--- schema: armada/Manifest/v1 metadata: schema: metadata/Document/v1 name: cluster-bootstrap layeringDefinition: abstract: false layer: site storagePolicy: cleartext data: release_prefix: ucp chart_groups: - kubernetes-proxy - container-networking - dns - kubernetes - ucp-services --- schema: armada/ChartGroup/v1 metadata: schema: metadata/Document/v1 name: kubernetes-proxy layeringDefinition: abstract: false layer: site storagePolicy: cleartext data: description: Kubernetes proxy sequenced: true chart_group: - kubernetes-proxy --- schema: armada/ChartGroup/v1 metadata: schema: metadata/Document/v1 name: container-networking layeringDefinition: abstract: false layer: site storagePolicy: cleartext data: description: Container networking via Calico sequenced: true chart_group: - calico-etcd - calico --- schema: armada/ChartGroup/v1 metadata: schema: metadata/Document/v1 name: dns layeringDefinition: abstract: false layer: site storagePolicy: cleartext data: description: Cluster DNS chart_group: - coredns --- schema: armada/ChartGroup/v1 metadata: schema: metadata/Document/v1 name: ucp-services layeringDefinition: abstract: false layer: site storagePolicy: cleartext data: description: UCP Services chart_group: - promenade --- schema: armada/ChartGroup/v1 metadata: schema: metadata/Document/v1 name: kubernetes layeringDefinition: abstract: false layer: site storagePolicy: cleartext data: description: Kubernetes components chart_group: - haproxy - kubernetes-etcd - kubernetes-apiserver - kubernetes-controller-manager - kubernetes-scheduler --- schema: armada/Chart/v1 metadata: schema: metadata/Document/v1 name: helm-toolkit layeringDefinition: abstract: false layer: site storagePolicy: cleartext data: chart_name: helm-toolkit release: helm-toolkit namespace: helm-toolkit timeout: 600 upgrade: no_hooks: true values: {} source: type: git location: https://git.openstack.org/openstack/openstack-helm subpath: helm-toolkit reference: master dependencies: [] --- schema: armada/Chart/v1 metadata: schema: metadata/Document/v1 name: infra-helm-toolkit layeringDefinition: abstract: false layer: site storagePolicy: cleartext data: chart_name: infra-helm-toolkit release: infra-helm-toolkit namespace: infra-helm-toolkit timeout: 600 wait: timeout: 600 upgrade: no_hooks: true values: {} source: type: git location: https://git.openstack.org/openstack/openstack-helm-infra subpath: helm-toolkit reference: master dependencies: [] --- schema: armada/Chart/v1 metadata: schema: metadata/Document/v1 name: kubernetes-proxy layeringDefinition: abstract: false layer: site storagePolicy: cleartext data: chart_name: proxy release: kubernetes-proxy namespace: kube-system timeout: 600 upgrade: no_hooks: true values: images: tags: proxy: ${IMAGE_HYPERKUBE} network: kubernetes_netloc: 127.0.0.1:6553 source: type: local location: /etc/genesis/armada/assets/charts subpath: proxy dependencies: - helm-toolkit --- schema: armada/Chart/v1 metadata: schema: metadata/Document/v1 name: calico-etcd layeringDefinition: abstract: false layer: site storagePolicy: cleartext substitutions: - src: schema: deckhand/CertificateAuthority/v1 name: calico-etcd path: . dest: path: '.values.secrets.tls.client.ca' - src: schema: deckhand/CertificateAuthority/v1 name: calico-etcd-peer path: . dest: path: '.values.secrets.tls.peer.ca' - src: schema: deckhand/Certificate/v1 name: calico-etcd-anchor path: . dest: path: '.values.secrets.anchor.tls.cert' - src: schema: deckhand/CertificateKey/v1 name: calico-etcd-anchor path: . dest: path: '.values.secrets.anchor.tls.key' - src: schema: deckhand/Certificate/v1 name: calico-etcd-${GENESIS_HOSTNAME} path: . dest: path: '.values.nodes[0].tls.client.cert' - src: schema: deckhand/CertificateKey/v1 name: calico-etcd-${GENESIS_HOSTNAME} path: . dest: path: '.values.nodes[0].tls.client.key' - src: schema: deckhand/Certificate/v1 name: calico-etcd-${GENESIS_HOSTNAME}-peer path: . dest: path: '.values.nodes[0].tls.peer.cert' - src: schema: deckhand/CertificateKey/v1 name: calico-etcd-${GENESIS_HOSTNAME}-peer path: . dest: path: '.values.nodes[0].tls.peer.key' - src: schema: deckhand/Certificate/v1 name: calico-etcd-${MASTER1_HOSTNAME} path: . dest: path: '.values.nodes[1].tls.client.cert' - src: schema: deckhand/CertificateKey/v1 name: calico-etcd-${MASTER1_HOSTNAME} path: . dest: path: '.values.nodes[1].tls.client.key' - src: schema: deckhand/Certificate/v1 name: calico-etcd-${MASTER1_HOSTNAME}-peer path: . dest: path: '.values.nodes[1].tls.peer.cert' - src: schema: deckhand/CertificateKey/v1 name: calico-etcd-${MASTER1_HOSTNAME}-peer path: . dest: path: '.values.nodes[1].tls.peer.key' - src: schema: deckhand/Certificate/v1 name: calico-etcd-${MASTER2_HOSTNAME} path: . dest: path: '.values.nodes[2].tls.client.cert' - src: schema: deckhand/CertificateKey/v1 name: calico-etcd-${MASTER2_HOSTNAME} path: . dest: path: '.values.nodes[2].tls.client.key' - src: schema: deckhand/Certificate/v1 name: calico-etcd-${MASTER2_HOSTNAME}-peer path: . dest: path: '.values.nodes[2].tls.peer.cert' - src: schema: deckhand/CertificateKey/v1 name: calico-etcd-${MASTER2_HOSTNAME}-peer path: . dest: path: '.values.nodes[2].tls.peer.key' - src: schema: deckhand/Certificate/v1 name: calico-etcd-${WORKER_HOSTNAME} path: . dest: path: '.values.nodes[3].tls.client.cert' - src: schema: deckhand/CertificateKey/v1 name: calico-etcd-${WORKER_HOSTNAME} path: . dest: path: '.values.nodes[3].tls.client.key' - src: schema: deckhand/Certificate/v1 name: calico-etcd-${WORKER_HOSTNAME}-peer path: . dest: path: '.values.nodes[3].tls.peer.cert' - src: schema: deckhand/CertificateKey/v1 name: calico-etcd-${WORKER_HOSTNAME}-peer path: . dest: path: '.values.nodes[3].tls.peer.key' data: chart_name: etcd release: calico-etcd namespace: kube-system timeout: 600 wait: timeout: 6000 test: true upgrade: no_hooks: true values: anchor: etcdctl_endpoint: 10.96.232.136 labels: anchor: node_selector_key: calico-etcd node_selector_value: enabled secrets: anchor: tls: cert: placeholder key: placeholder tls: client: ca: placeholder peer: ca: placeholder etcd: host_data_path: /var/lib/etcd/calico host_etc_path: /etc/etcd/calico bootstrapping: enabled: true host_directory: /var/lib/anchor filename: calico-etcd-bootstrap images: tags: etcd: ${IMAGE_ETCD} etcdctl: ${IMAGE_ETCD} nodes: - name: ${GENESIS_HOSTNAME} tls: client: cert: placeholder key: placeholder peer: cert: placeholder key: placeholder - name: ${MASTER1_HOSTNAME} tls: client: cert: placeholder key: placeholder peer: cert: placeholder key: placeholder - name: ${MASTER2_HOSTNAME} tls: client: cert: placeholder key: placeholder peer: cert: placeholder key: placeholder # ${WORKER_HOSTNAME} is here to demonstrate movability of the cluster - name: ${WORKER_HOSTNAME} tls: client: cert: placeholder key: placeholder peer: cert: placeholder key: placeholder service: name: calico-etcd ip: 10.96.232.136 network: service_client: name: service_client port: 6666 target_port: 6666 service_peer: name: service_peer port: 6667 target_port: 6667 source: type: local location: /etc/genesis/armada/assets/charts subpath: etcd dependencies: - helm-toolkit --- schema: armada/Chart/v1 metadata: schema: metadata/Document/v1 name: calico layeringDefinition: abstract: false layer: site storagePolicy: cleartext substitutions: - src: schema: deckhand/CertificateAuthority/v1 name: calico-etcd path: . dest: path: '.values.endpoints.etcd.auth.client.tls.ca' - src: schema: deckhand/Certificate/v1 name: calico-node path: . dest: path: '.values.endpoints.etcd.auth.client.tls.crt' - src: schema: deckhand/CertificateKey/v1 name: calico-node path: . dest: path: '.values.endpoints.etcd.auth.client.tls.key' data: chart_name: calico release: calico namespace: kube-system timeout: 600 upgrade: no_hooks: true values: conf: cni_network_config: name: k8s-pod-network cniVersion: 0.1.0 type: calico etcd_endpoints: __ETCD_ENDPOINTS__ etcd_ca_cert_file: /etc/calico/pki/ca etcd_cert_file: /etc/calico/pki/crt etcd_key_file: /etc/calico/pki/key log_level: info mtu: 1500 ipam: type: calico-ipam policy: type: k8s k8s_api_root: https://__KUBERNETES_SERVICE_HOST__:__KUBERNETES_SERVICE_PORT__ k8s_auth_token: __SERVICEACCOUNT_TOKEN__ policy_controller: K8S_API: "https://10.96.0.1:443" node: CALICO_STARTUP_LOGLEVEL: INFO CLUSTER_TYPE: - k8s - bgp IP_AUTODETECTION_METHOD: ${CALICO_IP_AUTODETECTION_METHOD} WAIT_FOR_STORAGE: "true" endpoints: etcd: hosts: default: calico-etcd host_fqdn_override: default: 10.96.232.136 scheme: default: https networking: podSubnet: 10.97.0.0/16 mtu: 1500 images: tags: calico_node: ${IMAGE_CALICO_NODE} calico_cni: ${IMAGE_CALICO_CNI} calico_ctl: ${IMAGE_CALICO_CTL} calico_settings: ${IMAGE_CALICO_CTL} calico_kube_policy_controller: ${IMAGE_CALICO_KUBE_CONTROLLERS} dep_check: ${IMAGE_DEP_CHECK} manifests: daemonset_calico_etcd: false job_image_repo_sync: false service_calico_etcd: false source: type: git location: https://git.openstack.org/openstack/openstack-helm-infra reference: master subpath: calico dependencies: - infra-helm-toolkit --- schema: armada/Chart/v1 metadata: schema: metadata/Document/v1 name: coredns layeringDefinition: abstract: false layer: site storagePolicy: cleartext data: chart_name: coredns release: coredns namespace: kube-system test: true timeout: 600 wait: timeout: 600 upgrade: no_hooks: true values: images: tags: coredns: ${IMAGE_COREDNS} source: type: local location: /etc/genesis/armada/assets/charts subpath: coredns dependencies: - helm-toolkit --- schema: armada/Chart/v1 metadata: schema: metadata/Document/v1 name: haproxy layeringDefinition: abstract: false layer: site data: chart_name: haproxy release: haproxy namespace: kube-system timeout: 600 wait: timeout: 600 upgrade: no_hooks: true values: conf: anchor: kubernetes_url: https://10.96.0.1:443 services: default: null kube-system: kubernetes-apiserver: server_opts: "check port 6443" conf_parts: frontend: - mode tcp - bind *:6553 backend: - mode tcp - option tcp-check - option redispatch kubernetes-etcd: server_opts: "check" conf_parts: frontend: - mode tcp - bind *:2378 backend: - mode tcp - option tcp-check - option redispatch images: tags: anchor: ${IMAGE_HYPERKUBE} haproxy: ${IMAGE_HAPROXY} source: type: local location: /etc/genesis/armada/assets/charts subpath: haproxy dependencies: - helm-toolkit --- schema: armada/Chart/v1 metadata: schema: metadata/Document/v1 name: kubernetes-apiserver layeringDefinition: abstract: false layer: site storagePolicy: cleartext substitutions: - src: schema: deckhand/CertificateAuthority/v1 name: kubernetes path: . dest: path: .values.secrets.tls.ca - src: schema: deckhand/Certificate/v1 name: apiserver path: . dest: path: .values.secrets.tls.cert - src: schema: deckhand/CertificateKey/v1 name: apiserver path: . dest: path: .values.secrets.tls.key - src: schema: deckhand/CertificateAuthority/v1 name: kubernetes-etcd path: . dest: path: .values.secrets.etcd.tls.ca - src: schema: deckhand/Certificate/v1 name: apiserver-etcd path: . dest: path: .values.secrets.etcd.tls.cert - src: schema: deckhand/CertificateKey/v1 name: apiserver-etcd path: . dest: path: .values.secrets.etcd.tls.key - src: schema: deckhand/PublicKey/v1 name: service-account path: . dest: path: .values.secrets.service_account.public_key data: chart_name: apiserver release: kubernetes-apiserver namespace: kube-system timeout: 600 upgrade: no_hooks: true values: apiserver: etcd: endpoints: https://127.0.0.1:2378 images: tags: anchor: ${IMAGE_HYPERKUBE} apiserver: ${IMAGE_HYPERKUBE} secrets: service_account: public_key: placeholder tls: ca: placeholder cert: placeholder key: placeholder etcd: tls: ca: placeholder cert: placeholder key: placeholder network: kubernetes_service_ip: 10.96.0.1 pod_cidr: 10.97.0.0/16 service_cidr: 10.96.0.0/16 source: type: local location: /etc/genesis/armada/assets/charts subpath: apiserver dependencies: - helm-toolkit --- schema: armada/Chart/v1 metadata: schema: metadata/Document/v1 name: kubernetes-controller-manager layeringDefinition: abstract: false layer: site storagePolicy: cleartext substitutions: - src: schema: deckhand/CertificateAuthority/v1 name: kubernetes path: . dest: path: .values.secrets.tls.ca - src: schema: deckhand/Certificate/v1 name: controller-manager path: . dest: path: .values.secrets.tls.cert - src: schema: deckhand/CertificateKey/v1 name: controller-manager path: . dest: path: .values.secrets.tls.key - src: schema: deckhand/PrivateKey/v1 name: service-account path: . dest: path: .values.secrets.service_account.private_key data: chart_name: controller_manager release: kubernetes-controller-manager namespace: kube-system timeout: 600 upgrade: no_hooks: true values: images: tags: anchor: ${IMAGE_HYPERKUBE} controller_manager: ${IMAGE_HYPERKUBE} secrets: service_account: private_key: placeholder tls: ca: placeholder cert: placeholder key: placeholder network: kubernetes_netloc: 127.0.0.1:6553 pod_cidr: 10.97.0.0/16 service_cidr: 10.96.0.0/16 source: type: local location: /etc/genesis/armada/assets/charts subpath: controller_manager dependencies: - helm-toolkit --- schema: armada/Chart/v1 metadata: schema: metadata/Document/v1 name: kubernetes-scheduler layeringDefinition: abstract: false layer: site storagePolicy: cleartext substitutions: - src: schema: deckhand/CertificateAuthority/v1 name: kubernetes path: . dest: path: .values.secrets.tls.ca - src: schema: deckhand/Certificate/v1 name: scheduler path: . dest: path: .values.secrets.tls.cert - src: schema: deckhand/CertificateKey/v1 name: scheduler path: . dest: path: .values.secrets.tls.key data: chart_name: scheduler release: kubernetes-scheduler namespace: kube-system timeout: 600 upgrade: no_hooks: true values: secrets: tls: ca: placeholder cert: placeholder key: placeholder network: kubernetes_netloc: 127.0.0.1:6553 images: tags: anchor: ${IMAGE_HYPERKUBE} scheduler: ${IMAGE_HYPERKUBE} source: type: local location: /etc/genesis/armada/assets/charts subpath: scheduler dependencies: - helm-toolkit --- schema: armada/Chart/v1 metadata: schema: metadata/Document/v1 name: kubernetes-etcd layeringDefinition: abstract: false layer: site storagePolicy: cleartext substitutions: - src: schema: deckhand/CertificateAuthority/v1 name: kubernetes-etcd path: . dest: path: '.values.secrets.tls.client.ca' - src: schema: deckhand/CertificateAuthority/v1 name: kubernetes-etcd-peer path: . dest: path: '.values.secrets.tls.peer.ca' - src: schema: deckhand/Certificate/v1 name: kubernetes-etcd-anchor path: . dest: path: '.values.secrets.anchor.tls.cert' - src: schema: deckhand/CertificateKey/v1 name: kubernetes-etcd-anchor path: . dest: path: '.values.secrets.anchor.tls.key' - src: schema: deckhand/Certificate/v1 name: kubernetes-etcd-${GENESIS_HOSTNAME} path: . dest: path: '.values.nodes[0].tls.client.cert' - src: schema: deckhand/CertificateKey/v1 name: kubernetes-etcd-${GENESIS_HOSTNAME} path: . dest: path: '.values.nodes[0].tls.client.key' - src: schema: deckhand/Certificate/v1 name: kubernetes-etcd-${GENESIS_HOSTNAME}-peer path: . dest: path: '.values.nodes[0].tls.peer.cert' - src: schema: deckhand/CertificateKey/v1 name: kubernetes-etcd-${GENESIS_HOSTNAME}-peer path: . dest: path: '.values.nodes[0].tls.peer.key' - src: schema: deckhand/Certificate/v1 name: kubernetes-etcd-${MASTER1_HOSTNAME} path: . dest: path: '.values.nodes[1].tls.client.cert' - src: schema: deckhand/CertificateKey/v1 name: kubernetes-etcd-${MASTER1_HOSTNAME} path: . dest: path: '.values.nodes[1].tls.client.key' - src: schema: deckhand/Certificate/v1 name: kubernetes-etcd-${MASTER1_HOSTNAME}-peer path: . dest: path: '.values.nodes[1].tls.peer.cert' - src: schema: deckhand/CertificateKey/v1 name: kubernetes-etcd-${MASTER1_HOSTNAME}-peer path: . dest: path: '.values.nodes[1].tls.peer.key' - src: schema: deckhand/Certificate/v1 name: kubernetes-etcd-${MASTER2_HOSTNAME} path: . dest: path: '.values.nodes[2].tls.client.cert' - src: schema: deckhand/CertificateKey/v1 name: kubernetes-etcd-${MASTER2_HOSTNAME} path: . dest: path: '.values.nodes[2].tls.client.key' - src: schema: deckhand/Certificate/v1 name: kubernetes-etcd-${MASTER2_HOSTNAME}-peer path: . dest: path: '.values.nodes[2].tls.peer.cert' - src: schema: deckhand/CertificateKey/v1 name: kubernetes-etcd-${MASTER2_HOSTNAME}-peer path: . dest: path: '.values.nodes[2].tls.peer.key' data: chart_name: etcd release: kubernetes-etcd namespace: kube-system timeout: 600 wait: timeout: 6000 test: true upgrade: no_hooks: true values: anchor: etcdctl_endpoint: kubernetes-etcd labels: anchor: node_selector_key: kubernetes-etcd node_selector_value: enabled secrets: anchor: tls: cert: placeholder key: placeholder tls: client: ca: placeholder peer: ca: placeholder etcd: host_data_path: /var/lib/etcd/kubernetes host_etc_path: /etc/etcd/kubernetes images: tags: etcd: ${IMAGE_ETCD} etcdctl: ${IMAGE_ETCD} nodes: - name: ${GENESIS_HOSTNAME} tls: client: cert: placeholder key: placeholder peer: cert: placeholder key: placeholder - name: ${MASTER1_HOSTNAME} tls: client: cert: placeholder key: placeholder peer: cert: placeholder key: placeholder - name: ${MASTER2_HOSTNAME} tls: client: cert: placeholder key: placeholder peer: cert: placeholder key: placeholder service: name: kubernetes-etcd network: service_client: name: service_client port: 2379 target_port: 2379 service_peer: name: service_peer port: 2380 target_port: 2380 source: type: local location: /etc/genesis/armada/assets/charts subpath: etcd dependencies: - helm-toolkit --- schema: armada/Chart/v1 metadata: schema: metadata/Document/v1 name: promenade layeringDefinition: abstract: false layer: site storagePolicy: cleartext data: chart_name: promenade release: promenade namespace: ucp timeout: 600 values: conf: paste: pipeline:main: pipeline: promenade-api images: tags: dep_check: ${IMAGE_DEP_CHECK} promenade: ${IMAGE_PROMENADE} manifests: job_ks_endpoints: false job_ks_service: false job_ks_user: false secret_keystone: false upgrade: no_hooks: true source: type: local location: /etc/genesis/armada/assets/charts subpath: promenade dependencies: - helm-toolkit ...