gcp.yaml

tosca_definitions_version: cloudify_dsl_1_3

description: >
  This Blueprint installs the nodecellar application behind
  an haproxy instance on an openstack cloud environment.

imports:
  - http://www.getcloudify.org/spec/cloudify/4.3/types.yaml
  - plugin:cloudify-diamond-plugin
  - plugin:cloudify-fabric-plugin
  - plugin:cloudify-utilities-plugin
  - plugin:cloudify-gcp-plugin
  - imports/kubernetes.yaml

inputs:

  client_x509_cert_url:
    type: string
    default: { get_secret: client_x509_cert_url }

  client_email:
    type: string
    default: { get_secret: client_email }

  client_id:
    type: string
    default: { get_secret: client_id }

  project_id:
    type: string
    default: { get_secret: project_id }

  private_key_id:
    type: string
    default: { get_secret: private_key_id }

  private_key:
    type: string
    default: { get_secret: private_key }

  zone:
    type: string
    default: { get_secret: zone }

  region:
    type: string
    default: { get_secret: region }

  image:
    description: >
      A GCE Image ID. Tested with a Ubuntu 14.04 image.
    default: { get_secret: centos_core_image }

  instance_type:
    description: >
      A GCE instance sytpe.
    default: { get_secret: small_instance_type }

  agent_user:
    description: The user name of the agent on the instance created from the image.
    default: docker

  resource_prefix:
    default: cfyk8s

  node_firewall_name:
    description: >
      The resource id of the node security group

  ssh_firewall_name:
    description: >
      The resource id of the ssh security group

dsl_definitions:

  client_config: &gcp_config
    auth:
      type: service_account
      auth_uri: https://accounts.google.com/o/oauth2/auth
      token_uri: https://accounts.google.com/o/oauth2/token
      auth_provider_x509_cert_url: https://www.googleapis.com/oauth2/v1/certs
      client_x509_cert_url: { get_input: client_x509_cert_url }
      client_email: { get_input: client_email }
      client_id: { get_input: client_id }
      project_id: { get_input: project_id }
      private_key_id: { get_input: private_key_id }
      private_key: { get_input: private_key }
    project: { get_input: project_id }
    zone: { get_input: zone }

node_templates:

  k8s_node_host:
    type: cloudify.gcp.nodes.Instance
    properties:
      gcp_config: *gcp_config
      agent_config:
        install_method: remote
        user: { get_input: agent_user }
        port: 22
        key: { get_secret: agent_key_private }
      image_id: { get_input: image }
      instance_type: { get_input: instance_type }
      zone: { get_input: zone }
      external_ip: true
      block_project_ssh_keys: true
      startup_script: &install_kubernetes
        type: string
        script:
          concat:
            - |
              cat <<EOF > /etc/yum.repos.d/docker.repo
              [dockerrepo]
              name=Docker Repository
              baseurl=https://yum.dockerproject.org/repo/main/centos/7
              enabled=1
              gpgcheck=1
              gpgkey=https://yum.dockerproject.org/gpg
              EOF
            - |
              cat <<EOF > /etc/yum.repos.d/kubernetes.repo
              [kubernetes]
              name=Kubernetes
              baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64
              enabled=1
              gpgcheck=1
              repo_gpgcheck=1
              gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg
                      https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
              EOF
              setenforce 0
            - |
              yum -t -y install docker-engine-1.13.1 kubelet-1.9.6-0 kubeadm-1.9.6-0 kubectl-1.9.6-0 kubernetes-cni-0.6.0-0 ca-certificates
              update-ca-trust force-enable
              swapon -s | awk '{print "sudo swapoff " $1}' | grep -v "Filename" | sh -
              sed -i 's|cgroup-driver=systemd|cgroup-driver=systemd --provider-id='`hostname`'|g' /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
              sed -i 's|/usr/bin/dockerd|/usr/bin/dockerd --exec-opt native.cgroupdriver=systemd|g' /usr/lib/systemd/system/docker.service
              systemctl enable docker && systemctl start docker
              systemctl enable kubelet && systemctl start kubelet
              iptables --flush
              iptables -tnat --flush
              mkdir -p /tmp/data
              chcon -Rt svirt_sandbox_file_t /tmp/data
    relationships:
      - type: cloudify.relationships.depends_on
        target: subnetwork
      - type: cloudify.gcp.relationships.instance_connected_to_security_group
        target: kubernetes_fw
    interfaces:
      cloudify.interfaces.lifecycle:
        create:
          implementation: scripts/gcp/instance_ssh_key.py
          executor: central_deployment_agent
          inputs:
            user: { get_input: agent_user }
            ssh_keys:
            - { get_secret: agent_key_public }

  kubernetes_fw:
    type: cloudify.gcp.nodes.FirewallRule
    properties:
      gcp_config: *gcp_config
      use_external_resource: true
      name: { get_input: node_firewall_name }
      resource_id: { get_input: node_firewall_name }
      sources:
        - 0.0.0.0/0
      allowed:
        tcp:
          - 53
          - 80
          - 179
          - 443
          - 2379
          - 4001
          - 4789
          - 6443
          - 6666
          - 6783
          - 6784
          - 8080
          - 9090
          - 10250
        udp:
          - 53
          - 6443
          - 6783
          - 6784
          - 8285
          - 8472
    relationships:
      - type: cloudify.relationships.connected_to
        target: network

  ssh_fw:
    type: cloudify.gcp.nodes.FirewallRule
    properties:
      gcp_config: *gcp_config
      use_external_resource: true
      name: { get_input: ssh_firewall_name }
      resource_id: { get_input: ssh_firewall_name }
      sources:
        - 0.0.0.0/0
      allowed:
        tcp:
          - 22
    relationships:
      - type: cloudify.relationships.connected_to
        target: network

  subnetwork:
    type: cloudify.gcp.nodes.SubNetwork
    properties:
      use_external_resource: true
      name: { get_secret: management_subnetwork_name }
      region: { get_secret: region }
      gcp_config: *gcp_config
    relationships:
      - type: cloudify.gcp.relationships.contained_in_network
        target: network

  network:
    type: cloudify.gcp.nodes.Network
    properties:
      use_external_resource: true
      name: { get_secret: management_network_name }
      gcp_config: *gcp_config

groups:
  k8s_node_group:
    members:
      - k8s_node_host

policies:
  kubernetes_node_vms_scaling_policy:
    type: cloudify.policies.scaling
    properties:
      default_instances:  1
    targets: [k8s_node_group]

outputs:
  deployment-type:
    description: Deployment Type, Needed In order to determine if the kubernetes host is normal node or load balancer
    value: node

  deployment-node-data-type:
    description: Cloudify node type needed in kubernetes cloudify provider
    value: cloudify.nodes.ApplicationServer.kubernetes.Node