filesystem: "root"
mode: 0644
path: "/usr/local/share/openshift-recovery/template/kube-etcd-cert-signer.yaml.template"
contents:
  inline: |
    apiVersion: v1
    kind: Pod 
    metadata:
      name: etcd-signer
      namespace: openshift-config
      labels:
        k8s-app: etcd
    spec:
      containers:
      - name: etcd-signer
        image: "__KUBE_ETCD_SIGNER_SERVER__"
        command:
        - /bin/sh
        - -c
        - | 
          #!/bin/sh
          set -euox pipefail
    
          source /run/etcd/environment
    
          exec kube-etcd-signer-server serve \
            --cacrt=/etc/ssl/etcd/signer/tls.crt \
            --cakey=/etc/ssl/etcd/signer/tls.key \
            --metric-cacrt=/etc/ssl/etcd/metric-signer/tls.crt \
            --metric-cakey=/etc/ssl/etcd/metric-signer/tls.key \
            --servcrt=/etc/ssl/etcd/system:etcd-server:${ETCD_DNS_NAME}.crt \
            --servkey=/etc/ssl/etcd/system:etcd-server:${ETCD_DNS_NAME}.key \
            --address=0.0.0.0:9943 \
            --csrdir=/tmp \
            --peercertdur=26280h \
            --servercertdur=26280h \
            --metriccertdur=26280h
        resources:
          requests:
            memory: 600Mi
            cpu: 300m
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - name: discovery
          mountPath: /run/etcd/
        - name: etcd-certs
          mountPath: /etc/ssl/etcd/
        - name: etcd-signer
          mountPath: /etc/ssl/etcd/signer
        - name: etcd-metric-signer
          mountPath: /etc/ssl/etcd/metric-signer
        ports:
        - name: server
          containerPort: 9943
          protocol: TCP 
        securityContext:
          privileged: true
      hostNetwork: true
      nodeSelector:
        kubernetes.io/hostname: "__MASTER_HOSTNAME__"
      priorityClassName: system-node-critical
      tolerations:
      - operator: "Exists"
      restartPolicy: Always
      volumes:
      - name: etcd-certs
        hostPath:
          path: /etc/kubernetes/static-pod-resources/etcd-member
      - name: discovery
        hostPath:
          path: /run/etcd
      - name: etcd-signer
        secret:
          secretName: etcd-signer
      - name: etcd-metric-signer
        secret:
          secretName: etcd-metric-signer
