passwd:
  users:
    - name: core
      ssh_authorized_keys:
        - ssh-rsa AAABBB
        - ssh-rsa CCCDDD

networkd:
  units:
    - name: static-nic.network
      contents: |
        [Match]
        # Because of difficulty predicting specific NIC names on different cloud providers,
        # we only support static addressing on VSphere. There should be a single NIC attached
        # that we will match by name prefix 'en' which denotes ethernet devices.
        Name=en*

        [Network]
        DHCP=no
        Address=192.168.81.4/24
        Gateway=192.168.81.1
        DNS=8.8.8.8


systemd:
  units:
    - name: update-engine.service
      mask: true
    - name: locksmithd.service
      mask: true
    - name: docker.service
      enabled: true

    - name: download-healthcheck-script.service
      enabled: true
      contents: |
        [Unit]
        Requires=network-online.target
        After=network-online.target
        [Service]
        Type=oneshot
        EnvironmentFile=-/etc/environment
        ExecStart=/opt/bin/download.sh
        ExecPost=systemctl daemon-reload
        [Install]
        WantedBy=multi-user.target

    - name: docker-healthcheck.service
      enabled: true
      dropins:
      - name: 40-docker.conf
        contents: |
          [Unit]
          Requires=download-healthcheck-script.service
          After=download-healthcheck-script.service
      contents: |
          [Unit]
          Requires=docker.service
          After=docker.service

          [Service]
          ExecStart=/opt/bin/health-monitor.sh container-runtime

          [Install]
          WantedBy=multi-user.target

    - name: kubelet-healthcheck.service
      enabled: true
      dropins:
      - name: 40-docker.conf
        contents: |
          [Unit]
          Requires=download-healthcheck-script.service
          After=download-healthcheck-script.service
      contents: |
          [Unit]
          Requires=kubelet.service
          After=kubelet.service

          [Service]
          ExecStart=/opt/bin/health-monitor.sh kubelet

          [Install]
          WantedBy=multi-user.target


    - name: nodeip.service
      enabled: true
      contents: |
        [Unit]
        Description=Setup Kubelet Node IP Env
        Requires=network-online.target
        After=network-online.target

        [Service]
        ExecStart=/opt/bin/setup_net_env.sh
        RemainAfterExit=yes
        Type=oneshot
        [Install]
        WantedBy=multi-user.target


    - name: kubelet.service
      enabled: true
      contents: |
        [Unit]
        Description=Kubernetes Kubelet
        Requires=docker.service
        After=docker.service
        [Service]
        TimeoutStartSec=5min
        CPUAccounting=true
        MemoryAccounting=true
        EnvironmentFile=-/etc/environment
        EnvironmentFile=/etc/kubernetes/nodeip.conf
        Environment=KUBELET_IMAGE=docker://k8s.gcr.io/hyperkube-amd64:v1.16.2
        Environment="RKT_RUN_ARGS=--uuid-file-save=/var/cache/kubelet-pod.uuid \
          --inherit-env \
          --insecure-options=image \
          --volume=resolv,kind=host,source=/etc/resolv.conf \
          --mount volume=resolv,target=/etc/resolv.conf \
          --volume cni-bin,kind=host,source=/opt/cni/bin \
          --mount volume=cni-bin,target=/opt/cni/bin \
          --volume cni-conf,kind=host,source=/etc/cni/net.d \
          --mount volume=cni-conf,target=/etc/cni/net.d \
          --volume etc-kubernetes,kind=host,source=/etc/kubernetes \
          --mount volume=etc-kubernetes,target=/etc/kubernetes \
          --volume var-log,kind=host,source=/var/log \
          --mount volume=var-log,target=/var/log \
          --volume var-lib-calico,kind=host,source=/var/lib/calico \
          --mount volume=var-lib-calico,target=/var/lib/calico"
        ExecStartPre=/bin/mkdir -p /var/lib/calico
        ExecStartPre=/bin/mkdir -p /etc/kubernetes/manifests
        ExecStartPre=/bin/mkdir -p /etc/cni/net.d
        ExecStartPre=/bin/mkdir -p /opt/cni/bin
        ExecStartPre=-/usr/bin/rkt rm --uuid-file=/var/cache/kubelet-pod.uuid
        ExecStartPre=-/bin/rm -rf /var/lib/rkt/cas/tmp/
        ExecStartPre=/bin/bash /opt/load-kernel-modules.sh
        ExecStart=/usr/lib/coreos/kubelet-wrapper \
          --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf \
          --kubeconfig=/var/lib/kubelet/kubeconfig \
          --config=/etc/kubernetes/kubelet.conf \
          --network-plugin=cni \
          --cni-conf-dir=/etc/cni/net.d \
          --cni-bin-dir=/opt/cni/bin \
          --cert-dir=/etc/kubernetes/pki \
          --cloud-provider=vsphere \
          --cloud-config=/etc/kubernetes/cloud-config \
          --hostname-override=node1 \
          --dynamic-config-dir=/etc/kubernetes/dynamic-config-dir \
          --exit-on-lock-contention \
          --lock-file=/tmp/kubelet.lock \
          --volume-plugin-dir=/var/lib/kubelet/volumeplugins \
          --node-ip ${KUBELET_NODE_IP}
        ExecStop=-/usr/bin/rkt stop --uuid-file=/var/cache/kubelet-pod.uuid
        Restart=always
        RestartSec=10
        [Install]
        WantedBy=multi-user.target

    - name: docker.service
      enabled: true
      dropins:
      - name: 10-environment.conf
        contents: |
          [Service]
          EnvironmentFile=-/etc/environment

storage:
  files:

    - path: "/etc/systemd/journald.conf.d/max_disk_use.conf"
      filesystem: root
      mode: 0644
      contents:
        inline: |
          [Journal]
          SystemMaxUse=5G


    - path: "/etc/kubernetes/kubelet.conf"
      filesystem: root
      mode: 0644
      contents:
        inline: |
          apiVersion: kubelet.config.k8s.io/v1beta1
          authentication:
            anonymous:
              enabled: false
            webhook:
              cacheTTL: 0s
              enabled: true
            x509:
              clientCAFile: /etc/kubernetes/pki/ca.crt
          authorization:
            mode: Webhook
            webhook:
              cacheAuthorizedTTL: 0s
              cacheUnauthorizedTTL: 0s
          cgroupDriver: systemd
          clusterDNS:
          - 10.10.10.10
          clusterDomain: cluster.local
          cpuManagerReconcilePeriod: 0s
          evictionPressureTransitionPeriod: 0s
          featureGates:
            RotateKubeletServerCertificate: true
          fileCheckFrequency: 0s
          httpCheckFrequency: 0s
          imageMinimumGCAge: 0s
          kind: KubeletConfiguration
          kubeReserved:
            cpu: 100m
            ephemeral-storage: 1Gi
            memory: 100Mi
          nodeStatusReportFrequency: 0s
          nodeStatusUpdateFrequency: 0s
          protectKernelDefaults: true
          rotateCertificates: true
          runtimeRequestTimeout: 0s
          serverTLSBootstrap: true
          staticPodPath: /etc/kubernetes/manifests
          streamingConnectionIdleTimeout: 0s
          syncFrequency: 0s
          systemReserved:
            cpu: 100m
            ephemeral-storage: 1Gi
            memory: 100Mi
          volumeStatsAggPeriod: 0s


    - path: /opt/load-kernel-modules.sh
      filesystem: root
      mode: 0755
      contents:
        inline: |
          #!/usr/bin/env bash
          set -euo pipefail

          modprobe ip_vs
          modprobe ip_vs_rr
          modprobe ip_vs_wrr
          modprobe ip_vs_sh

          if modinfo nf_conntrack_ipv4 &> /dev/null; then
            modprobe nf_conntrack_ipv4
          else
            modprobe nf_conntrack
          fi


    - path: /etc/sysctl.d/k8s.conf
      filesystem: root
      mode: 0644
      contents:
        inline: |
          net.bridge.bridge-nf-call-ip6tables = 1
          net.bridge.bridge-nf-call-iptables = 1
          kernel.panic_on_oops = 1
          kernel.panic = 10
          net.ipv4.ip_forward = 1
          vm.overcommit_memory = 1
          fs.inotify.max_user_watches = 1048576


    - path: /proc/sys/kernel/panic_on_oops
      filesystem: root
      mode: 0644
      contents:
        inline: |
          1

    - path: /proc/sys/kernel/panic
      filesystem: root
      mode: 0644
      contents:
        inline: |
          10

    - path: /proc/sys/vm/overcommit_memory
      filesystem: root
      mode: 0644
      contents:
        inline: |
          1

    - path: "/opt/bin/setup_net_env.sh"
      filesystem: root
      mode: 0755
      contents:
        inline: |
          #!/usr/bin/env bash
          echodate() {
            echo "[$(date -Is)]" "$@"
          }

          # get the default interface IP address
          DEFAULT_IFC_IP=$(ip -o  route get 1 | grep -oP "src \K\S+")

          if [ -z "${DEFAULT_IFC_IP}" ]
          then
          	echodate "Failed to get IP address for the default route interface"
          	exit 1
          fi

          # write the nodeip_env file
          if grep -q coreos /etc/os-release
          then
            echo "KUBELET_NODE_IP=${DEFAULT_IFC_IP}" > /etc/kubernetes/nodeip.conf
          elif [ ! -d /etc/systemd/system/kubelet.service.d ]
          then
          	echodate "Can't find kubelet service extras directory"
          	exit 1
          else
            echo -e "[Service]\nEnvironment=\"KUBELET_NODE_IP=${DEFAULT_IFC_IP}\"" > /etc/systemd/system/kubelet.service.d/nodeip.conf
          fi


    - path: /etc/kubernetes/bootstrap-kubelet.conf
      filesystem: root
      mode: 0400
      contents:
        inline: |
          apiVersion: v1
          clusters:
          - cluster:
              certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVXakNDQTBLZ0F3SUJBZ0lKQUxmUmxXc0k4WVFITUEwR0NTcUdTSWIzRFFFQkJRVUFNSHN4Q3pBSkJnTlYKQkFZVEFsVlRNUXN3Q1FZRFZRUUlFd0pEUVRFV01CUUdBMVVFQnhNTlUyRnVJRVp5WVc1amFYTmpiekVVTUJJRwpBMVVFQ2hNTFFuSmhaR1pwZEhwcGJtTXhFakFRQmdOVkJBTVRDV3h2WTJGc2FHOXpkREVkTUJzR0NTcUdTSWIzCkRRRUpBUllPWW5KaFpFQmtZVzVuWVM1amIyMHdIaGNOTVRRd056RTFNakEwTmpBMVdoY05NVGN3TlRBME1qQTAKTmpBMVdqQjdNUXN3Q1FZRFZRUUdFd0pWVXpFTE1Ba0dBMVVFQ0JNQ1EwRXhGakFVQmdOVkJBY1REVk5oYmlCRwpjbUZ1WTJselkyOHhGREFTQmdOVkJBb1RDMEp5WVdSbWFYUjZhVzVqTVJJd0VBWURWUVFERXdsc2IyTmhiR2h2CmMzUXhIVEFiQmdrcWhraUc5dzBCQ1FFV0RtSnlZV1JBWkdGdVoyRXVZMjl0TUlJQklqQU5CZ2txaGtpRzl3MEIKQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBdDVmQWpwNGZUY2VrV1VUZnpzcDBreWloMU9ZYnNHTDBLWDFlUmJTUwpSOE9kMCs5UTYySHlueStHRndNVGI0QS9LVThtc3NvSHZjY2VTQUFid2ZieEZLLytzNTFUb2JxVW5PUlpyT29UClpqa1V5Z2J5WERTSzk5WUJiY1IxUGlwOHZ3TVRtNFhLdUx0Q2lnZUJCZGpqQVFkZ1VPMjhMRU5HbHNNbm1lWWsKSmZPRFZHblZtcjVMdGI5QU5BOElLeVRmc25ISjRpT0NTL1BsUGJVajJxN1lub1ZMcG9zVUJNbGdVYi9DeWtYMwptT29MYjR5SkpReUEvaVNUNlp4aUlFajM2RDR5V1o1bGc3WUpsK1VpaUJRSEdDblBkR3lpcHFWMDZleDBoZVlXCmNhaVc4TFdaU1VROTNqUStXVkNIOGhUN0RRTzFkbXN2VW1YbHEvSmVBbHdRL1FJREFRQUJvNEhnTUlIZE1CMEcKQTFVZERnUVdCQlJjQVJPdGhTNFA0VTd2VGZqQnlDNTY5UjdFNkRDQnJRWURWUjBqQklHbE1JR2lnQlJjQVJPdApoUzRQNFU3dlRmakJ5QzU2OVI3RTZLRi9wSDB3ZXpFTE1Ba0dBMVVFQmhNQ1ZWTXhDekFKQmdOVkJBZ1RBa05CCk1SWXdGQVlEVlFRSEV3MVRZVzRnUm5KaGJtTnBjMk52TVJRd0VnWURWUVFLRXd0Q2NtRmtabWwwZW1sdVl6RVMKTUJBR0ExVUVBeE1KYkc5allXeG9iM04wTVIwd0d3WUpLb1pJaHZjTkFRa0JGZzVpY21Ga1FHUmhibWRoTG1OdgpiWUlKQUxmUmxXc0k4WVFITUF3R0ExVWRFd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVGQlFBRGdnRUJBRzZoClU5ZjlzTkgwLzZvQmJHR3kyRVZVMFVnSVRVUUlyRldvOXJGa3JXNWsvWGtEalFtKzNsempUMGlHUjRJeEUvQW8KZVU2c1FodWE3d3JXZUZFbjQ3R0w5OGxuQ3NKZEQ3b1pOaEZtUTk1VGIvTG5EVWpzNVlqOWJyUDBOV3pYZllVNApVSzJabklOSlJjSnBCOGlSQ2FDeEU4RGRjVUYwWHFJRXE2cEEyNzJzbm9MbWlYTE12Tmwza1lFZG0ramU2dm9ECjU4U05WRVVzenR6UXlYbUpFaENwd1ZJMEE2UUNqelhqK3F2cG13M1paSGk4SndYZWk4WlpCTFRTRkJraThaN24Kc0g5QkJIMzgvU3pVbUFONFFIU1B5MWdqcW0wME9BRThOYVlEa2gvYnpFNGQ3bUxHR01XcC9XRTNLUFN1ODJIRgprUGU2WG9TYmlMbS9reGszMlQwPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
              server: https://server:443
            name: ""
          contexts: []
          current-context: ""
          kind: Config
          preferences: {}
          users:
          - name: ""
            user:
              token: my-token


    - path: /etc/kubernetes/cloud-config
      filesystem: root
      mode: 0400
      contents:
        inline: |
          {vsphere-config:true}

    - path: /etc/kubernetes/pki/ca.crt
      filesystem: root
      mode: 0644
      contents:
        inline: |
          -----BEGIN CERTIFICATE-----
          MIIEWjCCA0KgAwIBAgIJALfRlWsI8YQHMA0GCSqGSIb3DQEBBQUAMHsxCzAJBgNV
          BAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEUMBIG
          A1UEChMLQnJhZGZpdHppbmMxEjAQBgNVBAMTCWxvY2FsaG9zdDEdMBsGCSqGSIb3
          DQEJARYOYnJhZEBkYW5nYS5jb20wHhcNMTQwNzE1MjA0NjA1WhcNMTcwNTA0MjA0
          NjA1WjB7MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFjAUBgNVBAcTDVNhbiBG
          cmFuY2lzY28xFDASBgNVBAoTC0JyYWRmaXR6aW5jMRIwEAYDVQQDEwlsb2NhbGhv
          c3QxHTAbBgkqhkiG9w0BCQEWDmJyYWRAZGFuZ2EuY29tMIIBIjANBgkqhkiG9w0B
          AQEFAAOCAQ8AMIIBCgKCAQEAt5fAjp4fTcekWUTfzsp0kyih1OYbsGL0KX1eRbSS
          R8Od0+9Q62Hyny+GFwMTb4A/KU8mssoHvcceSAAbwfbxFK/+s51TobqUnORZrOoT
          ZjkUygbyXDSK99YBbcR1Pip8vwMTm4XKuLtCigeBBdjjAQdgUO28LENGlsMnmeYk
          JfODVGnVmr5Ltb9ANA8IKyTfsnHJ4iOCS/PlPbUj2q7YnoVLposUBMlgUb/CykX3
          mOoLb4yJJQyA/iST6ZxiIEj36D4yWZ5lg7YJl+UiiBQHGCnPdGyipqV06ex0heYW
          caiW8LWZSUQ93jQ+WVCH8hT7DQO1dmsvUmXlq/JeAlwQ/QIDAQABo4HgMIHdMB0G
          A1UdDgQWBBRcAROthS4P4U7vTfjByC569R7E6DCBrQYDVR0jBIGlMIGigBRcAROt
          hS4P4U7vTfjByC569R7E6KF/pH0wezELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNB
          MRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRQwEgYDVQQKEwtCcmFkZml0emluYzES
          MBAGA1UEAxMJbG9jYWxob3N0MR0wGwYJKoZIhvcNAQkBFg5icmFkQGRhbmdhLmNv
          bYIJALfRlWsI8YQHMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAG6h
          U9f9sNH0/6oBbGGy2EVU0UgITUQIrFWo9rFkrW5k/XkDjQm+3lzjT0iGR4IxE/Ao
          eU6sQhua7wrWeFEn47GL98lnCsJdD7oZNhFmQ95Tb/LnDUjs5Yj9brP0NWzXfYU4
          UK2ZnINJRcJpB8iRCaCxE8DdcUF0XqIEq6pA272snoLmiXLMvNl3kYEdm+je6voD
          58SNVEUsztzQyXmJEhCpwVI0A6QCjzXj+qvpmw3ZZHi8JwXei8ZZBLTSFBki8Z7n
          sH9BBH38/SzUmAN4QHSPy1gjqm00OAE8NaYDkh/bzE4d7mLGGMWp/WE3KPSu82HF
          kPe6XoSbiLm/kxk32T0=
          -----END CERTIFICATE-----

    - path: /etc/hostname
      filesystem: root
      mode: 0600
      contents:
        inline: 'node1'

    - path: /etc/ssh/sshd_config
      filesystem: root
      mode: 0600
      user:
        id: 0
      group:
        id: 0
      contents:
        inline: |
          # Use most defaults for sshd configuration.
          Subsystem sftp internal-sftp
          ClientAliveInterval 180
          UseDNS no
          UsePAM yes
          PrintLastLog no # handled by PAM
          PrintMotd no # handled by PAM
          PasswordAuthentication no
          ChallengeResponseAuthentication no

    - path: /etc/docker/daemon.json
      filesystem: root
      mode: 0644
      contents:
        inline: |
          {"exec-opts":["native.cgroupdriver=systemd"],"storage-driver":"overlay2","log-driver":"json-file","log-opts":{"max-size":"100m"}}

    - path: /opt/bin/download.sh
      filesystem: root
      mode: 0755
      contents:
        inline: |
          #!/bin/bash
          set -xeuo pipefail
          opt_bin=/opt/bin
          cni_bin_dir=/opt/cni/bin
          mkdir -p /etc/cni/net.d /etc/kubernetes/dynamic-config-dir /etc/kubernetes/manifests "$opt_bin" "$cni_bin_dir"
          arch=${HOST_ARCH:-amd64}
          CNI_VERSION="${CNI_VERSION:-v0.8.7}"
          cni_base_url="https://github.com/containernetworking/plugins/releases/download/$CNI_VERSION"
          cni_filename="cni-plugins-linux-$arch-$CNI_VERSION.tgz"
          curl -Lfo "$cni_bin_dir/$cni_filename" "$cni_base_url/$cni_filename"
          cni_sum=$(curl -Lf "$cni_base_url/$cni_filename.sha256")
          cd "$cni_bin_dir"
          sha256sum -c <<<"$cni_sum"
          tar xvf "$cni_filename"
          rm -f "$cni_filename"
          cd -
          KUBE_VERSION="${KUBE_VERSION:-v1.16.2}"
          kube_dir="$opt_bin/kubernetes-$KUBE_VERSION"
          kube_base_url="https://storage.googleapis.com/kubernetes-release/release/$KUBE_VERSION/bin/linux/$arch"
          kube_sum_file="$kube_dir/sha256"
          mkdir -p "$kube_dir"
          : >"$kube_sum_file"

          for bin in kubelet kubeadm kubectl; do
              curl -Lfo "$kube_dir/$bin" "$kube_base_url/$bin"
              chmod +x "$kube_dir/$bin"
              sum=$(curl -Lf "$kube_base_url/$bin.sha256")
              echo "$sum  $kube_dir/$bin" >>"$kube_sum_file"
          done
          sha256sum -c "$kube_sum_file"

          for bin in kubelet kubeadm kubectl; do
              ln -sf "$kube_dir/$bin" "$opt_bin"/$bin
          done

          if [[ ! -x /opt/bin/health-monitor.sh ]]; then
              curl -Lfo /opt/bin/health-monitor.sh https://raw.githubusercontent.com/kubermatic/machine-controller/8b5b66e4910a6228dfaecccaa0a3b05ec4902f8e/pkg/userdata/scripts/health-monitor.sh
              chmod +x /opt/bin/health-monitor.sh
          fi
