azure-blueprint.yaml

tosca_definitions_version: cloudify_dsl_1_3

description: >
  This blueprint creates a Kubernetes Cluster.
  It is based on this documentation: https://kubernetes.io/docs/getting-started-guides/kubeadm/

# Several lines are commented. Currently there is not a Centos 7 image that supports Cloud Init. When there is, we will replace the current docker/kubernetes installation method with the commented lines.

imports:
  - http://www.getcloudify.org/spec/cloudify/4.0.1/types.yaml
  - https://raw.githubusercontent.com/cloudify-cosmo/cloudify-azure-plugin/1.4.3/plugin.yaml
  - http://www.getcloudify.org/spec/diamond-plugin/1.3.5/plugin.yaml
  - types/scale.yaml
#  - types/cloud_config/cloud-config.yaml
  - types/kubernetes.yaml
  - imports/kubernetes.yaml
#  - imports/cloud-config.yaml

inputs:

  resource_prefix:
    default: k8s

  resource_suffix:
    default: '0'

  retry_after:
    type: integer
    default: 60

  size:
    default: Standard_A3

  image:
    default:
      publisher: OpenLogic
      offer: CentOS
      sku: '7.3'
      version: latest

  agent_user:
    description: The user name of the agent on the instance created from the image.
    default: docker # currently this is required

  ssh_public_keys:
    description: the public key
    default:
    - path: {concat:[ '/home/', { get_input: agent_user }, '/.ssh/authorized_keys' ]}
      keyData: { get_secret: agent_key_public }

  encode_cloud_config:
    default: true

dsl_definitions:

  azure_config: &azure_config
    subscription_id: { get_secret: subscription_id }
    tenant_id: { get_secret: tenant_id }
    client_id: { get_secret: client_id }
    client_secret: { get_secret: client_secret }

node_templates:

  kubernetes_master_docker:
    type: cloudify.azure.nodes.compute.VirtualMachineExtension
    properties:
      location: { get_secret: location }
      retry_after: { get_input: retry_after }
      azure_config: *azure_config
    interfaces:
      cloudify.interfaces.lifecycle:
        create:
          inputs:
            resource_config:
              publisher: Microsoft.Azure.Extensions
              type: CustomScript
              typeHandlerVersion: '2.0'
              autoUpgradeMinorVersion: true
              settings:
                commandToExecute:
                  concat:
                    - |
                      cat <<EOF > /etc/yum.repos.d/kubernetes.repo
                      [kubernetes]
                      name=Kubernetes
                      baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64
                      enabled=1
                      gpgcheck=1
                      repo_gpgcheck=1
                      gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg
                              https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
                      EOF
                      setenforce 0
                    - |
                      yum -t -y install docker-1.12.6-28.git1398f24.el7.centos kubelet-1.6.4-0 kubeadm-1.6.4-0 kubectl-1.6.4-0 kubernetes-cni-0.5.1-0
                      systemctl enable docker && systemctl start docker
                      systemctl enable kubelet && systemctl start kubelet
    relationships:
    - type: cloudify.azure.relationships.vmx_contained_in_vm
      target: kubernetes_master_host

  kubernetes_node_docker:
    type: cloudify.azure.nodes.compute.VirtualMachineExtension
    properties:
      location: { get_secret: location }
      retry_after: { get_input: retry_after }
      azure_config: *azure_config
    interfaces:
      cloudify.interfaces.lifecycle:
        create:
          inputs:
            resource_config:
              publisher: Microsoft.Azure.Extensions
              type: CustomScript
              typeHandlerVersion: '2.0'
              autoUpgradeMinorVersion: true
              settings:
                commandToExecute:
                  concat:
                    - |
                      cat <<EOF > /etc/yum.repos.d/kubernetes.repo
                      [kubernetes]
                      name=Kubernetes
                      baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64
                      enabled=1
                      gpgcheck=1
                      repo_gpgcheck=1
                      gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg
                              https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
                      EOF
                      setenforce 0
                    - |
                      yum -t -y install docker-1.12.6-28.git1398f24.el7.centos kubelet-1.6.4-0 kubeadm-1.6.4-0 kubectl-1.6.4-0 kubernetes-cni-0.5.1-0
                      systemctl enable docker && systemctl start docker
                      systemctl enable kubelet && systemctl start kubelet
    relationships:
    - type: cloudify.azure.relationships.vmx_contained_in_vm
      target: kubernetes_node_host

  kubernetes_master_host:
    type: cloudify.azure.nodes.compute.VirtualMachine
    properties:
      location: { get_secret: location }
      retry_after: { get_input: retry_after }
      os_family: linux
      azure_config: *azure_config
      resource_config:
        hardwareProfile: {}
        storageProfile: {}
        osProfile: {}
      agent_config:
        user: { get_input: agent_user }
        install_method: remote
        port: 22
        key: { get_secret: agent_key_private }
    relationships:
    - type: cloudify.azure.relationships.contained_in_resource_group
      target: resource_group
    - type: cloudify.azure.relationships.connected_to_storage_account
      target: storage_account
    - type: cloudify.azure.relationships.connected_to_availability_set
      target: availability_set
    - type: cloudify.azure.relationships.connected_to_nic
      target: kubernetes_master_host_nic
    interfaces:
      cloudify.interfaces.lifecycle:
        create:
          implementation: pkg.cloudify_azure.resources.compute.virtualmachine.create
          inputs:
            args:
              hardwareProfile:
                vmSize: { get_input: size }
              storageProfile:
                imageReference: { get_input: image}
              osProfile:
                adminUsername: { get_input: agent_user }
                adminPassword: ''
                # customData: { get_attribute: [ cloudify_host_cloud_config, cloud_config ] }
                linuxConfiguration:
                  ssh:
                    publicKeys: { get_input: ssh_public_keys }
                  disablePasswordAuthentication: true

  kubernetes_node_host:
    type: cloudify.azure.nodes.compute.VirtualMachine
    properties:
      location: { get_secret: location }
      retry_after: { get_input: retry_after }
      os_family: linux
      azure_config: *azure_config
      resource_config:
        hardwareProfile: {}
        storageProfile: {}
        osProfile: {}
      agent_config:
        user: { get_input: agent_user }
        install_method: remote
        port: 22
        key: { get_secret: agent_key_private }
    relationships:
    - type: cloudify.azure.relationships.contained_in_resource_group
      target: resource_group
    - type: cloudify.azure.relationships.connected_to_storage_account
      target: storage_account
    - type: cloudify.azure.relationships.connected_to_availability_set
      target: availability_set
    - type: cloudify.azure.relationships.connected_to_nic
      target: kubernetes_node_host_nic
    interfaces:
      cloudify.interfaces.lifecycle:
        create:
          implementation: pkg.cloudify_azure.resources.compute.virtualmachine.create
          inputs:
            args:
              hardwareProfile:
                vmSize: { get_input: size }
              storageProfile:
                imageReference: { get_input: image}
              osProfile:
                adminUsername: { get_input: agent_user }
                adminPassword: ''
#                customData: { get_attribute: [ cloudify_host_cloud_config, cloud_config ] }
                linuxConfiguration:
                  ssh:
                    publicKeys: { get_input: ssh_public_keys }
                  disablePasswordAuthentication: true
      cloudify.interfaces.monitoring_agent:
        install:
          implementation: diamond.diamond_agent.tasks.install
          inputs:
            diamond_config:
              interval: 1
        start: diamond.diamond_agent.tasks.start
        stop: diamond.diamond_agent.tasks.stop
        uninstall: diamond.diamond_agent.tasks.uninstall
      cloudify.interfaces.monitoring:
        start:
          implementation: diamond.diamond_agent.tasks.add_collectors
          inputs:
            collectors_config:
              ProcessResourcesCollector:
                config:
                  enabled: true
                  unit: B
                  measure_collector_time: true
                  cpu_interval: 0.5
                  process:
                    hyperkube:
                      name: hyperkube

  network_security_group:
    type: cloudify.azure.nodes.network.NetworkSecurityGroup
    properties:
      name: {concat:[{get_input: resource_prefix},nsg,{get_input: resource_suffix}]}
      location: { get_secret: location }
      azure_config: *azure_config
      retry_after: { get_input: retry_after }
      resource_config:
        securityRules:
        - name: {concat:[{get_input: resource_prefix},nsg,{get_input: resource_suffix},ssh]}
          properties:
            description: SSH access
            protocol: Tcp
            sourcePortRange: '*'
            destinationPortRange: 22
            sourceAddressPrefix: '*'
            destinationAddressPrefix: '*'
            priority: 102
            access: Allow
            direction: Inbound
        - name: {concat:[{get_input: resource_prefix},nsg,{get_input: resource_suffix},udp]}
          properties:
            description: 53 UDP access
            protocol: Udp
            sourcePortRange: '*'
            destinationPortRange: 53
            sourceAddressPrefix: '*'
            destinationAddressPrefix: '*'
            priority: 103
            access: Allow
            direction: Inbound
        - name: {concat:[{get_input: resource_prefix},nsg,{get_input: resource_suffix},tcp53]}
          properties:
            description: 53 TCP access
            protocol: Tcp
            sourcePortRange: '*'
            destinationPortRange: 53
            sourceAddressPrefix: '*'
            destinationAddressPrefix: '*'
            priority: 104
            access: Allow
            direction: Inbound
        - name: {concat:[{get_input: resource_prefix},nsg,{get_input: resource_suffix},http]}
          properties:
            description: HTTP access
            protocol: Tcp
            sourcePortRange: '*'
            destinationPortRange: 80
            sourceAddressPrefix: '*'
            destinationAddressPrefix: '*'
            priority: 105
            access: Allow
            direction: Inbound
        - name: {concat:[{get_input: resource_prefix},nsg,{get_input: resource_suffix},https]}
          properties:
            description: HTTPS access
            protocol: Tcp
            sourcePortRange: '*'
            destinationPortRange: 443
            sourceAddressPrefix: '*'
            destinationAddressPrefix: '*'
            priority: 106
            access: Allow
            direction: Inbound
        - name: {concat:[{get_input: resource_prefix},nsg,{get_input: resource_suffix},2379tcp]}
          properties:
            description: 2379 TCP access
            protocol: Tcp
            sourcePortRange: '*'
            destinationPortRange: 2379
            sourceAddressPrefix: '*'
            destinationAddressPrefix: '*'
            priority: 107
            access: Allow
            direction: Inbound
        - name: {concat:[{get_input: resource_prefix},nsg,{get_input: resource_suffix},4001tcp]}
          properties:
            description: 4001 TCP access
            protocol: Tcp
            sourcePortRange: '*'
            destinationPortRange: 4001
            sourceAddressPrefix: '*'
            destinationAddressPrefix: '*'
            priority: 108
            access: Allow
            direction: Inbound
        - name: {concat:[{get_input: resource_prefix},nsg,{get_input: resource_suffix},6443tcp]}
          properties:
            description: 6443 TCP access
            protocol: Tcp
            sourcePortRange: '*'
            destinationPortRange: 6443
            sourceAddressPrefix: '*'
            destinationAddressPrefix: '*'
            priority: 109
            access: Allow
            direction: Inbound
        - name: {concat:[{get_input: resource_prefix},nsg,{get_input: resource_suffix},8000tcp]}
          properties:
            description: 8000 TCP access
            protocol: Tcp
            sourcePortRange: '*'
            destinationPortRange: 8000
            sourceAddressPrefix: '*'
            destinationAddressPrefix: '*'
            priority: 110
            access: Allow
            direction: Inbound
        - name: {concat:[{get_input: resource_prefix},nsg,{get_input: resource_suffix},http8080]}
          properties:
            description: 8080 TCP access
            protocol: Tcp
            sourcePortRange: '*'
            destinationPortRange: 8080
            sourceAddressPrefix: '*'
            destinationAddressPrefix: '*'
            priority: 111
            access: Allow
            direction: Inbound
        - name: {concat:[{get_input: resource_prefix},nsg,{get_input: resource_suffix},9090tcp]}
          properties:
            description: 9090 TCP access
            protocol: Tcp
            sourcePortRange: '*'
            destinationPortRange: 9090
            sourceAddressPrefix: '*'
            destinationAddressPrefix: '*'
            priority: 112
            access: Allow
            direction: Inbound
        - name: {concat:[{get_input: resource_prefix},nsg,{get_input: resource_suffix},10250tcp]}
          properties:
            description: 10250 TCP access
            protocol: Tcp
            sourcePortRange: '*'
            destinationPortRange: 10250
            sourceAddressPrefix: '*'
            destinationAddressPrefix: '*'
            priority: 113
            access: Allow
            direction: Inbound
    relationships:
    - type: cloudify.azure.relationships.contained_in_resource_group
      target: resource_group

  availability_set:
    type: cloudify.azure.nodes.compute.AvailabilitySet
    properties:
      name: {concat:[{get_input: resource_prefix},availset,{get_input: resource_suffix}]}
      location: { get_secret: location }
      azure_config: *azure_config
      retry_after: { get_input: retry_after }
    relationships:
    - type: cloudify.azure.relationships.contained_in_resource_group
      target: resource_group

  kubernetes_node_host_nic:
    type: cloudify.azure.nodes.network.NetworkInterfaceCard
    properties:
      location: { get_secret: location }
      azure_config: *azure_config
      retry_after: { get_input: retry_after }
    relationships:
    - type: cloudify.azure.relationships.contained_in_resource_group
      target: resource_group
    - type: cloudify.azure.relationships.nic_connected_to_network_security_group
      target: network_security_group
    - type: cloudify.azure.relationships.nic_connected_to_ip_configuration
      target: kubernetes_node_host_nic_ip_cfg

  kubernetes_master_host_nic:
    type: cloudify.azure.nodes.network.NetworkInterfaceCard
    properties:
      location: { get_secret: location }
      azure_config: *azure_config
      retry_after: { get_input: retry_after }
    relationships:
    - type: cloudify.azure.relationships.contained_in_resource_group
      target: resource_group
    - type: cloudify.azure.relationships.nic_connected_to_network_security_group
      target: network_security_group
    - type: cloudify.azure.relationships.nic_connected_to_ip_configuration
      target: kubernetes_master_host_nic_ip_cfg

  kubernetes_node_host_nic_ip_cfg:
    type: cloudify.azure.nodes.network.IPConfiguration
    properties:
      location: { get_secret: location }
      azure_config: *azure_config
      retry_after: { get_input: retry_after }
      resource_config:
        privateIPAllocationMethod: Dynamic
    relationships:
    - type: cloudify.azure.relationships.contained_in_resource_group
      target: resource_group
    - type: cloudify.azure.relationships.ip_configuration_connected_to_subnet
      target: subnet

  kubernetes_master_host_nic_ip_cfg:
    type: cloudify.azure.nodes.network.IPConfiguration
    properties:
      location: { get_secret: location }
      azure_config: *azure_config
      retry_after: { get_input: retry_after }
      resource_config:
        privateIPAllocationMethod: Dynamic
    relationships:
    - type: cloudify.azure.relationships.ip_configuration_connected_to_subnet
      target: subnet
    - type: cloudify.azure.relationships.ip_configuration_connected_to_public_ip
      target: kubernetes_master_ip

  kubernetes_master_ip:
    type: cloudify.azure.nodes.network.PublicIPAddress
    properties:
      location: { get_secret: location }
      azure_config: *azure_config
      retry_after: { get_input: retry_after }
      resource_config:
        publicIPAllocationMethod: Static
    relationships:
    - type: cloudify.azure.relationships.contained_in_resource_group
      target: resource_group

  subnet:
    type: cloudify.azure.nodes.network.Subnet
    properties:
      resource_group_name: { get_secret: mgr_resource_group_name }
      name: { get_secret: mgr_subnet_name }
      azure_config: *azure_config
      use_external_resource: true
      location: { get_secret: location }
    relationships:
    - type: cloudify.azure.relationships.contained_in_virtual_network
      target: virtual_network

  virtual_network:
    type: cloudify.azure.nodes.network.VirtualNetwork
    properties:
      resource_group_name: { get_secret: mgr_resource_group_name }
      name: { get_secret: mgr_virtual_network_name }
      azure_config: *azure_config
      use_external_resource: true
      location: { get_secret: location }
    relationships:
    - type: cloudify.azure.relationships.contained_in_resource_group
      target: resource_group

  storage_account:
    type: cloudify.azure.nodes.storage.StorageAccount
    properties:
      location: { get_secret: location }
      azure_config: *azure_config
      retry_after: { get_input: retry_after }
      resource_config:
        accountType: Standard_LRS
    relationships:
    - type: cloudify.azure.relationships.contained_in_resource_group
      target: resource_group

  resource_group:
    type: cloudify.azure.nodes.ResourceGroup
    properties:
      name: {concat:[{get_input: resource_prefix},arg,{get_input: resource_suffix}]}
      location: { get_secret: location }
      azure_config: *azure_config
#    relationships:
#      - type: cloudify.relationships.depends_on
#        target: cloudify_host_cloud_config

groups:

  k8s_node_scale_group:
    members:
      - kubernetes_node_host_nic_ip_cfg
      - kubernetes_node_host_nic
      - kubernetes_node_host

policies:

  kubernetes_node_vms_scaling_policy:
    type: cloudify.policies.scaling
    properties:
      default_instances:  1
    targets: [k8s_node_scale_group]

outputs:
  kubernetes_info:
    description: Kubernetes Dashboard URL
    value:
      url: { concat: ["http://", { get_attribute: [ kubernetes_master_host, public_ip ] } , ":8080/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard" ] }