From 799182f0c40730e41253dc5c861857d219291c3b Mon Sep 17 00:00:00 2001 From: "Sridhar K. N. Rao" Date: Fri, 18 Oct 2019 14:35:14 +0530 Subject: Site definition for Intel Pod-10 This patch adds site definition for Intel Pod-10. Updated publickeys of luc and trevor Updated site-definition Updated divingbell Modifying common parts - FOR TESTING ONLY - Will be removed Trying with only 1 disk (bootdisk) Trying with 2 disks - /dev/sda as bootdisk, /dev/sdb as datadisk Change ceph config from directory to /dev/sdb (OSD-data only) Change ceph config from directory to /dev/sdb (OSD-Journl too) Reduce footprint of osh-infra (reduce disk pressure) Move ceph to site specific manifests Fix pod10 host/hardware profiles to be site local Fix Nova/Neutron parts to be site local Fix glance cirros image pull Fix type to site layer names for moved files Rename pod10 hardware/host profiles Move ceph fully to /dev/sdb Disable SR-IOV configuration Optimize disk storage for Nova VMs (use root disk or 3T) Signed-off-by: Sridhar K. N. Rao Change-Id: I2160e56744917510d4627cefca32031904188f77 --- site/intel-pod10/pki/pki-catalog.yaml | 289 ++++++++++++++++++++++++++++++++++ 1 file changed, 289 insertions(+) create mode 100644 site/intel-pod10/pki/pki-catalog.yaml (limited to 'site/intel-pod10/pki') diff --git a/site/intel-pod10/pki/pki-catalog.yaml b/site/intel-pod10/pki/pki-catalog.yaml new file mode 100644 index 0000000..b66ea64 --- /dev/null +++ b/site/intel-pod10/pki/pki-catalog.yaml @@ -0,0 +1,289 @@ +--- +# The purpose of this file is to define the PKI certificates for the environment +# +# NOTE: When deploying a new site, this file should not be configured until +# baremetal/nodes.yaml is complete. +# +schema: promenade/PKICatalog/v1 +metadata: + schema: metadata/Document/v1 + name: cluster-certificates + layeringDefinition: + abstract: false + layer: site + storagePolicy: cleartext +data: + certificate_authorities: + kubernetes: + description: CA for Kubernetes components + certificates: + - document_name: apiserver + description: Service certificate for Kubernetes apiserver + common_name: apiserver + hosts: + - localhost + - 127.0.0.1 + # FIXME: Repetition of api_service_ip in common-addresses; use + # substitution + - 10.96.0.1 + kubernetes_service_names: + - kubernetes.default.svc.cluster.local + + # NEWSITE-CHANGEME: The following should be a list of all the nodes in + # the environment (genesis, control plane, data plane, everything). + # Add/delete from this list as necessary until all nodes are listed. + # For each node, the `hosts` list should be comprised of: + # 1. The node's hostname, as already defined in baremetal/nodes.yaml + # 2. The node's Calico IP address, as already defined in baremetal/nodes.yaml + # NOTE: This list also needs to include the Genesis node, which is not + # listed in baremetal/nodes.yaml, but by convention should be allocated + # the first non-reserved IP in each logical network allocation range + # defined in networks/physical/networks.yaml + # NOTE: The genesis node needs to be defined twice (the first two entries + # on this list) with all of the same paramters except the document_name. + # In the first case the document_name is `kubelet-genesis`, and in the + # second case the document_name format is `kubelet-YOUR_GENESIS_HOSTNAME`. + - document_name: kubelet-genesis + common_name: system:node:pod10-node1 + hosts: + - pod10-node1 + - 10.10.102.21 + groups: + - system:nodes + - document_name: kubelet-pod10-node1 + common_name: system:node:pod10-node1 + hosts: + - pod10-node1 + - 10.10.102.21 + groups: + - system:nodes + - document_name: kubelet-pod10-node2 + common_name: system:node:pod10-node2 + hosts: + - pod10-node2 + - 10.10.102.22 + groups: + - system:nodes + - document_name: kubelet-pod10-node3 + common_name: system:node:pod10-node3 + hosts: + - pod10-node3 + - 10.10.102.23 + groups: + - system:nodes + - document_name: kubelet-pod10-node4 + common_name: system:node:pod10-node4 + hosts: + - pod10-node4 + - 10.10.102.24 + groups: + - system:nodes + - document_name: kubelet-pod10-node5 + common_name: system:node:pod10-node5 + hosts: + - pod10-node4 + - 10.10.102.25 + groups: + - system:nodes + # End node list + - document_name: scheduler + description: Service certificate for Kubernetes scheduler + common_name: system:kube-scheduler + - document_name: controller-manager + description: certificate for controller-manager + common_name: system:kube-controller-manager + - document_name: admin + common_name: admin + groups: + - system:masters + - document_name: armada + common_name: armada + groups: + - system:masters + kubernetes-etcd: + description: Certificates for Kubernetes's etcd servers + certificates: + - document_name: apiserver-etcd + description: etcd client certificate for use by Kubernetes apiserver + common_name: apiserver + # NOTE(mark-burnett): hosts not required for client certificates + - document_name: kubernetes-etcd-anchor + description: anchor + common_name: anchor + # NEWSITE-CHANGEME: The following should be a list of the control plane + # nodes in the environment, including genesis. + # For each node, the `hosts` list should be comprised of: + # 1. The node's hostname, as already defined in baremetal/nodes.yaml + # 2. The node's Calico IP address, as already defined in baremetal/nodes.yaml + # 3. 127.0.0.1 + # 4. localhost + # 5. kubernetes-etcd.kube-system.svc.cluster.local + # NOTE: This list also needs to include the Genesis node, which is not + # listed in baremetal/nodes.yaml, but by convention should be allocated + # the first non-reserved IP in each logical network allocation range + # defined in networks/physical/networks.yaml, except for the kubernetes + # service_cidr where it should start with the second IP in the range. + # NOTE: The genesis node is defined twice with the same `hosts` data: + # Once with its hostname in the common/document name, and once with + # `genesis` defined instead of the host. For now, this duplicated + # genesis definition is required. FIXME: Remove duplicate definition + # after Promenade addresses this issue. + - document_name: kubernetes-etcd-genesis + common_name: kubernetes-etcd-genesis + hosts: + - pod10-node1 + - 10.10.102.21 + - 127.0.0.1 + - localhost + - kubernetes-etcd.kube-system.svc.cluster.local + - 10.96.0.2 + - document_name: kubernetes-etcd-pod10-node1 + common_name: kubernetes-etcd-pod10-node1 + hosts: + - pod10-node1 + - 10.10.102.21 + - 127.0.0.1 + - localhost + - kubernetes-etcd.kube-system.svc.cluster.local + - 10.96.0.2 + - document_name: kubernetes-etcd-pod10-node2 + common_name: kubernetes-etcd-pod10-node2 + hosts: + - pod10-node2 + - 10.10.102.22 + - 127.0.0.1 + - localhost + - kubernetes-etcd.kube-system.svc.cluster.local + - 10.96.0.2 + - document_name: kubernetes-etcd-pod10-node3 + common_name: kubernetes-etcd-pod10-node3 + hosts: + - pod10-node3 + - 10.10.102.23 + - 127.0.0.1 + - localhost + - kubernetes-etcd.kube-system.svc.cluster.local + - 10.96.0.2 + # End node list + kubernetes-etcd-peer: + certificates: + # NEWSITE-CHANGEME: This list should be identical to the previous list, + # except that `-peer` has been appended to the document/common names. + - document_name: kubernetes-etcd-genesis-peer + common_name: kubernetes-etcd-genesis-peer + hosts: + - pod10-node1 + - 10.10.102.21 + - 127.0.0.1 + - localhost + - kubernetes-etcd.kube-system.svc.cluster.local + - 10.96.0.2 + - document_name: kubernetes-etcd-pod10-node1-peer + common_name: kubernetes-etcd-pod10-node1-peer + hosts: + - pod10-node1 + - 10.10.102.21 + - 127.0.0.1 + - localhost + - kubernetes-etcd.kube-system.svc.cluster.local + - 10.96.0.2 + - document_name: kubernetes-etcd-pod10-node2-peer + common_name: kubernetes-etcd-pod10-node2-peer + hosts: + - pod10-node2 + - 10.10.102.22 + - 127.0.0.1 + - localhost + - kubernetes-etcd.kube-system.svc.cluster.local + - 10.96.0.2 + - document_name: kubernetes-etcd-pod10-node3-peer + common_name: kubernetes-etcd-pod10-node3-peer + hosts: + - pod10-node3 + - 10.10.102.23 + - 127.0.0.1 + - localhost + - kubernetes-etcd.kube-system.svc.cluster.local + - 10.96.0.2 + # End node list + calico-etcd: + description: Certificates for Calico etcd client traffic + certificates: + - document_name: calico-etcd-anchor + description: anchor + common_name: anchor + # NEWSITE-CHANGEME: The following should be a list of the control plane + # nodes in the environment, including genesis. + # For each node, the `hosts` list should be comprised of: + # 1. The node's hostname, as already defined in baremetal/nodes.yaml + # 2. The node's Calico IP address, as already defined in baremetal/nodes.yaml + # 3. 127.0.0.1 + # 4. localhost + # 5. The calico/etcd/service_ip defined in networks/common-addresses.yaml + # NOTE: This list also needs to include the Genesis node, which is not + # listed in baremetal/nodes.yaml, but by convention should be allocated + # the first non-reserved IP in each logical network allocation range + # defined in networks/physical/networks.yaml + - document_name: calico-etcd-pod10-node1 + common_name: calico-etcd-pod10-node1 + hosts: + - pod10-node1 + - 10.10.102.21 + - 127.0.0.1 + - localhost + - 10.96.232.136 + - document_name: calico-etcd-pod10-node2 + common_name: calico-etcd-pod10-node2 + hosts: + - pod10-node2 + - 10.10.102.22 + - 127.0.0.1 + - localhost + - 10.96.232.136 + - document_name: calico-etcd-pod10-node3 + common_name: calico-etcd-pod10-node3 + hosts: + - pod10-node3 + - 10.10.102.23 + - 127.0.0.1 + - localhost + - 10.96.232.136 + - document_name: calico-node + common_name: calcico-node + # End node list + calico-etcd-peer: + description: Certificates for Calico etcd clients + certificates: + # NEWSITE-CHANGEME: This list should be identical to the previous list, + # except that `-peer` has been appended to the document/common names. + - document_name: calico-etcd-pod10-node1-peer + common_name: calico-etcd-pod10-node1-peer + hosts: + - pod10-node1 + - 10.10.102.21 + - 127.0.0.1 + - localhost + - 10.96.232.136 + - document_name: calico-etcd-pod10-node2-peer + common_name: calico-etcd-pod10-node2-peer + hosts: + - pod10-node2 + - 10.10.102.22 + - 127.0.0.1 + - localhost + - 10.96.232.136 + - document_name: calico-etcd-pod10-node3-peer + common_name: calico-etcd-pod10-node3-peer + hosts: + - pod10-node3 + - 10.10.102.23 + - 127.0.0.1 + - localhost + - 10.96.232.136 + - document_name: calico-node-peer + common_name: calcico-node-peer + # End node list + keypairs: + - name: service-account + description: Service account signing key for use by Kubernetes controller-manager. +... -- cgit 1.2.3-korg