kube-apiserver-pod.yaml

kind: Pod
apiVersion: v1
metadata:
  name: bootstrap-kube-apiserver
  # Use the same namespace for the bootstrap apiserver as the post-bootstrap
  # apiserver for compatibility with a single-node (SNO) cluster.
  namespace: openshift-kube-apiserver
  labels:
    openshift.io/control-plane: "true"
    openshift.io/component: "api"
  annotations:
    openshift.io/run-level: "0"
    kubectl.kubernetes.io/default-logs-container: kube-apiserver
    target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
spec:
  restartPolicy: Always
  hostNetwork: true
  initContainers:
  - name: setup
    terminationMessagePolicy: FallbackToLogsOnError
    image: {{ .Image }}
    imagePullPolicy: IfNotPresent
    volumeMounts:
    - mountPath: /var/log/kube-apiserver
      name: audit-dir
    command: ['/bin/bash', '-ec']
    args:
    - |
      echo -n "Fixing audit permissions."
      chmod 0700 /var/log/kube-apiserver && touch /var/log/kube-apiserver/audit.log && chmod 0600 /var/log/kube-apiserver/*
    securityContext:
      privileged: true
    resources:
      requests:
        memory: 50Mi
        cpu: 5m
  containers:
  - name: kube-apiserver
    image: {{ .Image }}
    imagePullPolicy: {{ .ImagePullPolicy }}
    terminationMessagePolicy: FallbackToLogsOnError
    command: [ "/bin/bash", "-ec" ]
    args:
    - >
      hyperkube kube-apiserver
      --openshift-config=/etc/kubernetes/config/{{ .ConfigFileName }}
      --v=2
      --advertise-address=${HOST_IP}
    resources:
      requests:
        memory: 1Gi
        cpu: 265m
    volumeMounts:
    - mountPath: /etc/ssl/certs
      name: ssl-certs-host
      readOnly: true
    - mountPath: /etc/kubernetes/secrets
      name: secrets
      readOnly: true
    - mountPath: /etc/kubernetes/cloud
      name: etc-kubernetes-cloud
      readOnly: true
    - mountPath: /etc/kubernetes/config
      name: config
      readOnly: true
    - mountPath: /var/log/bootstrap-control-plane
      name: logs
    - mountPath: /var/log/kube-apiserver
      name: audit-dir
    livenessProbe:
      httpGet:
        scheme: HTTPS
        port: 6443
        path: livez?exclude=etcd
      initialDelaySeconds: 0
      periodSeconds: 10
      timeoutSeconds: 10
      successThreshold: 1
      failureThreshold: 3
    readinessProbe:
      httpGet:
        scheme: HTTPS
        port: 6443
        path: readyz
      initialDelaySeconds: 0
      periodSeconds: 5
      timeoutSeconds: 10
      successThreshold: 1
      failureThreshold: 3
    startupProbe:
      httpGet:
        scheme: HTTPS
        port: 6443
        path: livez
      initialDelaySeconds: 0
      periodSeconds: 5
      timeoutSeconds: 10
      successThreshold: 1
      failureThreshold: 30
    env:
    - name: HOST_IP
      valueFrom:
        fieldRef:
          fieldPath: status.hostIP
  {{if .OperatorImage}}
  - name: kube-apiserver-insecure-readyz
    image: {{.OperatorImage}}
    imagePullPolicy: IfNotPresent
    terminationMessagePolicy: FallbackToLogsOnError
    command: ["cluster-kube-apiserver-operator", "insecure-readyz"]
    args:
    - --insecure-port=6080
    - --delegate-url=https://localhost:6443/readyz
    ports:
    - containerPort: 6080
    resources:
      requests:
        memory: 50Mi
        cpu: 5m
{{end}}
  terminationGracePeriodSeconds: {{ .TerminationGracePeriodSeconds }}
  volumes:
  - hostPath:
      path: {{ .SecretsHostPath }}
    name: secrets
  - hostPath:
      path: {{ .CloudProviderHostPath }}
    name: etc-kubernetes-cloud
  - hostPath:
      path: {{ .ConfigHostPath }}
    name: config
  - hostPath:
      path: /etc/ssl/certs
    name: ssl-certs-host
  - hostPath:
      path: /var/log/bootstrap-control-plane
    name: logs
  - hostPath:
      path: /var/log/kube-apiserver
    name: audit-dir