#cloud-config
write_files:
  - path: /etc/systemd/system/enable-kube-proxy.service
    owner: "root:root"
    permissions: "0644"
    content: |
      [Unit]
      Description=Configure Kubernetes Proxy

      [Service]
      Type=oneshot
      EnvironmentFile=/etc/sysconfig/heat-params
      ExecStart=/etc/sysconfig/enable-kube-proxy-minion.sh

      [Install]
      WantedBy=multi-user.target

  - path: /etc/sysconfig/enable-kube-proxy-minion.sh
    owner: "root:root"
    permissions: "0755"
    content: |
      #!/bin/sh

      KUBE_CONFIG_PATH=/etc/kubernetes/config
      KUBE_PROTOCOL="https"
      KUBE_CONFIG="${KUBE_CONFIG_PATH}/worker-kubeconfig.yaml"
      if [ "${TLS_DISABLED}" == "True" ]; then
        KUBE_PROTOCOL="http"
        KUBE_CONFIG=
      fi
      KUBE_MASTER_URI="${KUBE_PROTOCOL}://${KUBE_MASTER_IP}:${KUBE_API_PORT}"

      TEMPLATE=/etc/kubernetes/manifests/kube-proxy.yaml
      mkdir -p $(dirname ${TEMPLATE})
      cat > ${TEMPLATE} <<EOF
      apiVersion: v1
      kind: Pod
      metadata:
        name: kube-proxy
        namespace: kube-system
      spec:
        hostNetwork: true
        containers:
        - name: kube-proxy
          image: ${HYPERKUBE_IMAGE_REPO}:${KUBE_VERSION}
          command:
          - /hyperkube
          - proxy
          - --master=${KUBE_MASTER_URI}
          - --kubeconfig=${KUBE_CONFIG}
          - --cluster-cidr=${FLANNEL_NETWORK_CIDR}
          - --logtostderr=true
          - --v=0
          securityContext:
            privileged: true
          volumeMounts:
            - mountPath: ${KUBE_CONFIG_PATH}
              name: kubeconfig
              readOnly: true
            - mountPath: ${KUBE_CERTS_PATH}
              name: ssl-certs-kubernetes
              readOnly: true
            - mountPath: /etc/ssl/certs
              name: ssl-certs-host
              readOnly: true
            - mountPath: /var/run/dbus
              name: dbus
              readOnly: false
        volumes:
          - name: kubeconfig
            hostPath:
              path: ${KUBE_CONFIG_PATH}
          - name: ssl-certs-kubernetes
            hostPath:
              path: ${KUBE_CERTS_PATH}
          - hostPath:
              path: ${HOST_CERTS_PATH}
            name: ssl-certs-host
          - hostPath:
              path: /var/run/dbus
            name: dbus
      EOF
