apiVersion: v1
kind: Pod
metadata:
  annotations:
    scheduler.alpha.kubernetes.io/critical-pod: ""
  labels:
    component: etcd
    tier: control-plane
  name: etcd
  namespace: kube-system
spec:
  hostname: etcd
  hostNetwork: true
  priorityClassName: system-cluster-critical
  volumes:
  - hostPath:
      path: /var/lib/etcd
      type: DirectoryOrCreate
    name: etcd-data
  - hostPath:
      path: /etc/kubernetes/pki/etcd
      type: DirectoryOrCreate
    name: etcd-certs
  - hostPath:
      path: /etc/facter/facts.d
      type: DirectoryOrCreate
    name: facter-facts
  containers:
  - image: ubuntu/16.04
    name: etcd
    securityContext:
      privileged: true
    #livenessProbe:
      #exec:
        #command:
        #- /bin/sh
        #- -ec
        #- ETCDCTL_API=3 etcdctl --endpoints=https://[127.0.0.1]:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt
          #--cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key
          #get foo
      #failureThreshold: 8
      #initialDelaySeconds: 15
      #periodSeconds: 10
      #successThreshold: 1
      #timeoutSeconds: 15
    resources: {}
    volumeMounts:
    - mountPath: /var/lib/etcd
      name: etcd-data
    - mountPath: /etc/kubernetes/pki/etcd
      name: etcd-certs
    - mountPath: /etc/facter/facts.d
      name: facter-facts
    env:
      - name: user-data
        value: |
          #cloud-config
          apt:
            sources:
              kubernetes.list:
                source: "deb [ arch=amd64 ] https://apt.kubernetes.io/ kubernetes-xenial main"
                key: |
                  -----BEGIN PGP PUBLIC KEY BLOCK-----
                  Version: GnuPG v1
      
                  mQENBFUd6rIBCAD6mhKRHDn3UrCeLDp7U5IE7AhhrOCPpqGF7mfTemZYHf/5Jdjx
                  cOxoSFlK7zwmFr3lVqJ+tJ9L1wd1K6P7RrtaNwCiZyeNPf/Y86AJ5NJwBe0VD0xH
                  TXzPNTqRSByVYtdN94NoltXUYFAAPZYQls0x0nUD1hLMlOlC2HdTPrD1PMCnYq/N
                  uL/Vk8sWrcUt4DIS+0RDQ8tKKe5PSV0+PnmaJvdF5CKawhh0qGTklS2MXTyKFoqj
                  XgYDfY2EodI9ogT/LGr9Lm/+u4OFPvmN9VN6UG+s0DgJjWvpbmuHL/ZIRwMEn/tp
                  uneaLTO7h1dCrXC849PiJ8wSkGzBnuJQUbXnABEBAAG0QEdvb2dsZSBDbG91ZCBQ
                  YWNrYWdlcyBBdXRvbWF0aWMgU2lnbmluZyBLZXkgPGdjLXRlYW1AZ29vZ2xlLmNv
                  bT6JAT4EEwECACgFAlUd6rICGy8FCQWjmoAGCwkIBwMCBhUIAgkKCwQWAgMBAh4B
                  AheAAAoJEDdGwginMXsPcLcIAKi2yNhJMbu4zWQ2tM/rJFovazcY28MF2rDWGOnc
                  9giHXOH0/BoMBcd8rw0lgjmOosBdM2JT0HWZIxC/Gdt7NSRA0WOlJe04u82/o3OH
                  WDgTdm9MS42noSP0mvNzNALBbQnlZHU0kvt3sV1YsnrxljoIuvxKWLLwren/GVsh
                  FLPwONjw3f9Fan6GWxJyn/dkX3OSUGaduzcygw51vksBQiUZLCD2Tlxyr9NvkZYT
                  qiaWW78L6regvATsLc9L/dQUiSMQZIK6NglmHE+cuSaoK0H4ruNKeTiQUw/EGFaL
                  ecay6Qy/s3Hk7K0QLd+gl0hZ1w1VzIeXLo2BRlqnjOYFX4CwAgADmQENBFrBaNsB
                  CADrF18KCbsZlo4NjAvVecTBCnp6WcBQJ5oSh7+E98jX9YznUCrNrgmeCcCMUvTD
                  RDxfTaDJybaHugfba43nqhkbNpJ47YXsIa+YL6eEE9emSmQtjrSWIiY+2YJYwsDg
                  sgckF3duqkb02OdBQlh6IbHPoXB6H//b1PgZYsomB+841XW1LSJPYlYbIrWfwDfQ
                  vtkFQI90r6NknVTQlpqQh5GLNWNYqRNrGQPmsB+NrUYrkl1nUt1LRGu+rCe4bSaS
                  mNbwKMQKkROE4kTiB72DPk7zH4Lm0uo0YFFWG4qsMIuqEihJ/9KNX8GYBr+tWgyL
                  ooLlsdK3l+4dVqd8cjkJM1ExABEBAAG0QEdvb2dsZSBDbG91ZCBQYWNrYWdlcyBB
                  dXRvbWF0aWMgU2lnbmluZyBLZXkgPGdjLXRlYW1AZ29vZ2xlLmNvbT6JAT4EEwEC
                  ACgFAlrBaNsCGy8FCQWjmoAGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEGoD
                  CyG6B/T78e8H/1WH2LN/nVNhm5TS1VYJG8B+IW8zS4BqyozxC9iJAJqZIVHXl8g8
                  a/Hus8RfXR7cnYHcg8sjSaJfQhqO9RbKnffiuQgGrqwQxuC2jBa6M/QKzejTeP0M
                  gi67pyrLJNWrFI71RhritQZmzTZ2PoWxfv6b+Tv5v0rPaG+ut1J47pn+kYgtUaKd
                  sJz1umi6HzK6AacDf0C0CksJdKG7MOWsZcB4xeOxJYuy6NuO6KcdEz8/XyEUjIuI
                  OlhYTd0hH8E/SEBbXXft7/VBQC5wNq40izPi+6WFK/e1O42DIpzQ749ogYQ1eode
                  xPNhLzekKR3XhGrNXJ95r5KO10VrsLFNd8KwAgAD
                  =ssty
                  -----END PGP PUBLIC KEY BLOCK-----
          write_files:
            - path: /etc/etcd/etcd.conf.yaml
              owner: root:root
              permissions: '0600'
              content: |
                # This is the configuration file for the etcd server.
                # Human-readable name for this member.
                # Replace with [[hostname]] when lxe is fixed
                name: etcd
                # Path to the data directory.
                data-dir: /var/lib/etcd
                # Number of committed transactions to trigger a snapshot to disk.
                snapshot-count: 10000
                # List of comma separated URLs to listen on for peer traffic.
                listen-peer-urls: https://[[ipaddress]]:2380
                # List of comma separated URLs to listen on for client traffic.
                listen-client-urls: https://[[ipaddress]]:2379
                # List of this member's peer URLs to advertise to the rest of the cluster.
                # The URLs needed to be a comma-separated list.
                initial-advertise-peer-urls: https://[[ipaddress]]:2380
                # List of this member's client URLs to advertise to the public.
                # The URLs needed to be a comma-separated list.
                advertise-client-urls: https://[[ipaddress]]:2379
                # Initial cluster configuration for bootstrapping.
                initial-cluster: etcd=https://[[ipaddress]]:2380
                # Initial cluster state ('new' or 'existing').
                initial-cluster-state: 'new'
                client-transport-security:
                  # Path to the client server TLS cert file.
                  cert-file: /etc/kubernetes/pki/etcd/server.crt
                  # Path to the client server TLS key file.
                  key-file: /etc/kubernetes/pki/etcd/server.key
                  # Enable client cert authentication.
                  client-cert-auth: true
                  # Path to the client server TLS trusted CA cert file.
                  trusted-ca-file: /etc/kubernetes/pki/etcd/ca.crt
                peer-transport-security:
                  # Path to the peer server TLS cert file.
                  cert-file: /etc/kubernetes/pki/etcd/peer.crt
                  # Path to the peer server TLS key file.
                  key-file: /etc/kubernetes/pki/etcd/peer.key
                  # Enable peer client cert authentication.
                  peer-client-cert-auth: true
                  # Path to the peer server TLS trusted CA cert file.
                  trusted-ca-file: /etc/kubernetes/pki/etcd/ca.crt
            - path: /etc/etcd/finalize_config.sh
              owner: root:root
              permissions: '0600'
              content: |
                #!/bin/bash
                FILE=/etc/etcd/etcd.conf.yaml
                IP=$(facter ipaddress_ens3)

                sed -i "s@\[\[ipaddress\]\]@$IP@g" "$FILE"
            - path: /etc/systemd/system/etcd.service.d/10-etcd.conf
              owner: root:root
              permissions: '0600'
              content: |
                [Service]
                # Check if the interface name in LXC Containers is ens3 as well.
                Environment="ETCD_CONFIG=--config-file=/etc/etcd/etcd.conf.yaml"
                ExecStart=
                ExecStart=/usr/bin/etcd $ETCD_CONFIG

            - path: /lib/systemd/system/etcd.service
              owner: root:root
              permissions: '0600'
              content: |
                [Unit]
                Description=etcd: Kubernetes APIServer Backend Store

                [Service]
                ExecStart=/usr/bin/etcd
                Restart=always
                StartLimitInterval=0
                RestartSec=10

                [Install]
                WantedBy=multi-user.target

          packages:
            - facter
          runcmd:
            - "for i in {1..100}; do sleep 2; if test -e /etc/kubernetes/pki/etcd/ca.crt; then break; fi; done;"
            - "chmod +x /etc/etcd/finalize_config.sh"
            - "/etc/etcd/finalize_config.sh"
            - wget https://github.com/etcd-io/etcd/releases/download/v3.3.10/etcd-v3.3.10-linux-amd64.tar.gz
            - tar zxf etcd-v3.3.10-linux-amd64.tar.gz
            - cp etcd-v3.3.10-linux-amd64/etcd /usr/bin/
            - cp etcd-v3.3.10-linux-amd64/etcdctl /usr/bin/
            - [ systemctl, daemon-reload ]
            - [ systemctl, enable, etcd.service ]
            - [ systemctl, start, etcd.service ]
