Change:
We need to document all the configuration derived by Salt. Ideally this would be a markdown doc that we kept as live documentation within the project. The main reasons to bother: It's hard right now for anyone approaching the directory to get a big picture view of what's is going on, especially across providers. If we ever want to do something disciplined w.r.t. upgrade between (non-dev) versions, we're probably going to need a place to look for the state of the world. Decreasing the velocity with which people can add to Salt configuration will encourage people to delete more Salt configuration. cc

Discussion:
<ins> # SaltStack configuration This is the root of the SaltStack configuration for Kubernetes. A high level overview for the Kubernetes SaltStack configuration can be found [in the docs tree.](../../docs/salt.md) This SaltStack configuration currently applies to default configurations for Debian-on-GCE, Fedora-on-Vagrant, Ubuntu-on-AWS and Ubuntu-on-Azure. (That doesn't mean it can't be made to apply to an arbitrary configuration, but those are only the in-tree OS/IaaS combinations supported today.) As you peruse the configuration, these are shorthanded as `gce`, `vagrant`, `aws`, `azure` in `grains.cloud`; the documentation in this tree uses this same shorthand for convenience. See more: * [pillar](pillar/) * [reactor](reactor/) * [salt](salt/) </ins>

# limitations under the License. # This script will set up the salt directory on the target server.  It takes one <del> # argument that is a tarball with the pre-compiled kuberntes server binaries. </del> <ins> # argument that is a tarball with the pre-compiled kubernetes server binaries. </ins> set -o errexit set -o nounset

<ins> The [SaltStack pillar](http://docs.saltstack.com/en/latest/topics/pillar/) data is partially statically dervied from the contents of this directory. The bulk of the pillars are hard to perceive from browsing this directory, though, because they are written into [cluster-params.sls](cluster-params.sls) at cluster inception. * [cluster-params.sls](cluster-params.sls) is generated entirely at cluster inception. See e.g. [configure-vm.sh](../../gce/configure-vm.sh#L226) * [docker-images.sls](docker-images.sls) stores the Docker tags of the current Docker-wrapped server binaries, twiddling by the Salt install script * [logging.sls](logging.sls) defines the cluster log level * [mine.sls](mine.sls): defines the variables shared across machines in the Salt mine. It is starting to be largely deprecated in use, and is totally unavailable on GCE, which runs standalone. * [privilege.sls](privilege.sls) defines whether privileged containers are allowed. * [top.sls](top.sls) defines which pillars are active across the cluster. ## Future work Document the current pillars across providers </ins>

<ins> [SaltStack reactor](http://docs.saltstack.com/en/latest/topics/reactor/) files, largely defining reactions to new nodes. **Ignored for GCE, which runs standalone on each machine** </ins>

<ins> This directory forms the base of the main SaltStack configuration. The place to start with any SaltStack configuration is [top.sls](top.sls). However, unless you are particularly keen on reading Jinja templates, the following tables break down what configurations run on what providers. (NB: The [_states](_states/) directory is a special directory included by Salt for `ensure` blocks, and is only used for the [docker](docker/) config.) Key: M = Config applies to master, n = config applies to nodes Config                                              | GCE   | Vagrant | AWS | Azure ----------------------------------------------------|-------|---------|-----|------ [cadvisor](cadvisor/)                               | M n   | M n     | M n | M n [debian-auto-upgrades](debian-auto-upgrades/)       | M n   | M n     | M n | M n [docker](docker/)                                   | M n   | M n     | M n |   n [etcd](etcd/)                                       | M     | M       | M   | M [fluentd-es](fluentd-es/) (pillar conditional)      | M n   | M n     | M n | M n [fluentd-gcp](fluentd-gcp/) (pillar conditional)    | M n   | M n     | M n | M n [generate-cert](generate-cert/)                     | M     | M       | M   | M [kube-addons](kube-addons/)                         | M     | M       | M   | M [kube-apiserver](kube-apiserver/)                   | M     | M       | M   | M [kube-controller-manager](kube-controller-manager/) | M     | M       | M   | M [kube-proxy](kube-proxy/)                           |   n   |   n     |   n |   n [kube-scheduler](kube-scheduler/)                   | M     | M       | M   | M [kubelet](kubelet/)                                 | M n   | M n     | M n |   n [logrotate](logrotate/)                             | M n   |   n     | M n | M n [monit](monit/)                                     | M n   | M n     | M n | M n [nginx](nginx/)                                     | M     | M       | M   | M [openvpn-client](openvpn-client/)                   |       |         |     |   n [openvpn](openvpn/)                                 |       |         |     | M [sdn](sdn/) (Vagrant only)                          |   n   | M n     |   n | [static-routes](static-routes/) (vsphere only)      |       |         |     | [base](base.sls)                                    | M n   | M n     | M n | M n [kube-client-tools](kube-client-tools.sls)          | M     | M       | M   | M </ins>

## Salt cluster setup <del> The **salt-master** service runs on the kubernetes-master node. </del> <ins> The **salt-master** service runs on the kubernetes-master node [(except on the default GCE setup)](#standalone-salt-configuration-on-gce). </ins> The **salt-minion** service runs on the kubernetes-master node and each kubernetes-minion node in the cluster. <del> Each salt-minion service is configured to interact with the **salt-master** service hosted on the kubernetes-master via the **master.conf** file. </del> <ins> Each salt-minion service is configured to interact with the **salt-master** service hosted on the kubernetes-master via the **master.conf** file [(except on GCE)](#standalone-salt-configuration-on-gce). </ins> ``` [root@kubernetes-master] $ cat /etc/salt/minion.d/master.conf

If you are running the Vagrant based environment, the **salt-api** service is running on the kubernetes-master.  It is configured to enable the vagrant user to introspect the salt cluster in order to find out about machines in the Vagrant environment via a REST API. <ins> ## Standalone Salt Configuration on GCE On GCE, the master and nodes are all configured as [standalone minions](http://docs.saltstack.com/en/latest/topics/tutorials/standalone_minion.html). The configuration for each VM is derived from the VM's [instance metadata](https://cloud.google.com/compute/docs/metadata) and then stored in Salt grains (`/etc/salt/minion.d/grains.conf`) and pillars (`/srv/salt-overlay/pillar/cluster-params.sls`) that local Salt uses to enforce state. All remaining sections that refer to master/minion setups should be ignored for GCE. One fallout of the GCE setup is that the Salt mine doesn't exist - there is no sharing of configuration amongst nodes. </ins> ## Salt security <ins> *(Not applicable on default GCE setup.)* </ins> Security is not enabled on the salt-master, and the salt-master is configured to auto-accept incoming requests from minions.  It is not recommended to use this security configuration in production environments without deeper study.  (In some environments this isn't as bad as it might sound if the salt master port isn't externally accessible and you trust everyone on your network.) ```

open_mode: True auto_accept: True ``` ## Salt minion configuration Each minion in the salt cluster has an associated configuration that instructs the salt-master how to provision the required resources on the machine.

`api_servers` | (Optional) The IP address / host name where a kubelet can get read-only access to kube-apiserver `cbr-cidr` | (Optional) The minion IP address range used for the docker container bridge. `cloud` | (Optional) Which IaaS platform is used to host kubernetes, *gce*, *azure*, *aws*, *vagrant* <del> `etcd_servers` | (Optional) Comma-delimited list of IP addresses the kube-apiserver and kubelet use to reach etcd.  Uses the IP of the first machine in the kubernetes_master role. `hostnamef` | (Optional) The full host name of the machine, i.e. hostname -f </del> <ins> `etcd_servers` | (Optional) Comma-delimited list of IP addresses the kube-apiserver and kubelet use to reach etcd.  Uses the IP of the first machine in the kubernetes_master role, or 127.0.0.1 on GCE. `hostnamef` | (Optional) The full host name of the machine, i.e. hostname -f (only used on Azure) </ins> `node_ip` | (Optional) The IP address to use to address this node `minion_ip` | (Optional) Mapped to the kubelet hostname_override, K8S TODO - change this name `network_mode` | (Optional) Networking model to use among nodes: *openvswitch*

Per pod IP configuration is provider specific, so when making networking changes, its important to sand-box these as all providers may not use the same mechanisms (iptables, openvswitch, etc.) We should define a grains.conf key that captures more specifically what network configuration environment is being used to avoid future confusion across providers. <ins> ## Further reading The [cluster/saltbase](../cluster/saltbase) tree has more details on the current SaltStack configuration. </ins>