mirror of
https://github.com/vmware-tanzu/pinniped.git
synced 2026-02-14 18:10:17 +00:00
77 lines
3.4 KiB
YAML
77 lines
3.4 KiB
YAML
#@ load("@ytt:data", "data")
|
|
|
|
kind: Cluster
|
|
apiVersion: kind.x-k8s.io/v1alpha4
|
|
nodes:
|
|
- role: control-plane
|
|
extraPortMappings:
|
|
- protocol: TCP
|
|
#! This same port number is hardcoded in the integration test setup
|
|
#! when creating a Service on a kind cluster. It is used to talk to
|
|
#! the supervisor app via HTTPS.
|
|
containerPort: 31243
|
|
hostPort: 12344
|
|
listenAddress: 127.0.0.1
|
|
- protocol: TCP
|
|
#! This same port number is hardcoded in the integration test setup
|
|
#! when creating a Service on a kind cluster. It is used to talk to
|
|
#! the Dex app.
|
|
containerPort: 31235
|
|
hostPort: 12346
|
|
listenAddress: 127.0.0.1
|
|
|
|
|
|
#! Kind v0.12.0 ignores kubeadm.k8s.io/v1beta2 for Kube v1.23+ but uses it for older versions of Kube.
|
|
#! Previous versions of Kind would use kubeadm.k8s.io/v1beta2 for all versions of Kube including 1.23.
|
|
#! To try to maximize compatibility with various versions of Kind and Kube, define this
|
|
#! ClusterConfiguration twice and hope that Kind will use the one that it likes for the given version
|
|
#! of Kube, and ignore the one that it doesn't like. This seems to work, at least for Kind v0.12.0.
|
|
kubeadmConfigPatches:
|
|
- |
|
|
apiVersion: kubeadm.k8s.io/v1beta2
|
|
kind: ClusterConfiguration
|
|
apiServer:
|
|
extraArgs:
|
|
#! To make sure the endpoints on our service are correct (this mostly matters for kubectl based
|
|
#! installs where kapp is not doing magic changes to the deployment and service selectors).
|
|
#! Setting this field to true makes it so that the API service will do the service cluster IP
|
|
#! to endpoint IP translations internally instead of relying on the network stack (i.e. kube-proxy).
|
|
#! The logic inside the API server is very straightforward - randomly pick an IP from the list
|
|
#! of available endpoints. This means that over time, all endpoints associated with the service
|
|
#! are exercised. For whatever reason, leaving this as false (i.e. use kube-proxy) appears to
|
|
#! hide some network misconfigurations when used internally by the API server aggregation layer.
|
|
enable-aggregator-routing: "true"
|
|
- |
|
|
apiVersion: kubeadm.k8s.io/v1beta3
|
|
kind: ClusterConfiguration
|
|
apiServer:
|
|
extraArgs:
|
|
# See comment above.
|
|
enable-aggregator-routing: "true"
|
|
#@ if data.values.enable_audit_logs:
|
|
- |
|
|
kind: ClusterConfiguration
|
|
apiServer:
|
|
#! enable auditing flags on the API server
|
|
extraArgs:
|
|
audit-log-path: /var/log/kubernetes/kube-apiserver-audit.log
|
|
audit-policy-file: /etc/kubernetes/policies/audit-policy.yaml
|
|
#! mount new files / directories on the control plane
|
|
extraVolumes:
|
|
- name: audit-policies
|
|
hostPath: /etc/kubernetes/policies
|
|
mountPath: /etc/kubernetes/policies
|
|
readOnly: true
|
|
pathType: "DirectoryOrCreate"
|
|
- name: "audit-logs"
|
|
hostPath: "/var/log/kubernetes"
|
|
mountPath: "/var/log/kubernetes"
|
|
readOnly: false
|
|
pathType: DirectoryOrCreate
|
|
#! mount the local file on the control plane
|
|
extraMounts:
|
|
- hostPath: /tmp/metadata-audit-policy.yaml
|
|
containerPath: /etc/kubernetes/policies/audit-policy.yaml
|
|
readOnly: true
|
|
#@ end
|