apiVersion: v1
kind: Pod
metadata:
  annotations:
    scheduler.alpha.kubernetes.io/critical-pod: ""
  labels:
    component: control-plane
    tier: control-plane
  name: controlplane
  namespace: kube-system
spec:
  hostname: controlplane
  hostNetwork: true
  priorityClassName: system-cluster-critical
  volumes:
  - hostPath:
      path: /etc/kubernetes/
      type: DirectoryOrCreate
    name: kubernetes
  - hostPath:
      path: /etc/facter/facts.d
      type: DirectoryOrCreate
    name: facter-facts
  containers:
  - image: ubuntu/16.04
    name: controlplane
    securityContext:
      privileged: true
    #livenessProbe:
      #failureThreshold: 8
      #httpGet:
        #path: /healthz
        #port: 6443
        #scheme: HTTPS
      #initialDelaySeconds: 15
      #timeoutSeconds: 15
    resources: {}
    volumeMounts:
    - mountPath: /etc/kuberneteshost
      name: kubernetes
    - mountPath: /etc/facter/facts.d
      name: facter-facts

    env:
      - name: user-data
        value: |
          #cloud-config
          apt:
            sources:
              kubernetes.list:
                source: "deb [ arch=amd64 ] https://apt.kubernetes.io/ kubernetes-xenial main"
                key: |
                  -----BEGIN PGP PUBLIC KEY BLOCK-----
                  Version: GnuPG v1
      
                  mQENBFUd6rIBCAD6mhKRHDn3UrCeLDp7U5IE7AhhrOCPpqGF7mfTemZYHf/5Jdjx
                  cOxoSFlK7zwmFr3lVqJ+tJ9L1wd1K6P7RrtaNwCiZyeNPf/Y86AJ5NJwBe0VD0xH
                  TXzPNTqRSByVYtdN94NoltXUYFAAPZYQls0x0nUD1hLMlOlC2HdTPrD1PMCnYq/N
                  uL/Vk8sWrcUt4DIS+0RDQ8tKKe5PSV0+PnmaJvdF5CKawhh0qGTklS2MXTyKFoqj
                  XgYDfY2EodI9ogT/LGr9Lm/+u4OFPvmN9VN6UG+s0DgJjWvpbmuHL/ZIRwMEn/tp
                  uneaLTO7h1dCrXC849PiJ8wSkGzBnuJQUbXnABEBAAG0QEdvb2dsZSBDbG91ZCBQ
                  YWNrYWdlcyBBdXRvbWF0aWMgU2lnbmluZyBLZXkgPGdjLXRlYW1AZ29vZ2xlLmNv
                  bT6JAT4EEwECACgFAlUd6rICGy8FCQWjmoAGCwkIBwMCBhUIAgkKCwQWAgMBAh4B
                  AheAAAoJEDdGwginMXsPcLcIAKi2yNhJMbu4zWQ2tM/rJFovazcY28MF2rDWGOnc
                  9giHXOH0/BoMBcd8rw0lgjmOosBdM2JT0HWZIxC/Gdt7NSRA0WOlJe04u82/o3OH
                  WDgTdm9MS42noSP0mvNzNALBbQnlZHU0kvt3sV1YsnrxljoIuvxKWLLwren/GVsh
                  FLPwONjw3f9Fan6GWxJyn/dkX3OSUGaduzcygw51vksBQiUZLCD2Tlxyr9NvkZYT
                  qiaWW78L6regvATsLc9L/dQUiSMQZIK6NglmHE+cuSaoK0H4ruNKeTiQUw/EGFaL
                  ecay6Qy/s3Hk7K0QLd+gl0hZ1w1VzIeXLo2BRlqnjOYFX4CwAgADmQENBFrBaNsB
                  CADrF18KCbsZlo4NjAvVecTBCnp6WcBQJ5oSh7+E98jX9YznUCrNrgmeCcCMUvTD
                  RDxfTaDJybaHugfba43nqhkbNpJ47YXsIa+YL6eEE9emSmQtjrSWIiY+2YJYwsDg
                  sgckF3duqkb02OdBQlh6IbHPoXB6H//b1PgZYsomB+841XW1LSJPYlYbIrWfwDfQ
                  vtkFQI90r6NknVTQlpqQh5GLNWNYqRNrGQPmsB+NrUYrkl1nUt1LRGu+rCe4bSaS
                  mNbwKMQKkROE4kTiB72DPk7zH4Lm0uo0YFFWG4qsMIuqEihJ/9KNX8GYBr+tWgyL
                  ooLlsdK3l+4dVqd8cjkJM1ExABEBAAG0QEdvb2dsZSBDbG91ZCBQYWNrYWdlcyBB
                  dXRvbWF0aWMgU2lnbmluZyBLZXkgPGdjLXRlYW1AZ29vZ2xlLmNvbT6JAT4EEwEC
                  ACgFAlrBaNsCGy8FCQWjmoAGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEGoD
                  CyG6B/T78e8H/1WH2LN/nVNhm5TS1VYJG8B+IW8zS4BqyozxC9iJAJqZIVHXl8g8
                  a/Hus8RfXR7cnYHcg8sjSaJfQhqO9RbKnffiuQgGrqwQxuC2jBa6M/QKzejTeP0M
                  gi67pyrLJNWrFI71RhritQZmzTZ2PoWxfv6b+Tv5v0rPaG+ut1J47pn+kYgtUaKd
                  sJz1umi6HzK6AacDf0C0CksJdKG7MOWsZcB4xeOxJYuy6NuO6KcdEz8/XyEUjIuI
                  OlhYTd0hH8E/SEBbXXft7/VBQC5wNq40izPi+6WFK/e1O42DIpzQ749ogYQ1eode
                  xPNhLzekKR3XhGrNXJ95r5KO10VrsLFNd8KwAgAD
                  =ssty
                  -----END PGP PUBLIC KEY BLOCK-----
          write_files:
            - path: /etc/systemd/system/kube-apiserver.service.d/10-apiserver.conf
              owner: root:root
              permissions: '0600'
              content: |
                [Service]
                Environment="KUBE_API_SECURITY=--authorization-mode=Node,RBAC --allow-privileged=true --enable-admission-plugins=NodeRestriction --enable-bootstrap-token-auth=true"
                Environment="KUBE_API_ETCD=--etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key"
                Environment="KUBE_API_KUBELET=--kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key"
                Environment="KUBE_API_PROXY=--proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key"
                Environment="KUBE_API_REQUESTHEADER=--requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User"
                Environment="KUBE_API_SA=--service-account-key-file=/etc/kubernetes/pki/sa.pub"
                Environment="KUBE_API_NETWORK=--service-cluster-ip-range=10.96.0.0/12 --insecure-port=0 --secure-port=6443 --kubelet-preferred-address-types InternalIP,InternalDNS,Hostname"
                Environment="KUBE_API_CLIENT=--client-ca-file=/etc/kubernetes/pki/ca.crt"
                Environment="KUBE_API_TLS=--tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key"
                ExecStart=
                # NOTE: We should switch to `--config` flags as soon as that's released
                # Also, we need to expand the facter commands, so we can't put this in `Environment=`. This is why we start the apiserver with /bin/sh
                ExecStart=/bin/sh -c '/usr/bin/kube-apiserver --advertise-address=$(facter ipaddress_ens3) --etcd-servers=https://$(facter ipaddress_ens3):2379 $KUBE_API_SECURITY $KUBE_API_ETCD $KUBE_API_KUBELET $KUBE_API_PROXY $KUBE_API_REQUESTHEADER $KUBE_API_SA $KUBE_API_NETWORK $KUBE_API_CLIENT $KUBE_API_TLS'

            - path: /etc/systemd/system/kube-controller-manager.service.d/10-controller-manager.conf
              owner: root:root
              permissions: '0600'
              content: |
                [Service]
                Environment="KUBE_CONTMGR_NETWORK=--allocate-node-cidrs=true --cluster-cidr={{ getVar "podSubnet" }} --node-cidr-mask-size=24"
                Environment="KUBE_CONTMGR_SECURITY=--cluster-signing-cert-file=/etc/kubernetes/pki/ca.crt --cluster-signing-key-file=/etc/kubernetes/pki/ca.key --root-ca-file=/etc/kubernetes/pki/ca.crt --service-account-private-key-file=/etc/kubernetes/pki/sa.key --use-service-account-credentials=true"
                # TODO: Check if bind address needs to be public?
                Environment="KUBE_CONTMGR_MISC=--bind-address=127.0.0.1 --controllers=*,bootstrapsigner,tokencleaner --kubeconfig=/etc/kubernetes/controller-manager.conf"
                ExecStart=
                ExecStart=/usr/bin/kube-controller-manager $KUBE_CONTMGR_NETWORK $KUBE_CONTMGR_SECURITY $KUBE_CONTMGR_MISC
                # NOTE: We should switch to `--config` flags as soon as that's released

            - path: /etc/systemd/system/kube-scheduler.service.d/10-scheduler.conf
              owner: root:root
              permissions: '0600'
              content: |
                [Service]
                Environment="KUBE_SCHEDULER_ARGS=--config=/etc/kubernetes/componentconfig/scheduler.conf"
                ExecStart=
                ExecStart=/usr/bin/kube-scheduler $KUBE_SCHEDULER_ARGS

            - path: /lib/systemd/system/kube-apiserver.service
              owner: root:root
              permissions: '0600'
              content: |
                [Unit]
                Description=kube-apiserver: Kubernetes Control Plane Component

                [Service]
                ExecStart=/usr/bin/kube-apiserver
                Restart=always
                StartLimitInterval=0
                RestartSec=10

                [Install]
                WantedBy=multi-user.target

            - path: /lib/systemd/system/kube-controller-manager.service
              owner: root:root
              permissions: '0600'
              content: |
                [Unit]
                Description=kube-controller-manager: Kubernetes Control Plane Component

                [Service]
                ExecStart=/usr/bin/kube-controller-manager
                Restart=always
                StartLimitInterval=0
                RestartSec=10

                [Install]
                WantedBy=multi-user.target

            - path: /lib/systemd/system/kube-scheduler.service
              owner: root:root
              permissions: '0600'
              content: |
                [Unit]
                Description=kube-scheduler: Kubernetes Scheduling Component of the Control Plane

                [Service]
                ExecStart=/usr/bin/kube-scheduler
                Restart=always
                StartLimitInterval=0
                RestartSec=10

                [Install]
                WantedBy=multi-user.target

            - path: /etc/kubernetes/componentconfig/scheduler.conf
              owner: root:root
              permissions: '0600'
              content: |
                apiVersion: componentconfig/v1alpha1
                kind: KubeSchedulerConfiguration
                clientConnection:
                  kubeconfig: /etc/kubernetes/scheduler.conf
                leaderElection:
                  leaderElect: true
          packages:
            - facter
          runcmd:
            - "for i in {1..100}; do sleep 2; if test -e /etc/kubernetes/pki/ca.crt; then break; fi; done"
            - [ cp, /etc/kuberneteshost/admin.conf, /etc/kubernetes/admin.conf ]
            - [ cp, /etc/kuberneteshost/controller-manager.conf, /etc/kubernetes/controller-manager.conf ]
            - [ cp, /etc/kuberneteshost/kubelet.conf, /etc/kubernetes/kubelet.conf ]
            - [ cp, /etc/kuberneteshost/scheduler.conf, /etc/kubernetes/scheduler.conf ]
            - [ cp, -r, /etc/kuberneteshost/pki, /etc/kubernetes/ ]
            - mkdir tmp
            - curl https://raw.githubusercontent.com/kubernetes/kubernetes/master/cluster/get-kube-binaries.sh -o tmp/get-kube-binaries.sh
            - chmod +x tmp/get-kube-binaries.sh
            - KUBE_VERSION=v1.12.3 KUBERNETES_SKIP_CONFIRM=y ./tmp/get-kube-binaries.sh
            - tar zxf server/kubernetes-server-linux-amd64.tar.gz
            - cp kubernetes/server/bin/kube-apiserver /usr/bin/
            - cp kubernetes/server/bin/kube-controller-manager /usr/bin/
            - cp kubernetes/server/bin/kube-scheduler /usr/bin/
            - [ systemctl, daemon-reload ]
            - [ systemctl, enable, kube-apiserver.service ]
            - [ systemctl, start, kube-apiserver.service ]
            - [ systemctl, enable, kube-scheduler.service ]
            - [ systemctl, start, kube-scheduler.service ]
            - [ systemctl, enable, kube-controller-manager.service ]
            - [ systemctl, start, kube-controller-manager.service ]
