUBERNETES_PROVIDER=vagrant; wget -q -O - https://get.k8s.io | bash
 #  VMWare VSphere

cluster/kube-env.sh

@@ -18,7 +18,7 @@
 # You can override the default provider by exporting the KUBERNETES_PROVIDER
 # variable in your bashrc
 #
-# The valid values: 'gce', 'gke', 'aws', 'azure', 'vagrant', 'vsphere', 'libvirt-coreos', 'juju'
+# The valid values: 'gce', 'gke', 'aws', 'vagrant', 'vsphere', 'libvirt-coreos', 'juju'
 
 KUBERNETES_PROVIDER=${KUBERNETES_PROVIDER:-gce}
 

cluster/saltbase/README.md

@@ -4,11 +4,11 @@ This is the root of the SaltStack configuration for Kubernetes. A high
 level overview for the Kubernetes SaltStack configuration can be found [in the docs tree.](../../docs/admin/salt.md)
 
 This SaltStack configuration currently applies to default
-configurations for Debian-on-GCE, Fedora-on-Vagrant, Ubuntu-on-AWS and
-Ubuntu-on-Azure. (That doesn't mean it can't be made to apply to an
+configurations for Debian-on-GCE, Fedora-on-Vagrant, and Ubuntu-on-AWS.
+(That doesn't mean it can't be made to apply to an
 arbitrary configuration, but those are only the in-tree OS/IaaS
 combinations supported today.) As you peruse the configuration, these
-are shorthanded as `gce`, `vagrant`, `aws`, `azure` in `grains.cloud`;
+are shorthanded as `gce`, `vagrant`, `aws` in `grains.cloud`;
 the documentation in this tree uses this same shorthand for convenience.
 
 See more:

cluster/saltbase/salt/README.md

@@ -8,29 +8,27 @@ and is only used for the [docker](docker/) config.)
 
 Key: M = Config applies to master, n = config applies to nodes
 
-Config                                              | GCE   | Vagrant | AWS | Azure
-----------------------------------------------------|-------|---------|-----|------
-[cadvisor](cadvisor/)                               | M n   | M n     | M n | M n
-[debian-auto-upgrades](debian-auto-upgrades/)       | M n   | M n     | M n | M n
-[docker](docker/)                                   | M n   | M n     | M n |   n
-[etcd](etcd/)                                       | M     | M       | M   | M
-[fluentd-es](fluentd-es/) (pillar conditional)      | M n   | M n     | M n | M n
-[fluentd-gcp](fluentd-gcp/) (pillar conditional)    | M n   | M n     | M n | M n
-[generate-cert](generate-cert/)                     | M     | M       | M   | M
-[kube-addons](kube-addons/)                         | M     | M       | M   | M
-[kube-apiserver](kube-apiserver/)                   | M     | M       | M   | M
-[kube-controller-manager](kube-controller-manager/) | M     | M       | M   | M
-[kube-proxy](kube-proxy/)                           |   n   |   n     |   n |   n
-[kube-scheduler](kube-scheduler/)                   | M     | M       | M   | M
-[kubelet](kubelet/)                                 | M n   | M n     | M n |   n
-[logrotate](logrotate/)                             | M n   |   n     | M n | M n
-[monit](monit/)                                     | M n   | M n     | M n | M n
-[nginx](nginx/)                                     | M     | M       | M   | M
-[openvpn-client](openvpn-client/)                   |       |         |     |   n
-[openvpn](openvpn/)                                 |       |         |     | M
+Config                                              | GCE   | Vagrant | AWS |
+----------------------------------------------------|-------|---------|-----|
+[cadvisor](cadvisor/)                               | M n   | M n     | M n |
+[debian-auto-upgrades](debian-auto-upgrades/)       | M n   | M n     | M n |
+[docker](docker/)                                   | M n   | M n     | M n |
+[etcd](etcd/)                                       | M     | M       | M   |
+[fluentd-es](fluentd-es/) (pillar conditional)      | M n   | M n     | M n |
+[fluentd-gcp](fluentd-gcp/) (pillar conditional)    | M n   | M n     | M n |
+[generate-cert](generate-cert/)                     | M     | M       | M   |
+[kube-addons](kube-addons/)                         | M     | M       | M   |
+[kube-apiserver](kube-apiserver/)                   | M     | M       | M   |
+[kube-controller-manager](kube-controller-manager/) | M     | M       | M   |
+[kube-proxy](kube-proxy/)                           |   n   |   n     |   n |
+[kube-scheduler](kube-scheduler/)                   | M     | M       | M   |
+[kubelet](kubelet/)                                 | M n   | M n     | M n |
+[logrotate](logrotate/)                             | M n   |   n     | M n |
+[monit](monit/)                                     | M n   | M n     | M n |
+[nginx](nginx/)                                     | M     | M       | M   |
 [static-routes](static-routes/) (vsphere only)      |       |         |     |
-[base](base.sls)                                    | M n   | M n     | M n | M n
-[kube-client-tools](kube-client-tools.sls)          | M     | M       | M   | M
+[base](base.sls)                                    | M n   | M n     | M n |
+[kube-client-tools](kube-client-tools.sls)          | M     | M       | M   |
 
 
 [![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/cluster/saltbase/salt/README.md?pixel)]()

cluster/saltbase/salt/generate-cert/init.sls

@@ -6,9 +6,6 @@
   {% if grains.cloud == 'aws' %}
     {% set cert_ip='_use_aws_external_ip_' %}
   {% endif %}
-  {% if grains.cloud == 'azure' %}
-    {% set cert_ip='_use_azure_dns_name_' %}
-  {% endif %}
   {% if grains.cloud == 'vsphere' %}
     {% set cert_ip=grains.ip_interfaces.eth0[0] %}
   {% endif %}

cluster/saltbase/salt/generate-cert/make-ca-cert.sh

@@ -36,11 +36,6 @@ if [ "$cert_ip" == "_use_aws_external_ip_" ]; then
   cert_ip=$(curl -s http://169.254.169.254/latest/meta-data/public-ipv4)
 fi
 
-if [ "$cert_ip" == "_use_azure_dns_name_" ]; then
-  cert_ip=$(uname -n | awk -F. '{ print $2 }').cloudapp.net
-  use_cn=true
-fi
-
 sans="IP:${cert_ip}"
 if [[ -n "${extra_sans}" ]]; then
   sans="${sans},${extra_sans}"

cluster/saltbase/salt/kube-proxy/default

@@ -2,28 +2,20 @@
 {% if grains['os_family'] == 'RedHat' -%}
 	{% set daemon_args = "" -%}
 {% endif -%}
-{# TODO(azure-maintainer): add support for distributing kubeconfig with token to kube-proxy #}
-{# so it can use https #}
-{% if grains['cloud'] is defined and grains['cloud'] == 'azure' -%}
-  {% set api_servers = "--master=http://" + ips[0][0] -%}
-  {% set api_servers_with_port = api_servers + ":7080" -%}
-  {% set kubeconfig = "" -%}
-{% else -%}
-  {% set kubeconfig = "--kubeconfig=/var/lib/kube-proxy/kubeconfig" -%}
-  {% if grains.api_servers is defined -%}
-    {% set api_servers = "--master=https://" + grains.api_servers -%}
-  {% else -%}
-    {% set ips = salt['mine.get']('roles:kubernetes-master', 'network.ip_addrs', 'grain').values() -%}
-    {% set api_servers = "--master=https://" + ips[0][0] -%}
-  {% endif -%}
 
-  # TODO: remove nginx for other cloud providers.
-  {% if grains['cloud'] is defined and grains.cloud in [ 'aws', 'gce', 'vagrant' ]  %}
-     {% set api_servers_with_port = api_servers -%}
-  {% else -%}
-    {% set api_servers_with_port = api_servers + ":6443" -%}
-  {% endif -%}
+{% set kubeconfig = "--kubeconfig=/var/lib/kube-proxy/kubeconfig" -%}
+{% if grains.api_servers is defined -%}
+  {% set api_servers = "--master=https://" + grains.api_servers -%}
+{% else -%}
+  {% set ips = salt['mine.get']('roles:kubernetes-master', 'network.ip_addrs', 'grain').values() -%}
+  {% set api_servers = "--master=https://" + ips[0][0] -%}
+{% endif -%}
 
+# TODO: remove nginx for other cloud providers.
+{% if grains['cloud'] is defined and grains.cloud in [ 'aws', 'gce', 'vagrant' ]  %}
+   {% set api_servers_with_port = api_servers -%}
+{% else -%}
+  {% set api_servers_with_port = api_servers + ":6443" -%}
 {% endif -%}
 
 {% set test_args = "" -%}

cluster/saltbase/salt/openvpn-client/client.conf

-# Specify that we are a client and that we
-# will be pulling certain config file directives
-# from the server.
-client
-
-# Use the same setting as you are using on
-# the server.
-# On most systems, the VPN will not function
-# unless you partially or fully disable
-# the firewall for the TUN/TAP interface.
-dev tun
-
-# Are we connecting to a TCP or
-# UDP server?  Use the same setting as
-# on the server.
-proto udp
-
-# The hostname/IP and port of the server.
-# You can have multiple remote entries
-# to load balance between the servers.
-remote {{ salt['mine.get']('roles:kubernetes-master', 'network.ip_addrs', 'grain').keys()[0] }} 1194
-
-# Keep trying indefinitely to resolve the
-# host name of the OpenVPN server.  Very useful
-# on machines which are not permanently connected
-# to the internet such as laptops.
-resolv-retry infinite
-
-# Most clients don't need to bind to
-# a specific local port number.
-nobind
-
-# Try to preserve some state across restarts.
-persist-key
-persist-tun
-
-# SSL/TLS parms.
-# See the server config file for more
-# description.  It's best to use
-# a separate .crt/.key file pair
-# for each client.  A single ca
-# file can be used for all clients.
-ca /etc/openvpn/ca.crt
-cert /etc/openvpn/client.crt
-key /etc/openvpn/client.key
-
-# Enable compression on the VPN link.
-# Don't enable this unless it is also
-# enabled in the server config file.
-comp-lzo
-
-# Set log file verbosity.
-verb 3

cluster/saltbase/salt/openvpn-client/init.sls

-/etc/openvpn/client.conf:
-  file.managed:
-    - source: salt://openvpn-client/client.conf
-    - template: jinja
-    - user: root
-    - group: root
-    - mode: 644
-    - makedirs: True
-
-openvpn:
-  pkg:
-    - latest
-  service.running:
-    - enable: True
-    - watch:
-      - file: /etc/openvpn/client.conf

cluster/saltbase/salt/openvpn/init.sls

-/etc/openvpn/server.conf:
-  file.managed:
-    - source: salt://openvpn/server.conf
-    - template: jinja
-    - user: root
-    - group: root
-    - mode: 644
-    - makedirs: True
-
-{% for (minion, grains) in salt['mine.get']('roles:kubernetes-pool', 'grains.items', expr_form='grain').items() %}
-/etc/openvpn/ccd/{{ minion }}:
-  file.managed:
-    - contents: "iroute {{ grains['cbr-string'] }}\n"
-    - user: root
-    - group: root
-    - mode: 644
-    - makedirs: True
-{% endfor %}
-
-openssl dhparam -out /etc/openvpn/dh1024.pem 1024:
-  cmd.run:
-    - creates: /etc/openvpn/dh1024.pem
-    - unless: file /etc/openvpn/dh1024.pem
-
-openvpn:
-  pkg:
-    - latest
-  service.running:
-    - enable: True
-    - watch:
-      - file: /etc/openvpn/server.conf

cluster/saltbase/salt/openvpn/server.conf

-# Which TCP/UDP port should OpenVPN listen on?
-# If you want to run multiple OpenVPN instances
-# on the same machine, use a different port
-# number for each one.  You will need to
-# open up this port on your firewall.
-port 1194
-
-# TCP or UDP server?
-proto udp
-
-# "dev tun" will create a routed IP tunnel,
-# "dev tap" will create an ethernet tunnel.
-# Use "dev tap0" if you are ethernet bridging
-# and have precreated a tap0 virtual interface
-# and bridged it with your ethernet interface.
-# If you want to control access policies
-# over the VPN, you must create firewall
-# rules for the the TUN/TAP interface.
-# On non-Windows systems, you can give
-# an explicit unit number, such as tun0.
-# On Windows, use "dev-node" for this.
-# On most systems, the VPN will not function
-# unless you partially or fully disable
-# the firewall for the TUN/TAP interface.
-dev tun
-
-# SSL/TLS root certificate (ca), certificate
-# (cert), and private key (key).  Each client
-# and the server must have their own cert and
-# key file.  The server and all clients will
-# use the same ca file.
-#
-# See the "easy-rsa" directory for a series
-# of scripts for generating RSA certificates
-# and private keys.  Remember to use
-# a unique Common Name for the server
-# and each of the client certificates.
-#
-# Any X509 key management system can be used.
-# OpenVPN can also use a PKCS #12 formatted key file
-# (see "pkcs12" directive in man page).
-ca /etc/openvpn/ca.crt
-cert /etc/openvpn/server.crt
-key /etc/openvpn/server.key  # This file should be kept secret
-
-# Diffie hellman parameters.
-# Generate your own with:
-#   openssl dhparam -out dh1024.pem 1024
-# Substitute 2048 for 1024 if you are using
-# 2048 bit keys.
-dh /etc/openvpn/dh1024.pem
-
-# Configure server mode and supply a VPN subnet
-# for OpenVPN to draw client addresses from.
-# The server will take 10.8.0.1 for itself,
-# the rest will be made available to clients.
-# Each client will be able to reach the server
-# on 10.8.0.1. Comment this line out if you are
-# ethernet bridging. See the man page for more info.
-server 10.8.0.0 255.255.255.0
-
-# Maintain a record of client <-> virtual IP address
-# associations in this file.  If OpenVPN goes down or
-# is restarted, reconnecting clients can be assigned
-# the same virtual IP address from the pool that was
-# previously assigned.
-ifconfig-pool-persist ipp.txt
-
-# To assign specific IP addresses to specific
-# clients or if a connecting client has a private
-# subnet behind it that should also have VPN access,
-# use the subdirectory "ccd" for client-specific
-# configuration files (see man page for more info).
-
-client-config-dir /etc/openvpn/ccd
-
-{% for minion in salt['mine.get']('roles:kubernetes-pool', 'grains.items', expr_form='grain').values() %}
-push "route {{ minion['cbr-string'] }}"
-route {{ minion['cbr-string'] }}
-{% endfor %}
-
-# Uncomment this directive to allow different
-# clients to be able to "see" each other.
-# By default, clients will only see the server.
-# To force clients to only see the server, you
-# will also need to appropriately firewall the
-# server's TUN/TAP interface.
-client-to-client
-
-# The keepalive directive causes ping-like
-# messages to be sent back and forth over
-# the link so that each side knows when
-# the other side has gone down.
-# Ping every 10 seconds, assume that remote
-# peer is down if no ping received during
-# a 120 second time period.
-keepalive 10 120
-
-# Enable compression on the VPN link.
-# If you enable it here, you must also
-# enable it in the client config file.
-comp-lzo
-
-# The persist options will try to avoid
-# accessing certain resources on restart
-# that may no longer be accessible because
-# of the privilege downgrade.
-persist-key
-persist-tun
-
-# Output a short status file showing
-# current connections, truncated
-# and rewritten every minute.
-status openvpn-status.log
-
-# Set the appropriate level of log
-# file verbosity.
-#
-# 0 is silent, except for fatal errors
-# 4 is reasonable for general usage
-# 5 and 6 can help to debug connection problems
-# 9 is extremely verbose
-verb 3

cluster/saltbase/salt/top.sls

@@ -10,9 +10,6 @@ base:
   'roles:kubernetes-pool':
     - match: grain
     - docker
-{% if grains['cloud'] is defined and grains['cloud'] == 'azure' %}
-    - openvpn-client
-{% endif %}
     - helpers
     - cadvisor
     - kube-client-tools
@@ -69,9 +66,6 @@ base:
     - logrotate
 {% endif %}
     - kube-addons
-{% if grains['cloud'] is defined and grains['cloud'] == 'azure' %}
-    - openvpn
-{% endif %}
 {% if grains['cloud'] is defined and grains['cloud'] in [ 'vagrant', 'gce', 'aws' ] %}
     - docker
     - kubelet

docs/getting-started-guides/README.md

@@ -159,7 +159,6 @@ AWS                  | Juju         | Ubuntu | flannel     | [docs](juju.md)
 OpenStack/HPCloud    | Juju         | Ubuntu | flannel     | [docs](juju.md)                                   |          | [Community](https://github.com/whitmo/bundle-kubernetes) ( [@whit](https://github.com/whitmo), [@matt](https://github.com/mbruzek), [@chuck](https://github.com/chuckbutler) )
 Joyent               | Juju         | Ubuntu | flannel     | [docs](juju.md)                                   |          | [Community](https://github.com/whitmo/bundle-kubernetes) ( [@whit](https://github.com/whitmo), [@matt](https://github.com/mbruzek), [@chuck](https://github.com/chuckbutler) )
 AWS                  | Saltstack    | Ubuntu | OVS         | [docs](aws.md)                                    |          | Community ([@justinsb](https://github.com/justinsb))
-Azure                | Saltstack    | Ubuntu | OpenVPN     | [docs](azure.md)                                  |          | Community
 Bare-metal           | custom       | Ubuntu | Calico      | [docs](ubuntu-calico.md)                          |          | Community ([@djosborne](https://github.com/djosborne))
 Bare-metal           | custom       | Ubuntu | flannel     | [docs](ubuntu.md)                                 |          | Community ([@resouer](https://github.com/resouer), [@WIZARD-CXY](https://github.com/WIZARD-CXY))
 Local                |              |        | _none_      | [docs](locally.md)                                |          | Community ([@preillyme](https://github.com/preillyme))

docs/getting-started-guides/azure.md

@@ -30,84 +30,11 @@ Documentation for other releases can be found at
 <!-- END STRIP_FOR_RELEASE -->
 
 <!-- END MUNGE: UNVERSIONED_WARNING -->
+
 Getting started on Microsoft Azure
 ----------------------------------
 
-**Table of Contents**
-
-- [Prerequisites](#prerequisites)
-- [Setup](#setup)
-- [Getting started with your cluster](#getting-started-with-your-cluster)
-- [Tearing down the cluster](#tearing-down-the-cluster)
-
-
-## Prerequisites
-
-**Azure Prerequisites**
-
-1. You need an Azure account. Visit http://azure.microsoft.com/ to get started.
-2. Install and configure the Azure cross-platform command-line interface. http://azure.microsoft.com/en-us/documentation/articles/xplat-cli/
-3. Make sure you have a default account set in the Azure cli, using `azure account set`
-
-**Prerequisites for your workstation**
-
-1. Be running a Linux or Mac OS X.
-2. Get or build a [binary release](binary_release.md)
-3. If you want to build your own release, you need to have [Docker
-installed](https://docs.docker.com/installation/).  On Mac OS X you can use
-[boot2docker](http://boot2docker.io/).
-
-## Setup
-
-### Starting a cluster
-
-The cluster setup scripts can setup Kubernetes for multiple targets. First modify `cluster/kube-env.sh` to specify azure:
-
-    KUBERNETES_PROVIDER="azure"
-
-Next, specify an existing virtual network and subnet in `cluster/azure/config-default.sh`:
-
-    AZ_VNET=<vnet name>
-    AZ_SUBNET=<subnet name>
-
-You can create a virtual network:
-
-    azure network vnet create <vnet name> --subnet-name=<subnet name> --location "West US" -v
-
-Now you're ready.
-
-You can download and install the latest Kubernetes release from [this page](https://github.com/kubernetes/kubernetes/releases), then run the `<kubernetes>/cluster/kube-up.sh` script to start the cluster:
-
-    cd kubernetes
-    cluster/kube-up.sh
-
-The script above will start (by default) a single master VM along with 4 worker VMs.  You
-can tweak some of these parameters by editing `cluster/azure/config-default.sh`.
-
-### Adding the Kubernetes command line tools to PATH
-
-The [kubectl](../../docs/user-guide/kubectl/kubectl.md) tool controls the Kubernetes cluster manager.  It lets you inspect your cluster resources, create, delete, and update components, and much more.
-You will use it to look at your new cluster and bring up example apps.
-
-Add the appropriate binary folder to your `PATH` to access kubectl:
-
-    # OS X
-    export PATH=<path/to/kubernetes-directory>/platforms/darwin/amd64:$PATH
-
-    # Linux
-    export PATH=<path/to/kubernetes-directory>/platforms/linux/amd64:$PATH
-
-## Getting started with your cluster
-
-See [a simple nginx example](../user-guide/simple-nginx.md) to try out your new cluster.
-
-For more complete applications, please look in the [examples directory](../../examples/).
-
-## Tearing down the cluster
-
-```sh
-cluster/kube-down.sh
-```
+Checkout the [coreos azure getting started guide](coreos/azure/README.md)
 
 
 <!-- BEGIN MUNGE: GENERATED_ANALYTICS -->