Merge pull request #11330 from codablock/etcd-events

Make events etcd cluster optional
kubernetes · May 21, 2021 · 72a5618 · 72a5618
2 parents 8a6ec14 + 5306e27
commit 72a5618
Show file tree

Hide file tree

Showing 72 changed files with 174 additions and 158 deletions.
diff --git a/nodeup/pkg/model/etcd_manager_tls.go b/nodeup/pkg/model/etcd_manager_tls.go
@@ -41,7 +41,8 @@ func (b *EtcdManagerTLSBuilder) Build(ctx *fi.ModelBuilderContext) error {
 		return err
 	}
 
-	for _, k := range []string{"main", "events"} {
+	for _, etcdCluster := range b.Cluster.Spec.EtcdClusters {
+		k := etcdCluster.Name
 		d := "/etc/kubernetes/pki/etcd-manager-" + k
 
 		keys := make(map[string]string)

diff --git a/nodeup/pkg/model/kube_apiserver.go b/nodeup/pkg/model/kube_apiserver.go
@@ -312,29 +312,31 @@ func (b *KubeAPIServerBuilder) buildPod() (*v1.Pod, error) {
 		}
 	}
 
-	var mainEtcdCluster, eventsEtcdCluster string
-	if b.IsMaster {
-		mainEtcdCluster = "https://127.0.0.1:4001"
-		eventsEtcdCluster = "https://127.0.0.1:4002"
-	} else {
-		host := b.Cluster.ObjectMeta.Name
-		mainEtcdCluster = "https://main.etcd." + host + ":4001"
-		eventsEtcdCluster = "https://events.etcd." + host + ":4002"
+	// we need to replace 127.0.0.1 for etcd urls with the dns names in case this apiserver is not
+	// running on master nodes
+	if !b.IsMaster {
+		clusterName := b.Cluster.ObjectMeta.Name
+		mainEtcdDNSName := "main.etcd." + clusterName
+		eventsEtcdDNSName := "events.etcd." + clusterName
+		for i := range kubeAPIServer.EtcdServers {
+			kubeAPIServer.EtcdServers[i] = strings.ReplaceAll(kubeAPIServer.EtcdServers[i], "127.0.0.1", mainEtcdDNSName)
+		}
+		for i := range kubeAPIServer.EtcdServersOverrides {
+			if strings.HasPrefix(kubeAPIServer.EtcdServersOverrides[i], "/events") {
+				kubeAPIServer.EtcdServersOverrides[i] = strings.ReplaceAll(kubeAPIServer.EtcdServersOverrides[i], "127.0.0.1", eventsEtcdDNSName)
+			}
+		}
 	}
 
 	if b.UseEtcdManager() && b.UseEtcdTLS() {
 		basedir := "/etc/kubernetes/pki/kube-apiserver"
 		kubeAPIServer.EtcdCAFile = filepath.Join(basedir, "etcd-ca.crt")
 		kubeAPIServer.EtcdCertFile = filepath.Join(basedir, "etcd-client.crt")
 		kubeAPIServer.EtcdKeyFile = filepath.Join(basedir, "etcd-client.key")
-		kubeAPIServer.EtcdServers = []string{mainEtcdCluster}
-		kubeAPIServer.EtcdServersOverrides = []string{"/events#" + eventsEtcdCluster}
 	} else if b.UseEtcdTLS() {
 		kubeAPIServer.EtcdCAFile = filepath.Join(b.PathSrvKubernetes(), "ca.crt")
 		kubeAPIServer.EtcdCertFile = filepath.Join(b.PathSrvKubernetes(), "etcd-client.pem")
 		kubeAPIServer.EtcdKeyFile = filepath.Join(b.PathSrvKubernetes(), "etcd-client-key.pem")
-		kubeAPIServer.EtcdServers = []string{mainEtcdCluster}
-		kubeAPIServer.EtcdServersOverrides = []string{"/events#" + eventsEtcdCluster}
 	}
 
 	// @note we are making assumption were using the ones created by the pki model, not custom defined ones

diff --git a/pkg/model/components/apiserver.go b/pkg/model/components/apiserver.go
@@ -133,8 +133,21 @@ func (b *KubeAPIServerOptionsBuilder) BuildOptions(o interface{}) error {
 
 	c.AllowPrivileged = fi.Bool(true)
 	c.ServiceClusterIPRange = clusterSpec.ServiceClusterIPRange
-	c.EtcdServers = []string{"http://127.0.0.1:4001"}
-	c.EtcdServersOverrides = []string{"/events#http://127.0.0.1:4002"}
+	c.EtcdServers = nil
+	c.EtcdServersOverrides = nil
+
+	for _, etcdCluster := range clusterSpec.EtcdClusters {
+		protocol := "http"
+		if etcdCluster.EnableEtcdTLS {
+			protocol = "https"
+		}
+		switch etcdCluster.Name {
+		case "main":
+			c.EtcdServers = append(c.EtcdServers, protocol+"://127.0.0.1:4001")
+		case "events":
+			c.EtcdServersOverrides = append(c.EtcdServersOverrides, "/events#"+protocol+"://127.0.0.1:4002")
+		}
+	}
 
 	// TODO: We can probably rewrite these more clearly in descending order
 	// Based on recommendations from:

diff --git a/tests/integration/update_cluster/apiservernodes/cloudformation.json.extracted.yaml b/tests/integration/update_cluster/apiservernodes/cloudformation.json.extracted.yaml
@@ -120,8 +120,8 @@ Resources.AWSEC2LaunchTemplatemasterustest1amastersminimalexamplecom.Properties.
   \ enableAdmissionPlugins:\n  - NamespaceLifecycle\n  - LimitRanger\n  - ServiceAccount\n
   \ - PersistentVolumeLabel\n  - DefaultStorageClass\n  - DefaultTolerationSeconds\n
   \ - MutatingAdmissionWebhook\n  - ValidatingAdmissionWebhook\n  - NodeRestriction\n
-  \ - ResourceQuota\n  etcdServers:\n  - http://127.0.0.1:4001\n  etcdServersOverrides:\n
-  \ - /events#http://127.0.0.1:4002\n  image: k8s.gcr.io/kube-apiserver:v1.21.0\n
+  \ - ResourceQuota\n  etcdServers:\n  - https://127.0.0.1:4001\n  etcdServersOverrides:\n
+  \ - /events#https://127.0.0.1:4002\n  image: k8s.gcr.io/kube-apiserver:v1.21.0\n
   \ kubeletPreferredAddressTypes:\n  - InternalIP\n  - Hostname\n  - ExternalIP\n
   \ logLevel: 2\n  requestheaderAllowedNames:\n  - aggregator\n  requestheaderExtraHeaderPrefixes:\n
   \ - X-Remote-Extra-\n  requestheaderGroupHeaders:\n  - X-Remote-Group\n  requestheaderUsernameHeaders:\n

diff --git a/...ntroller/data/aws_launch_template_master-us-test-1a.masters.minimal.example.com_user_data b/...ntroller/data/aws_launch_template_master-us-test-1a.masters.minimal.example.com_user_data
@@ -171,9 +171,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.21.0
   kubeletPreferredAddressTypes:
   - InternalIP

diff --git a/.../data/aws_launch_template_master-us-test-1a.masters.bastionuserdata.example.com_user_data b/.../data/aws_launch_template_master-us-test-1a.masters.bastionuserdata.example.com_user_data
@@ -171,9 +171,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.21.0
   kubeletPreferredAddressTypes:
   - InternalIP

diff --git a/tests/integration/update_cluster/complex/cloudformation.json.extracted.yaml b/tests/integration/update_cluster/complex/cloudformation.json.extracted.yaml
@@ -53,7 +53,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amasterscomplexexamplecom.Properties.
   \ - NamespaceLifecycle\n  - LimitRanger\n  - ServiceAccount\n  - PersistentVolumeLabel\n
   \ - DefaultStorageClass\n  - DefaultTolerationSeconds\n  - MutatingAdmissionWebhook\n
   \ - ValidatingAdmissionWebhook\n  - NodeRestriction\n  - ResourceQuota\n  etcdServers:\n
-  \ - http://127.0.0.1:4001\n  etcdServersOverrides:\n  - /events#http://127.0.0.1:4002\n
+  \ - https://127.0.0.1:4001\n  etcdServersOverrides:\n  - /events#https://127.0.0.1:4002\n
   \ image: k8s.gcr.io/kube-apiserver:v1.21.0\n  kubeletPreferredAddressTypes:\n  -
   InternalIP\n  - Hostname\n  - ExternalIP\n  logLevel: 2\n  memoryLimit: 1000Mi\n
   \ memoryRequest: 800Mi\n  requestheaderAllowedNames:\n  - aggregator\n  requestheaderExtraHeaderPrefixes:\n

diff --git a/.../complex/data/aws_launch_template_master-us-test-1a.masters.complex.example.com_user_data b/.../complex/data/aws_launch_template_master-us-test-1a.masters.complex.example.com_user_data
@@ -183,9 +183,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.21.0
   kubeletPreferredAddressTypes:
   - InternalIP

diff --git a/...ompress/data/aws_launch_template_master-us-test-1a.masters.compress.example.com_user_data b/...ompress/data/aws_launch_template_master-us-test-1a.masters.compress.example.com_user_data
@@ -128,7 +128,7 @@ function download-release() {
 echo "== nodeup node config starting =="
 ensure-install-dir
 
-echo "H4sIAAAAAAAA/+xW3Y8bNRB/z19hFVV96e1mr0eBVSsRcoULvSsh6QcSqpBjTzYmXns7tvcuiD8ejb1JNrk7SukjJFKyni/Px29mVmgb5NiaparKAWM1N7yCubfIKxhr7hy4knkMMBDWeK4M4CwYr2oo2Y4i90xJVkS091MLiEpCyf4cMMZYC+iUNew5Ox1Ewq+NDpUy7n067gnZA2WzvcmswkZkbZEJVA92wv9MvEfvaX6yboYpaHdg5N+boQfx/sAUYx3zN79pgD1nRyZJI2tPHwyOtD7Lhcw2XlkqATv6zDfOQy3HFdrQsOcJA4xpW11CC7pkyiztYFfVkhXZWfZ0IK1YAxII3Fo1E+M817pDEBiBm3hfBzhmgtYD8EKOdXAe0JEitGB8fOpZf5KdZcWTiFBl7uatwwJG08kcsE0ecK3t9RRVqzRUIMttDNxYs6ltcKPgVyVbcu0iuVGjIBUYAfH2E0YW0YAHl7lWZBKWPGifRNM1YxuML1lBtOBXFtUfnAK8soT7kb7mGzciNwaMLZSRIykRnCvZMItfahbqwCnaVknAkvFrRzkwfKFhJGvlKMZpKnHy6hWvwTVcwKVagtgIDZF8qWrlZ9xUgPFMDioBIyHIx0iaUsacB+PfWh1quOQL0JFznkLrN36f/tpqwBjYHIQ1MjGvgudemWrn5jtYrKxdR+ZbrpW8n/3KSpiB86gEmY20GTgbUMDPwXpOSfBCpjR3ka+8b8o8L06/itkryrPhsDgU3A6dTiNPYPriLs3TAWOq5hWUbP21yyqBmbI51fyEN8olGLVFdlrEOhFDg58iLAERtqV8vWm2l02MBzRcT6bxeGGdN7xO1Xlx0+Ptm4h8QPgQwPkVcAkYwQIy1jhZ5VWFUHFv8Vj2xY1HfhEfySt1s1X55WQGtfVwEiVOjvV+oJZOescKkXUs/8aR6zXcrUJcancQAWFq0Zfs7OxJpPQBOHEuEL6pEq7Mc96oTHUJy4StG0pmBje8bjQQ4ZaFH9+9nL+ZTT7BRG4bMErmbZH/fr12e4vduJlMY7+UrBgOs6dnBI08DhmX+uA7LtZgZBkBlgbM2BqPVmvAq7gqd4NGcA8E6vHkfOb2o8Z7LlbnQL8zah2hNMw3RkwBlZUlK+qhu28IiOQlWUwufvM0uVjsmQQU2sR35i/t4YAwJvMzGzxt8+28uwf7YhfhSd2FuG8CnYCnIXZtmsM9Wnl7TRDCg4PDaTRGkGC84nqbKrp6ivZmU3408CbMEjojj+JcdZ22f+N49C2/do/uD7KJV/Xi6vlLAnOxAhl0Ku89NtxO5vPy0w2W8v7NJOISPkdFE4m5tJl39Jm1vmT5R1B0/mrew3kx7HFs3KnbY0ZY1rsddA6LUFXKVBfcSE3tv40B2jS7LzjKktVQW9xkvOVKk96zYji8Uo+NlbB0B+SHW6Kif/c9Ajz78uHjmOVbolvqgezfl5zymZA/5ZTFvOWYa7XIu0Tne4FbSDXgry2u077tessoYlhzxd2HAMhTjx8ODUpnY+UVN2oJzncXgxf5/h0irzuuG9ScMv3y/8L/1wpPm7WiVzDsJgzFu633XwAAAP//AQAA//9BU/tajA0AAA==" | base64 -d | gzip -d > conf/cluster_spec.yaml
+echo "H4sIAAAAAAAA/+xW648bNRD/nr/CKqr6pbebvR4FVq1EyBUu9K6EpA8kVCHHnmxMvPZ2bO9dEH88Gns3r7ujlH6ERErW8/I8fjOzQtsgx9YsVVUOGKu54RXMvUVewVhz58CVzGOAgbDGc2UAZ8F4VUPJthS5Y0qyIqK9n1pAVBJK9ueAMcZaQKesYc/Z6SASfm10qJRx79NxR8geKJvtTGYVNiJri0ygerAV/mfie/Q9zU/WzTAF7Q6M/Hsz9CDeH5hirGP+5jcNsOfsyCRpZO3pg8GR1me5kNnGK0slYEef+cZ5qOW4Qhsa9jxhgDFtq0toQZdMmaUdbKtasiI7y54OpBVrQAKBW6tmYpznWncIAiNwE+/rAMdM0HoAXsixDs4DOlKEFoyPT3vWn2RnWfEkIlSZu3nrsIDRdDIHbJMHXGt7PUXVKg0VyLKPgRtrNrUNbhT8qmRLrl0kN2oUpAIjIN5+wsgiGvDgMteKTMKSB+2TaLpmbIPxJSuIFvzKovqDU4BXlnA/0td840bkxoCxhTJyJCWCcyUbZvFLzUIdOEXbKglYMn7tKAeGLzSMZK0cxThNJU5eveI1uIYLuFRLEBuhIZIvVa38jJsKMJ7JQSVgJAT5GElTypjzYPxbq0MNl3wBOnLOU2j7jb9Pf201YAxsDsIamZhXwXOvTLV18x0sVtauI/Mt10rez35lJczAeVSCzEbaDJwNKODnYD2nJHghU5q7yFfeN67M8+L0q5i+ojwbDotDyX7qdCp5QtMXd6qeDhhTNa+gZOuvXVYJzJTNqeonvFEuAaktstMiVooYGvwUYQmI0Bfz9abpb5sYD2i4nkzj8cI6b3id6vPiZo+3ayPyAeFDAOdXwCVghAvIWOVklVcVQsW9xWPZFzce+UV8JK/UTa/yy8kMauvhJEqcHOv9QE2d9I4VIutY/o0j12u4W4W41PAgAsLUoi/Z2dmTSNmH4MS5QAjvS8EblakuYZmwdUPJzOCG140GItyy8OO7l/M3s8knmMhtA0bJvC3y36/XbmexGziTaeyYkhXDYfb0jKCRxzHjUid8x8UajCwjwtKIGVvj0WoNeBWX5XbUCO6BYD2enM/cbth4z8XqHOh3Rs0jlIb5xogpoLKyZEU9dPeNAZG8JIvJxW+eJheLHZOAQrv4zvylTRwQxmR+ZoOnfd5PvHuwL7YRntRdiLsm0Al4GmLfpkm8RytvLwpCeHBwOI/GCBKMV1z3qaKrp2hvNuVHA2/CLKEz8ijOVddpu3eOR9/ya/fo/iCbeNVeXHv+ksBcrEAGncp7jw23lfm8/HSDpbx/N4m4hs9R0URiLu3mLX1mrS9Z/hEUnb+a7+G8GO5xbNyq/TEjLOvtFjqHRagqZaoLbqSm9u9jgDZN7wuOsmQ11BY3GW+50qT3rBgOr9RjYyUs3QH5YU9U9O++R4BnXz58HLN8S7SnHsj+fckpnwn5U05ZzFuOuVaLvEt0vhO4hVQD/triOm3crreMIoY1V9x9CIA89fjh0KB0NlZecaOW4Hx3MXiR794i8rrjukHNKdMv/y/8f63wtFkregnDbsJQvH29/wIAAP//AQAA///JK3mEjg0AAA==" | base64 -d | gzip -d > conf/cluster_spec.yaml
 
 echo "H4sIAAAAAAAA/6qu5QIAAAD//wEAAP//BrCh3QMAAAA=" | base64 -d | gzip -d > conf/ig_spec.yaml
 

diff --git a/tests/integration/update_cluster/containerd-custom/cloudformation.json.extracted.yaml b/tests/integration/update_cluster/containerd-custom/cloudformation.json.extracted.yaml
@@ -55,8 +55,8 @@ Resources.AWSEC2LaunchTemplatemasterustest1amasterscontainerdexamplecom.Properti
   \ cloudProvider: aws\n  enableAdmissionPlugins:\n  - NamespaceLifecycle\n  - LimitRanger\n
   \ - ServiceAccount\n  - PersistentVolumeLabel\n  - DefaultStorageClass\n  - DefaultTolerationSeconds\n
   \ - MutatingAdmissionWebhook\n  - ValidatingAdmissionWebhook\n  - NodeRestriction\n
-  \ - ResourceQuota\n  etcdServers:\n  - http://127.0.0.1:4001\n  etcdServersOverrides:\n
-  \ - /events#http://127.0.0.1:4002\n  image: k8s.gcr.io/kube-apiserver:v1.21.0\n
+  \ - ResourceQuota\n  etcdServers:\n  - https://127.0.0.1:4001\n  etcdServersOverrides:\n
+  \ - /events#https://127.0.0.1:4002\n  image: k8s.gcr.io/kube-apiserver:v1.21.0\n
   \ kubeletPreferredAddressTypes:\n  - InternalIP\n  - Hostname\n  - ExternalIP\n
   \ logLevel: 2\n  requestheaderAllowedNames:\n  - aggregator\n  requestheaderExtraHeaderPrefixes:\n
   \ - X-Remote-Extra-\n  requestheaderGroupHeaders:\n  - X-Remote-Group\n  requestheaderUsernameHeaders:\n

diff --git a/tests/integration/update_cluster/containerd/cloudformation.json.extracted.yaml b/tests/integration/update_cluster/containerd/cloudformation.json.extracted.yaml
@@ -49,8 +49,8 @@ Resources.AWSEC2LaunchTemplatemasterustest1amasterscontainerdexamplecom.Properti
   \ enableAdmissionPlugins:\n  - NamespaceLifecycle\n  - LimitRanger\n  - ServiceAccount\n
   \ - PersistentVolumeLabel\n  - DefaultStorageClass\n  - DefaultTolerationSeconds\n
   \ - MutatingAdmissionWebhook\n  - ValidatingAdmissionWebhook\n  - NodeRestriction\n
-  \ - ResourceQuota\n  etcdServers:\n  - http://127.0.0.1:4001\n  etcdServersOverrides:\n
-  \ - /events#http://127.0.0.1:4002\n  image: k8s.gcr.io/kube-apiserver:v1.21.0\n
+  \ - ResourceQuota\n  etcdServers:\n  - https://127.0.0.1:4001\n  etcdServersOverrides:\n
+  \ - /events#https://127.0.0.1:4002\n  image: k8s.gcr.io/kube-apiserver:v1.21.0\n
   \ kubeletPreferredAddressTypes:\n  - InternalIP\n  - Hostname\n  - ExternalIP\n
   \ logLevel: 2\n  requestheaderAllowedNames:\n  - aggregator\n  requestheaderExtraHeaderPrefixes:\n
   \ - X-Remote-Extra-\n  requestheaderGroupHeaders:\n  - X-Remote-Group\n  requestheaderUsernameHeaders:\n

diff --git a/tests/integration/update_cluster/docker-custom/cloudformation.json.extracted.yaml b/tests/integration/update_cluster/docker-custom/cloudformation.json.extracted.yaml
@@ -51,8 +51,8 @@ Resources.AWSEC2LaunchTemplatemasterustest1amastersdockerexamplecom.Properties.L
   \ enableAdmissionPlugins:\n  - NamespaceLifecycle\n  - LimitRanger\n  - ServiceAccount\n
   \ - PersistentVolumeLabel\n  - DefaultStorageClass\n  - DefaultTolerationSeconds\n
   \ - MutatingAdmissionWebhook\n  - ValidatingAdmissionWebhook\n  - NodeRestriction\n
-  \ - ResourceQuota\n  etcdServers:\n  - http://127.0.0.1:4001\n  etcdServersOverrides:\n
-  \ - /events#http://127.0.0.1:4002\n  image: k8s.gcr.io/kube-apiserver:v1.21.0\n
+  \ - ResourceQuota\n  etcdServers:\n  - https://127.0.0.1:4001\n  etcdServersOverrides:\n
+  \ - /events#https://127.0.0.1:4002\n  image: k8s.gcr.io/kube-apiserver:v1.21.0\n
   \ kubeletPreferredAddressTypes:\n  - InternalIP\n  - Hostname\n  - ExternalIP\n
   \ logLevel: 2\n  requestheaderAllowedNames:\n  - aggregator\n  requestheaderExtraHeaderPrefixes:\n
   \ - X-Remote-Extra-\n  requestheaderGroupHeaders:\n  - X-Remote-Group\n  requestheaderUsernameHeaders:\n

diff --git a/...iam/data/aws_launch_template_master-us-test-1a.masters.existing-iam.example.com_user_data b/...iam/data/aws_launch_template_master-us-test-1a.masters.existing-iam.example.com_user_data
@@ -171,9 +171,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.21.0
   kubeletPreferredAddressTypes:
   - InternalIP

diff --git a/...iam/data/aws_launch_template_master-us-test-1b.masters.existing-iam.example.com_user_data b/...iam/data/aws_launch_template_master-us-test-1b.masters.existing-iam.example.com_user_data
@@ -171,9 +171,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.21.0
   kubeletPreferredAddressTypes:
   - InternalIP

diff --git a/...iam/data/aws_launch_template_master-us-test-1c.masters.existing-iam.example.com_user_data b/...iam/data/aws_launch_template_master-us-test-1c.masters.existing-iam.example.com_user_data
@@ -171,9 +171,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.21.0
   kubeletPreferredAddressTypes:
   - InternalIP

diff --git a/...integration/update_cluster/existing_iam_cloudformation/cloudformation.json.extracted.yaml b/...integration/update_cluster/existing_iam_cloudformation/cloudformation.json.extracted.yaml
@@ -49,8 +49,8 @@ Resources.AWSEC2LaunchTemplatemasterustest1amastersminimalexamplecom.Properties.
   \ enableAdmissionPlugins:\n  - NamespaceLifecycle\n  - LimitRanger\n  - ServiceAccount\n
   \ - PersistentVolumeLabel\n  - DefaultStorageClass\n  - DefaultTolerationSeconds\n
   \ - MutatingAdmissionWebhook\n  - ValidatingAdmissionWebhook\n  - NodeRestriction\n
-  \ - ResourceQuota\n  etcdServers:\n  - http://127.0.0.1:4001\n  etcdServersOverrides:\n
-  \ - /events#http://127.0.0.1:4002\n  image: k8s.gcr.io/kube-apiserver:v1.21.0\n
+  \ - ResourceQuota\n  etcdServers:\n  - https://127.0.0.1:4001\n  etcdServersOverrides:\n
+  \ - /events#https://127.0.0.1:4002\n  image: k8s.gcr.io/kube-apiserver:v1.21.0\n
   \ kubeletPreferredAddressTypes:\n  - InternalIP\n  - Hostname\n  - ExternalIP\n
   \ logLevel: 2\n  requestheaderAllowedNames:\n  - aggregator\n  requestheaderExtraHeaderPrefixes:\n
   \ - X-Remote-Extra-\n  requestheaderGroupHeaders:\n  - X-Remote-Group\n  requestheaderUsernameHeaders:\n

diff --git a/...ng_sg/data/aws_launch_template_master-us-test-1a.masters.existingsg.example.com_user_data b/...ng_sg/data/aws_launch_template_master-us-test-1a.masters.existingsg.example.com_user_data
@@ -171,9 +171,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.21.0
   kubeletPreferredAddressTypes:
   - InternalIP

diff --git a/...ng_sg/data/aws_launch_template_master-us-test-1b.masters.existingsg.example.com_user_data b/...ng_sg/data/aws_launch_template_master-us-test-1b.masters.existingsg.example.com_user_data
@@ -171,9 +171,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.21.0
   kubeletPreferredAddressTypes:
   - InternalIP

diff --git a/...ng_sg/data/aws_launch_template_master-us-test-1c.masters.existingsg.example.com_user_data b/...ng_sg/data/aws_launch_template_master-us-test-1c.masters.existingsg.example.com_user_data
@@ -171,9 +171,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.21.0
   kubeletPreferredAddressTypes:
   - InternalIP

diff --git a/tests/integration/update_cluster/externallb/cloudformation.json.extracted.yaml b/tests/integration/update_cluster/externallb/cloudformation.json.extracted.yaml
@@ -49,8 +49,8 @@ Resources.AWSEC2LaunchTemplatemasterustest1amastersexternallbexamplecom.Properti
   \ enableAdmissionPlugins:\n  - NamespaceLifecycle\n  - LimitRanger\n  - ServiceAccount\n
   \ - PersistentVolumeLabel\n  - DefaultStorageClass\n  - DefaultTolerationSeconds\n
   \ - MutatingAdmissionWebhook\n  - ValidatingAdmissionWebhook\n  - NodeRestriction\n
-  \ - ResourceQuota\n  etcdServers:\n  - http://127.0.0.1:4001\n  etcdServersOverrides:\n
-  \ - /events#http://127.0.0.1:4002\n  image: k8s.gcr.io/kube-apiserver:v1.21.0\n
+  \ - ResourceQuota\n  etcdServers:\n  - https://127.0.0.1:4001\n  etcdServersOverrides:\n
+  \ - /events#https://127.0.0.1:4002\n  image: k8s.gcr.io/kube-apiserver:v1.21.0\n
   \ kubeletPreferredAddressTypes:\n  - InternalIP\n  - Hostname\n  - ExternalIP\n
   \ logLevel: 2\n  requestheaderAllowedNames:\n  - aggregator\n  requestheaderExtraHeaderPrefixes:\n
   \ - X-Remote-Extra-\n  requestheaderGroupHeaders:\n  - X-Remote-Group\n  requestheaderUsernameHeaders:\n

diff --git a/...nallb/data/aws_launch_template_master-us-test-1a.masters.externallb.example.com_user_data b/...nallb/data/aws_launch_template_master-us-test-1a.masters.externallb.example.com_user_data
@@ -171,9 +171,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.21.0
   kubeletPreferredAddressTypes:
   - InternalIP

diff --git a/...data/aws_launch_template_master-us-test-1a.masters.externalpolicies.example.com_user_data b/...data/aws_launch_template_master-us-test-1a.masters.externalpolicies.example.com_user_data
@@ -172,9 +172,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.21.0
   kubeletPreferredAddressTypes:
   - InternalIP

diff --git a/...te_cluster/ha/data/aws_launch_template_master-us-test-1a.masters.ha.example.com_user_data b/...te_cluster/ha/data/aws_launch_template_master-us-test-1a.masters.ha.example.com_user_data
@@ -171,9 +171,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.21.0
   kubeletPreferredAddressTypes:
   - InternalIP

diff --git a/...te_cluster/ha/data/aws_launch_template_master-us-test-1b.masters.ha.example.com_user_data b/...te_cluster/ha/data/aws_launch_template_master-us-test-1b.masters.ha.example.com_user_data
@@ -171,9 +171,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.21.0
   kubeletPreferredAddressTypes:
   - InternalIP

diff --git a/...te_cluster/ha/data/aws_launch_template_master-us-test-1c.masters.ha.example.com_user_data b/...te_cluster/ha/data/aws_launch_template_master-us-test-1c.masters.ha.example.com_user_data
@@ -171,9 +171,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.21.0
   kubeletPreferredAddressTypes:
   - InternalIP

diff --git a/...le_compute_instance_template_master-us-test1-a-ha-gce-example-com_metadata_startup-script b/...le_compute_instance_template_master-us-test1-a-ha-gce-example-com_metadata_startup-script
@@ -173,9 +173,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.21.0
   kubeletPreferredAddressTypes:
   - InternalIP

diff --git a/...le_compute_instance_template_master-us-test1-b-ha-gce-example-com_metadata_startup-script b/...le_compute_instance_template_master-us-test1-b-ha-gce-example-com_metadata_startup-script
@@ -173,9 +173,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.21.0
   kubeletPreferredAddressTypes:
   - InternalIP

diff --git a/...le_compute_instance_template_master-us-test1-c-ha-gce-example-com_metadata_startup-script b/...le_compute_instance_template_master-us-test1-c-ha-gce-example-com_metadata_startup-script
@@ -173,9 +173,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.21.0
   kubeletPreferredAddressTypes:
   - InternalIP

diff --git a/...ter/irsa/data/aws_launch_template_master-us-test-1a.masters.minimal.example.com_user_data b/...ter/irsa/data/aws_launch_template_master-us-test-1a.masters.minimal.example.com_user_data
@@ -171,9 +171,9 @@ kubeAPIServer:
   - NodeRestriction
   - ResourceQuota
   etcdServers:
-  - http://127.0.0.1:4001
+  - https://127.0.0.1:4001
   etcdServersOverrides:
-  - /events#http://127.0.0.1:4002
+  - /events#https://127.0.0.1:4002
   image: k8s.gcr.io/kube-apiserver:v1.20.0
   kubeletPreferredAddressTypes:
   - InternalIP