github.com/rochacon/deis@v1.0.2-0.20150903015341-6839b592a1ff/contrib/coreos/user-data.example (about) 1 #cloud-config 2 --- 3 coreos: 4 fleet: 5 # We have to set the public_ip here so this works on Vagrant -- otherwise, Vagrant VMs 6 # will all publish the same private IP. This is harmless for cloud providers. 7 public-ip: $private_ipv4 8 # allow etcd to slow down at times 9 etcd_request_timeout: 3.0 10 metadata: controlPlane=true,dataPlane=true,routerMesh=true 11 units: 12 - name: etcd.service 13 command: start 14 content: | 15 [Unit] 16 Description=etcd2 container 17 Requires=early-docker.service 18 After=early-docker.service 19 Before=early-docker.target 20 21 [Service] 22 User=etcd 23 PermissionsStartOnly=true 24 Restart=always 25 RestartSec=10s 26 LimitNOFILE=40000 27 EnvironmentFile=/etc/environment 28 Environment="ETCD_IMAGE=quay.io/coreos/etcd:v2.1.2" 29 Environment="ETCD_ELECTION_TIMEOUT=2000" 30 Environment="ETCD_HEARTBEAT_INTERVAL=400" 31 Environment="ETCD_HOST_DATA_DIR=/var/lib/etcd2" 32 Environment="ETCD_NAME=%m" 33 Environment="DOCKER_HOST=unix:///var/run/early-docker.sock" 34 ExecStartPre=/bin/sh -c "docker history $ETCD_IMAGE >/dev/null 2>&1 || docker pull $ETCD_IMAGE" 35 ExecStartPre=/bin/sh -c "docker inspect $ETCD_NAME >/dev/null 2>&1 && docker rm -f $ETCD_NAME || true" 36 ExecStart=/usr/bin/docker run --net=host --rm \ 37 --volume=${ETCD_HOST_DATA_DIR}:/var/lib/etcd2 \ 38 --volume=/usr/share/ca-certificates:/etc/ssl/certs:ro \ 39 -p 4001:4001 -p 2380:2380 -p 2379:2379 -p 7001:7001 \ 40 --name ${ETCD_NAME} \ 41 ${ETCD_IMAGE} \ 42 -name ${ETCD_NAME} \ 43 -data-dir /var/lib/etcd2 \ 44 -advertise-client-urls http://${COREOS_PRIVATE_IPV4}:2379,http://${COREOS_PRIVATE_IPV4}:4001 \ 45 -listen-client-urls http://0.0.0.0:2379,http://0.0.0.0:4001 \ 46 -initial-advertise-peer-urls http://${COREOS_PRIVATE_IPV4}:2380,http://${COREOS_PRIVATE_IPV4}:7001 \ 47 -listen-peer-urls http://0.0.0.0:2380,http://0.0.0.0:7001 \ 48 --heartbeat-interval ${ETCD_HEARTBEAT_INTERVAL} \ 49 --election-timeout ${ETCD_ELECTION_TIMEOUT} \ 50 --discovery #DISCOVERY_URL 51 ExecStop=-/usr/bin/docker stop $ETCD_NAME 52 - name: etcd2.service 53 mask: true 54 - name: docker-tcp.socket 55 command: start 56 enable: true 57 content: | 58 [Unit] 59 Description=Docker Socket for the API 60 61 [Socket] 62 ListenStream=2375 63 BindIPv6Only=both 64 Service=docker.service 65 [Install] 66 WantedBy=sockets.target 67 - name: flanneld.service 68 command: start 69 content: | 70 [Unit] 71 Description=Network fabric for containers 72 Documentation=https://github.com/coreos/flannel 73 Requires=early-docker.service etcd.service 74 After=etcd.service early-docker.service 75 Before=early-docker.target 76 77 [Service] 78 Type=notify 79 Restart=always 80 RestartSec=5 81 Environment="TMPDIR=/var/tmp/" 82 Environment="DOCKER_HOST=unix:///var/run/early-docker.sock" 83 Environment="FLANNEL_VER=0.5.1" 84 LimitNOFILE=40000 85 LimitNPROC=1048576 86 ExecStartPre=/sbin/modprobe ip_tables 87 ExecStartPre=/usr/bin/mkdir -p /run/flannel 88 ExecStartPre=/usr/bin/touch /run/flannel/options.env 89 ExecStartPre=-/usr/bin/etcdctl mk /coreos.com/network/config '{"Network":"10.244.0.0/16", "SubnetLen": 24, "SubnetMin":"10.244.0.0", "Backend": {"Type": "vxlan"}}' 90 ExecStart=/usr/libexec/sdnotify-proxy /run/flannel/sd.sock \ 91 /usr/bin/docker run --net=host --privileged=true --rm \ 92 --volume=/run/flannel:/run/flannel \ 93 --env=NOTIFY_SOCKET=/run/flannel/sd.sock \ 94 --env-file=/run/flannel/options.env \ 95 --volume=/usr/share/ca-certificates:/etc/ssl/certs:ro \ 96 quay.io/coreos/flannel:${FLANNEL_VER} /opt/bin/flanneld --ip-masq=true 97 98 # Update docker options 99 ExecStartPost=/usr/bin/docker run --net=host --rm -v /run:/run \ 100 quay.io/coreos/flannel:${FLANNEL_VER} \ 101 /opt/bin/mk-docker-opts.sh -d /run/flannel_docker_opts.env -i 102 - name: stop-update-engine.service 103 command: start 104 content: | 105 [Unit] 106 Description=stop update-engine 107 108 [Service] 109 Type=oneshot 110 ExecStart=/usr/bin/systemctl stop update-engine.service 111 ExecStartPost=/usr/bin/systemctl mask update-engine.service 112 - name: graceful-deis-shutdown.service 113 content: | 114 [Unit] 115 Description=Clean up 116 DefaultDependencies=no 117 After=fleet.service etcd.service docker.service docker.socket deis-store-admin.service deis-store-daemon.service deis-store-volume.service deis-store-monitor.service 118 Requires=fleet.service etcd.service deis-store-admin.service deis-store-daemon.service deis-store-volume.service docker.service docker.socket deis-store-monitor.service 119 120 [Install] 121 WantedBy=shutdown.target halt.target reboot.target 122 123 [Service] 124 ExecStop=/opt/bin/graceful-shutdown.sh --really 125 Type=oneshot 126 TimeoutSec=1200 127 RemainAfterExit=yes 128 - name: install-deisctl.service 129 command: start 130 content: | 131 [Unit] 132 Description=Install deisctl utility 133 ConditionPathExists=!/opt/bin/deisctl 134 135 [Service] 136 Type=oneshot 137 ExecStart=/usr/bin/sh -c 'curl -sSL --retry 5 --retry-delay 2 http://deis.io/deisctl/install.sh | sh -s 1.9.1' 138 - name: debug-etcd.service 139 content: | 140 [Unit] 141 Description=etcd debugging service 142 143 [Service] 144 ExecStartPre=/usr/bin/curl -sSL -o /opt/bin/jq http://stedolan.github.io/jq/download/linux64/jq 145 ExecStartPre=/usr/bin/chmod +x /opt/bin/jq 146 ExecStart=/usr/bin/bash -c "while true; do curl -sL http://127.0.0.1:4001/v2/stats/self | /opt/bin/jq . ; sleep 1 ; done" 147 - name: increase-nf_conntrack-connections.service 148 command: start 149 content: | 150 [Unit] 151 Description=Increase the number of connections in nf_conntrack. default is 65536 152 153 [Service] 154 Type=oneshot 155 ExecStartPre=/usr/sbin/modprobe nf_conntrack 156 ExecStart=/bin/sh -c "sysctl -w net.netfilter.nf_conntrack_max=262144" 157 - name: fleet.service 158 command: start 159 write_files: 160 - path: /etc/deis-release 161 content: | 162 DEIS_RELEASE=v1.9.1 163 - path: /etc/motd 164 content: " \e[31m* * \e[34m* \e[32m***** \e[39mddddd eeeeeee iiiiiii ssss\n\e[31m* * \e[34m* * \e[32m* * \e[39md d e e i s s\n \e[31m* * \e[34m***** \e[32m***** \e[39md d e i s\n\e[32m***** \e[31m* * \e[34m* \e[39md d e i s\n\e[32m* * \e[31m* * \e[34m* * \e[39md d eee i sss\n\e[32m***** \e[31m* * \e[34m***** \e[39md d e i s\n \e[34m* \e[32m***** \e[31m* * \e[39md d e i s\n \e[34m* * \e[32m* * \e[31m* * \e[39md d e e i s s\n\e[34m***** \e[32m***** \e[31m* * \e[39mddddd eeeeeee iiiiiii ssss\n\n\e[39mWelcome to Deis\t\t\tPowered by Core\e[38;5;45mO\e[38;5;206mS\e[39m\n" 165 - path: /etc/profile.d/nse-function.sh 166 permissions: '0755' 167 content: | 168 function nse() { 169 docker exec -it $1 bash 170 } 171 - path: /etc/systemd/system/docker.service.d/50-insecure-registry.conf 172 content: | 173 [Unit] 174 Requires=flanneld.service 175 After=flanneld.service 176 177 [Service] 178 EnvironmentFile=/etc/environment_proxy 179 Environment="DOCKER_OPTS=--insecure-registry 10.0.0.0/8 --insecure-registry 172.16.0.0/12 --insecure-registry 192.168.0.0/16 --insecure-registry 100.64.0.0/10" 180 - path: /run/deis/bin/get_image 181 permissions: '0755' 182 content: | 183 #!/usr/bin/env bash 184 # usage: get_image <component_path> 185 IMAGE=`etcdctl get $1/image 2>/dev/null` 186 187 # if no image was set in etcd, we use the default plus the release string 188 if [ $? -ne 0 ]; then 189 RELEASE=`etcdctl get /deis/platform/version 2>/dev/null` 190 191 # if no release was set in etcd, use the default provisioned with the server 192 if [ $? -ne 0 ]; then 193 source /etc/deis-release 194 RELEASE=$DEIS_RELEASE 195 fi 196 197 IMAGE=$1:$RELEASE 198 fi 199 200 # remove leading slash 201 echo ${IMAGE#/} 202 - path: /run/deis/bin/preseed 203 permissions: '0755' 204 content: | 205 #!/usr/bin/env bash 206 207 COMPONENTS=(builder cache controller database logger logspout publisher registry router store-daemon store-gateway store-metadata store-monitor) 208 for c in "${COMPONENTS[@]}"; do 209 image=`/run/deis/bin/get_image /deis/$c` 210 docker history $image >/dev/null 2>&1 || docker pull $image 211 done 212 - path: /opt/bin/deis-debug-logs 213 permissions: '0755' 214 content: | 215 #!/usr/bin/env bash 216 217 echo '--- VERSIONS ---' 218 source /etc/os-release 219 echo $PRETTY_NAME 220 source /etc/deis-release 221 echo "Deis $DEIS_RELEASE" 222 etcd -version 223 fleet -version 224 printf "\n" 225 226 echo '--- SYSTEM STATUS ---' 227 journalctl -n 50 -u etcd --no-pager 228 journalctl -n 50 -u fleet --no-pager 229 printf "\n" 230 231 echo '--- DEIS STATUS ---' 232 deisctl list 233 etcdctl ls --recursive /deis 234 printf "\n" 235 - path: /home/core/.toolboxrc 236 owner: core 237 content: | 238 TOOLBOX_DOCKER_IMAGE=alpine 239 TOOLBOX_DOCKER_TAG=3.1 240 TOOLBOX_USER=root 241 - path: /etc/environment_proxy 242 owner: core 243 content: | 244 HTTP_PROXY= 245 HTTPS_PROXY= 246 ALL_PROXY= 247 NO_PROXY= 248 http_proxy= 249 https_proxy= 250 all_proxy= 251 no_proxy= 252 - path: /etc/systemd/coredump.conf 253 content: | 254 [Coredump] 255 Storage=none 256 - path: /opt/bin/graceful-shutdown.sh 257 permissions: '0755' 258 content: | 259 #!/usr/bin/bash 260 if [ "$1" != '--really' ]; then 261 echo "command must be run as: $0 --really" 262 exit 1 263 fi 264 # procedure requires the store-admin 265 ADMIN_RUNNING=$(docker inspect --format="{{ .State.Running }}" deis-store-admin) 266 if [ $? -eq 1 ] || [ "$ADMIN_RUNNING" == "false" ]; then 267 echo "deis-store-admin container is required for graceful shutdown" 268 exit 2 269 fi 270 set -e -x -o pipefail 271 # determine osd id 272 CURRENT_STATUS=$(/usr/bin/docker exec deis-store-admin ceph health | awk '{print $1}') 273 OSD_HOSTS=($(/usr/bin/etcdctl ls /deis/store/hosts/| awk -F'/' '{print $5}')) 274 for HOST in "${OSD_HOSTS[@]}" 275 do 276 PUBLIC_IP=$(fleetctl list-machines -fields="machine,ip" -full -no-legend| grep `cat /etc/machine-id` | awk '{print $2}') 277 if [ "$HOST" = "$PUBLIC_IP" ] ; then 278 OSD_ID=$(/usr/bin/etcdctl get /deis/store/osds/$PUBLIC_IP) 279 break 280 fi 281 done 282 # if we own an osd and its healthy, try to gracefully remove it 283 if [ ! -z "$OSD_ID" ] && [[ "$CURRENT_STATUS" == *"HEALTH_OK"* ]] && [ ${#OSD_HOSTS[@]} -gt "3" ]; then 284 /usr/bin/docker exec deis-store-admin ceph osd out $OSD_ID 285 sleep 30 286 TIMEWAITED=0 287 until [[ $(/usr/bin/docker exec deis-store-admin ceph health) == *"HEALTH_OK"* ]] 288 do 289 if [ $TIMEWAITED -gt "1200" ] 290 then 291 echo "ceph graceful removal timeout exceeded" 292 break 293 fi 294 echo "waiting" && sleep 5 295 TIMEWAITED=$((TIMEWAITED+5)) 296 done 297 /usr/bin/docker stop deis-store-daemon 298 /usr/bin/docker exec deis-store-admin ceph osd crush remove osd.$OSD_ID 299 /usr/bin/docker exec deis-store-admin ceph auth del osd.$OSD_ID 300 /usr/bin/docker exec deis-store-admin ceph osd rm $OSD_ID 301 /usr/bin/etcdctl rm /deis/store/osds/$PUBLIC_IP 302 etcdctl rm /deis/store/hosts/$PUBLIC_IP && sleep 10 303 # remove ceph mon 304 /usr/bin/docker stop deis-store-monitor || true 305 /usr/bin/docker exec deis-store-admin ceph mon remove `hostname -f` # fixme 306 /usr/bin/docker stop deis-store-metadata || true 307 fi 308 309 # TODO: remove the next check once etcdctl is using etcd2 310 ETCDCTL=/usr/bin/etcdctl 311 if ! $ETCDCTL --version | grep -q "etcdctl version 2.0."; then 312 ETCD_VERSION=2.0.13 313 curl -sSL https://github.com/coreos/etcd/releases/download/v${ETCD_VERSION}/etcd-v${ETCD_VERSION}-linux-amd64.tar.gz | \ 314 tar zxv -C /opt/bin etcd-v${ETCD_VERSION}-linux-amd64/etcdctl --strip=1 315 ETCDCTL="/opt/bin/etcdctl" 316 fi 317 # removing the node from etcd 318 NODE=$($ETCDCTL member list | grep `cat /etc/machine-id` | cut -d ':' -f 1) 319 $ETCDCTL member remove $NODE 320 - path: /opt/bin/wupiao 321 permissions: '0755' 322 content: | 323 #!/usr/bin/env bash 324 # [w]ait [u]ntil [p]ort [i]s [a]ctually [o]pen 325 [ -n "$1" ] && \ 326 until curl -o /dev/null -sIf http://${1}; do \ 327 sleep 1 && echo .; 328 done; 329 exit $? 330 - path: /opt/bin/download-k8s-binary 331 permissions: '0755' 332 content: | 333 #!/usr/bin/env bash 334 export K8S_VERSION="v1.0.1" 335 mkdir -p /opt/bin 336 FILE=$1 337 if [ ! -f /opt/bin/$FILE ]; then 338 curl -sSL -o /opt/bin/$FILE https://storage.googleapis.com/kubernetes-release/release/${K8S_VERSION}/bin/linux/amd64/$FILE 339 chmod +x /opt/bin/$FILE 340 else 341 # we check the version of the binary 342 INSTALLED_VERSION=$(/opt/bin/$FILE --version) 343 MATCH=$(echo "${INSTALLED_VERSION}" | grep -c "${K8S_VERSION}") 344 if [ $MATCH -eq 0 ]; then 345 # the version is different 346 curl -sSL -o /opt/bin/$FILE https://storage.googleapis.com/kubernetes-release/release/${K8S_VERSION}/bin/linux/amd64/$FILE 347 chmod +x /opt/bin/$FILE 348 fi 349 fi 350 - path: /opt/bin/scheduler-policy.json 351 content: | 352 { 353 "kind": "Policy", 354 "apiVersion": "v1", 355 "predicates": [{"name": "PodFitsPorts"},{"name": "PodFitsResources"},{"name": "NoDiskConflict"},{"name": "MatchNodeSelector"},{"name": "HostName"}], 356 "priorities": [{"name": "LeastRequestedPriority","weight": 1},{"name": "BalancedResourceAllocation","weight": 1},{"name": "ServiceSpreadingPriority","weight": 2},{"name": "EqualPriority","weight": 1}] 357 }