cluster-template-vpc-clusterclass.yaml

apiVersion: cluster.x-k8s.io/v1beta1
kind: Cluster
metadata:
  labels:
    ccm: external
    cluster.x-k8s.io/cluster-name: ${CLUSTER_NAME}
  name: ${CLUSTER_NAME}
  namespace: ${NAMESPACE}
spec:
  clusterNetwork:
    pods:
      cidrBlocks:
      - ${POD_CIDR:="192.168.0.0/16"}
    serviceDomain: ${SERVICE_DOMAIN:="cluster.local"}
    services:
      cidrBlocks:
      - ${SERVICE_CIDR:="10.128.0.0/12"}
  topology:
    class: ${IBMVPC_CLUSTER_CLASS_NAME}
    controlPlane:
      replicas: ${CONTROL_PLANE_MACHINE_COUNT}
    version: ${KUBERNETES_VERSION}
    workers:
      machineDeployments:
      - class: default-worker
        name: md-0
        replicas: ${WORKER_MACHINE_COUNT}
---
apiVersion: cluster.x-k8s.io/v1beta1
kind: ClusterClass
metadata:
  name: ${IBMVPC_CLUSTER_CLASS_NAME:="vpc-cc"}
spec:
  controlPlane:
    machineInfrastructure:
      ref:
        apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
        kind: IBMVPCMachineTemplate
        name: ${IBMVPC_CLUSTER_CLASS_NAME}-control-plane-machinetemplate
        namespace: ${NAMESPACE}
    ref:
      apiVersion: controlplane.cluster.x-k8s.io/v1beta1
      kind: KubeadmControlPlaneTemplate
      name: ${IBMVPC_CLUSTER_CLASS_NAME}-control-plane
      namespace: ${NAMESPACE}
  infrastructure:
    ref:
      apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
      kind: IBMVPCClusterTemplate
      name: ${IBMVPC_CLUSTER_CLASS_NAME}-cluster-template
      namespace: ${NAMESPACE}
  workers:
    machineDeployments:
    - class: default-worker
      template:
        bootstrap:
          ref:
            apiVersion: bootstrap.cluster.x-k8s.io/v1beta1
            kind: KubeadmConfigTemplate
            name: ${IBMVPC_CLUSTER_CLASS_NAME}-md-0
        infrastructure:
          ref:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
            kind: IBMVPCMachineTemplate
            name: ${IBMVPC_CLUSTER_CLASS_NAME}-worker-machinetemplate
---
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
kind: IBMVPCClusterTemplate
metadata:
  name: ${IBMVPC_CLUSTER_CLASS_NAME}-cluster-template
spec:
  template:
    spec:
      controlPlaneLoadBalancer:
        name: ${CLUSTER_NAME}-load-balancer
      region: ${IBMVPC_REGION}
      resourceGroup: ${IBMVPC_RESOURCEGROUP}
      vpc: ${IBMVPC_NAME}
      zone: ${IBMVPC_ZONE}
---
apiVersion: controlplane.cluster.x-k8s.io/v1beta1
kind: KubeadmControlPlaneTemplate
metadata:
  name: ${IBMVPC_CLUSTER_CLASS_NAME}-control-plane
  namespace: ${NAMESPACE}
spec:
  template:
    spec:
      kubeadmConfigSpec:
        clusterConfiguration:
          apiServer:
            certSANs:
            - localhost
            - 127.0.0.1
            extraArgs:
              cloud-provider: external
          controllerManager:
            extraArgs:
              cloud-provider: external
              enable-hostpath-provisioner: "true"
          dns: {}
          etcd: {}
          kubernetesVersion: ${KUBERNETES_VERSION}
          networking: {}
          scheduler: {}
        initConfiguration:
          nodeRegistration:
            criSocket: /var/run/containerd/containerd.sock
            kubeletExtraArgs:
              cloud-provider: external
              eviction-hard: nodefs.available<0%,nodefs.inodesFree<0%,imagefs.available<0%
        joinConfiguration:
          discovery: {}
          nodeRegistration:
            criSocket: /var/run/containerd/containerd.sock
            kubeletExtraArgs:
              cloud-provider: external
              eviction-hard: nodefs.available<0%,nodefs.inodesFree<0%,imagefs.available<0%
---
apiVersion: bootstrap.cluster.x-k8s.io/v1beta1
kind: KubeadmConfigTemplate
metadata:
  name: ${IBMVPC_CLUSTER_CLASS_NAME}-md-0
spec:
  template:
    spec:
      joinConfiguration:
        nodeRegistration:
          kubeletExtraArgs:
            cloud-provider: external
            eviction-hard: nodefs.available<0%,nodefs.inodesFree<0%,imagefs.available<0%
---
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
kind: IBMVPCMachineTemplate
metadata:
  name: ${IBMVPC_CLUSTER_CLASS_NAME}-control-plane-machinetemplate
spec:
  template:
    spec:
      bootVolume:
        sizeGiB: ${IBMVPC_CONTROLPLANE_BOOT_VOLUME_SIZEGIB:=20}
      image:
        name: ${IBMVPC_IMAGE_NAME}
      profile: ${IBMVPC_PROFILE}
      sshKeys:
      - name: ${IBMVPC_SSHKEY_NAME}
      zone: ${IBMVPC_ZONE}
---
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
kind: IBMVPCMachineTemplate
metadata:
  name: ${IBMVPC_CLUSTER_CLASS_NAME}-worker-machinetemplate
spec:
  template:
    spec:
      bootVolume:
        sizeGiB: ${IBMVPC_WORKER_BOOT_VOLUME_SIZEGIB:=20}
      image:
        name: ${IBMVPC_IMAGE_NAME}
      profile: ${IBMVPC_PROFILE}
      sshKeys:
      - name: ${IBMVPC_SSHKEY_NAME}
      zone: ${IBMVPC_ZONE}
---
apiVersion: addons.cluster.x-k8s.io/v1beta1
kind: ClusterResourceSet
metadata:
  name: crs-cloud-conf
spec:
  clusterSelector:
    matchLabels:
      ccm: external
  resources:
  - kind: Secret
    name: ibm-credential
  - kind: ConfigMap
    name: ibm-cfg
  - kind: ConfigMap
    name: cloud-controller-manager-addon
  strategy: ApplyOnce
---
apiVersion: v1
data:
  ibm-cloud-conf.yaml: |-
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: ibm-cloud-config
      namespace: kube-system
    data:
      ibm.conf: |
        [global]
        version = 1.1.0
        [kubernetes]
        config-file = ""
        [provider]
        cluster-default-provider = g2
        accountID = ${IBMACCOUNT_ID}
        clusterID = ${CLUSTER_NAME}
        g2workerServiceAccountID = ${IBMACCOUNT_ID}
        g2Credentials = /etc/ibm-secret/ibmcloud_api_key
        g2ResourceGroupName = ${IBMVPC_RESOURCEGROUP_NAME:=""}
        g2VpcSubnetNames = "${CLUSTER_NAME}-subnet"
        g2VpcName = ${IBMVPC_NAME:=""}
        region =  ${IBMVPC_REGION:=""}
kind: ConfigMap
metadata:
  name: ibm-cfg
---
apiVersion: v1
kind: Secret
metadata:
  name: ibm-credential
stringData:
  ibm-credential.yaml: |-
    apiVersion: v1
    kind: Secret
    metadata:
      name: ibm-cloud-credential
      namespace: kube-system
    data:
      ibmcloud_api_key: ${BASE64_API_KEY}
type: addons.cluster.x-k8s.io/resource-set
---
apiVersion: v1
data:
  ibm-ccm-external.yaml: |-
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: cloud-controller-manager
      namespace: kube-system
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
      name: cloud-controller-manager:apiserver-authentication-reader
      namespace: kube-system
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: Role
      name: extension-apiserver-authentication-reader
    subjects:
      - apiGroup: ""
        kind: ServiceAccount
        name: cloud-controller-manager
        namespace: kube-system
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: system:cloud-controller-manager
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: system:cloud-controller-manager
    subjects:
      - kind: ServiceAccount
        name: cloud-controller-manager
        namespace: kube-system
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRole
    metadata:
      name: system:cloud-controller-manager
    rules:
      - apiGroups:
          - ""
        resources:
          - events
        verbs:
          - create
          - patch
          - update
      - apiGroups:
          - ""
        resources:
          - nodes
        verbs:
          - "*"
      - apiGroups:
          - ""
        resources:
          - nodes/status
        verbs:
          - patch
      - apiGroups:
          - ""
        resources:
          - services
        verbs:
          - list
          - patch
          - update
          - watch
      - apiGroups:
          - ""
        resources:
          - services/status
        verbs:
          - patch
      - apiGroups:
          - ""
        resources:
          - serviceaccounts
        verbs:
          - create
          - get
          - list
          - watch
          - update
      - apiGroups:
          - ""
        resources:
          - persistentvolumes
        verbs:
          - get
          - list
          - update
          - watch
      - apiGroups:
          - ""
        resources:
          - endpoints
        verbs:
          - create
          - get
          - list
          - watch
          - update
      - apiGroups:
          - ""
        resources:
          - secrets
        verbs:
          - get
          - list
          - watch
      - apiGroups:
          - "coordination.k8s.io"
        resources:
          - leases
        verbs:
          - create
          - get
          - list
          - watch
          - update
      - apiGroups:
          - ""
        resourceNames:
          - node-controller
          - service-controller
        resources:
          - serviceaccounts/token
        verbs:
          - create
    ---
    apiVersion: apps/v1
    kind: DaemonSet
    metadata:
      name: ibm-cloud-controller-manager
      namespace: kube-system
      labels:
        k8s-app: ibm-cloud-controller-manager
    spec:
      selector:
        matchLabels:
          k8s-app: ibm-cloud-controller-manager
      updateStrategy:
        type: RollingUpdate
      template:
        metadata:
          labels:
            k8s-app: ibm-cloud-controller-manager
        spec:
          nodeSelector:
            node-role.kubernetes.io/control-plane: ""
          tolerations:
            - key: node.cloudprovider.kubernetes.io/uninitialized
              value: "true"
              effect: NoSchedule
            - key: node-role.kubernetes.io/master
              effect: NoSchedule
              operator: Exists
            - key: node-role.kubernetes.io/control-plane
              effect: NoSchedule
              operator: Exists
            - key: node.kubernetes.io/not-ready
              effect: NoSchedule
              operator: Exists
          serviceAccountName: cloud-controller-manager
          containers:
            - name: ibm-cloud-controller-manager
              image: gcr.io/k8s-staging-capi-ibmcloud/powervs-cloud-controller-manager:6c98ec5
              args:
                - --v=2
                - --cloud-provider=ibm
                - --cloud-config=/etc/cloud/ibm.conf
                - --use-service-account-credentials=true
              resources:
                requests:
                  cpu: 200m
              terminationMessagePolicy: FallbackToLogsOnError
              volumeMounts:
                - mountPath: /etc/cloud
                  name: ibm-config-volume
                  readOnly: true
                - mountPath: /etc/ibm-secret
                  name: ibm-secret
          hostNetwork: true
          volumes:
            - name: ibm-config-volume
              configMap:
                name: ibm-cloud-config
            - name: ibm-secret
              secret:
                secretName: ibm-cloud-credential
kind: ConfigMap
metadata:
  name: cloud-controller-manager-addon