Add Azure standalone CP template

docs/azure/cluster-parameters.md

@@ -0,0 +1,98 @@
+# Azure cluster parameters
+
+## Prerequisites
+
+- Azure CLI installed
+- `az login` command executed
+
+## Cluster Identity
+
+To provide credentials for CAPI Azure provider (CAPZ) the `AzureClusterIdentity`
+resource must be created. This should be done before provisioning any clusters.
+
+
+To create the `AzureClusterIdentity` you should first get the desired
+`SubscriptionID` by executing `az account list -o table` which will return list
+of subscriptions available to user.
+
+Then you need to create service principal which will be used by CAPZ to interact
+with Azure API. To do so you need to execute the following command:
+
+```bash
+az ad sp create-for-rbac --role contributor --scopes="/subscriptions/<Subscription ID>"
+```
+
+The command will return json with the credentials for the service principal which
+will look like this:
+
+```json
+{
+	"appId": "29a3a125-7848-4ce6-9be9-a4b3eecca0ff",
+	"displayName": "azure-cli",
+	"password": "u_RANDOMHASH",
+	"tenant": "2f10bc28-959b-481f-b094-eb043a87570a",
+}
+```
+
+*Note: make sure to save this credentials and treat them like passwords.*
+
+With the data from the json you can now create the `AzureClusterIdentity` object
+and it's secret.
+
+The objects created with the data above can look something like this:
+
+**Secret**:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: az-cluster-identity-secret
+  namespace: hmc-system
+stringData:
+  clientSecret: u_RANDOMHASH
+type: Opaque
+```
+
+**AzureClusterIdentity**:
+
+```yaml
+apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
+kind: AzureClusterIdentity
+metadata:
+  labels:
+    clusterctl.cluster.x-k8s.io/move-hierarchy: "true"
+  name: az-cluster-identity
+  namespace: hmc-system
+spec:
+  allowedNamespaces: {}
+  clientID: 29a3a125-7848-4ce6-9be9-a4b3eecca0ff
+  clientSecret:
+    name: az-cluster-identity-secret
+    namespace: hmc-system
+  tenantID: 2f10bc28-959b-481f-b094-eb043a87570a
+  type: ServicePrincipal
+```
+
+These objects then should be referenced in the `Deployment` object in the
+`.spec.config.clusterIdentity` field.
+
+Subscription ID which was used to create service principal should be the
+same that will be used in the `.spec.config.subscriptionID` field of the
+`Deployment` object.
+
+### Cloud controller manager note
+
+In order for CCM to work on Azure it requires `azure.json` file to be located on
+all nodes.
+
+Because of a limitation (k0sproject/k0smotron#692) it's not currently possible
+to automatically pass credentials to all nodes.
+
+To mitigate that you should pass cluster identity data once again in the
+following fields of a `Deployment` object:
+
+- `.spec.config.tenantID` - value of the `tenant` field of a service principal
+- `.spec.config.clientID` - value of the `appId` field of a service principal
+- `.spec.config.clientSecret` - value of the `password` field of a service
+  principal

templates/azure-standalone-cp/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

templates/azure-standalone-cp/Chart.yaml

@@ -0,0 +1,19 @@
+apiVersion: v2
+name: azure-standalone-cp
+description: |
+  An HMC template to deploy a k0s cluster on Azure with bootstrapped control plane nodes.
+type: application
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.0.1
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.30.4+k0s.0"
+annotations:
+  hmc.mirantis.com/type: deployment
+  hmc.mirantis.com/infrastructure-providers: azure
+  hmc.mirantis.com/controlplane-providers: k0s
+  hmc.mirantis.com/bootstrap-providers: k0s

templates/azure-standalone-cp/templates/_helpers.tpl

@@ -0,0 +1,71 @@
+{{- define "cluster.name" -}}
+    {{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "azuremachinetemplate.controlplane.name" -}}
+    {{- include "cluster.name" . }}-cp-mt
+{{- end }}
+
+{{- define "azuremachinetemplate.worker.name" -}}
+    {{- include "cluster.name" . }}-worker-mt
+{{- end }}
+
+{{- define "k0scontrolplane.name" -}}
+    {{- include "cluster.name" . }}-cp
+{{- end }}
+
+{{- define "k0sworkerconfigtemplate.name" -}}
+    {{- include "cluster.name" . }}-machine-config
+{{- end }}
+
+{{- define "machinedeployment.name" -}}
+    {{- include "cluster.name" . }}-md
+{{- end }}
+
+{{- define "azure.json.worker" -}}
+{
+  "cloud": "AzurePublicCloud",
+  "tenantId": "{{ .Values.tenantID }}",
+  "subscriptionId": "{{ .Values.subscriptionID }}",
+  "aadClientId": "{{ .Values.clientID }}",
+  "aadClientSecret": "{{ .Values.clientSecret }}",
+  "resourceGroup": "{{ include "cluster.name" . }}",
+  "securityGroupName": "{{ include "cluster.name" . }}-node-nsg",
+  "securityGroupResourceGroup": "{{ include "cluster.name" . }}",
+  "location": "{{ .Values.location }}",
+  "vmType": "vmss",
+  "vnetName": "{{ include "cluster.name" . }}-vnet",
+  "vnetResourceGroup": "{{ include "cluster.name" . }}",
+  "subnetName": "{{ include "cluster.name" . }}-node-subnet",
+  "routeTableName": "{{ include "cluster.name" . }}-node-routetable",
+  "loadBalancerSku": "Standard",
+  "loadBalancerName": "",
+  "maximumLoadBalancerRuleCount": 250,
+  "useManagedIdentityExtension": false,
+  "useInstanceMetadata": true
+}
+{{- end }}
+
+{{- define "azure.json.controller" -}}
+{
+  "cloud": "AzurePublicCloud",
+  "tenantId": "{{ .Values.tenantID }}",
+  "subscriptionId": "{{ .Values.subscriptionID }}",
+  "aadClientId": "{{ .Values.clientID }}",
+  "aadClientSecret": "{{ .Values.clientSecret }}",
+  "resourceGroup": "{{ include "cluster.name" . }}",
+  "securityGroupName": "{{ include "cluster.name" . }}-controlplane-nsg",
+  "securityGroupResourceGroup": "{{ include "cluster.name" . }}",
+  "location": "{{ .Values.location }}",
+  "vmType": "vmss",
+  "vnetName": "{{ include "cluster.name" . }}-vnet",
+  "vnetResourceGroup": "{{ include "cluster.name" . }}",
+  "subnetName": "{{ include "cluster.name" . }}-controlplane-subnet",
+  "routeTableName": "{{ include "cluster.name" . }}-controlplane-routetable",
+  "loadBalancerSku": "Standard",
+  "loadBalancerName": "",
+  "maximumLoadBalancerRuleCount": 250,
+  "useManagedIdentityExtension": false,
+  "useInstanceMetadata": true
+}
+{{- end }}

templates/azure-standalone-cp/templates/azurecluster.yaml

@@ -0,0 +1,17 @@
+apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
+kind: AzureCluster
+metadata:
+  name: {{ include "cluster.name" . }}
+spec:
+  identityRef:
+    kind: AzureClusterIdentity
+    name: {{ .Values.clusterIdentity.name }}
+    namespace: {{ .Values.clusterIdentity.namespace }}
+  location: {{ .Values.location }}
+  {{- if .Values.bastion.enabled }}
+  {{- with .Values.bastion.bastionSpec }}
+  bastionSpec:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- end }}
+  subscriptionID: {{ .Values.subscriptionID }}

templates/azure-standalone-cp/templates/azuremachinetemplate-controlplane.yaml

@@ -0,0 +1,20 @@
+apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
+kind: AzureMachineTemplate
+metadata:
+  name: {{ include "azuremachinetemplate.controlplane.name" . }}
+spec:
+  template:
+    spec:
+      osDisk:
+        diskSizeGB: {{ .Values.controlPlane.rootVolumeSize }}
+        osType: Linux
+      {{- if not (quote .Values.controlPlane.sshPublicKey | empty) }}
+      sshPublicKey: {{ .Values.controlPlane.sshPublicKey }}
+      {{- end }}
+      vmSize: {{ .Values.controlPlane.vmSize }}
+      {{- if not (quote .Values.controlPlane.image | empty) }}
+      {{- with .Values.controlPlane.image }}
+      image:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- end }}

templates/azure-standalone-cp/templates/azuremachinetemplate-worker.yaml

@@ -0,0 +1,20 @@
+apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
+kind: AzureMachineTemplate
+metadata:
+  name: {{ include "azuremachinetemplate.worker.name" . }}
+spec:
+  template:
+    spec:
+      osDisk:
+        diskSizeGB: {{ .Values.worker.rootVolumeSize }}
+        osType: Linux
+      {{- if not (quote .Values.worker.sshPublicKey | empty) }}
+      sshPublicKey: {{ .Values.worker.sshPublicKey }}
+      {{- end }}
+      vmSize: {{ .Values.worker.vmSize }}
+      {{- if not (quote .Values.worker.image | empty) }}
+      {{- with .Values.worker.image }}
+      image:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- end }}

templates/azure-standalone-cp/templates/cluster.yaml

@@ -0,0 +1,17 @@
+apiVersion: cluster.x-k8s.io/v1beta1
+kind: Cluster
+metadata:
+  name: {{ include "cluster.name" . }}
+spec:
+  {{- with .Values.clusterNetwork }}
+  clusterNetwork:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  controlPlaneRef:
+    apiVersion: controlplane.cluster.x-k8s.io/v1beta1
+    kind: K0sControlPlane
+    name: {{ include "k0scontrolplane.name" .  }}
+  infrastructureRef:
+    apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
+    kind: AzureCluster
+    name: {{ include "cluster.name" . }}

templates/azure-standalone-cp/templates/k0scontrolplane.yaml

@@ -0,0 +1,61 @@
+apiVersion: controlplane.cluster.x-k8s.io/v1beta1
+kind: K0sControlPlane
+metadata:
+  name: {{ include "k0scontrolplane.name" . }}
+spec:
+  replicas: {{ .Values.controlPlaneNumber }}
+  version: {{ .Values.k0s.version }}
+  k0sConfigSpec:
+    args:
+      - --enable-worker
+      - --enable-cloud-provider
+      - --kubelet-extra-args="--cloud-provider=external"
+      - --disable-components=konnectivity-server
+    files:
+      - path: "/etc/kubernetes/azure.json"
+        permissions: "0644"
+        content: {{ include "azure.json.controller" . | toJson }}
+    k0s:
+      apiVersion: k0s.k0sproject.io/v1beta1
+      kind: ClusterConfig
+      metadata:
+        name: k0s
+      spec:
+        api:
+          extraArgs:
+            anonymous-auth: "true"
+        network:
+          provider: calico
+          calico:
+            mode: vxlan
+        extensions:
+          helm:
+            repositories:
+              - name: cloud-provider-azure
+                url: https://raw.githubusercontent.com/kubernetes-sigs/cloud-provider-azure/master/helm/repo
+              - name: azuredisk-csi-driver
+                url: https://raw.githubusercontent.com/kubernetes-sigs/azuredisk-csi-driver/master/charts
+            charts:
+              - name: cloud-provider-azure
+                namespace: kube-system
+                chartname: cloud-provider-azure/cloud-provider-azure
+                version: 1.30.4
+                order: 1
+                values: |
+                  cloudControllerManager:
+                    nodeSelector:
+                      node-role.kubernetes.io/control-plane: "true"
+              - name: azuredisk-csi-driver
+                namespace: kube-system
+                chartname: azuredisk-csi-driver/azuredisk-csi-driver
+                version: 1.30.3
+                order: 2
+                values: |
+                  linux:
+                    kubelet: "/var/lib/k0s/kubelet"
+  machineTemplate:
+    infrastructureRef:
+      apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
+      kind: AzureMachineTemplate
+      name: {{ include "azuremachinetemplate.controlplane.name" . }}
+      namespace: {{ .Release.Namespace }}

templates/azure-standalone-cp/templates/k0sworkerconfigtemplate.yaml

@@ -0,0 +1,15 @@
+apiVersion: bootstrap.cluster.x-k8s.io/v1beta1
+kind: K0sWorkerConfigTemplate
+metadata:
+  name: {{ include "k0sworkerconfigtemplate.name" . }}
+spec:
+  template:
+    spec:
+      version: {{ .Values.k0s.version }}
+      args:
+      - --enable-cloud-provider
+      - --kubelet-extra-args="--cloud-provider=external"
+      files:
+        - path: "/etc/kubernetes/azure.json"
+          permissions: "0644"
+          content: {{ include "azure.json.worker" . | toJson }}

templates/azure-standalone-cp/templates/machinedeployment.yaml

@@ -0,0 +1,26 @@
+apiVersion: cluster.x-k8s.io/v1beta1
+kind: MachineDeployment
+metadata:
+  name: {{ include "machinedeployment.name" . }}
+spec:
+  clusterName: {{ include "cluster.name" . }}
+  replicas: {{ .Values.workersNumber }}
+  selector:
+    matchLabels:
+      cluster.x-k8s.io/cluster-name: {{ include "cluster.name" . }}
+  template:
+    metadata:
+      labels:
+        cluster.x-k8s.io/cluster-name: {{ include "cluster.name" . }}
+    spec:
+      version: {{ regexReplaceAll "\\+k0s.+$" .Values.k0s.version "" }}
+      clusterName: {{ include "cluster.name" . }}
+      bootstrap:
+        configRef:
+          apiVersion: bootstrap.cluster.x-k8s.io/v1beta1
+          kind: K0sWorkerConfigTemplate
+          name: {{ include "k0sworkerconfigtemplate.name" . }}
+      infrastructureRef:
+        apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
+        kind: AzureMachineTemplate
+        name: {{ include "azuremachinetemplate.worker.name" . }}