93 lines
3.2 KiB
Text
93 lines
3.2 KiB
Text
|
|
||
|
|
{%- if taskserv.hostname == "$hostname" and server.hostname -%}
|
||
|
|
{% set hostname=server.hostname %}
|
||
|
|
{%- else -%}
|
||
|
|
{% set hostname=taskserv.hostname %}
|
||
|
|
{%- endif -%}
|
||
|
|
# Main Ip for node should be in same K8S_MASTER network
|
||
|
|
# Be sure main_ip is alive and reachable
|
||
|
|
{%- if taskserv.ip == "$network_private_ip" and server.network_private_ip -%}
|
||
|
|
{% set main_ip=server.network_private_ip %}
|
||
|
|
{%- elif taskserv.ip == "$network_public_ip" and server.ip_addresses.pub -%}
|
||
|
|
{% set main_ip=server.ip_addresses.pub %}
|
||
|
|
{%- else -%}
|
||
|
|
{% set main_ip=taskserv.ip %}
|
||
|
|
{%- endif %}
|
||
|
|
apiVersion: kubeadm.k8s.io/v1beta4
|
||
|
|
kind: InitConfiguration
|
||
|
|
{%- if taskserv.skip_phases %}
|
||
|
|
skipPhases:
|
||
|
|
{% for phase in taskserv.skip_phases %}
|
||
|
|
- {{ phase }}
|
||
|
|
{% endfor %}
|
||
|
|
{%- endif %}
|
||
|
|
localAPIEndpoint:
|
||
|
|
advertiseAddress: {{main_ip}}
|
||
|
|
bindPort: {{taskserv.bind_port}}
|
||
|
|
nodeRegistration:
|
||
|
|
# criSocket: taskserv.cri_socket
|
||
|
|
imagePullPolicy: {{taskserv.pull_policy}}
|
||
|
|
name: {{hostname}}
|
||
|
|
{%- if taskserv.taints_effect != "" %}
|
||
|
|
taints:
|
||
|
|
- effect: {{taskserv.taints_effect}}
|
||
|
|
key: node-role.kubernetes.io/control-plane
|
||
|
|
{%- else %}
|
||
|
|
taints: []
|
||
|
|
{%- endif %}
|
||
|
|
---
|
||
|
|
apiServer:
|
||
|
|
certSANs: {% for ip in taskserv.cert_sans %}
|
||
|
|
- {{ ip | replace(from="$cluster_name",to=taskserv.cluster_name) | replace(from="$hostname",to=hostname) }}
|
||
|
|
{%- endfor %}
|
||
|
|
extraArgs:
|
||
|
|
- name: authorization-mode
|
||
|
|
value: "{{taskserv.auth_mode}}"
|
||
|
|
# Force IPv4-only binding so the loopback client uses 127.0.0.1 instead of [::1].
|
||
|
|
# Prevents bootstrap failures on nodes where IPv6 is not configured.
|
||
|
|
- name: bind-address
|
||
|
|
value: "0.0.0.0"
|
||
|
|
{% if taskserv.etcd_prefix != "" %}- name: etcd-prefix
|
||
|
|
value: "{{taskserv.etcd_prefix | replace(from="$cluster_name",to=taskserv.cluster_name) | trim}}"
|
||
|
|
{% endif %}
|
||
|
|
# Reduce gRPC reconnection storm on nodes where etcd and apiserver share vCPUs.
|
||
|
|
- name: request-timeout
|
||
|
|
value: "120s"
|
||
|
|
# No etcd-servers override — uses all endpoints from ClusterConfiguration.etcd.external.
|
||
|
|
# With CP on a dedicated node (no etcd collocated), all 3 endpoints can be used
|
||
|
|
# for resilience without CPU competition causing gRPC storms.
|
||
|
|
# Shorter event TTL reduces etcd write load (default is 1h, events are noisy).
|
||
|
|
- name: event-ttl
|
||
|
|
value: "30m0s"
|
||
|
|
# Reduce watch cache sizes for low-priority resources to cap memory + gRPC pressure.
|
||
|
|
- name: watch-cache-sizes
|
||
|
|
value: "replicationcontrollers#0,endpoints#0"
|
||
|
|
apiVersion: kubeadm.k8s.io/v1beta4
|
||
|
|
certificatesDir: {{taskserv.certs_dir}}
|
||
|
|
clusterName: {{taskserv.cluster_name}}
|
||
|
|
controlPlaneEndpoint: {{main_ip}}:{{taskserv.bind_port}}
|
||
|
|
controllerManager: {}
|
||
|
|
dns: {}
|
||
|
|
{% if taskserv.etcd_mode == "external" -%}
|
||
|
|
etcd:
|
||
|
|
external:
|
||
|
|
caFile: {{taskserv.etcd_ca_path}}
|
||
|
|
certFile: {{taskserv.etcd_cert_path}}
|
||
|
|
keyFile: {{taskserv.etcd_key_path}}
|
||
|
|
endpoints: {% for endpoint in taskserv.etcd_endpoints %}
|
||
|
|
{% if endpoint.addr -%}
|
||
|
|
- {{endpoint.prot}}://{{endpoint.addr}}:{{endpoint.port}}
|
||
|
|
{%- elif endpoint.name -%}
|
||
|
|
- {{endpoint.prot}}://{{endpoint.name}}:{{endpoint.port}}
|
||
|
|
{%- endif %}
|
||
|
|
{%- endfor -%}
|
||
|
|
{%- endif %}
|
||
|
|
imageRepository: {{taskserv.repo}}
|
||
|
|
kind: ClusterConfiguration
|
||
|
|
kubernetesVersion: {{taskserv.version}}
|
||
|
|
networking:
|
||
|
|
dnsDomain: {{taskserv.dns_domain}}
|
||
|
|
podSubnet: {{taskserv.pod_net}}
|
||
|
|
serviceSubnet: {{taskserv.service_net}}
|
||
|
|
scheduler: {}
|