kubecluster.yaml

heat_template_version: 2014-10-16

description: >
  Kubernetes cluster with one master and one or more worker nodes
  (as specified by the number_of_minions parameter, which defaults to 2).

parameters:
  ssh_key_name:
    type: string
    description: name of ssh key to be provisioned on our server

  external_network:
    type: string
    description: uuid/name of a network to use for floating ip addresses
    default: public

  server_image:
    type: string
    description: glance image used to boot the server

  master_flavor:
    type: string
    default: m1.small
    description: flavor to use when booting the server

  minion_flavor:
    type: string
    default: m1.small
    description: flavor to use when booting the server

  dns_nameserver:
    type: string
    description: address of a dns nameserver reachable in your environment
    default: 8.8.8.8

  number_of_minions:
    type: number
    description: how many kubernetes minions to spawn initially
    default: 1

  max_number_of_minions:
    type: number
    description: maximum number of kubernetes minions to spawn
    default: 10

  fixed_network_cidr:
    type: string
    description: network range for fixed ip network
    default: 10.0.0.0/24

  apiserver_user:
    type: string
    description: User name used for api-server
    default: user

  apiserver_password:
    type: string
    description: Password used for api-server
    default: password

  token_kubelet:
    type: string
    description: Token used by kubelet
    default: TokenKubelet

  token_kube_proxy:
    type: string
    description: Token used by kube-proxy
    default: TokenKubeproxy

  wait_condition_timeout:
    type: number
    description : >
      timeout for the Wait Conditions
    default: 1000

  docker_registry_url:
    type: string
    description: Docker registry url
    default: ""

  docker_registry_prefix:
    type: string
    description: Docker registry prefix for k8s images
    default: ""

resources:

  ######################################################################
  #
  # wait conditions and signal.
  #

  master_wait_handle:
    type: OS::Heat::WaitConditionHandle

  master_wait_condition:
    type: OS::Heat::WaitCondition
    depends_on: kube_master
    properties:
      handle: {get_resource: master_wait_handle}
      timeout: {get_param: wait_condition_timeout}

  master_wc_notify:
    type: OS::Heat::SoftwareConfig
    properties:
      group: ungrouped
      config:
        str_replace:
          template: |
            #!/bin/sh -v
            wc_notify --data-binary '{"status": "SUCCESS"}'
          params:
            wc_notify: {get_attr: [master_wait_handle, curl_cli]}

  ######################################################################
  #
  # network resources.  allocate a network and router for our server.
  #

  fixed_network:
    type: OS::Neutron::Net

  fixed_subnet:
    type: OS::Neutron::Subnet
    properties:
      cidr: {get_param: fixed_network_cidr}
      network: {get_resource: fixed_network}
      dns_nameservers:
        - {get_param: dns_nameserver}

  extrouter:
    type: OS::Neutron::Router
    properties:
      external_gateway_info:
        network: {get_param: external_network}

  extrouter_inside:
    type: OS::Neutron::RouterInterface
    properties:
      router_id: {get_resource: extrouter}
      subnet: {get_resource: fixed_subnet}

  ######################################################################
  #
  # security groups.  we need to permit network traffic of various
  # sorts.
  #

  secgroup_base:
    type: OS::Neutron::SecurityGroup
    properties:
      rules:
        - protocol: icmp
        - protocol: tcp
          port_range_min: 22
          port_range_max: 22
        - remote_mode: remote_group_id

  secgroup_master:
    type: OS::Neutron::SecurityGroup
    properties:
      rules:
        - protocol: tcp # api-server
          port_range_min: 6443
          port_range_max: 6443

  secgroup_node:
    type: OS::Neutron::SecurityGroup
    properties:
      rules:
        - protocol: tcp
          port_range_min: 30000
          port_range_max: 32767

  ######################################################################
  #
  # software configs.  these are components that are combined into
  # a multipart MIME user-data archive.
  #

  write_heat_params:
    type: OS::Heat::SoftwareConfig
    properties:
      group: ungrouped
      config:
        str_replace:
          template: {get_file: fragments/write-heat-params.yaml}
          params:
            "$MASTER_IP": {get_attr: [kube_master_eth0, fixed_ips, 0, ip_address]}
            "$ROLE": "master"
            "$DOCKER_REGISTRY_URL": {get_param: docker_registry_url}
            "$DOCKER_REGISTRY_PREFIX": {get_param: docker_registry_prefix}

  kube_user:
    type: OS::Heat::SoftwareConfig
    properties:
      group: ungrouped
      config: {get_file: fragments/kube-user.yaml}

  pre_tasks:
    type: OS::Heat::SoftwareConfig
    properties:
      group: ungrouped
      config:
        str_replace:
          template: {get_file: fragments/custom-scripts.sh}
          params:
            "$CUSTOM_SCRIPTS_PATH": "/usr/local/pre-scripts"

  post_tasks:
    type: OS::Heat::SoftwareConfig
    properties:
      group: ungrouped
      config:
        str_replace:
          template: {get_file: fragments/custom-scripts.sh}
          params:
            "$CUSTOM_SCRIPTS_PATH": "/usr/local/post-scripts"

  provision_master:
    type: OS::Heat::SoftwareConfig
    properties:
      group: ungrouped
      config:
        str_replace:
          params:
            "$MASTER_CONTENT": {get_file: master.sh}
            wc_notify: {get_attr: [master_wait_handle, curl_cli]}
          template: |
            #!/bin/bash
            tee /home/minion/master.sh <<-'EOF'
            #!/bin/bash
            set -e
            function finish {
              if [ "$?" -ne 0 ]
              then
                wc_notify --data-binary '{"status": "FAILURE"}'
              fi
            }
            trap "finish"  EXIT
            source /etc/sysconfig/heat-params
            $MASTER_CONTENT
            EOF
            chmod 755 /home/minion/master.sh
            /home/minion/master.sh install

  kube_master_init:
    type: OS::Heat::MultipartMime
    properties:
      parts:
        - config: {get_resource: write_heat_params}
        - config: {get_resource: kube_user}
        - config: {get_resource: pre_tasks}
        - config: {get_resource: provision_master}
        - config: {get_resource: post_tasks}
        - config: {get_resource: master_wc_notify}

  ######################################################################
  #
  # kubernetes master server.
  #

  kube_master:
    type: OS::Nova::Server
    depends_on:
      - extrouter_inside
    properties:
      image: {get_param: server_image}
      flavor: {get_param: master_flavor}
      key_name: {get_param: ssh_key_name}
      user_data_format: RAW
      user_data: {get_resource: kube_master_init}
      networks:
        - port: {get_resource: kube_master_eth0}
      name:
        list_join: [-, [{get_param: "OS::stack_name"}, master]]

  kube_master_eth0:
    type: OS::Neutron::Port
    properties:
      network: {get_resource: fixed_network}
      security_groups:
        - {get_resource: secgroup_base}
        - {get_resource: secgroup_master}
      fixed_ips:
        - subnet: {get_resource: fixed_subnet}
      allowed_address_pairs:
        - ip_address: 10.246.0.0/16
      replacement_policy: AUTO

  kube_master_floating:
    type: OS::Neutron::FloatingIP
    properties:
      floating_network: {get_param: external_network}
      port_id: {get_resource: kube_master_eth0}

  ######################################################################
  #
  # kubernetes minions. This is an autoscaling group that will initially
  # create <number_of_minions> minions, and will scale up to
  # <max_number_of_minions> based on CPU utilization.
  #

  kube_minions:
    type: OS::Heat::AutoScalingGroup
    depends_on:
      - extrouter_inside
      - master_wait_condition
    properties:
      resource:
        type: kubeminion.yaml
        properties:
          ssh_key_name: {get_param: ssh_key_name}
          server_image: {get_param: server_image}
          minion_flavor: {get_param: minion_flavor}
          token_kubelet: {get_param: token_kubelet}
          token_kube_proxy: {get_param: token_kube_proxy}
          fixed_network: {get_resource: fixed_network}
          fixed_subnet: {get_resource: fixed_subnet}
          kube_master_ip: {get_attr: [kube_master_eth0, fixed_ips, 0, ip_address]}
          external_network: {get_param: external_network}
          wait_condition_timeout: {get_param: wait_condition_timeout}
          metadata: {"metering.stack": {get_param: "OS::stack_id"}}
          cluster_name: {get_param: "OS::stack_name"}
          secgroup_base: {get_resource: secgroup_base}
          secgroup_node: {get_resource: secgroup_node}
          docker_registry_url: {get_param: docker_registry_url}
          docker_registry_prefix: {get_param: docker_registry_prefix}
      min_size: {get_param: number_of_minions}
      desired_capacity: {get_param: number_of_minions}
      max_size: {get_param: max_number_of_minions}

outputs:

  kube_master:
    value: {get_attr: [kube_master_floating, floating_ip_address]}
    description: >
      This is the "public" IP address of the Kubernetes master node. Use this IP address
      to log in to the Kubernetes master via ssh or to access the Kubernetes API
      from outside the cluster.

  kube_minions:
    value: {get_attr: [kube_minions, outputs_list, kube_minion_ip]}
    description: >
      Here is the list of the "private" addresses of all Kubernetes worker nodes.

  kube_minions_external:
    value: {get_attr: [kube_minions, outputs_list, kube_minion_external_ip]}
    description: >
      Here is the list of the "public" addresses of all Kubernetes worker nodes.