apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  name: test-config
spec:
  osImageURL: registry.example.com/oscontainer@sha256:b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
  kernelArguments:
    - foo=bar
    - nosmt
  config:
    ignition:
      version: "2.2.0"
    storage:
      files:
        -
          contents:
            source: "data:,GROUP%3Dstable%0ASERVER%3Dhttp%3A%2F%2Flocalhost%3A32003%2Fv1%2Fupdate%0A"
            verification: {}
          filesystem: root
          mode: 420
          path: /etc/coreos/update.conf
    systemd:
      units:
        -
          dropins:
            -
              contents: |
                  [Service]
                  Environment="DOCKER_OPTS=--log-opt max-size=50m --log-opt max-file=3
              name: 10-dockeropts.conf
          enabled: true
          name: docker.service
        -
          contents: |
              [Unit]
              Description=etcd (System Application Container) TLS assets
              ConditionFileNotEmpty=|!/etc/ssl/etcd/system:etcd-server:my-test-cluster-etcd-{{.etcd_index}}.installer.team.coreos.systems.crt
              ConditionFileNotEmpty=|!/etc/ssl/etcd/system:etcd-server:my-test-cluster-etcd-{{.etcd_index}}.installer.team.coreos.systems.key
              ConditionFileNotEmpty=|!/etc/ssl/etcd/system:etcd-peer:my-test-cluster-etcd-{{.etcd_index}}.installer.team.coreos.systems.crt
              ConditionFileNotEmpty=|!/etc/ssl/etcd/system:etcd-peer:my-test-cluster-etcd-{{.etcd_index}}.installer.team.coreos.systems.key
              Requires=docker.service
              After=docker.service
              [Service]
              Type=oneshot
              RemainAfterExit=yes
              Environment="SIGNER_IMAGE=registry.svc.ci.openshift.org/openshift/origin-v4.0:kube-client-agent"
              ExecStart=/usr/bin/docker \
                run \
                  --rm \
                  --volume /etc/ssl/etcd:/etc/ssl/etcd:rw \
                "${SIGNER_IMAGE}" \
                  request \
                    --orgname=system:etcd-servers \
                    --cacrt=/etc/ssl/etcd/root-ca.crt \
                    --assetsdir=/etc/ssl/etcd \
                    --address=https://my-test-cluster-api.installer.team.coreos.systems:6443 \
                    --dnsnames=localhost,*.kube-etcd.kube-system.svc.cluster.local,kube-etcd-client.kube-system.svc.cluster.local,my-test-cluster-etcd-0.installer.team.coreos.systems,my-test-cluster-etcd-1.installer.team.coreos.systems,my-test-cluster-etcd-2.installer.team.coreos.systems \
                    --commonname=system:etcd-server:my-test-cluster-etcd-{{.etcd_index}}.installer.team.coreos.systems \
                    --ipaddrs=127.0.0.1 \
              ExecStart=/usr/bin/docker \
                run \
                  --rm \
                  --volume /etc/ssl/etcd:/etc/ssl/etcd:rw \
                "${SIGNER_IMAGE}" \
                  request \
                    --orgname=system:etcd-peers \
                    --cacrt=/etc/ssl/etcd/root-ca.crt \
                    --assetsdir=/etc/ssl/etcd \
                    --address=https://my-test-cluster-api.installer.team.coreos.systems:6443 \
                    --dnsnames=*.kube-etcd.kube-system.svc.cluster.local,kube-etcd-client.kube-system.svc.cluster.local,my-test-cluster-etcd-0.installer.team.coreos.systems,my-test-cluster-etcd-1.installer.team.coreos.systems,my-test-cluster-etcd-2.installer.team.coreos.systems \
                    --commonname=system:etcd-peer:my-test-cluster-etcd-{{.etcd_index}}.installer.team.coreos.systems \
              ExecStart=/bin/chown etcd:etcd /etc/ssl/etcd/system:etcd-server:my-test-cluster-etcd-{{.etcd_index}}.installer.team.coreos.systems.crt
              ExecStart=/bin/chown etcd:etcd /etc/ssl/etcd/system:etcd-server:my-test-cluster-etcd-{{.etcd_index}}.installer.team.coreos.systems.key
              ExecStart=/bin/chown etcd:etcd /etc/ssl/etcd/system:etcd-peer:my-test-cluster-etcd-{{.etcd_index}}.installer.team.coreos.systems.crt
              ExecStart=/bin/chown etcd:etcd /etc/ssl/etcd/system:etcd-peer:my-test-cluster-etcd-{{.etcd_index}}.installer.team.coreos.systems.key
          enabled: true
          name: etcd-member-tls.service
        -
          contents: |
              [Unit]
              Description=etcd (System Application Container)
              Documentation=https://github.com/coreos/etcd
              Requires=etcd-member-tls.service
              After=etcd-member-tls.service
              [Service]
              Restart=on-failure
              RestartSec=10s
              TimeoutStartSec=0
              LimitNOFILE=40000
              Environment="ETCD_IMAGE=quay.io/coreos/etcd:v3.3.10"
              ExecStartPre=-/usr/bin/docker rm etcd-member
              ExecStartPre=/usr/bin/mkdir --parents /var/lib/etcd
              ExecStartPre=/usr/bin/mkdir --parents /run/etcd
              ExecStartPre=/usr/bin/chown etcd /var/lib/etcd
              ExecStartPre=/usr/bin/chown etcd /run/etcd
              ExecStart= /usr/bin/bash -c " \
                  /usr/bin/docker \
                    run \
                      --rm \
                      --name etcd-member \
                      --volume /run/systemd/system:/run/systemd/system:ro \
                      --volume /etc/ssl/certs:/etc/ssl/certs:ro \
                      --volume /etc/ssl/etcd:/etc/ssl/etcd:ro \
                      --volume /var/lib/etcd:/var/lib/etcd:rw \
                      --volume /etc/ssl/certs:/etc/ssl/certs:ro \
                      --env 'ETCD_NAME=%m' \
                      --env ETCD_DATA_DIR=/var/lib/etcd \
                      --network host \
                      --user=$(id --user etcd) \
                    '${ETCD_IMAGE}' \
                      etcd \
                        --name=my-test-cluster-etcd-{{.etcd_index}}.installer.team.coreos.systems \
                        --advertise-client-urls=https://my-test-cluster-etcd-{{.etcd_index}}.installer.team.coreos.systems:2379 \
                        --cert-file=/etc/ssl/etcd/system:etcd-server:my-test-cluster-etcd-{{.etcd_index}}.installer.team.coreos.systems.crt \
                        --key-file=/etc/ssl/etcd/system:etcd-server:my-test-cluster-etcd-{{.etcd_index}}.installer.team.coreos.systems.key \
                        --trusted-ca-file=/etc/ssl/etcd/ca.crt \
                        --client-cert-auth=true \
                        --peer-cert-file=/etc/ssl/etcd/system:etcd-peer:my-test-cluster-etcd-{{.etcd_index}}.installer.team.coreos.systems.crt \
                        --peer-key-file=/etc/ssl/etcd/system:etcd-peer:my-test-cluster-etcd-{{.etcd_index}}.installer.team.coreos.systems.key \
                        --peer-trusted-ca-file=/etc/ssl/etcd/ca.crt \
                        --peer-client-cert-auth=true \
                        --initial-cluster='my-test-cluster-etcd-0.installer.team.coreos.systems=https://my-test-cluster-etcd-0.installer.team.coreos.systems:2380,my-test-cluster-etcd-1.installer.team.coreos.systems=https://my-test-cluster-etcd-1.installer.team.coreos.systems:2380,my-test-cluster-etcd-2.installer.team.coreos.systems=https://my-test-cluster-etcd-2.installer.team.coreos.systems:2380' \
                        --initial-advertise-peer-urls=https://my-test-cluster-etcd-{{.etcd_index}}.installer.team.coreos.systems:2380 \
                        --listen-client-urls=https://0.0.0.0:2379 \
                        --listen-peer-urls=https://0.0.0.0:2380 \
                  "
              [Install]
              WantedBy=multi-user.target
          enabled: true
          name: etcd-member.service
        -
          contents: |
              [Service]
              ExecStart=/usr/bin/env bash -c \
                " \
                  if grep rhcos /etc/os-release > /dev/null; \
                  then \
                    echo CGROUP_DRIVER_FLAG=--cgroup-driver=systemd > /etc/kubernetes/kubelet-workaround; \
                    mount -o remount,rw /sys/fs/cgroup; \
                    ln --symbolic /sys/fs/cgroup/cpu,cpuacct /sys/fs/cgroup/cpuacct,cpu; \
                  fi \
                "
          name: kubelet-workaround.service
        -
          contents: |
              [Unit]
              Description=Kubernetes Kubelet
              Wants=rpc-statd.service
              Requires=docker.service kubelet-workaround.service
              After=docker.service kubelet-workaround.service
              [Service]
              Environment="KUBELET_IMAGE=openshift/origin-node"
              EnvironmentFile=-/etc/kubernetes/kubelet-workaround
              ExecStartPre=/bin/mkdir --parents /etc/kubernetes/manifests
              ExecStartPre=/bin/mkdir --parents /etc/kubernetes/checkpoint-secrets
              ExecStartPre=/bin/mkdir --parents /etc/kubernetes/cni/net.d
              ExecStartPre=/bin/mkdir --parents /run/kubelet
              ExecStartPre=/bin/mkdir --parents /var/lib/cni
              ExecStartPre=/bin/mkdir --parents /var/lib/kubelet/pki
              ExecStartPre=/usr/bin/bash -c "gawk '/certificate-authority-data/ {print $2}' /etc/kubernetes/kubeconfig | base64 --decode > /etc/kubernetes/ca.crt"
              ExecStart=/usr/bin/docker \
                run \
                  --rm \
                  --net host \
                  --pid host \
                  --privileged \
                  --volume /dev:/dev:rw \
                  --volume /sys:/sys:ro \
                  --volume /var/run:/var/run:rw \
                  --volume /var/lib/cni/:/var/lib/cni:rw \
                  --volume /var/lib/docker/:/var/lib/docker:rw \
                  --volume /var/lib/kubelet/:/var/lib/kubelet:shared \
                  --volume /var/log:/var/log:shared \
                  --volume /etc/kubernetes:/etc/kubernetes:ro \
                  --entrypoint /usr/bin/hyperkube \
                "${KUBELET_IMAGE}" \
                  kubelet \
                    --bootstrap-kubeconfig=/etc/kubernetes/kubeconfig \
                    --kubeconfig=/var/lib/kubelet/kubeconfig \
                    --rotate-certificates \
                    --cni-conf-dir=/etc/kubernetes/cni/net.d \
                    --cni-bin-dir=/var/lib/cni/bin \
                    --network-plugin=cni \
                    --lock-file=/var/run/lock/kubelet.lock \
                    --exit-on-lock-contention \
                    --pod-manifest-path=/etc/kubernetes/manifests \
                    --node-labels=node-role.kubernetes.io/etcd \
                    --minimum-container-ttl-duration=6m0s \
                    --cluster-dns=10.3.0.10 \
                    --cluster-domain=cluster.local \
                    --cloud-provider=aws \
                     \
                    --register-with-taints=node-role.kubernetes.io/etcd=:NoSchedule \
                    $CGROUP_DRIVER_FLAG
              Restart=always
              RestartSec=10
              [Install]
              WantedBy=multi-user.target
          enabled: true
          name: kubelet.service
        -
          mask: true
          name: locksmith.service
