heat_template_version: 2016-10-14 description: > Kubernetes cluster with one master and one or more worker nodes (as specified by the number_of_minions parameter, which defaults to 3). parameters: ssh_key_name: type: string description: name of ssh key to be provisioned on our server external_network: type: string description: uuid/name of a network to use for floating ip addresses default: public lbaas_version: type: string description: version of OpenStack LBaaS service. not specifying means auto detect server_image: type: string description: glance image used to boot the server master_flavor: type: string default: m1.small description: flavor to use when booting the server minion_flavor: type: string default: m1.small description: flavor to use when booting the server dns_nameserver: type: string description: address of a dns nameserver reachable in your environment default: 8.8.8.8 number_of_minions: type: number description: how many kubernetes minions to spawn initially default: 3 max_number_of_minions: type: number description: maximum number of kubernetes minions to spawn default: 10 fixed_network_cidr: type: string description: network range for fixed ip network default: 10.0.0.0/24 cluster_cidr: type: string description: network range for pod IPs default: 10.244.0.0/16 service_cluster_cidr: type: string description: network range for service IPs default: 10.10.0.0/16 master_pod_cidr: type: string description: >- network range for master pod IPs (ignored, but must not conflict with other subnets) default: 10.245.1.0/24 kubernetes_server_url: type: string description: URL of kubernetes server binary. Must be tar.gz. kubernetes_salt_url: type: string description: URL of kubernetes salt scripts. Must be tar.gz. apiserver_user: type: string description: User name used for api-server default: user apiserver_password: type: string description: Password used for api-server default: password token_kubelet: type: string description: Token used by kubelet default: TokenKubelet token_kube_proxy: type: string description: Token used by kube-proxy default: TokenKubeproxy wait_condition_timeout: type: number description : > timeout for the Wait Conditions default: 6000 os_auth_url: type: string description: OpenStack Auth URL default: false os_username: type: string description: OpenStack Username default: false os_password: type: string description: OpenStack Password default: false os_region_name: type: string description: OpenStack Region Name default: false os_tenant_name: type: string description: OpenStack Tenant Name default: false os_user_domain_name: type: string description: OpenStack User Domain Name (Domain-level authorization scope for keystone v3) enable_proxy: type: string description: Whether or not to enable proxy settings default: false ftp_proxy: type: string description: FTP Proxy URL default: localhost http_proxy: type: string description: HTTP Proxy URL default: localhost https_proxy: type: string description: HTTPS Proxy URL default: localhost socks_proxy: type: string description: SOCKS Proxy URL default: localhost no_proxy: type: string description: Comma seperated list of domains/addresses that bypass proxying. default: localhost assign_floating_ip: type: boolean description: Indicates whether floating IPs will be generated for minions default: true resources: master_wait_handle: type: OS::Heat::WaitConditionHandle master_wait_condition: type: OS::Heat::WaitCondition depends_on: kube_master properties: handle: {get_resource: master_wait_handle} timeout: {get_param: wait_condition_timeout} ###################################################################### # # network resources. allocate a network and router for our server. # fixed_network: type: OS::Neutron::Net fixed_subnet: type: OS::Neutron::Subnet properties: cidr: {get_param: fixed_network_cidr} network: {get_resource: fixed_network} dns_nameservers: - {get_param: dns_nameserver} extrouter: type: OS::Neutron::Router properties: external_gateway_info: network: {get_param: external_network} extrouter_inside: type: OS::Neutron::RouterInterface properties: router_id: {get_resource: extrouter} subnet: {get_resource: fixed_subnet} ###################################################################### # # security groups. we need to permit network traffic of various # sorts. # secgroup_base: type: OS::Neutron::SecurityGroup properties: rules: - protocol: icmp - protocol: tcp port_range_min: 22 port_range_max: 22 - remote_mode: remote_group_id secgroup_master: type: OS::Neutron::SecurityGroup properties: rules: - protocol: tcp # api-server port_range_min: 443 port_range_max: 443 secgroup_node: type: OS::Neutron::SecurityGroup properties: rules: - protocol: icmp - protocol: tcp - protocol: udp ###################################################################### # # software configs. these are components that are combined into # a multipart MIME user-data archive. # write_heat_params: type: OS::Heat::SoftwareConfig properties: group: ungrouped config: str_replace: template: {get_file: fragments/write-heat-params.yaml} params: "$KUBERNETES_SERVER_URL": {get_param: kubernetes_server_url} "$KUBERNETES_SALT_URL": {get_param: kubernetes_salt_url} "$MASTER_IP": {get_attr: [kube_master_eth0, fixed_ips, 0, ip_address]} proxy_config: type: OS::Heat::SoftwareConfig properties: group: ungrouped config: str_replace: template: {get_file: fragments/configure-proxy.sh} params: "$ENABLE_PROXY": {get_param: enable_proxy } "$FTP_PROXY": {get_param: ftp_proxy } "$HTTP_PROXY": {get_param: http_proxy } "$HTTPS_PROXY": {get_param: https_proxy } "$SOCKS_PROXY": {get_param: socks_proxy } "$NO_PROXY": {get_param: no_proxy } hostname_hack: type: OS::Heat::SoftwareConfig properties: group: ungrouped config: {get_file: fragments/hostname-hack.yaml} hostname_hack_script: type: OS::Heat::SoftwareConfig properties: group: ungrouped config: {get_file: fragments/hostname-hack.sh} kube_user: type: OS::Heat::SoftwareConfig properties: group: ungrouped config: {get_file: fragments/kube-user.yaml} provision_network_master: type: OS::Heat::SoftwareConfig properties: group: ungrouped config: {get_file: fragments/provision-network-master.sh} deploy_kube_auth_files_master: type: OS::Heat::SoftwareConfig properties: group: ungrouped config: str_replace: template: {get_file: fragments/deploy-kube-auth-files-master.yaml} params: "$apiserver_user": {get_param: apiserver_user} "$apiserver_password": {get_param: apiserver_password} "$token_kubelet": {get_param: token_kubelet} "$token_kube_proxy": {get_param: token_kube_proxy} configure_salt_master: type: OS::Heat::SoftwareConfig properties: group: ungrouped config: str_replace: template: {get_file: fragments/configure-salt.yaml} params: "$MASTER_IP": {get_attr: [kube_master_eth0, fixed_ips, 0, ip_address]} "$OS_AUTH_URL": {get_param: os_auth_url} "$OS_USERNAME": {get_param: os_username} "$OS_PASSWORD": {get_param: os_password} "$OS_REGION_NAME": {get_param: os_region_name} "$OS_TENANT_NAME": {get_param: os_tenant_name} "$OS_USER_DOMAIN_NAME": {get_param: os_user_domain_name} "$LBAAS_VERSION": {get_param: lbaas_version} "$SUBNET_ID": {get_resource: fixed_subnet} "$FLOATING_NETWORK_ID": {get_attr: [kube_master_floating, floating_network_id]} "$role": "kubernetes-master" "$router_id": {get_resource: extrouter} "$cluster_cidr": {get_param: cluster_cidr} "$MASTER_IP_RANGE": {get_param: master_pod_cidr} run_salt: type: OS::Heat::SoftwareConfig properties: group: ungrouped config: str_replace: template: {get_file: fragments/run-salt.sh} params: "$$wc_notify": {get_attr: [master_wait_handle, curl_cli]} kube_master_init: type: OS::Heat::MultipartMime properties: parts: - config: {get_resource: write_heat_params} - config: {get_resource: proxy_config} - config: {get_resource: hostname_hack} - config: {get_resource: hostname_hack_script} - config: {get_resource: kube_user} - config: {get_resource: provision_network_master} - config: {get_resource: deploy_kube_auth_files_master} - config: {get_resource: configure_salt_master} - config: {get_resource: run_salt} ###################################################################### # # kubernetes master server. # kube_master: type: OS::Nova::Server depends_on: - extrouter_inside properties: image: {get_param: server_image} flavor: {get_param: master_flavor} key_name: {get_param: ssh_key_name} user_data_format: RAW user_data: {get_resource: kube_master_init} networks: - port: {get_resource: kube_master_eth0} name: list_join: [-, [{get_param: "OS::stack_name"}, master]] kube_master_eth0: type: OS::Neutron::Port properties: network: {get_resource: fixed_network} security_groups: - {get_resource: secgroup_base} - {get_resource: secgroup_master} fixed_ips: - subnet: {get_resource: fixed_subnet} allowed_address_pairs: - ip_address: 10.246.0.0/16 replacement_policy: AUTO kube_master_floating: type: OS::Neutron::FloatingIP properties: floating_network: {get_param: external_network} port_id: {get_resource: kube_master_eth0} ###################################################################### # # kubernetes minions. This is an autoscaling group that will initially # create minions, and will scale up to # based on CPU utilization. # kube_minions: type: OS::Heat::AutoScalingGroup depends_on: - extrouter_inside - master_wait_condition properties: resource: type: kubeminion.yaml properties: kubernetes_server_url: {get_param: kubernetes_server_url} kubernetes_salt_url: {get_param: kubernetes_salt_url} ssh_key_name: {get_param: ssh_key_name} server_image: {get_param: server_image} minion_flavor: {get_param: minion_flavor} token_kubelet: {get_param: token_kubelet} token_kube_proxy: {get_param: token_kube_proxy} fixed_network: {get_resource: fixed_network} fixed_subnet: {get_resource: fixed_subnet} cluster_cidr: {get_param: cluster_cidr} kube_master_ip: {get_attr: [kube_master_eth0, fixed_ips, 0, ip_address]} external_network: {get_param: external_network} wait_condition_timeout: {get_param: wait_condition_timeout} metadata: {"metering.stack": {get_param: "OS::stack_id"}} cluster_name: {get_param: "OS::stack_name"} secgroup_base: {get_resource: secgroup_base} secgroup_node: {get_resource: secgroup_node} os_auth_url: {get_param: os_auth_url} os_username: {get_param: os_username} os_password: {get_param: os_password} os_region_name: {get_param: os_region_name} os_tenant_name: {get_param: os_tenant_name} os_user_domain_name: {get_param: os_user_domain_name} enable_proxy: {get_param: enable_proxy } ftp_proxy: {get_param: ftp_proxy } http_proxy: {get_param: http_proxy } https_proxy: {get_param: https_proxy } socks_proxy: {get_param: socks_proxy } no_proxy: {get_param: no_proxy } assign_floating_ip: {get_param: assign_floating_ip } min_size: {get_param: number_of_minions} desired_capacity: {get_param: number_of_minions} max_size: {get_param: max_number_of_minions} outputs: kube_master: value: {get_attr: [kube_master_floating, floating_ip_address]} description: > This is the "public" IP address of the Kubernetes master node. Use this IP address to log in to the Kubernetes master via ssh or to access the Kubernetes API from outside the cluster. kube_minions: value: {get_attr: [kube_minions, outputs_list, kube_minion_ip]} description: > Here is the list of the "private" addresses of all Kubernetes worker nodes. kube_minions_external: value: {get_attr: [kube_minions, outputs_list, kube_minion_external_ip]} description: > Here is the list of the "public" addresses of all Kubernetes worker nodes.