{%- if taskserv.hostname == "$hostname" and server.hostname -%}
{% set hostname=server.hostname %}
{%- else -%}
{% set hostname=taskserv.hostname %}
{%- endif -%}
# Main Ip for node should be in same K8S_MASTER network
# Be sure main_ip is alive and reachable 
{%- if taskserv.ip == "$network_private_ip" and server.network_private_ip -%}
{% set main_ip=server.network_private_ip %}
{%- elif taskserv.ip == "$network_public_ip" and server.ip_addresses.pub -%}
{% set main_ip=server.ip_addresses.pub %}
{%- else -%}
{% set main_ip=taskserv.ip  %}
{%- endif %}
apiVersion: kubeadm.k8s.io/v1beta4
kind: InitConfiguration
{%- if taskserv.skip_phases %}
skipPhases:
{% for phase in taskserv.skip_phases %}
- {{ phase }}
{% endfor %}
{%- endif %}
localAPIEndpoint:
  advertiseAddress: {{main_ip}}
  bindPort: {{taskserv.bind_port}}
nodeRegistration:
#  criSocket: taskserv.cri_socket
  imagePullPolicy: {{taskserv.pull_policy}}
  name: {{hostname}}
  {%- if taskserv.taints_effect != "" %}
  taints:
  - effect: {{taskserv.taints_effect}}
    key: node-role.kubernetes.io/control-plane
  {%- else %}
  taints: []
  {%- endif %}
---
apiServer:
  certSANs: {% for ip in taskserv.cert_sans %}
  - {{ ip | replace(from="$cluster_name",to=taskserv.cluster_name) | replace(from="$hostname",to=hostname) }}
  {%- endfor %}
  extraArgs:
  - name: authorization-mode
    value: "{{taskserv.auth_mode}}"
  # Force IPv4-only binding so the loopback client uses 127.0.0.1 instead of [::1].
  # Prevents bootstrap failures on nodes where IPv6 is not configured.
  - name: bind-address
    value: "0.0.0.0"
  {% if taskserv.etcd_prefix != "" %}- name: etcd-prefix
    value: "{{taskserv.etcd_prefix | replace(from="$cluster_name",to=taskserv.cluster_name) | trim}}"
  {% endif %}
  # Reduce gRPC reconnection storm on nodes where etcd and apiserver share vCPUs.
  - name: request-timeout
    value: "120s"
  # No etcd-servers override — uses all endpoints from ClusterConfiguration.etcd.external.
  # With CP on a dedicated node (no etcd collocated), all 3 endpoints can be used
  # for resilience without CPU competition causing gRPC storms.
  # Shorter event TTL reduces etcd write load (default is 1h, events are noisy).
  - name: event-ttl
    value: "30m0s"
  # Reduce watch cache sizes for low-priority resources to cap memory + gRPC pressure.
  - name: watch-cache-sizes
    value: "replicationcontrollers#0,endpoints#0"
apiVersion: kubeadm.k8s.io/v1beta4
certificatesDir: {{taskserv.certs_dir}}
clusterName: {{taskserv.cluster_name}}
controlPlaneEndpoint: {{main_ip}}:{{taskserv.bind_port}}
controllerManager: {}
dns: {}
{% if taskserv.etcd_mode == "external" -%} 
etcd:
  external:
    caFile: {{taskserv.etcd_ca_path}}
    certFile: {{taskserv.etcd_cert_path}}
    keyFile: {{taskserv.etcd_key_path}}
    endpoints: {% for endpoint in taskserv.etcd_endpoints %}
    {% if endpoint.addr -%}
    - {{endpoint.prot}}://{{endpoint.addr}}:{{endpoint.port}}
    {%- elif endpoint.name -%}
    - {{endpoint.prot}}://{{endpoint.name}}:{{endpoint.port}}
    {%- endif %}
  {%- endfor -%}
{%- endif %}
imageRepository: {{taskserv.repo}}
kind: ClusterConfiguration
kubernetesVersion: {{taskserv.version}}
networking:
  dnsDomain: {{taskserv.dns_domain}}
  podSubnet: {{taskserv.pod_net}}
  serviceSubnet: {{taskserv.service_net}}
scheduler: {}