---
schema: armada/Manifest/v1
metadata:
  schema: metadata/Document/v1
  name: cluster-bootstrap
  layeringDefinition:
    abstract: false
    layer: site
data:
  release_prefix: ucp
  chart_groups:
    - kubernetes-proxy
    - container-networking
    - dns
    - kubernetes
    - kubernetes-rbac
---
schema: armada/ChartGroup/v1
metadata:
  schema: metadata/Document/v1
  name: kubernetes-proxy
  layeringDefinition:
    abstract: false
    layer: site
data:
  description: Kubernetes proxy
  sequenced: true
  chart_group:
    - kubernetes-proxy
---
schema: armada/ChartGroup/v1
metadata:
  schema: metadata/Document/v1
  name: container-networking
  layeringDefinition:
    abstract: false
    layer: site
data:
  description: Container networking via Calico
  sequenced: true
  chart_group:
    - calico-etcd
    - calico
---
schema: armada/ChartGroup/v1
metadata:
  schema: metadata/Document/v1
  name: dns
  layeringDefinition:
    abstract: false
    layer: site
data:
  description: Cluster DNS
  chart_group:
    - coredns
---
schema: armada/ChartGroup/v1
metadata:
  schema: metadata/Document/v1
  name: kubernetes-rbac
  layeringDefinition:
    abstract: false
    layer: site
data:
  description: Role Based Access Control configuration for Kubernetes
  sequenced: true
  chart_group:
    - kubernetes-rbac
---
schema: armada/ChartGroup/v1
metadata:
  schema: metadata/Document/v1
  name: kubernetes
  layeringDefinition:
    abstract: false
    layer: site
data:
  description: Kubernetes components
  chart_group:
    - kubernetes-etcd
    - kubernetes-apiserver
    - kubernetes-controller-manager
    - kubernetes-scheduler
---
schema: armada/Chart/v1
metadata:
  schema: metadata/Document/v1
  name: helm-toolkit
data:
  chart_name: helm-toolkit
  release: helm-toolkit
  namespace: helm-toolkit
  timeout: 600
  upgrade:
    no_hooks: true
  values: {}
  source:
    type: git
    location: https://git.openstack.org/openstack/openstack-helm-infra
    subpath: helm-toolkit
    reference: master
  dependencies: []
---
schema: armada/Chart/v1
metadata:
  schema: metadata/Document/v1
  name: kubernetes-proxy
  layeringDefinition:
    abstract: false
    layer: site
  substitutions:
    -
      src:
        schema: deckhand/CertificateAuthority/v1
        name: kubernetes
        path: $
      dest:
        path: '$.values.tls.ca'
    -
      src:
        schema: deckhand/Certificate/v1
        name: proxy
        path: $
      dest:
        path: '$.values.tls.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: proxy
        path: $
      dest:
        path: '$.values.tls.key'
data:
  chart_name: proxy
  release: kubernetes-proxy
  namespace: kube-system
  timeout: 600
  upgrade:
    no_hooks: true
  values:
    tls:
      ca: placeholder
      cert: placeholder
      key: placeholder
    images:
      proxy: ${IMAGE_HYPERKUBE}
    network:
      kubernetes_netloc: apiserver.kubernetes.promenade:6443
      pod_cidr: 10.97.0.0/16
  source:
    type: local
    location: /etc/genesis/armada/assets/charts
    subpath: proxy
  dependencies: []
---
schema: armada/Chart/v1
metadata:
  schema: metadata/Document/v1
  name: calico-etcd
  layeringDefinition:
    abstract: false
    layer: site
  substitutions:
    -
      src:
        schema: deckhand/CertificateAuthority/v1
        name: calico-etcd
        path: $
      dest:
        path: '$.values.tls.client.ca'
    -
      src:
        schema: deckhand/CertificateAuthority/v1
        name: calico-etcd-peer
        path: $
      dest:
        path: '$.values.tls.peer.ca'

    -
      src:
        schema: deckhand/Certificate/v1
        name: calico-etcd-anchor
        path: $
      dest:
        path: '$.values.anchor.tls.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: calico-etcd-anchor
        path: $
      dest:
        path: '$.values.anchor.tls.key'

    -
      src:
        schema: deckhand/Certificate/v1
        name: calico-etcd-${GENESIS_HOSTNAME}
        path: $
      dest:
        path: '$.values.nodes[0].tls.client.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: calico-etcd-${GENESIS_HOSTNAME}
        path: $
      dest:
        path: '$.values.nodes[0].tls.client.key'
    -
      src:
        schema: deckhand/Certificate/v1
        name: calico-etcd-${GENESIS_HOSTNAME}-peer
        path: $
      dest:
        path: '$.values.nodes[0].tls.peer.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: calico-etcd-${GENESIS_HOSTNAME}-peer
        path: $
      dest:
        path: '$.values.nodes[0].tls.peer.key'

    -
      src:
        schema: deckhand/Certificate/v1
        name: calico-etcd-${MASTER1_HOSTNAME}
        path: $
      dest:
        path: '$.values.nodes[1].tls.client.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: calico-etcd-${MASTER1_HOSTNAME}
        path: $
      dest:
        path: '$.values.nodes[1].tls.client.key'
    -
      src:
        schema: deckhand/Certificate/v1
        name: calico-etcd-${MASTER1_HOSTNAME}-peer
        path: $
      dest:
        path: '$.values.nodes[1].tls.peer.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: calico-etcd-${MASTER1_HOSTNAME}-peer
        path: $
      dest:
        path: '$.values.nodes[1].tls.peer.key'

    -
      src:
        schema: deckhand/Certificate/v1
        name: calico-etcd-${MASTER2_HOSTNAME}
        path: $
      dest:
        path: '$.values.nodes[2].tls.client.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: calico-etcd-${MASTER2_HOSTNAME}
        path: $
      dest:
        path: '$.values.nodes[2].tls.client.key'
    -
      src:
        schema: deckhand/Certificate/v1
        name: calico-etcd-${MASTER2_HOSTNAME}-peer
        path: $
      dest:
        path: '$.values.nodes[2].tls.peer.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: calico-etcd-${MASTER2_HOSTNAME}-peer
        path: $
      dest:
        path: '$.values.nodes[2].tls.peer.key'

    -
      src:
        schema: deckhand/Certificate/v1
        name: calico-etcd-${WORKER_HOSTNAME}
        path: $
      dest:
        path: '$.values.nodes[3].tls.client.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: calico-etcd-${WORKER_HOSTNAME}
        path: $
      dest:
        path: '$.values.nodes[3].tls.client.key'
    -
      src:
        schema: deckhand/Certificate/v1
        name: calico-etcd-${WORKER_HOSTNAME}-peer
        path: $
      dest:
        path: '$.values.nodes[3].tls.peer.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: calico-etcd-${WORKER_HOSTNAME}-peer
        path: $
      dest:
        path: '$.values.nodes[3].tls.peer.key'

data:
  chart_name: etcd
  release: calico-etcd
  namespace: kube-system
  timeout: 600
  upgrade:
    no_hooks: true
  values:
    anchor:
      etcdctl_endpoint: 10.96.232.136
      node_selector:
        key: calico-etcd
        value: enabled
      tls:
        cert: placeholder
        key: placeholder
    etcd:
      host_data_path: /var/lib/etcd/calico
      host_etc_path: /etc/etcd/calico
    bootstrapping:
      enabled: true
      host_directory: /var/lib/anchor
      filename: calico-etcd-bootstrap
    images:
      etcd: ${IMAGE_ETCD}
      etcdctl: ${IMAGE_ETCD}
    nodes:
      - name: ${GENESIS_HOSTNAME}
        tls:
          client:
            cert: placeholder
            key: placeholder
          peer:
            cert: placeholder
            key: placeholder
      - name: ${MASTER1_HOSTNAME}
        tls:
          client:
            cert: placeholder
            key: placeholder
          peer:
            cert: placeholder
            key: placeholder
      - name: ${MASTER2_HOSTNAME}
        tls:
          client:
            cert: placeholder
            key: placeholder
          peer:
            cert: placeholder
            key: placeholder
      # ${WORKER_HOSTNAME} is here to demonstrate movability of the cluster
      - name: ${WORKER_HOSTNAME}
        tls:
          client:
            cert: placeholder
            key: placeholder
          peer:
            cert: placeholder
            key: placeholder
    service:
      name: calico-etcd
      ip: 10.96.232.136
      client:
        port: 6666
        target_port: 6666
      peer:
        port: 6667
        target_port: 6667
    tls:
      client:
        ca: placeholder
      peer:
        ca: placeholder
  source:
    type: local
    location: /etc/genesis/armada/assets/charts
    subpath: etcd
  dependencies:
    - helm-toolkit
---
schema: armada/Chart/v1
metadata:
  schema: metadata/Document/v1
  name: calico
  layeringDefinition:
    abstract: false
    layer: site
  substitutions:
    -
      src:
        schema: deckhand/CertificateAuthority/v1
        name: calico-etcd
        path: $
      dest:
        path: '$.values.etcd.tls.ca'
    -
      src:
        schema: deckhand/Certificate/v1
        name: calico-node
        path: $
      dest:
        path: '$.values.etcd.tls.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: calico-node
        path: $
      dest:
        path: '$.values.etcd.tls.key'
data:
  chart_name: calico
  release: calico
  namespace: kube-system
  timeout: 600
  upgrade:
    no_hooks: true
  values:
    calico:
      ip_autodetection_method: ${CALICO_IP_AUTODETECTION_METHOD}
      pod_ip_cidr: 10.97.0.0/16
      ctl:
        install_on_host: true
    etcd:
      service:
        ip: 10.96.232.136
        port: 6666
      tls:
        ca: placeholder
        cert: placeholder
        key: placeholder
    images:
      cni: ${IMAGE_CALICO_CNI}
      ctl: ${IMAGE_CALICO_CTL}
      node: ${IMAGE_CALICO_NODE}
      policy_controller: ${IMAGE_CALICO_KUBE_CONTROLLERS}
  source:
    type: local
    location: /etc/genesis/armada/assets/charts
    subpath: calico
  dependencies: []
---
schema: armada/Chart/v1
metadata:
  schema: metadata/Document/v1
  name: coredns
  layeringDefinition:
    abstract: false
    layer: site
  substitutions:
    -
      src:
        schema: deckhand/CertificateAuthority/v1
        name: kubernetes
        path: $
      dest:
        path: '$.values.tls.ca'
    -
      src:
        schema: deckhand/Certificate/v1
        name: coredns
        path: $
      dest:
        path: '$.values.tls.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: coredns
        path: $
      dest:
        path: '$.values.tls.key'
data:
  chart_name: coredns
  release: coredns
  namespace: kube-system
  timeout: 600
  upgrade:
    no_hooks: true
  values:
    coredns:
      cluster_domain: cluster.local
      upstream_nameservers:
        - 8.8.8.8
        - 8.8.4.4

      zones:
        - name: promenade
          services:
            - bind_name: apiserver.kubernetes
              service:
                name: kubernetes-apiserver
                namespace: kube-system
            - bind_name: etcd.kubernetes
              service:
                name: kubernetes-etcd
                namespace: kube-system
            - bind_name: etcd.calico
              service:
                name: calico-etcd
                namespace: kube-system
    images:
      anchor: ${IMAGE_HYPERKUBE}
      coredns: ${IMAGE_COREDNS}
    tls:
      ca: placeholder
      cert: placeholder
      key: placeholder
    network:
      kubernetes_netloc: apiserver.kubernetes.promenade:6443
  source:
    type: local
    location: /etc/genesis/armada/assets/charts
    subpath: coredns
  dependencies:
    - helm-toolkit
---
schema: armada/Chart/v1
metadata:
  schema: metadata/Document/v1
  name: kubernetes-apiserver
  layeringDefinition:
    abstract: false
    layer: site
  substitutions:
    -
      src:
        schema: deckhand/CertificateAuthority/v1
        name: kubernetes
        path: $
      dest:
        path: $.values.tls.ca

    -
      src:
        schema: deckhand/Certificate/v1
        name: apiserver
        path: $
      dest:
        path: $.values.tls.cert
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: apiserver
        path: $
      dest:
        path: $.values.tls.key
    -
      src:
        schema: deckhand/CertificateAuthority/v1
        name: kubernetes-etcd
        path: $
      dest:
        path: $.values.apiserver.etcd.tls.ca
    -
      src:
        schema: deckhand/Certificate/v1
        name: apiserver-etcd
        path: $
      dest:
        path: $.values.apiserver.etcd.tls.cert
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: apiserver-etcd
        path: $
      dest:
        path: $.values.apiserver.etcd.tls.key
    -
      src:
        schema: deckhand/PublicKey/v1
        name: service-account
        path: $
      dest:
        path: $.values.service_account.public_key

data:
  chart_name: apiserver
  release: kubernetes-apiserver
  namespace: kube-system
  timeout: 600
  upgrade:
    no_hooks: true
  values:
    apiserver:
      etcd:
        endpoints: https://etcd.kubernetes.promenade:2379
        tls:
          ca: placeholder
          cert: placeholder
          key: placeholder
    images:
      anchor: ${IMAGE_HYPERKUBE}
      apiserver: ${IMAGE_HYPERKUBE}
    service_account:
      public_key: placeholder
    tls:
      ca: placeholder
      cert: placeholder
      key: placeholder
    network:
      kubernetes_service_ip: 10.96.0.1
      pod_cidr: 10.97.0.0/16
      service_cidr: 10.96.0.0/16

  source:
    type: local
    location: /etc/genesis/armada/assets/charts
    subpath: apiserver
  dependencies:
    - helm-toolkit
---
schema: armada/Chart/v1
metadata:
  schema: metadata/Document/v1
  name: kubernetes-controller-manager
  layeringDefinition:
    abstract: false
    layer: site
  substitutions:
    -
      src:
        schema: deckhand/CertificateAuthority/v1
        name: kubernetes
        path: $
      dest:
        path: $.values.tls.ca

    -
      src:
        schema: deckhand/Certificate/v1
        name: controller-manager
        path: $
      dest:
        path: $.values.tls.cert
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: controller-manager
        path: $
      dest:
        path: $.values.tls.key
    -
      src:
        schema: deckhand/PrivateKey/v1
        name: service-account
        path: $
      dest:
        path: $.values.service_account.private_key

data:
  chart_name: controller_manager
  release: kubernetes-controller-manager
  namespace: kube-system
  timeout: 600
  upgrade:
    no_hooks: true
  values:
    images:
      anchor: ${IMAGE_HYPERKUBE}
      controller_manager: ${IMAGE_HYPERKUBE}
    service_account:
      private_key: placeholder
    tls:
      ca: placeholder
      cert: placeholder
      key: placeholder
    network:
      kubernetes_netloc: apiserver.kubernetes.promenade:6443
      pod_cidr: 10.97.0.0/16
      service_cidr: 10.96.0.0/16

  source:
    type: local
    location: /etc/genesis/armada/assets/charts
    subpath: controller_manager
  dependencies:
    - helm-toolkit
---
schema: armada/Chart/v1
metadata:
  schema: metadata/Document/v1
  name: kubernetes-scheduler
  layeringDefinition:
    abstract: false
    layer: site
  substitutions:
    -
      src:
        schema: deckhand/CertificateAuthority/v1
        name: kubernetes
        path: $
      dest:
        path: $.values.tls.ca
    -
      src:
        schema: deckhand/Certificate/v1
        name: scheduler
        path: $
      dest:
        path: $.values.tls.cert
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: scheduler
        path: $
      dest:
        path: $.values.tls.key

data:
  chart_name: scheduler
  release: kubernetes-scheduler
  namespace: kube-system
  timeout: 600
  upgrade:
    no_hooks: true
  values:
    tls:
      ca: placeholder
      cert: placeholder
      key: placeholder

    network:
      kubernetes_netloc: apiserver.kubernetes.promenade:6443

    images:
      anchor: ${IMAGE_HYPERKUBE}
      scheduler: ${IMAGE_HYPERKUBE}

  source:
    type: local
    location: /etc/genesis/armada/assets/charts
    subpath: scheduler
  dependencies:
    - helm-toolkit
---
schema: armada/Chart/v1
metadata:
  schema: metadata/Document/v1
  name: kubernetes-etcd
  layeringDefinition:
    abstract: false
    layer: site
  substitutions:
    -
      src:
        schema: deckhand/CertificateAuthority/v1
        name: kubernetes-etcd
        path: $
      dest:
        path: '$.values.tls.client.ca'
    -
      src:
        schema: deckhand/CertificateAuthority/v1
        name: kubernetes-etcd-peer
        path: $
      dest:
        path: '$.values.tls.peer.ca'

    -
      src:
        schema: deckhand/Certificate/v1
        name: kubernetes-etcd-anchor
        path: $
      dest:
        path: '$.values.anchor.tls.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: kubernetes-etcd-anchor
        path: $
      dest:
        path: '$.values.anchor.tls.key'

    -
      src:
        schema: deckhand/Certificate/v1
        name: kubernetes-etcd-${GENESIS_HOSTNAME}
        path: $
      dest:
        path: '$.values.nodes[0].tls.client.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: kubernetes-etcd-${GENESIS_HOSTNAME}
        path: $
      dest:
        path: '$.values.nodes[0].tls.client.key'
    -
      src:
        schema: deckhand/Certificate/v1
        name: kubernetes-etcd-${GENESIS_HOSTNAME}-peer
        path: $
      dest:
        path: '$.values.nodes[0].tls.peer.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: kubernetes-etcd-${GENESIS_HOSTNAME}-peer
        path: $
      dest:
        path: '$.values.nodes[0].tls.peer.key'

    -
      src:
        schema: deckhand/Certificate/v1
        name: kubernetes-etcd-${MASTER1_HOSTNAME}
        path: $
      dest:
        path: '$.values.nodes[1].tls.client.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: kubernetes-etcd-${MASTER1_HOSTNAME}
        path: $
      dest:
        path: '$.values.nodes[1].tls.client.key'
    -
      src:
        schema: deckhand/Certificate/v1
        name: kubernetes-etcd-${MASTER1_HOSTNAME}-peer
        path: $
      dest:
        path: '$.values.nodes[1].tls.peer.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: kubernetes-etcd-${MASTER1_HOSTNAME}-peer
        path: $
      dest:
        path: '$.values.nodes[1].tls.peer.key'

    -
      src:
        schema: deckhand/Certificate/v1
        name: kubernetes-etcd-${MASTER2_HOSTNAME}
        path: $
      dest:
        path: '$.values.nodes[2].tls.client.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: kubernetes-etcd-${MASTER2_HOSTNAME}
        path: $
      dest:
        path: '$.values.nodes[2].tls.client.key'
    -
      src:
        schema: deckhand/Certificate/v1
        name: kubernetes-etcd-${MASTER2_HOSTNAME}-peer
        path: $
      dest:
        path: '$.values.nodes[2].tls.peer.cert'
    -
      src:
        schema: deckhand/CertificateKey/v1
        name: kubernetes-etcd-${MASTER2_HOSTNAME}-peer
        path: $
      dest:
        path: '$.values.nodes[2].tls.peer.key'

data:
  chart_name: etcd
  release: kubernetes-etcd
  namespace: kube-system
  timeout: 600
  upgrade:
    no_hooks: true
  values:
    anchor:
      etcdctl_endpoint: 10.96.0.2
      node_selector:
        key: kubernetes-etcd
        value: enabled
      tls:
        cert: placeholder
        key: placeholder
    etcd:
      host_data_path: /var/lib/etcd/kubernetes
      host_etc_path: /etc/etcd/kubernetes
    images:
      etcd: ${IMAGE_ETCD}
      etcdctl: ${IMAGE_ETCD}
    nodes:
      - name: ${GENESIS_HOSTNAME}
        tls:
          client:
            cert: placeholder
            key: placeholder
          peer:
            cert: placeholder
            key: placeholder
      - name: ${MASTER1_HOSTNAME}
        tls:
          client:
            cert: placeholder
            key: placeholder
          peer:
            cert: placeholder
            key: placeholder
      - name: ${MASTER2_HOSTNAME}
        tls:
          client:
            cert: placeholder
            key: placeholder
          peer:
            cert: placeholder
            key: placeholder
    service:
      name: kubernetes-etcd
      ip: 10.96.0.2
      client:
        port: 2379
        target_port: 2379
      peer:
        port: 2380
        target_port: 2380
    tls:
      client:
        ca: placeholder
      peer:
        ca: placeholder
  source:
    type: local
    location: /etc/genesis/armada/assets/charts
    subpath: etcd
  dependencies:
    - helm-toolkit
---
schema: armada/Chart/v1
metadata:
  schema: metadata/Document/v1
  name: kubernetes-rbac
  layeringDefinition:
    abstract: false
    layer: site
data:
  chart_name: rbac
  release: rbac
  namespace: kube-system
  timeout: 600
  values: {}
  upgrade:
    no_hooks: true
  source:
    type: local
    location: /etc/genesis/armada/assets/charts
    subpath: rbac
  dependencies: []
...