---
apiVersion: kubeadm.k8s.io/v1beta2
kind: ClusterConfiguration
etcd:
{{- if .kubernetes.etcd.deployment_type | eq "internal" }}
  local:
    imageRepository: {{ slice (.kubernetes.etcd.image | splitList ":" | first | splitList "/") 1 (.kubernetes.etcd.image | splitList ":" | first | splitList "/" | len) | join "/" }}
    imageTag: {{ .kubernetes.etcd.image | splitList ":" | last }}
    serverCertSANs:
    {{- range .groups.etcd | default list }}
    - https://{{ index $.inventory_hosts . "internal_ipv4" }}:2379
    {{- end }}
{{- else }}
  external:
    endpoints:
    {{- range .groups.etcd | default list }}
    - https://{{ index $.inventory_hosts . "internal_ipv4" }}:2379
    {{- end }}
    caFile: /etc/kubernetes/pki/etcd/ca.crt
    certFile: /etc/kubernetes/pki/etcd/client.crt
    keyFile: /etc/kubernetes/pki/etcd/client.key
{{- end }}
dns:
  type: CoreDNS
  imageRepository: {{ slice (.kubernetes.networking.dns_image | splitList ":" | first | splitList "/") 1 (.kubernetes.networking.dns_image | splitList ":" | first | splitList "/" | len) | join "/" }}
  imageTag: {{ .kubernetes.networking.dns_image | splitList ":" | last }}
imageRepository: {{ .kubernetes.image_repository }}
kubernetesVersion: {{ .kube_version }}
certificatesDir: /etc/kubernetes/pki
clusterName: {{ .kubernetes.cluster_name }}
controlPlaneEndpoint: {{ if and .kubernetes.control_plane_endpoint (ne .kubernetes.control_plane_endpoint "") }}{{ .kubernetes.control_plane_endpoint }}{{ else }}{{ .init_kubernetes_node }}{{ end }}
networking:
  dnsDomain: {{ .kubernetes.networking.dns_domain }}
  podSubnet: {{ .kubernetes.networking.pod_cidr }}
  serviceSubnet: {{ .kubernetes.networking.service_cidr }}
apiServer:
  extraArgs:
{{- if .security_enhancement }}
    authorization-mode: Node,RBAC
    enable-admission-plugins: AlwaysPullImages,ServiceAccount,NamespaceLifecycle,NodeRestriction,LimitRanger,ResourceQuota,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,PodNodeSelector,PodSecurity
    profiling: false
    request-timeout: 120s
    service-account-lookup: true
    tls-min-version: VersionTLS12
    tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
{{- end }}
{{- if .kubernetes.audit }}
    audit-log-format: json
    audit-log-maxbackup: 2
    audit-log-maxsize: 200
    audit-policy-file: /etc/kubernetes/audit/policy.yaml
    audit-webhook-config-file: /etc/kubernetes/audit/webhook.yaml
{{- end }}
{{ .kubernetes.apiserver.extra_args | toYaml | indent 4 }}
  certSANs:
    - kubernetes
    - kubernetes.default
    - kubernetes.default.svc
    - localhost
    - 127.0.0.1
    - {{ .kubernetes.networking.service_cidr | ipInCIDR 0 }}
    - {{ if and .kubernetes.control_plane_endpoint (ne .kubernetes.control_plane_endpoint "") }}{{ .kubernetes.control_plane_endpoint }}{{ else }}{{ .init_kubernetes_node }}{{ end }}
    - kubernetes.default.svc.{{ if and .kubernetes.control_plane_endpoint (ne .kubernetes.control_plane_endpoint "") }}{{ .kubernetes.control_plane_endpoint }}{{ else }}{{ .init_kubernetes_node }}{{ end }}
    - kubernetes.default.svc.{{ .kubernetes.networking.dns_domain }}
  {{- range .groups.k8s_cluster | default list }}
    - {{ index $.inventory_hosts . "hostname" }}.{{ $.kubernetes.networking.dns_domain }}
    - {{ index $.inventory_hosts . "internal_ipv4" }}
    {{- if index $.inventory_hosts . "internal_ipv6" }}
    - {{ index $.inventory_hosts . "internal_ipv6" }}
    {{- end }}
  {{- end }}
  {{- range .kubernetes.apiserver.certSANs }}
    - {{ . }}
  {{- end }}
{{- if .kubernetes.audit }}
  extraVolumes:
  - name: k8s-audit
    hostPath: /etc/kubernetes/audit
    mountPath: /etc/kubernetes/audit
    pathType: DirectoryOrCreate
{{- end }}
controllerManager:
  extraArgs:
{{- if gt ( .kubernetes.networking.pod_cidr | splitList "," | len) 1 }}
    node-cidr-mask-size-ipv4: "{{ .kubernetes.controller_manager.kube_network_node_prefix }}"
    node-cidr-mask-size-ipv6: "64"
{{- else }}
    node-cidr-mask-size: "{{ .kubernetes.controller_manager.kube_network_node_prefix }}"
{{- end }}
{{- if .kube_version | semverCompare ">=v1.9.0" }}
    cluster-signing-duration: 87600h
{{- else }}
    experimental-cluster-signing-duration: 87600h
{{- end }}
{{- if .security_enhancement }}
    bind-address: 127.0.0.1
    profiling: false
    terminated-pod-gc-threshold: 50
    use-service-account-credentials: true
{{- else }}
    bind-address: 0.0.0.0
{{- end }}
{{ .kubernetes.controller_manager.extra_args | toYaml | indent 4 }}
  extraVolumes:
  - name: host-time
    hostPath: /etc/localtime
    mountPath: /etc/localtime
    readOnly: true
scheduler:
  extraArgs:
{{ if .security_enhancement }}
    bind-address: 127.0.0.1
    profiling: false
{{- else }}
    bind-address: 0.0.0.0
{{- end }}
{{ .kubernetes.scheduler.extra_args | toYaml | indent 4 }}

---
apiVersion: kubeadm.k8s.io/v1beta2
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: {{ .internal_ipv4 }}
  bindPort: {{ .kubernetes.apiserver.port }}
nodeRegistration:
  criSocket: {{ .cri.cri_socket }}
  kubeletExtraArgs:
    cgroup-driver: {{ .cri.cgroup_driver }}

---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
clusterCIDR: {{ .kubernetes.networking.pod_cidr }}
mode: {{ .kubernetes.kube_proxy.mode }}
{{ .kubernetes.kube_proxy.config | toYaml }}

---
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
clusterDomain: {{ .kubernetes.networking.dns_domain }}
clusterDNS:
  - {{ .kubernetes.networking.dns_service_ip }}
maxPods: {{ .kubernetes.max_pods }}
podPidsLimit: {{ .kubernetes.kubelet.pod_pids_limit }}
rotateCertificates: true
kubeReserved:
  cpu: 200m
  memory: 250Mi
systemReserved:
  cpu: 200m
  memory: 250Mi
evictionHard:
  memory.available: 5%
  pid.available: 10%
evictionSoft:
  memory.available: 10%
evictionSoftGracePeriod:
  memory.available: 2m
evictionMaxPodGracePeriod: 120
evictionPressureTransitionPeriod: 30s
{{- if .security_enhancement }}
readOnlyPort: 0
protectKernelDefaults: true
eventRecordQPS: 1
streamingConnectionIdleTimeout: 5m
makeIPTablesUtilChains: true
tlsCipherSuites:
 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
 - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
 - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
featureGates:
  RotateKubeletServerCertificate: true
  SeccompDefault: true
  {{- if .kube_version | semverCompare ">=v1.24.0" }}
  TTLAfterFinished: true
  {{- end }}
  {{ if .kube_version | semverCompare ">=v1.21.0" }}
  CSIStorageCapacity: true
  {{- end }}
{{ .kubernetes.kubelet.feature_gates | toYaml | indent 2 }}
{{- else }}
featureGates:
  RotateKubeletServerCertificate: true
  {{- if .kube_version | semverCompare ">=v1.24.0" }}
  TTLAfterFinished: true
  {{- end }}
  {{- if .kube_version | semverCompare ">=v1.21.0" }}
  CSIStorageCapacity: true
  ExpandCSIVolumes: true
  {{- end }}
  {{- if .kubernetes.kubelet.feature_gates }}
{{ .kubernetes.kubelet.feature_gates | toYaml | indent 2 }}
  {{- end }}
{{- end }}
cgroupDriver: {{ .cri.cgroup_driver }}
containerLogMaxSize: {{ .kubernetes.kubelet.container_log_max_size }}
containerLogMaxFiles: {{ .kubernetes.kubelet.container_log_max_files }}
{{- if .kubernetes.kubelet.extra_args }}
{{ .kubernetes.kubelet.extra_args | toYaml }}
{{- end }}
