chore(): updated kubeapi listener port

terraform/main/configs/cloud_init/main_master.yaml

@@ -60,19 +60,22 @@ runcmd:
         --disable coredns,traefik,local-storage,metrics-server,runtimes \
         --disable-network-policy \
         --disable-kube-proxy \
+        --disable-cloud-controller \
+        --disable-helm-controller \
         --flannel-backend none \
         --egress-selector-mode agent \
         --servicelb-namespace kube-system \
         --nonroot-devices \
+        --secrets-encryption \
         --secrets-encryption-provider secretbox \
         --lb-server-port 6444 \
+        --etcd-expose-metrics \
         --write-kubeconfig-mode 0600 \
         --write-kubeconfig-group root \
         --write-kubeconfig ${k3s_dir}/kubeconfig/config \
         --image-credential-provider-bin-dir /var/lib/rancher/credentialprovider/bin \
         --image-credential-provider-config /var/lib/rancher/credentialprovider/config.yaml \
-        --data-dir=${k3s_dir} \
+        --data-dir=${k3s_dir}" sh -
-        --default-local-storage-path=${k3s_dir}/storage" sh -
   - |
     curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
   - |

terraform/main/configs/cloud_init/master.yaml

@@ -59,19 +59,22 @@ runcmd:
         --disable coredns,traefik,local-storage,metrics-server,runtimes \
         --disable-network-policy \
         --disable-kube-proxy \
+        --disable-cloud-controller \
+        --disable-helm-controller \
         --flannel-backend none \
         --egress-selector-mode agent \
         --servicelb-namespace kube-system \
         --nonroot-devices \
+        --secrets-encryption \
         --secrets-encryption-provider secretbox \
         --lb-server-port 6444 \
+        --etcd-expose-metrics \
         --write-kubeconfig-mode 0600 \
         --write-kubeconfig-group root \
         --write-kubeconfig ${k3s_dir}/kubeconfig/config \
         --image-credential-provider-bin-dir /var/lib/rancher/credentialprovider/bin \
         --image-credential-provider-config /var/lib/rancher/credentialprovider/config.yaml \
-        --data-dir=${k3s_dir} \
+        --data-dir=${k3s_dir}" sh -
-        --default-local-storage-path=${k3s_dir}/storage" sh -
   - |
     mkdir -p /home/ubuntu/.kube
     cp ${k3s_dir}/kubeconfig/config /home/ubuntu/.kube/config

terraform/main/instance.tf

@@ -1,16 +1,16 @@
 resource "terraform_data" "k8s_main_master_user_data" {
   input = templatefile("${path.module}/configs/cloud_init/main_master.yaml", {
-      k3s_credential_provider_config = base64encode(file("${path.module}/configs/k3s/credentialprovider.yaml"))
+    k3s_credential_provider_config = base64encode(file("${path.module}/configs/k3s/credentialprovider.yaml"))
-      k3s_credential_provider        = base64encode(file("${path.module}/configs/k3s/yc-credential-provider"))
+    k3s_credential_provider        = base64encode(file("${path.module}/configs/k3s/yc-credential-provider"))
-      k3s_dir                        = local.k3s_data_dir
+    k3s_dir                        = local.k3s_data_dir
-      k3s_token                      = random_password.k3s_token.result
+    k3s_token                      = random_password.k3s_token.result
-      k3s_fqdn                       = var.cluster_domain
+    k3s_fqdn                       = var.cluster_domain
-      yc_cloud_id                    = var.cloud_id
+    yc_cloud_id                    = var.cloud_id
-    })
+  })
 }
 
 resource "yandex_compute_instance" "k8s_main_master" {
-  name               = "k8s-master"
+  name               = "master-0-ru-central1-d-k8s"
   hostname           = local.k8s_main_master_fqdn
   description        = "Salt, ansible and kubernetes master, provisions other nodes"
   platform_id        = "standard-v3"
@@ -77,7 +77,7 @@ resource "yandex_compute_instance" "k8s_main_master" {
     enable-oslogin        = true
     serial-port-enable    = 1
     install-unified-agent = 0
-    user-data = terraform_data.k8s_main_master_user_data.output
+    user-data             = terraform_data.k8s_main_master_user_data.output
   }
 
   metadata_options {

terraform/main/instance_group.tf

@@ -9,7 +9,7 @@ resource "yandex_compute_instance_group" "k8s_master" {
   }
 
   instance_template {
-    name     = "k8s-master-{instance.index_in_zone}-{instance.zone_id}"
+    name     = "master-{instance.index_in_zone}-{instance.zone_id}-k8s"
     hostname = "master-{instance.index_in_zone}.{instance.zone_id}.k8s.internal"
     labels = {
       "instance-group" = "master"
@@ -105,10 +105,10 @@ resource "yandex_compute_instance_group" "k8s_master" {
     ignore_health_checks         = true
   }
   health_check {
-    healthy_threshold   = 2
+    healthy_threshold   = 3
-    unhealthy_threshold = 2
+    unhealthy_threshold = 3
-    interval            = 2
+    interval            = 10
-    timeout             = 1
+    timeout             = 9
 
     tcp_options {
       port = 6443
@@ -135,7 +135,7 @@ resource "yandex_compute_instance_group" "k8s_worker" {
   }
 
   instance_template {
-    name     = "k8s-worker-{instance.index_in_zone}-{instance.zone_id}"
+    name     = "worker-{instance.index_in_zone}-{instance.zone_id}-k8s"
     hostname = "worker-{instance.index_in_zone}.{instance.zone_id}.k8s.internal"
     labels = {
       "instance-group" = "worker"
@@ -230,10 +230,10 @@ resource "yandex_compute_instance_group" "k8s_worker" {
     ignore_health_checks         = true
   }
   health_check {
-    healthy_threshold   = 2
+    healthy_threshold   = 3
-    unhealthy_threshold = 2
+    unhealthy_threshold = 3
-    interval            = 2
+    interval            = 10
-    timeout             = 1
+    timeout             = 9
 
     tcp_options {
       port = 80

terraform/main/loadbalancer.tf

@@ -5,7 +5,7 @@ resource "yandex_lb_network_load_balancer" "k8s_lb" {
 
   listener {
     name = "kubeapi"
-    port = 6443
+    port = 8443
     external_address_spec {
       address    = yandex_vpc_address.nlb.external_ipv4_address[0].address
       ip_version = "ipv4"