k8s_tectonic_master.yaml

#cloud-config
ssh_authorized_keys:
 - %PUB_KEY%
write-files:
  - path: /etc/kubernetes/ssl/openssl.cnf
    permissions: '0644'
    content: |
      [req]
      req_extensions = v3_req
      distinguished_name = req_distinguished_name
      [req_distinguished_name]
      [ v3_req ]
      basicConstraints = CA:FALSE
      keyUsage = nonRepudiation, digitalSignature, keyEncipherment
      subjectAltName = @alt_names
      [alt_names]
      DNS.1 = %HOSTNAME%
      DNS.2 = kubernetes
      DNS.3 = kubernetes.default
      DNS.4 = kubernetes.default.svc
      DNS.5 = kubernetes.default.svc.%K8S_DOMAIN%
      IP.1 = %K8S_SERVICE_IP%
  - path: /etc/kubernetes/ssl/make-ca-cert.sh
    permissions: '0755'
    content: |
      #!/bin/bash -e
      CA_KUBE=ca.pem
      CA_KUBE_KEY=ca-key.pem
      KUBE_SSL_CONF=openssl.cnf
      # Set permissions for the /etc/kubernetes/ssl directory
      chmod 700 /etc/kubernetes/ssl
      # inherit default 077 umask for the new files
      docker run --rm -v /etc/kubernetes/ssl:/etc/kubernetes/ssl %K8S_IMAGE% setfacl -d -m user::rwx /etc/kubernetes/ssl
      # Kubernetes CA
      openssl genrsa -out $CA_KUBE_KEY 2048
      openssl req -x509 -new -nodes -key $CA_KUBE_KEY -days 10000 -out $CA_KUBE -subj "/CN=kube-ca"
      # Kubernetes keypairs
      openssl genrsa -out apiserver-key.pem 2048
      openssl req -new -key apiserver-key.pem -out apiserver.csr -subj "/CN=kube-apiserver" -config $KUBE_SSL_CONF
      openssl x509 -req -in apiserver.csr -CA $CA_KUBE -CAkey $CA_KUBE_KEY -CAcreateserial -out apiserver.pem -days 365 -extensions v3_req -extfile $KUBE_SSL_CONF
      openssl genrsa -out worker-key.pem 2048
      openssl req -new -key worker-key.pem -out worker.csr -subj "/CN=kube-worker"
      openssl x509 -req -in worker.csr -CA $CA_KUBE -CAkey $CA_KUBE_KEY -CAcreateserial -out worker.pem -days 365
      openssl genrsa -out admin-key.pem 2048
      openssl req -new -key admin-key.pem -out admin.csr -subj "/CN=kube-admin"
      openssl x509 -req -in admin.csr -CA $CA_KUBE -CAkey $CA_KUBE_KEY -CAcreateserial -out admin.pem -days 365
  - path: /etc/kubernetes/mk-kubeconfig.sh
    permissions: '0700'
    content: |
      #!/bin/bash -e
      CERT_DIR=/etc/kubernetes/ssl
      KUBELET_CERT=$(cat $CERT_DIR/worker.pem | base64 -w0)
      KUBELET_KEY=$(cat $CERT_DIR/worker-key.pem | base64 -w0)
      KUBELET_CA_CERT=$(cat $CERT_DIR/ca.pem | base64 -w0)
      eval "echo \"$(cat /etc/kubernetes/kubeconfig.yaml.in)\"" | etcdctl set /kubeconfig > /dev/null
  - path: /etc/kubernetes/kubeconfig.yaml.in
    permissions: '0600'
    content: |
      apiVersion: v1
      kind: Config
      clusters:
      - name: local
        cluster:
          certificate-authority-data: ${KUBELET_CA_CERT}
      users:
      - name: kubelet
        user:
          client-certificate-data: ${KUBELET_CERT}
          client-key-data: ${KUBELET_KEY}
      contexts:
      - context:
          cluster: local
          user: kubelet
        name: kubelet-context
      current-context: kubelet-context
  - path: /etc/kubernetes/skydns.yaml
    permissions: '0644'
    content: |
      apiVersion: v1
      kind: Service
      metadata:
        name: kube-dns
        namespace: kube-system
        labels:
          k8s-app: kube-dns
          kubernetes.io/cluster-service: "true"
          kubernetes.io/name: "KubeDNS"
      spec:
        selector:
          k8s-app: kube-dns
        clusterIP: %DNS_SERVICE_IP%
        ports:
        - name: dns
          port: 53
          protocol: UDP
        - name: dns-tcp
          port: 53
          protocol: TCP

      ---

      apiVersion: v1
      kind: ReplicationController
      metadata:
        name: kube-dns-v11
        namespace: kube-system
        labels:
          k8s-app: kube-dns
          version: v11
          kubernetes.io/cluster-service: "true"
      spec:
        replicas: 1
        selector:
          k8s-app: kube-dns
          version: v11
        template:
          metadata:
            labels:
              k8s-app: kube-dns
              version: v11
              kubernetes.io/cluster-service: "true"
          spec:
            containers:
            - name: etcd
              image: gcr.io/google_containers/etcd:2.2.1
              resources:
                # keep request = limit to keep this container in guaranteed class
                limits:
                  cpu: 100m
                  memory: 50Mi
                requests:
                  cpu: 100m
                  memory: 50Mi
              command:
              - /usr/local/bin/etcd
              - -data-dir
              - /var/etcd/data
              - -listen-client-urls
              - http://127.0.0.1:2379,http://127.0.0.1:4001
              - -advertise-client-urls
              - http://127.0.0.1:2379,http://127.0.0.1:4001
              - -initial-cluster-token
              - skydns-etcd
              volumeMounts:
              - name: etcd-storage
                mountPath: /var/etcd/data
            - name: kube2sky
              image: gcr.io/google_containers/kube2sky:1.14
              resources:
                # keep request = limit to keep this container in guaranteed class
                limits:
                  cpu: 100m
                  memory: 50Mi
                requests:
                  cpu: 100m
                  memory: 50Mi
              args:
              # command = "/kube2sky"
              - --domain=%K8S_DOMAIN%
            - name: skydns
              image: gcr.io/google_containers/skydns:2015-10-13-8c72f8c
              resources:
                # keep request = limit to keep this container in guaranteed class
                limits:
                  cpu: 100m
                  memory: 50Mi
                requests:
                  cpu: 100m
                  memory: 50Mi
              args:
              # command = "/skydns"
              - --machines=http://127.0.0.1:2379
              - --addr=0.0.0.0:53
              - --ns-rotate=false
              - --domain=%K8S_DOMAIN%.
              ports:
              - containerPort: 53
                name: dns
                protocol: UDP
              - containerPort: 53
                name: dns-tcp
                protocol: TCP
              livenessProbe:
                httpGet:
                  path: /healthz
                  port: 8080
                  scheme: HTTP
                initialDelaySeconds: 30
                timeoutSeconds: 5
              readinessProbe:
                httpGet:
                  path: /healthz
                  port: 8080
                  scheme: HTTP
                initialDelaySeconds: 1
                timeoutSeconds: 5
            - name: healthz
              image: gcr.io/google_containers/exechealthz:1.0
              resources:
                # keep request = limit to keep this container in guaranteed class
                limits:
                  cpu: 10m
                  memory: 20Mi
                requests:
                  cpu: 10m
                  memory: 20Mi
              args:
              - -cmd=nslookup kubernetes.default.svc.%K8S_DOMAIN% 127.0.0.1 >/dev/null
              - -port=8080
              ports:
              - containerPort: 8080
                protocol: TCP
            volumes:
            - name: etcd-storage
              emptyDir: {}
            dnsPolicy: Default  # Don't use cluster DNS.
  - path: /etc/kubernetes/manifests/kube-apiserver.yaml
    permissions: '0644'
    content: |
      apiVersion: v1
      kind: Pod
      metadata:
        name: kube-apiserver
        namespace: kube-system
      spec:
        hostNetwork: true
        containers:
        - name: kube-apiserver
          image: %K8S_IMAGE%
          command:
          - /hyperkube
          - apiserver
          - --bind-address=0.0.0.0
          - --etcd_servers=%ETCD_ENDPOINTS%
          - --allow-privileged=true
          - --service-cluster-ip-range=%SERVICE_IP_RANGE%
          - --secure_port=443
          # - --advertise-address=%HOSTNAME%
          - --admission-control=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota
          - --tls-cert-file=/etc/kubernetes/ssl/apiserver.pem
          - --tls-private-key-file=/etc/kubernetes/ssl/apiserver-key.pem
          - --client-ca-file=/etc/kubernetes/ssl/ca.pem
          - --service-account-key-file=/etc/kubernetes/ssl/apiserver-key.pem
          ports:
          - containerPort: 443
            hostPort: 443
            name: https
          - containerPort: 8080
            hostPort: 8080
            name: local
          volumeMounts:
          - mountPath: /etc/kubernetes/ssl
            name: ssl-certs-kubernetes
            readOnly: true
          - mountPath: /etc/ssl/certs
            name: ssl-certs-host
            readOnly: true
        volumes:
        - hostPath:
            path: /etc/kubernetes/ssl
          name: ssl-certs-kubernetes
        - hostPath:
            path: /usr/share/ca-certificates
          name: ssl-certs-host
  - path: /etc/kubernetes/manifests/kube-proxy.yaml
    permissions: '0644'
    content: |
      apiVersion: v1
      kind: Pod
      metadata:
        name: kube-proxy
        namespace: kube-system
      spec:
        hostNetwork: true
        containers:
        - name: kube-proxy
          image: %K8S_IMAGE%
          command:
          - /hyperkube
          - proxy
          - --master=http://127.0.0.1:8080
          securityContext:
            privileged: true
          volumeMounts:
          - mountPath: /etc/ssl/certs
            name: ssl-certs-host
            readOnly: true
        volumes:
        - hostPath:
            path: /usr/share/ca-certificates
          name: ssl-certs-host
  - path: /etc/kubernetes/manifests/kube-podmaster.yaml
    permissions: '0644'
    content: |
      apiVersion: v1
      kind: Pod
      metadata:
        name: kube-podmaster
        namespace: kube-system
      spec:
        hostNetwork: true
        containers:
        - name: scheduler-elector
          image: gcr.io/google_containers/podmaster:1.1
          command:
          - /podmaster
          - --etcd-servers=%ETCD_ENDPOINTS%
          - --key=scheduler
          - --whoami=%HOSTNAME%
          - --source-file=/src/manifests/kube-scheduler.yaml
          - --dest-file=/dst/manifests/kube-scheduler.yaml
          volumeMounts:
          - mountPath: /src/manifests
            name: manifest-src
            readOnly: true
          - mountPath: /dst/manifests
            name: manifest-dst
        - name: controller-manager-elector
          image: gcr.io/google_containers/podmaster:1.1
          command:
          - /podmaster
          - --etcd-servers=%ETCD_ENDPOINTS%
          - --key=controller
          - --whoami=%HOSTNAME%
          - --source-file=/src/manifests/kube-controller-manager.yaml
          - --dest-file=/dst/manifests/kube-controller-manager.yaml
          terminationMessagePath: /dev/termination-log
          volumeMounts:
          - mountPath: /src/manifests
            name: manifest-src
            readOnly: true
          - mountPath: /dst/manifests
            name: manifest-dst
        volumes:
        - hostPath:
            path: /srv/kubernetes/manifests
          name: manifest-src
        - hostPath:
            path: /etc/kubernetes/manifests
          name: manifest-dst
  - path: /srv/kubernetes/manifests/kube-controller-manager.yaml
    permissions: '0644'
    content: |
      apiVersion: v1
      kind: Pod
      metadata:
        name: kube-controller-manager
        namespace: kube-system
      spec:
        containers:
        - name: kube-controller-manager
          image: %K8S_IMAGE%
          command:
          - /hyperkube
          - controller-manager
          - --master=http://127.0.0.1:8080
          - --service-account-private-key-file=/etc/kubernetes/ssl/apiserver-key.pem
          - --root-ca-file=/etc/kubernetes/ssl/ca.pem
          livenessProbe:
            httpGet:
              host: 127.0.0.1
              path: /healthz
              port: 10252
            initialDelaySeconds: 15
            timeoutSeconds: 1
          volumeMounts:
          - mountPath: /etc/kubernetes/ssl
            name: ssl-certs-kubernetes
            readOnly: true
          - mountPath: /etc/ssl/certs
            name: ssl-certs-host
            readOnly: true
        hostNetwork: true
        volumes:
        - hostPath:
            path: /etc/kubernetes/ssl
          name: ssl-certs-kubernetes
        - hostPath:
            path: /usr/share/ca-certificates
          name: ssl-certs-host
  - path: /srv/kubernetes/manifests/kube-scheduler.yaml
    permissions: '0644'
    content: |
      apiVersion: v1
      kind: Pod
      metadata:
        name: kube-scheduler
        namespace: kube-system
      spec:
        hostNetwork: true
        containers:
        - name: kube-scheduler
          image: %K8S_IMAGE%
          command:
          - /hyperkube
          - scheduler
          - --master=http://127.0.0.1:8080
          livenessProbe:
            httpGet:
              host: 127.0.0.1
              path: /healthz
              port: 10251
            initialDelaySeconds: 15
            timeoutSeconds: 1
  - path: /etc/kubernetes/ssl/tectonic-identity-openssl.cnf
    permissions: '0644'
    content: |
      [req]
      req_extensions = v3_req
      distinguished_name = req_distinguished_name
      [req_distinguished_name]
      [ v3_req ]
      basicConstraints = CA:FALSE
      keyUsage = nonRepudiation, digitalSignature, keyEncipherment
      subjectAltName = @alt_names
      [alt_names]
      DNS.1 = %HOSTNAME%
      DNS.2 = identity
      DNS.3 = identity.default
      DNS.4 = identity.default.svc
      DNS.5 = identity.default.svc.%K8S_DOMAIN%
      IP.1 = %K8S_SERVICE_IP%
  - path: /etc/kubernetes/ssl/tectonic-console-openssl.cnf
    permissions: '0644'
    content: |
      [req]
      req_extensions = v3_req
      distinguished_name = req_distinguished_name
      [req_distinguished_name]
      [ v3_req ]
      basicConstraints = CA:FALSE
      keyUsage = nonRepudiation, digitalSignature, keyEncipherment
      subjectAltName = @alt_names
      [alt_names]
      DNS.1 = %HOSTNAME%
      DNS.2 = console
      DNS.3 = console.default
      DNS.4 = console.default.svc
      DNS.5 = console.default.svc.%K8S_DOMAIN%
      IP.1 = %K8S_SERVICE_IP%
  - path: /etc/kubernetes/ssl/make-tectonic-ca-cert.sh
    permissions: '0755'
    content: |
      #!/bin/bash -e
      CA_TEC=ca-tec.pem
      CA_TEC_KEY=ca-tec-key.pem
      TEC_IDENT_SSL_CONF=tectonic-identity-openssl.cnf
      TEC_CONS_SSL_CONF=tectonic-console-openssl.cnf
      # Set permissions for the /etc/kubernetes/ssl directory
      chmod 700 /etc/kubernetes/ssl
      # inherit default 077 umask for the new files
      docker run --rm -v /etc/kubernetes/ssl:/etc/kubernetes/ssl %K8S_IMAGE% setfacl -d -m user::rwx /etc/kubernetes/ssl
      # Tectonic CA
      openssl genrsa -out $CA_TEC_KEY 2048
      openssl req -x509 -new -nodes -key $CA_TEC_KEY -days 10000 -out $CA_TEC -subj "/CN=tectonic-ca"
      # Tectonic identity keypairs
      openssl genrsa -out identity-key.pem 2048
      openssl req -new -key identity-key.pem -out identity.csr -subj "/CN=tectonic-identity" -config $TEC_IDENT_SSL_CONF
      openssl x509 -req -in identity.csr -CA $CA_TEC -CAkey $CA_TEC_KEY -CAcreateserial -out identity.pem -days 365 -extensions v3_req -extfile $TEC_IDENT_SSL_CONF
      # Tectonic console keypairs
      openssl genrsa -out console-key.pem 2048
      openssl req -new -key console-key.pem -out console.csr -subj "/CN=tectonic-console" -config $TEC_CONS_SSL_CONF
      openssl x509 -req -in console.csr -CA $CA_TEC -CAkey $CA_TEC_KEY -CAcreateserial -out console.pem -days 365 -extensions v3_req -extfile $TEC_CONS_SSL_CONF
  - path: /etc/kubernetes/mk-tectonic-config.sh
    permissions: '0700'
    content: |
      #!/bin/bash -e
      CERT_DIR=/etc/kubernetes/ssl
      export PATH="$PATH:/opt/bin"
      cd $CERT_DIR
      generate-secrets-from-file.sh tectonic-ca-cert tectonic-ca-cert.yml cert,ca-tec.pem
      generate-secrets-from-file.sh tectonic-identity-cert tectonic-identity-cert.yml cert,identity.pem key,identity-key.pem
      generate-secrets-from-file.sh tectonic-console-cert tectonic-console-cert.yml cert,console.pem key,console-key.pem
      kubectl create -f tectonic-ca-cert.yml
      kubectl create -f tectonic-identity-cert.yml
      kubectl create -f tectonic-console-cert.yml
  - path: /etc/kubernetes/deployer-config.txt
    permissions: '0644'
    content: |
      # This file contains the necessary user-supplied settings for Tectonic.
      # It is intended as input to generate-deployer-config.sh

      # URL for Identity DB
      identity-db-url=postgres://postgres:password@%HOSTNAME%:5432/tectonic?sslmode=disable

      # Issuer for identity; used by Identity itself, Console, and other Relying Parties of Identity.
      identity-issuer-url=https://%HOSTNAME%:30556

      # Customizes identity screens
      identity-issuer-name=Organization ID Services

      # Email address for Identity to send from.
      identity-email-from=tectonic-identity@example.com

      # Console URL
      console-url=https://%HOSTNAME%:32000

      # Email address of the identity admin user
      identity-admin-user=admin@example.com

      # Certificate Authorities for Console: This should be the name of a Kubernetes Secret
      # containing a "config" key, whose values are PEM-formatted certificates. These
      # will be the trusted CAs that Console uses to make https requests. If this
      # value is empty, then the host's root CAs will be used.
      tectonic-ca-cert-secret=tectonic-ca-cert

      # Secret containing TLS cert and key for Identity
      tectonic-identity-tls-secret=tectonic-identity-cert

      # Secret containing TLS cert and key for Console
      tectonic-console-tls-secret=tectonic-console-cert
  - path: /etc/kubernetes/identity-emailer.json
    permissions: '0600'
    content: |
      { "type": "fake" }
  - path: /etc/kubernetes/identity-connectors.json
    permissions: '0600'
    content: |
      [ { "type": "local", "id": "local" } ]
  - path: /etc/kubernetes/tectonic-license.yml
    permissions: '0600'
    content: |
      apiVersion: v1
      kind: Secret
      metadata:
        name: tectonic-license
        namespace: tectonic-system
      type: Opaque
      data:
        license: %TECTONIC_LICENSE%
  - path: /etc/kubernetes/coreos-pull-secret.yml
    permissions: '0600'
    content: |
      apiVersion: v1
      kind: Secret
      metadata:
        name: coreos-pull-secret
        namespace: tectonic-system
      type: kubernetes.io/dockercfg
      data:
        .dockercfg: %DOCKER_CFG%
hostname: %HOSTNAME%
coreos:
  etcd2:
    # generate a new token for each unique cluster from https://discovery.etcd.io/new?size=3
    # specify the initial size of your cluster with ?size=X
    discovery: %DISCOVERY%
    advertise-client-urls: http://%H:2379,http://%H:4001
    initial-advertise-peer-urls: http://%H:2380
    # listen on both the official ports and the legacy ports
    # legacy ports can be omitted if your application doesn't depend on them
    listen-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001
    listen-peer-urls: http://%H:2380
#  fleet:
#    metadata: "role=master"
  units:
    - name: systemd-networkd.service
      command: restart
    - name: etcd2.service
      command: start
#    - name: fleet.service
#      command: start
    - name: flanneld.service
      command: start
      drop-ins:
        - name: 50-network-config.conf
          content: |
            [Unit]
            Requires=etcd2.service
            [Service]
            ExecStartPre=/usr/bin/etcdctl set /coreos.com/network/config '{"Network":"%POD_NETWORK%", "Backend": {"Type": "%FLANNEL_TYPE%"}}'
    - name: docker.service
      drop-ins:
        - name: 40-flannel.conf
          content: |
            [Unit]
            Requires=flanneld.service
            After=flanneld.service
    - name: generate-keys.service
      command: start
      content: |
        [Unit]
        ConditionPathExists=!/etc/kubernetes/ssl/.certs.lock
        Requires=network-online.target docker.service
        After=network-online.target docker.service
        [Service]
        WorkingDirectory=/etc/kubernetes/ssl
        ExecStart=/etc/kubernetes/ssl/make-ca-cert.sh
        ExecStartPost=/usr/bin/touch /etc/kubernetes/ssl/.certs.lock
        # wait for etcd ready
        ExecStartPost=/usr/bin/bash -c "while true; do etcdctl ls / > /dev/null && exit 0; sleep 1; done"
        ExecStartPost=/etc/kubernetes/mk-kubeconfig.sh
        Type=oneshot
        RemainAfterExit=true
    - name: kubernetes-download@.service
      content: |
        [Unit]
        Description=Download Kubernetes %i binary
        Documentation=https://github.com/GoogleCloudPlatform/kubernetes
        Requires=network-online.target
        After=network-online.target
        [Service]
        ExecStartPre=-/usr/bin/mkdir -p /opt/bin
        ExecStart=/usr/bin/curl -s -L -o /opt/bin/%i -z /opt/bin/%i https://storage.googleapis.com/kubernetes-release/release/%K8S_RELEASE%/bin/linux/amd64/%i
        ExecStartPost=/usr/bin/chmod +x /opt/bin/%i
        RemainAfterExit=yes
        Type=oneshot
    - name: kubelet.service
      command: start
      content: |
        [Unit]
        Requires=docker.service generate-keys.service kubernetes-download@kubelet.service
        After=docker.service generate-keys.service kubernetes-download@kubelet.service
        [Service]
        ExecStart=/opt/bin/kubelet \
          --api_servers=http://127.0.0.1:8080 \
          --register-node=true \
          --register-schedulable=false \
          --allow-privileged=true \
          --pod-manifest-path=/etc/kubernetes/manifests \
          --hostname-override=%H \
          --cluster_dns=%DNS_SERVICE_IP% \
          --cluster_domain=%K8S_DOMAIN% \
          --cadvisor-port=0
        Restart=always
        RestartSec=10
        [Install]
        WantedBy=multi-user.target
    - name: kube-system-ns.service
      command: start
      content: |
        [Unit]
        ConditionPathExists=!/etc/kubernetes/.kube-system-ns.lock
        Requires=kubelet.service
        After=kubelet.service
        [Service]
        # Wait until apiserver start
        ExecStartPre=/usr/bin/bash -c "while true; do curl -v http://127.0.0.1:8080/api/v1/namespaces/kube-system -o /dev/null 2>&1 | grep '< HTTP/1.1' > /dev/null && exit 0; sleep 1; done"
        ExecStart=/usr/bin/bash -c 'curl -H "Content-Type: application/json" -XPOST -d\'{"apiVersion":"v1","kind":"Namespace","metadata":{"name":"kube-system"}}\' "http://127.0.0.1:8080/api/v1/namespaces"'
        ExecStartPost=/usr/bin/touch /etc/kubernetes/.kube-system-ns.lock
        Type=oneshot
        RemainAfterExit=true
    - name: skydns.service
      command: start
      content: |
        [Unit]
        ConditionPathExists=!/etc/kubernetes/.skydns.lock
        Requires=kubernetes-download@kubectl.service
        After=kubernetes-download@kubectl.service
        [Service]
        # Wait until kubectl can access apiserver
        ExecStartPre=/usr/bin/bash -c "while true; do /opt/bin/kubectl get nodes && exit 0; sleep 1; done"
        ExecStart=/opt/bin/kubectl create -f /etc/kubernetes/skydns.yaml
        ExecStartPost=/usr/bin/touch /etc/kubernetes/.skydns.lock
        RemainAfterExit=yes
        Type=oneshot
    - name: tectonic-ns.service
      command: start
      content: |
        [Unit]
        ConditionPathExists=!/etc/kubernetes/.tectonic-ns.lock
        Requires=kubelet.service
        After=kubelet.service
        [Service]
        ExecStartPre=/usr/bin/bash -c "while true; do curl -v http://127.0.0.1:8080/api/v1/namespaces/tectonic-system -o /dev/null 2>&1 | grep '404 Not Found' > /dev/null && exit 0; sleep 1; done"
        ExecStart=/usr/bin/bash -c 'curl -H "Content-Type: application/json" -XPOST -d\'{"apiVersion":"v1","kind":"Namespace","metadata":{"name":"tectonic-system"}}\' "http://127.0.0.1:8080/api/v1/namespaces"'
        ExecStartPost=/usr/bin/touch /etc/kubernetes/.tectonic-ns.lock
        Type=oneshot
        RemainAfterExit=true
    - name: generate-tectonic-keys.service
      command: start
      content: |
        [Unit]
        ConditionPathExists=!/etc/kubernetes/ssl/.tectonic-certs.lock
        Requires=network-online.target docker.service tectonic-ns.service kubernetes-download@kubectl.service
        After=network-online.target docker.service tectonic-ns.service kubernetes-download@kubectl.service
        [Service]
        WorkingDirectory=/etc/kubernetes/ssl
        ExecStartPre=/usr/bin/curl -s -L -o /opt/bin/generate-secrets-from-file.sh -z /opt/bin/generate-secrets-from-file.sh https://tectonic.com/enterprise/docs/latest/deployer/scripts/generate-secrets-from-file.sh
        ExecStartPre=/usr/bin/chmod +x /opt/bin/generate-secrets-from-file.sh
        ExecStartPre=/etc/kubernetes/ssl/make-tectonic-ca-cert.sh
        # wait for kubectl ready
        ExecStartPre=/usr/bin/bash -c "while true; do /opt/bin/kubectl get nodes && exit 0; sleep 1; done"
        ExecStart=/etc/kubernetes/mk-tectonic-config.sh
        ExecStartPost=/usr/bin/touch /etc/kubernetes/ssl/.tectonic-certs.lock
        Type=oneshot
        RemainAfterExit=true
    - name: generate-tectonic-deployer-config.service
      command: start
      content: |
        [Unit]
        ConditionPathExists=!/etc/kubernetes/.tectonic-deployer-config.lock
        Requires=generate-tectonic-keys.service
        After=generate-tectonic-keys.service
        [Service]
        WorkingDirectory=/etc/kubernetes
        ExecStartPre=/usr/bin/curl -s -L -o /opt/bin/generate-deployer-config.sh -z /opt/bin/generate-deployer-config.sh https://tectonic.com/enterprise/docs/latest/deployer/scripts/generate-deployer-config.sh
        ExecStartPre=/usr/bin/chmod +x /opt/bin/generate-deployer-config.sh
        ExecStartPre=/opt/bin/generate-deployer-config.sh deployer-config.txt tectonic-deployer-config-secret.yml
        ExecStartPre=/opt/bin/generate-secrets-from-file.sh tectonic-identity-emailer-config tectonic-identity-emailer-config-secret.yml identity-emailer.json
        ExecStartPre=/opt/bin/generate-secrets-from-file.sh tectonic-identity-connectors tectonic-identity-connectors-secret.yml identity-connectors.json
        ExecStart=/opt/bin/kubectl create -f tectonic-deployer-config-secret.yml
        ExecStart=/opt/bin/kubectl create -f tectonic-identity-emailer-config-secret.yml
        ExecStart=/opt/bin/kubectl create -f tectonic-identity-connectors-secret.yml
        ExecStartPost=/usr/bin/touch /etc/kubernetes/.tectonic-deployer-config.lock
        Type=oneshot
        RemainAfterExit=true
    - name: run-postgres.service
      command: start
      content: |
        [Unit]
        Description=Postgres container
        After=docker.service

        [Service]
        TimeoutSec=0
        Restart=always
        ExecStartPre=-/usr/bin/docker kill postgres
        ExecStartPre=-/usr/bin/docker rm postgres
        ExecStartPre=/usr/bin/docker pull postgres:latest
        ExecStart=/usr/bin/docker run --rm --name postgres -e POSTGRES_USER=postgres -e POSTGRES_PASSWORD=password -e POSTGRES_DB=tectonic -v /data:/var/lib/postgresql/data -p 5432:5432 postgres
    - name: install-tectonic.service
      command: start
      content: |
        [Unit]
        ConditionPathExists=!/etc/kubernetes/.install-tectonic.lock
        Requires=generate-tectonic-deployer-config.service generate-tectonic-deployer-config.service run-postgres.service
        After=generate-tectonic-deployer-config.service generate-tectonic-deployer-config.service run-postgres.service
        [Service]
        WorkingDirectory=/etc/kubernetes
        ExecStartPre=/usr/bin/curl -s -L -o /etc/kubernetes/tectonic-services.yml -z /etc/kubernetes/tectonic-services.yml https://tectonic.com/enterprise/docs/latest/deployer/files/tectonic-services.yml
        ExecStartPre=/usr/bin/curl -s -L -o /etc/kubernetes/tectonic-identity-service.yml -z /etc/kubernetes/tectonic-identity-service.yml https://tectonic.com/enterprise/docs/latest/deployer/files/tectonic-identity-service.yml
        ExecStartPre=/usr/bin/curl -s -L -o /etc/kubernetes/tectonic-console-service.yml -z /etc/kubernetes/tectonic-console-service.yml https://tectonic.com/enterprise/docs/latest/deployer/files/tectonic-console-service.yml
        ExecStart=/opt/bin/kubectl create -f /etc/kubernetes/tectonic-license.yml
        ExecStart=/opt/bin/kubectl create -f /etc/kubernetes/coreos-pull-secret.yml
        ExecStart=/opt/bin/kubectl create -f /etc/kubernetes/tectonic-services.yml
        ExecStart=/opt/bin/kubectl --namespace=tectonic-system create -f /etc/kubernetes/tectonic-identity-service.yml
        ExecStart=/opt/bin/kubectl --namespace=tectonic-system create -f /etc/kubernetes/tectonic-console-service.yml
        ExecStartPost=/usr/bin/touch /etc/kubernetes/.install-tectonic.lock
        Type=oneshot
        RemainAfterExit=true
  update:
    reboot-strategy: off