kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
kubeadmConfigPatches:
  - |
    apiVersion: kubeadm.k8s.io/v1beta2
    kind: ClusterConfiguration
    metadata:
      name: config
    apiServer:
      extraArgs:
        service-account-key-file: /etc/kubernetes/pki/sa.pub
        service-account-signing-key-file: /etc/kubernetes/pki/sa.key
        service-account-issuer: api,spire-agent
        api-audiences: api,spire-server
        # admission-control-config-file: /etc/kubernetes/pki/admctrl/admission-control.yaml
nodes:
  - role: control-plane
    extraMounts:
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public
  - role: worker
    extraMounts:
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-2-a/public
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-2-b/public
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
      # One spire-ha-agent on the host is shared by all three virtual nodes, with a
      # spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
      # package installed spire-ha-agent@main listens, so kubelet's configuration in
      # the node is the same one a real bare metal node would use.
      - hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-2/public
        containerPath: /var/run/spire/agent/sockets/main/public
      - hostPath: ./.github/kind/conf/credential-providers
        containerPath: /credential-plugins
      - hostPath: ./.github/kind/conf/credential-provider-config.yaml
        containerPath: /etc/kubernetes/credential-provider-config.yaml
    kubeadmConfigPatches:
      - |
        apiVersion: kubeadm.k8s.io/v1beta3
        kind: JoinConfiguration
        nodeRegistration:
          kubeletExtraArgs:
            image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
            image-credential-provider-bin-dir: /credential-plugins
    kubeadmConfigPatchesJSON6902:
      - group: kubeadm.k8s.io
        version: v1beta4
        kind: JoinConfiguration
        patch: |
          - op: add
            path: /nodeRegistration/kubeletExtraArgs/-
            value:
              name: image-credential-provider-config
              value: /etc/kubernetes/credential-provider-config.yaml
          - op: add
            path: /nodeRegistration/kubeletExtraArgs/-
            value:
              name: image-credential-provider-bin-dir
              value: /credential-plugins
  - role: worker
    extraMounts:
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-3-a/public
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-3-b/public
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
      # One spire-ha-agent on the host is shared by all three virtual nodes, with a
      # spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
      # package installed spire-ha-agent@main listens, so kubelet's configuration in
      # the node is the same one a real bare metal node would use.
      - hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-3/public
        containerPath: /var/run/spire/agent/sockets/main/public
      - hostPath: ./.github/kind/conf/credential-providers
        containerPath: /credential-plugins
      - hostPath: ./.github/kind/conf/credential-provider-config.yaml
        containerPath: /etc/kubernetes/credential-provider-config.yaml
    kubeadmConfigPatches:
      - |
        apiVersion: kubeadm.k8s.io/v1beta3
        kind: JoinConfiguration
        nodeRegistration:
          kubeletExtraArgs:
            image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
            image-credential-provider-bin-dir: /credential-plugins
    kubeadmConfigPatchesJSON6902:
      - group: kubeadm.k8s.io
        version: v1beta4
        kind: JoinConfiguration
        patch: |
          - op: add
            path: /nodeRegistration/kubeletExtraArgs/-
            value:
              name: image-credential-provider-config
              value: /etc/kubernetes/credential-provider-config.yaml
          - op: add
            path: /nodeRegistration/kubeletExtraArgs/-
            value:
              name: image-credential-provider-bin-dir
              value: /credential-plugins
  - role: worker
    extraMounts:
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-4-a/public
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-4-b/public
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
      # One spire-ha-agent on the host is shared by all three virtual nodes, with a
      # spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
      # package installed spire-ha-agent@main listens, so kubelet's configuration in
      # the node is the same one a real bare metal node would use.
      - hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-4/public
        containerPath: /var/run/spire/agent/sockets/main/public
      - hostPath: ./.github/kind/conf/credential-providers
        containerPath: /credential-plugins
      - hostPath: ./.github/kind/conf/credential-provider-config.yaml
        containerPath: /etc/kubernetes/credential-provider-config.yaml
    kubeadmConfigPatches:
      - |
        apiVersion: kubeadm.k8s.io/v1beta3
        kind: JoinConfiguration
        nodeRegistration:
          kubeletExtraArgs:
            image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
            image-credential-provider-bin-dir: /credential-plugins
    kubeadmConfigPatchesJSON6902:
      - group: kubeadm.k8s.io
        version: v1beta4
        kind: JoinConfiguration
        patch: |
          - op: add
            path: /nodeRegistration/kubeletExtraArgs/-
            value:
              name: image-credential-provider-config
              value: /etc/kubernetes/credential-provider-config.yaml
          - op: add
            path: /nodeRegistration/kubeletExtraArgs/-
            value:
              name: image-credential-provider-bin-dir
              value: /credential-plugins