87 lines
3.0 KiB
YAML
87 lines
3.0 KiB
YAML
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
namespace: kube-system
|
|
name: k8s-etcd
|
|
annotations:
|
|
novit.io/bootstrap-prio: "300"
|
|
labels:
|
|
component: k8s-etcd
|
|
tier: control-plane
|
|
spec:
|
|
hostNetwork: true
|
|
dnsPolicy: Default
|
|
priorityClassName: system-cluster-critical
|
|
automountServiceAccountToken: false
|
|
tolerations:
|
|
- key: node.kubernetes.io/not-ready
|
|
effect: NoSchedule
|
|
containers:
|
|
- name: etcd
|
|
image: {{.vars.etcd.image}}:{{.vars.etcd.version}}
|
|
command:
|
|
- etcd
|
|
- --name={{ .host.name }}
|
|
- --data-dir=/var/lib/etcd
|
|
- --trusted-ca-file=/tls/etcd-server/ca.crt
|
|
- --key-file=/tls/etcd-server/tls.key
|
|
- --cert-file=/tls/etcd-server/tls.crt
|
|
- --client-cert-auth=true
|
|
- --trusted-ca-file=/tls/etcd-server/ca.crt
|
|
- --listen-client-urls=https://127.0.0.1:2379,https://{{ .host.ip }}:2379
|
|
- --advertise-client-urls=https://{{ .host.ip }}:2379
|
|
- --listen-peer-urls=https://{{ .host.ip }}:2380
|
|
- --peer-trusted-ca-file=/tls/etcd-peer/ca.crt
|
|
- --peer-key-file=/tls/etcd-peer/tls.key
|
|
- --peer-cert-file=/tls/etcd-peer/tls.crt
|
|
- --peer-client-cert-auth=true
|
|
- --initial-advertise-peer-urls=https://{{ .host.ip }}:2380
|
|
env:
|
|
- name: ETCD_INITIAL_CLUSTER
|
|
value: {{ range $i, $host := hosts_by_group "master" }}{{ if gt $i 0 }},{{end}}{{$host.name}}=https://{{$host.ip}}:2380{{end}}
|
|
- name: ETCD_INITIAL_CLUSTER_STATE
|
|
value: {{.etcd.cluster_state}}
|
|
- name: ETCD_INITIAL_CLUSTER_TOKEN
|
|
value: '{{ token "etcd-initial-cluster" }}'
|
|
- name: ETCDCTL_ENDPOINTS
|
|
value: {{ range $i, $host := hosts_by_group "master" }}{{ if gt $i 0 }},{{end}}https://{{$host.ip}}:2379{{end}}
|
|
- name: ETCDCTL_CACERT
|
|
value: /tls/etcd-peer/ca.crt
|
|
- name: ETCDCTL_CERT
|
|
value: /tls/etcd-peer/tls.crt
|
|
- name: ETCDCTL_KEY
|
|
value: /tls/etcd-peer/tls.key
|
|
{{ if .vars.control_plane.reserve_resources }}
|
|
resources:
|
|
requests:
|
|
cpu: 200m
|
|
memory: 1.2Gi
|
|
{{ end }}
|
|
volumeMounts:
|
|
- name: etc-certs
|
|
mountPath: /etc/ssl/certs
|
|
- name: tls-etcd-server
|
|
mountPath: /tls/etcd-server
|
|
- name: tls-etcd-peer
|
|
mountPath: /tls/etcd-peer
|
|
- name: k8s
|
|
mountPath: /etc/kubernetes
|
|
- name: data
|
|
mountPath: /var/lib/etcd
|
|
volumes:
|
|
- name: etc-certs
|
|
hostPath:
|
|
path: /etc/ssl/certs
|
|
- name: tls-etcd-server
|
|
hostPath:
|
|
path: /etc/tls/etcd-server
|
|
- name: tls-etcd-peer
|
|
hostPath:
|
|
path: /etc/tls/etcd-peer
|
|
- name: k8s
|
|
hostPath:
|
|
path: /etc/kubernetes
|
|
- name: data
|
|
hostPath:
|
|
path: /var/lib/etcd
|