kubernetes/cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest

{% set daemon_args = "$DAEMON_ARGS" -%}
{% if grains['os_family'] == 'RedHat' -%}
	{% set daemon_args = "" -%}
{% endif -%}

{% set cloud_provider = "" -%}
{% set cloud_config = "" -%}

{% if grains.cloud is defined -%}
{% set cloud_provider = "--cloud_provider=" + grains.cloud -%}

{% if grains.cloud == 'gce' -%}
  {% if grains.cloud_config is defined -%}
    {% set cloud_config = "--cloud_config=" + grains.cloud_config -%}
  {% endif -%}

{% elif grains.cloud == 'aws' -%}
  {% if grains.cloud_config is defined -%}
    {% set cloud_config = "--cloud_config=" + grains.cloud_config -%}
  {% endif -%}
{% endif -%}

{% endif -%}

{% set address = "--address=127.0.0.1" -%}

{% set cluster_name = "" -%}
{% if pillar['instance_prefix'] is defined -%}
  {% set cluster_name = "--cluster_name=" + pillar['instance_prefix'] -%}
{% endif -%}

{% set publicAddressOverride = "" -%}
{% if grains.publicAddressOverride is defined -%}
  {% set publicAddressOverride = "--public_address_override=" + grains.publicAddressOverride -%}
{% endif -%}

{% set etcd_servers = "--etcd_servers=http://127.0.0.1:4001" -%}

{% set service_cluster_ip_range = "" -%}
{% if pillar['service_cluster_ip_range'] is defined -%}
  {% set service_cluster_ip_range = "--service-cluster-ip-range=" + pillar['service_cluster_ip_range'] -%}
{% endif -%}

{% set cert_file = "--tls_cert_file=/srv/kubernetes/server.cert" -%}
{% set key_file = "--tls_private_key_file=/srv/kubernetes/server.key" -%}
{% set client_ca_file = "" -%}

{% set secure_port = "6443" -%}
{% if grains['cloud'] is defined and grains.cloud in [ 'aws', 'gce' ]    %}
  {% set secure_port = "443" -%}
  {% set client_ca_file = "--client_ca_file=/srv/kubernetes/ca.crt" -%}
{% endif -%}

{% set token_auth_file = "--token_auth_file=/dev/null" -%}
{% set basic_auth_file = "" -%}

{% if grains.cloud is defined -%}
{% if grains.cloud in [ 'aws', 'gce', 'vagrant' ] -%}
    {% set token_auth_file = "--token_auth_file=/srv/kubernetes/known_tokens.csv" -%}
{% endif -%}
{% endif -%}

{% if grains['cloud'] is defined and grains.cloud in [ 'aws', 'gce' ]  %}
  {% set basic_auth_file = "--basic_auth_file=/srv/kubernetes/basic_auth.csv" -%}
{% endif -%}

{% set admission_control = "" -%}
{% if pillar['admission_control'] is defined -%}
 {% set admission_control = "--admission_control=" + pillar['admission_control'] -%}
{% endif -%}

{% set runtime_config = "" -%}
{% if grains.runtime_config is defined -%}
 {% set runtime_config = "--runtime_config=" + grains.runtime_config -%}
{% endif -%}

{% set params = address + " " + etcd_servers + " " + cloud_provider + " " + cloud_config + " " + runtime_config + " " + admission_control + " " + service_cluster_ip_range + " " + client_ca_file + " " + basic_auth_file -%}
{% set params = params + " " + cluster_name + " " + cert_file + " " + key_file + " --secure_port=" + secure_port + " " + token_auth_file + " " + publicAddressOverride + " " + pillar['log_level'] -%}


{
"apiVersion": "v1beta3",
"kind": "Pod",
"metadata": {"name":"kube-apiserver"},
"spec":{
"hostNetwork": true,
"containers":[
    {
    "name": "kube-apiserver",
    "image": "gcr.io/google_containers/kube-apiserver:{{pillar['kube-apiserver_docker_tag']}}",
    "command": [
                 "/bin/sh",
                 "-c",
                 "/usr/local/bin/kube-apiserver {{params}} --allow_privileged={{pillar['allow_privileged']}} 1>>/var/log/kube-apiserver.log 2>&1"
               ],
    "ports":[
      { "name": "https",
        "containerPort": {{secure_port}},
        "hostPort": {{secure_port}}},{
       "name": "http",
        "containerPort": 7080,
        "hostPort": 7080},{
       "name": "local",
        "containerPort": 8080,
        "hostPort": 8080}
        ],
    "volumeMounts": [
        { "name": "srvkube",
        "mountPath": "/srv/kubernetes",
        "readOnly": true},
        { "name": "logfile",
        "mountPath": "/var/log/kube-apiserver.log",
        "readOnly": false},
        { "name": "etcssl",
        "mountPath": "/etc/ssl",
        "readOnly": true},
        { "name": "usrsharessl",
        "mountPath": "/usr/share/ssl",
        "readOnly": true},
        { "name": "varssl",
        "mountPath": "/var/ssl",
        "readOnly": true},
        { "name": "usrssl",
        "mountPath": "/usr/ssl",
        "readOnly": true},
        { "name": "usrlibssl",
        "mountPath": "/usr/lib/ssl",
        "readOnly": true},
        { "name": "usrlocalopenssl",
        "mountPath": "/usr/local/openssl",
        "readOnly": true},
        { "name": "etcopenssl",
        "mountPath": "/etc/openssl",
        "readOnly": true},
        { "name": "etcpkitls",
        "mountPath": "/etc/pki/tls",
        "readOnly": true}
      ]
    }
],
"volumes":[
  { "name": "srvkube",
    "hostPath": {
        "path": "/srv/kubernetes"}
  },
  { "name": "logfile",
    "hostPath": {
        "path": "/var/log/kube-apiserver.log"}
  },
  { "name": "etcssl",
    "hostPath": {
        "path": "/etc/ssl"}
  },
  { "name": "usrsharessl",
    "hostPath": {
        "path": "/usr/share/ssl"}
  },
  { "name": "varssl",
    "hostPath": {
        "path": "/var/ssl"}
  },
  { "name": "usrssl",
    "hostPath": {
        "path": "/usr/ssl"}
  },
  { "name": "usrlibssl",
    "hostPath": {
        "path": "/usr/lib/ssl"}
  },
  { "name": "usrlocalopenssl",
    "hostPath": {
        "path": "/usr/local/openssl"}
  },
  { "name": "etcopenssl",
    "hostPath": {
        "path": "/etc/openssl"}
  },
  { "name": "etcpkitls",
    "hostPath": {
        "path": "/etc/pki/tls"}
  }
]
}}