Deploy ingress, lego and dashboard

roles/kubernetes-dashboard/defaults/main.yml

@@ -0,0 +1,15 @@
+---
+# set basic_auth_user as non-empty to enforce basic auth
+basic_auth_user: ""
+basic_auth_password: ""
+
+# e.g. the fqdn would be k8s.yourdomain.tld if
+#   dashboard_subdomain=k8s
+#   scaleway_reverse_ipaddr=yourdomain.tld
+dashboard_subdomain: k8s
+
+dashboard_image: gcr.io/google_containers/kubernetes-dashboard-amd64
+dashboard_version: v1.10.0
+
+init_dashboard_image: gcr.io/google_containers/kubernetes-dashboard-init-amd64
+init_dashboard_version: v1.0.1

roles/kubernetes-dashboard/files/dashboard-clusterrolebinding.yml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: kubernetes-dashboard-crb
+roleRef:
+  apiGroup: ""
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: kubernetes-dashboard
+    namespace: kube-system

roles/kubernetes-dashboard/files/dashboard-role.yml

@@ -0,0 +1,20 @@
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: kubernetes-dashboard-minimal
+  namespace: kube-system
+rules:
+  # Allow Dashboard to create and watch for changes of 'kubernetes-dashboard-key-holder' secret.
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["create", "watch"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  # Allow Dashboard to get, update and delete 'kubernetes-dashboard-key-holder' secret.
+  resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]
+  verbs: ["get", "update", "delete"]
+  # Allow Dashboard to get metrics from heapster.
+- apiGroups: [""]
+  resources: ["services"]
+  resourceNames: ["heapster"]
+  verbs: ["proxy"]

roles/kubernetes-dashboard/files/dashboard-rolebinding.yml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: kubernetes-dashboard-minimal
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubernetes-dashboard-minimal
+subjects:
+- kind: ServiceAccount
+  name: kubernetes-dashboard
+  namespace: kube-system

roles/kubernetes-dashboard/files/dashboard-sa.yml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kube-system

roles/kubernetes-dashboard/files/dashboard-secret.yml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard-certs
+  namespace: kube-system
+type: Opaque

roles/kubernetes-dashboard/files/dashboard-service.yml

@@ -0,0 +1,13 @@
+kind: Service
+apiVersion: v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kube-system
+spec:
+  ports:
+    - port: 80
+      targetPort: 9090
+  selector:
+    k8s-app: kubernetes-dashboard

roles/kubernetes-dashboard/files/heapster-clusterrolebinding.yml

@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: heapster
+  labels:
+    k8s-addon: monitoring-standalone.addons.k8s.io
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:heapster
+subjects:
+- kind: ServiceAccount
+  name: heapster
+  namespace: kube-system

roles/kubernetes-dashboard/files/heapster-deployment.yml

@@ -0,0 +1,77 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: heapster
+  namespace: kube-system
+  labels:
+    k8s-addon: monitoring-standalone.addons.k8s.io
+    k8s-app: heapster
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
+    version: v1.7.0
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      k8s-app: heapster
+      version: v1.7.0
+  template:
+    metadata:
+      labels:
+        k8s-app: heapster
+        version: v1.7.0
+      annotations:
+        scheduler.alpha.kubernetes.io/critical-pod: ''
+    spec:
+      serviceAccountName: heapster
+      containers:
+        - image: gcr.io/google_containers/heapster:v1.4.0
+          name: heapster
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8082
+              scheme: HTTP
+            initialDelaySeconds: 180
+            timeoutSeconds: 5
+          resources:
+            # keep request = limit to keep this container in guaranteed class
+            limits:
+              cpu: 100m
+              memory: 300Mi
+            requests:
+              cpu: 100m
+              memory: 300Mi
+          command:
+            - /heapster
+            - --source=kubernetes.summary_api:''
+        - image: gcr.io/google_containers/addon-resizer:2.0
+          name: heapster-nanny
+          resources:
+            limits:
+              cpu: 50m
+              memory: 100Mi
+            requests:
+              cpu: 50m
+              memory: 100Mi
+          env:
+            - name: MY_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: MY_POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+          command:
+            - /pod_nanny
+            - --cpu=80m
+            - --extra-cpu=0.5m
+            - --memory=140Mi
+            - --extra-memory=4Mi
+            - --deployment=heapster
+            - --container=heapster
+            - --poll-period=300000
+      tolerations:
+        - key: "CriticalAddonsOnly"
+          operator: "Exists"      

roles/kubernetes-dashboard/files/heapster-role.yml

@@ -0,0 +1,24 @@
+# Heapster's pod_nanny monitors the heapster deployment & its pod(s), and scales
+# the resources of the deployment if necessary.
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: Role
+metadata:
+  name: system:pod-nanny
+  namespace: kube-system
+  labels:
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+- apiGroups:
+  - "extensions"
+  resources:
+  - deployments
+  verbs:
+  - get
+  - update

roles/kubernetes-dashboard/files/heapster-rolebinding.yml

@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: heapster-binding
+  namespace: kube-system
+  labels:
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: system:pod-nanny
+subjects:
+- kind: ServiceAccount
+  name: heapster
+  namespace: kube-system

roles/kubernetes-dashboard/files/heapster-sa.yml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: heapster
+  namespace: kube-system
+  labels:
+    k8s-addon: monitoring-standalone.addons.k8s.io

roles/kubernetes-dashboard/files/heapster-service.yml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: heapster
+  namespace: kube-system
+  labels:
+    k8s-addon: monitoring-standalone.addons.k8s.io
+    kubernetes.io/name: "Heapster"
+    kubernetes.io/cluster-service: "true"
+spec:
+  ports:
+    - port: 80
+      targetPort: 8082
+  selector:
+    k8s-app: heapster

roles/kubernetes-dashboard/tasks/main.yml

@@ -0,0 +1,105 @@
+---
+- block:
+  - name: Installing python-passlib
+    apt:
+      name: python-passlib
+      state: latest
+    register: result
+    retries: 3
+    until: result is success
+
+  - name: Creating htpasswd file if k8s has basic auth
+    htpasswd:
+      path: /tmp/auth
+      name: "{{ basic_auth_user }}"
+      password: "{{ basic_auth_password }}"
+    when: inventory_hostname == initial_master
+
+  - name: Getting secrets
+    command: kubectl get secrets --namespace=kube-system
+    register: secrets
+    when: inventory_hostname == initial_master
+
+  - name: Creating secret
+    command: kubectl create secret generic dashboard-basic-auth --namespace=kube-system --from-file=/tmp/auth
+    when:
+      - inventory_hostname == initial_master
+      - '"dashboard-basic-auth" not in secrets.stdout'
+
+  - name: Deleting basic_auth file
+    file:
+      path: /tmp/auth
+      state: absent
+    when: inventory_hostname == initial_master
+
+  when: basic_auth_user | length > 0
+
+- name: Templating manifests
+  template: 
+    src: "{{ item }}"
+    dest: "/tmp/{{ item | regex_replace('.j2', '') }}"
+  with_items:
+    - dashboard-ingress.yml.j2
+    - dashboard-deployment.yml.j2
+  when: inventory_hostname == initial_master
+
+- name: Copying manifests files
+  copy:
+    src: "{{ item }}"
+    dest: "/tmp/{{ item }}"
+  with_items:
+    - dashboard-rolebinding.yml
+    - dashboard-role.yml
+    - dashboard-sa.yml
+    - dashboard-clusterrolebinding.yml
+    - dashboard-secret.yml
+    - dashboard-service.yml
+    - heapster-rolebinding.yml
+    - heapster-clusterrolebinding.yml
+    - heapster-role.yml
+    - heapster-sa.yml
+    - heapster-service.yml
+    - heapster-deployment.yml
+  when: inventory_hostname == initial_master
+
+- name: Deploying kubernetes-dashboard
+  kube:
+    name: "{{ item.name }}"
+    resource: "{{ item.type }}"
+    filename: "{{ item.file }}"
+    state: latest
+  with_items:
+    - { 'name': 'kubernetes-dashboard', 'type': 'sa', 'file': '/tmp/dashboard-sa.yml' }
+    - { 'name': 'kubernetes-dashboard', 'type': 'clusterrolebinding', 'file': '/tmp/dashboard-clusterrolebinding.yml' }
+    - { 'name': 'kubernetes-dashboard', 'type': 'secret', 'file': '/tmp/dashboard-secret.yml' }
+    - { 'name': 'kubernetes-dashboard', 'type': 'service', 'file': '/tmp/dashboard-service.yml' }
+    - { 'name': 'kubernetes-dashboard', 'type': 'deployment', 'file': '/tmp/dashboard-deployment.yml' }
+    - { 'name': 'kubernetes-dashboard', 'type': 'ingress', 'file': '/tmp/dashboard-ingress.yml' }
+    - { 'name': 'heapster', 'type': 'sa', 'file': '/tmp/heapster-sa.yml' }
+    - { 'name': 'heapster', 'type': 'clusterrolebinding', 'file': '/tmp/heapster-clusterrolebinding.yml' }
+    - { 'name': 'heapster', 'type': 'rolebinding', 'file': '/tmp/heapster-rolebinding.yml' }
+    - { 'name': 'heapster', 'type': 'role', 'file': '/tmp/heapster-role.yml' }
+    - { 'name': 'heapster', 'type': 'service', 'file': '/tmp/heapster-service.yml' }
+    - { 'name': 'heapster', 'type': 'deployment', 'file': '/tmp/heapster-deployment.yml' }
+  when: inventory_hostname == initial_master
+
+- name: Removing manifest
+  file:
+    path: "/tmp/{{ item }}"
+    state: absent
+  with_items:
+    - dashboard-ingress.yml.j2
+    - dashboard-deployment.yml.j2
+    - dashboard-clusterrolebinding.yml
+    - dashboard-rolebinding.yml
+    - dashboard-role.yml
+    - dashboard-sa.yml
+    - dashboard-secret.yml
+    - dashboard-service.yml
+    - heapster-rolebinding.yml
+    - heapster-clusterrolebinding.yml
+    - heapster-role.yml
+    - heapster-sa.yml
+    - heapster-service.yml
+    - heapster-deployment.yml
+  when: inventory_hostname == initial_master

roles/kubernetes-dashboard/templates/dashboard-deployment.yml.j2

@@ -0,0 +1,47 @@
+kind: Deployment
+apiVersion: extensions/v1beta1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kube-system
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      k8s-app: kubernetes-dashboard
+  template:
+    metadata:
+      labels:
+        k8s-app: kubernetes-dashboard
+    spec:
+      containers:
+      - name: kubernetes-dashboard
+        image: {{ dashboard_image }}:{{ dashboard_version }}
+        ports:
+        - containerPort: 9090
+          protocol: TCP
+        args:
+          # Uncomment the following line to manually specify Kubernetes API server Host
+          # If not specified, Dashboard will attempt to auto discover the API server and connect
+          # to it. Uncomment only if the default does not work.
+          # - --apiserver-host=http://my-address:port
+        volumeMounts:
+          # Create on-disk volume to store exec logs
+        - mountPath: /tmp
+          name: tmp-volume
+        livenessProbe:
+          httpGet:
+            path: /
+            port: 9090
+          initialDelaySeconds: 30
+          timeoutSeconds: 30
+      volumes:
+      - name: tmp-volume
+        emptyDir: {}
+      serviceAccountName: kubernetes-dashboard
+      # Comment the following tolerations if Dashboard must not be deployed on master
+      tolerations:
+      - key: node-role.kubernetes.io/master
+        effect: NoSchedule

roles/kubernetes-dashboard/templates/dashboard-ingress.yml.j2

@@ -0,0 +1,30 @@
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  namespace: kube-system
+  name: kubernetes-dashboard
+  annotations:
+    # enable kube-lego for this ingress
+    kubernetes.io/tls-acme: "true"
+    {% if basic_auth_user | length > 0 %}
+ingress.kubernetes.io/auth-type: basic
+    # name of the secret that contains the user/password definitions
+    ingress.kubernetes.io/auth-secret: dashboard-basic-auth
+    # message to display with an appropiate context why the authentication is required
+    ingress.kubernetes.io/auth-realm: "Authentication is required to access the k8s dashboard "
+    {% endif %}
+
+spec:
+  # this enables tls for the specified domain names
+  tls:
+  - hosts:
+    - {{ dashboard_subdomain }}.{{ scaleway_reverse_ipaddr }}
+    secretName: dashboard-tls
+  rules:
+  - host: {{ dashboard_subdomain }}.{{ scaleway_reverse_ipaddr }}
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: kubernetes-dashboard
+          servicePort: 80