[CE-271] Ansible agent needs to be updated

When upgrade default k8s version to 1.9.1, the
dashboard won't work any more. This patch added few
certificates and user file to make sure that k8s
dashboard is now being served at https.

Change-Id: I8b2de3f07a3eeae7fdd52ae1cb2c7e4e7ee99df3
Signed-off-by: tongliofcary <[email protected]>

docs/worker_ansible_howto.md

@@ -404,6 +404,23 @@ bin: The url point to the fabric binary tar gz file which contains
     configtxgen, configtxlator, cryptogen etc.
 ```
 
+## <a name="k8s-admin-dashboard"></a>K8S admin dashboard
+
+Started in cello 0.8.0, ansible agent has been upgraded to secure enable
+k8s dashboard when you choose to deploy fabric network over k8s. Ansible
+agent comes with a set of self-signed certificates in a directory named
+secrets/certs, if you do not want to use the default certificates, you
+should replace these certificates with your own. Agent also provides a pair
+of users named admin and fabric. They were defined in secrets/users/token.csv
+file. You can change and set your own password before you run the playbooks.
+Once you have everything setup, you should be able to access k8s dashboard
+at the following url:
+
+        https://<node_ip>>:32334/
+
+When you are asked for the token, you can use either either token `admintoken`
+or `fabrictoken` to login.
+
 ## <a name="running-an-ansible-playbook"></a>Running an ansible playbook
 
 Ansible allows you to run tasks in a playbook with particular tags or skip

src/agent/ansible/roles/env_k8s/master/tasks/apply.yml

@@ -16,7 +16,8 @@
     mode: 0775
   with_items:
     - "{{ fabricroot }}/bin"
-    - "/etc/kubernetes"
+    - "/etc/kubernetes/secrets/certs"
+    - "/etc/kubernetes/secrets/users"
 
 - name: Create etcd cluster endpoint parameter
   set_fact:
@@ -64,13 +65,27 @@
       --bind-address={{ private_ip }}
       --insecure-bind-address={{ private_ip }}
       --allow-privileged=true
+      --tls-cert-file=/etc/kubernetes/secrets/certs/server.crt
+      --tls-private-key-file=/etc/kubernetes/secrets/certs/server.key
+      --token-auth-file=/etc/kubernetes/secrets/users/token.csv
+      --admission-control=NamespaceLifecycle,LimitRanger,PersistentVolumeLabel,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota
     controller_params: >-
       --master=http://{{ private_ip }}:8080
       --cluster-cidr={{ cluster.container_network.Network }}
       --cluster-name=k8s
     scheduler_params: >-
       --master=http://{{ private_ip }}:8080
 
+- name: Upload certificats
+  copy:
+    src: "{{ playbook_dir }}/../../secrets/{{ item }}"
+    dest: "/etc/kubernetes/secrets/{{ item }}"
+    mode: 0644
+  with_items:
+    - certs/server.crt
+    - certs/server.key
+    - users/token.csv
+
 - name: Configure the services
   template:
     src: "{{ playbook_dir }}/../env_k8s/worker/templates/k8s.conf.j2"
@@ -99,4 +114,4 @@
   with_items:
     - kube-apiserver
     - kube-controller-manager
-    - kube-scheduler
+    - kube-scheduler

src/agent/ansible/roles/env_k8s/post/tasks/apply.yml

@@ -26,9 +26,14 @@
     {{ fabricroot }}/bin/kubectl --server={{ private_ip }}:8080 label --overwrite=true
     nodes {{ node_name }} dashboardId=master
 
+- name: Create secret for dashboard
+  command: >-
+    {{ fabricroot }}/bin/kubectl --server={{ private_ip }}:8080 create secret generic
+    kubernetes-dashboard-certs --from-file=/etc/kubernetes/secrets/certs -n kube-system
+
 - name: Create addon services
   command: >-
-    {{ fabricroot }}/bin/kubectl --server={{ private_ip }}:8080 create
+    {{ fabricroot }}/bin/kubectl --server={{ private_ip }}:8080 apply
     -f /etc/kubernetes/{{ item }}.yaml
   with_items:
     - dnscontroller

src/agent/ansible/roles/env_k8s/post/templates/dashboard.j2

@@ -14,11 +14,78 @@
 
 # Configuration to deploy release version of the Dashboard UI.
 #
-# Example usage: kubectl create -f <this_file>
+# Example usage: kubectl apply -f <this_file>
+
+# ------------------- Dashboard Secret ------------------- #
+
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard-certs
+  namespace: kube-system
+type: Opaque
+
+---
+# ------------------- Dashboard Service Account ------------------- #
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kube-system
 
 ---
+# ------------------- Dashboard Role & Role Binding ------------------- #
+
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: kubernetes-dashboard-minimal
+  namespace: kube-system
+rules:
+  # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret.
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["create"]
+  # Allow Dashboard to create 'kubernetes-dashboard-settings' config map.
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["create"]
+  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]
+  verbs: ["get", "update", "delete"]
+  # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
+- apiGroups: [""]
+  resources: ["configmaps"]
+  resourceNames: ["kubernetes-dashboard-settings"]
+  verbs: ["get", "update"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: kubernetes-dashboard-minimal
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubernetes-dashboard-minimal
+subjects:
+- kind: ServiceAccount
+  name: kubernetes-dashboard
+  namespace: kube-system
+
+---
+# ------------------- Dashboard Deployment ------------------- #
+
 kind: Deployment
-apiVersion: extensions/v1beta1
+apiVersion: apps/v1beta2
 metadata:
   labels:
     k8s-app: kubernetes-dashboard
@@ -39,24 +106,41 @@ spec:
         dashboardId: master
       containers:
       - name: kubernetes-dashboard
-        image: gcr.io/google_containers/kubernetes-dashboard-amd64:v1.6.1
+        image: gcr.io/google-containers/kubernetes-dashboard-amd64:v1.8.2
         ports:
-        - containerPort: 9090
+        - containerPort: 8443
           protocol: TCP
         args:
+          - --auto-generate-certificates
           - --apiserver-host=http://{{ private_ip }}:8080
+        volumeMounts:
+        - name: kubernetes-dashboard-certs
+          mountPath: /certs
+          # Create on-disk volume to store exec logs
+        - mountPath: /tmp
+          name: tmp-volume
         livenessProbe:
           httpGet:
+            scheme: HTTPS
             path: /
-            port: 9090
+            port: 8443
           initialDelaySeconds: 30
           timeoutSeconds: 30
+      volumes:
+      - name: kubernetes-dashboard-certs
+        secret:
+          secretName: kubernetes-dashboard-certs
+      - name: tmp-volume
+        emptyDir: {}
       serviceAccountName: kubernetes-dashboard
       # Comment the following tolerations if Dashboard must not be deployed on master
       tolerations:
       - key: node-role.kubernetes.io/master
         effect: NoSchedule
+
 ---
+# ------------------- Dashboard Service ------------------- #
+
 kind: Service
 apiVersion: v1
 metadata:
@@ -66,7 +150,11 @@ metadata:
   namespace: kube-system
 spec:
   ports:
-  - port: 80
-    targetPort: 9090
+  - nodePort: 32334
+    port: 443
+    protocol: TCP
+    targetPort: 8443
   selector:
-    k8s-app: kubernetes-dashboard
+    k8s-app: kubernetes-dashboard
+  sessionAffinity: None
+  type: NodePort

src/agent/ansible/secrets/certs/ca.crt

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC9TCCAd2gAwIBAgIJAKkQ5c82lNusMA0GCSqGSIb3DQEBCwUAMBExDzANBgNV
+BAMMBm1hc3RlcjAeFw0xODAxMTkxNjA3MTRaFw00NTA2MDYxNjA3MTRaMBExDzAN
+BgNVBAMMBm1hc3RlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJuP
+FHaP1vneRdyIh3R153Bsrz7rjKHhABZdOJvjMRA3RZjx9r0ObCwD8M40UJblvKtl
+gIS68odeZOpuDjtuch/OqnTwH1e8652vz4jTef31KbeuclFfrEAvAJgou1bzQvK+
+dye/foy1WeBKRluU+KsMgbid0cZTLhfRP6KkRxOKcRLiMEGYnQ+fx41GzWm2Tqoc
+i5lpUT+fS9gmihGKa9+i7PwtPyWXZh2Z+5VUuR1+CEZDnWLJCUEdLXS2JbRwJMla
+8ZuaMCy00yEClLoBPtaMB7RiJKxmuW9VobQ3O6q4Uv6alCpk34Ko5GWXhcz/53zj
+vnYyEgURPjF86LhmrdcCAwEAAaNQME4wHQYDVR0OBBYEFDQgZQJWxfPzSpUl4Act
+LIVzG5fSMB8GA1UdIwQYMBaAFDQgZQJWxfPzSpUl4ActLIVzG5fSMAwGA1UdEwQF
+MAMBAf8wDQYJKoZIhvcNAQELBQADggEBACThhI/WuteSztlzX8c0sLCQ1jDrmqm9
+YxBS7z7GmNkXQcRbUZIiOTuYclQ8qD7ZequVhyQ1rFW+F2xOH/g4SaLE2uLf5Amo
+nKNUPynxyNIQ+gzndGqqe0vTyVF+bE3qCsn6yVu/IpGkAOR81FeE6dae4OJR6WKu
+UH/PTvt08UGzhZjZRqFHYE92hUU6etUIBFZ4vIJExk3dWeehUNINSSn6Z9Gab2Fg
+wYqz/mtKWmFarCikLk8jiUihgB3XHjakKGkeOftLvk3rfLvxNJa+beJuyOYXvVYl
+xIjWMlxICZv1VwTSdXb50u04DPAXijLoaYZ0gTjjsyZLGd5nKJvfWjQ=
+-----END CERTIFICATE-----

src/agent/ansible/secrets/certs/ca.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAm48Udo/W+d5F3IiHdHXncGyvPuuMoeEAFl04m+MxEDdFmPH2
+vQ5sLAPwzjRQluW8q2WAhLryh15k6m4OO25yH86qdPAfV7zrna/PiNN5/fUpt65y
+UV+sQC8AmCi7VvNC8r53J79+jLVZ4EpGW5T4qwyBuJ3RxlMuF9E/oqRHE4pxEuIw
+QZidD5/HjUbNabZOqhyLmWlRP59L2CaKEYpr36Ls/C0/JZdmHZn7lVS5HX4IRkOd
+YskJQR0tdLYltHAkyVrxm5owLLTTIQKUugE+1owHtGIkrGa5b1WhtDc7qrhS/pqU
+KmTfgqjkZZeFzP/nfOO+djISBRE+MXzouGat1wIDAQABAoIBAQCB//u47ZJZtNCr
+cYnJ4PKueJWnvpADhJZfGj7BwAbzp01JeQSbkF8EFbL7kKq8wHeAwU27HsSqLk+l
+vp20OyOywzKekUGQQDijyhZlIV50xpq7f1TX/l1kMiOMBZYyHw+W72eC1zy5+KCI
+mWndBU0fHU+XaoSx+jet/dfxYtpnT+COKIq52iAkEFbb51D8pAWSYCYC95VpQMpq
+rAviPsqu7v+CUBPn88D7dbqbQXkwOkcHzLIrBV9TMVy88xb+FxRglfKkyFqotL3n
+1khNIcp7rsvEcukvaqVsmTwrsGbUYpDVZjWh7avkhlEDPlbNVDuOi+NnGyb7KrMH
+FJfITDRxAoGBAMe1RJvaCRGZCmLKHFzOTef4SUnUZI9oK5UzBgAQuvBbtZeekBCh
+9tIUT9fDNrhjkD7VRpPurb/iVSwmLqx5lK0Qk4WkOJo6ADER7Ko63xL/NEsdwRAz
+k5e9YT4qyw3N+H598NUnhAMz+M6bm3KOyhDSLKsrNZnKVAXQK54FslWfAoGBAMdo
+DXKD0RrVV0YuybLt3WxAGC42Wb748QjL076SgFzu+M52elWt0DQpyl74+Sd7NWTh
+eUk6tbhEYgr9fTbJH/hgGolxZVsRMrO75Mtfvvaxjiy5td4kea7Bh9UGs6135Iyl
+iZZwUXBgAmUVc8kJjjfqBSX8J1OnC8YHBgiT4gzJAoGAVUZBlYr0dF804BoNIlO1
+UGfkY3Idvl5svbibx0tdh2ShlaxPN8rw6aNitG7W3sUkwq+vA1vXNSgf1ko3g84m
+ff+l/lqxEKnTiyBsPgQFXMc8PRbnaVOcoh5rd3AuZCafBOQiAeJtrDB0/UPUjIYM
+IkKccDpzGMgcOJ87AK7OB2ECgYBQflFHU6yaL1puiz6CSwChzPG13dy2eVkbGuRb
+vlmwqgqnlS3m3iX4mJIHamtxI4w3L8k85UUrn/cPxqm/7spIActUhgDLFRMpeIRw
+EDNO8/eXWFPw2zp/b8H8HRt0v7vzhnMW1joZqbftxA4cLg5Jxd7UKYhafUkEZBts
+ZP3P+QKBgQCbMAYdDB+yHJ9k3K5UUwHqMdFfGZMGUVkkhZgL38XschrQQZ38XAsx
+PpeTOZEagjFlDKJxwK4QmlgjXPg/GnbJTT4SWQjDqnkFxz/1Bw8W71T8O8dELOu4
+eoozee8bWjW8UUKkdtfEr73UVsPjK6Rc4c8s006kaU46GCs99fjBHg==
+-----END RSA PRIVATE KEY-----

src/agent/ansible/secrets/certs/server.crt

@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIID+DCCAuCgAwIBAgIJAOS1oMZvFXCRMA0GCSqGSIb3DQEBCwUAMBExDzANBgNV
+BAMMBm1hc3RlcjAeFw0xODAxMTkxNjA5MTBaFw00NTA2MDYxNjA5MTBaMFkxCzAJ
+BgNVBAYTAnVzMQswCQYDVQQIDAJuYzENMAsGA1UEBwwEY2FyeTEMMAoGA1UECgwD
+aWJtMQ8wDQYDVQQLDAZmYWJyaWMxDzANBgNVBAMMBm1hc3RlcjCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAKf3LaphlLZvmMOYr6eNk49rwxD0ffhpK/EW
+ge65esSmcvFvuQX/ACgnwzGVoiYyTRLBtxq7/HYqCjlLqNsrPH87wPOXDzDBX/2+
+Oc2mhkvacLdzAeU2cD7xfBxm0/GAjrb4GQlFURMB8kRl0eKbdTx7H0C7fel8d2Jk
+C752bqtmH9xnjmlHsO72jBVG5CiXaKGxQFGdKJ154zMmYz38q4ZAL6RCM3DSK9C7
++F1CWq1NVB9SVd0cR3UZVx3mXxmWb0nMkuoe++/4SXU0h7Qt8G6/RT2TJyivbtQC
+Vi0fFZBzAWgau1BIpoe3XAk0subxm9KnZMwMLcw7XKCKo/3lpx0CAwEAAaOCAQkw
+ggEFMEEGA1UdIwQ6MDiAFDQgZQJWxfPzSpUl4ActLIVzG5fSoRWkEzARMQ8wDQYD
+VQQDDAZtYXN0ZXKCCQCpEOXPNpTbrDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEMDAd
+BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwgYgGA1UdEQSBgDB+ggprdWJl
+cm5ldGVzghJrdWJlcm5ldGVzLmRlZmF1bHSCFmt1YmVybmV0ZXMuZGVmYXVsdC5z
+dmOCHmt1YmVybmV0ZXMuZGVmYXVsdC5zdmMuY2x1c3RlcoIka3ViZXJuZXRlcy5k
+ZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsMA0GCSqGSIb3DQEBCwUAA4IBAQACCvlK
+HS1WgbhIzsHwWz5oKndPu5R1JQnht+y+U4RMG5kbc1kANui5yvPx415hiv0tBcPM
+O1rLaY49a2jTjke643xfCrdFLL3g/1C2ON6U6Yg2dr9J9T0CAwDHMhS7eiXnD0ZZ
+tSpmikvEOZYNwJWMoLsBiyJIxOZpc7kffNT1cG072yaymTqLjtggO020MU4rXN0+
+CPrBP9MROwHu4ijXssLQRZXzIp8xjtnDTcOm5o2kkUoo3qXAHYkVqsiK7bYZy8nK
+UensSReIb5PRYJH1VZIPuJMTvFw/s2cNA+qeSfLGGJX8M5M9+qL9VOyfN0tHkuvU
+WOwyjhFAwBuZ04G+
+-----END CERTIFICATE-----

src/agent/ansible/secrets/certs/server.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAp/ctqmGUtm+Yw5ivp42Tj2vDEPR9+Gkr8RaB7rl6xKZy8W+5
+Bf8AKCfDMZWiJjJNEsG3Grv8dioKOUuo2ys8fzvA85cPMMFf/b45zaaGS9pwt3MB
+5TZwPvF8HGbT8YCOtvgZCUVREwHyRGXR4pt1PHsfQLt96Xx3YmQLvnZuq2Yf3GeO
+aUew7vaMFUbkKJdoobFAUZ0onXnjMyZjPfyrhkAvpEIzcNIr0Lv4XUJarU1UH1JV
+3RxHdRlXHeZfGZZvScyS6h777/hJdTSHtC3wbr9FPZMnKK9u1AJWLR8VkHMBaBq7
+UEimh7dcCTSy5vGb0qdkzAwtzDtcoIqj/eWnHQIDAQABAoIBAQCVfVCPS7nnhPsZ
+WlM7dK3X/7jk5jUXWcNaFwYdSccSLnIun5i01Xd2Ra1b/CkMhchC4VXt3VGceV4Q
+EF6AccKuGqhoJBHI+tJMK3mWppbv+8JGA320WvcbjiE/xeTsE9bw0W626ZJ2sEzG
+wzhBzspQwePW4Qf3PmeikhhBs3Zb5F77roa4C4ft769RCTOWocEwoogntdOhYZY9
+bLY6ThBzd85Iw/Sm4xuLKfFmXripvspX3ooa/uE085ddP6n9SvmptWGIhQgVsvte
+4Yws2ghieDr2EujYTXKm35If72bhZEIuMXuSmIF21m1WlnklGI8P32dBG8HBtoTj
+7p/ARQehAoGBANmmfahbRb7fhdQ1llUN+zx5dm0PAPYczZS4jpLNgsKIQOy7W6/T
+OSrhQI7vLqNJgcVTmjZ3gk4VcRENyiUxfQpaTtUxJjKI2hAtcZWiTMpnQFZjUeAg
+Fsv+tGgcnLyfbP3eqm4PifinRn2/diMed7wlchlCwx+I4QVeyQmx4kf3AoGBAMWP
+kKJLlXND5iTkiGfrgG9ZwZSuYIcXI6c178DRpZO76mWz+icnYJp8pHj7rqs9Na7J
+2rv0Hajza/fCjXcMsvFTtFNgz/vzqDVW8X2KdhHa+K1FbO0ZJDFDQ8c7p6QuvHlc
+esHgWFh83UZxVXAqtht4VincoKWkHqgtwyGoXwyLAoGAIgAuVSSdCqpkf7g3WeYr
+P1FCPNtBLTFmtDr4mtpb+QPMEK9cLWVz4sz5htq6kGulSCw9RRD6XDRhS2a6E4Fd
+pUZiVk+tReu3FRvkSJnoIR5sIJK3canRpeCOUk1V9ul431fvi+4FgcCv9Gj6jZXu
+4od/AY86aCy76ljaUxdk4BUCgYAPsMBG84PSHMFpirD+t+iCb3l9aoAGGqNdQ15g
+TQY+fn02SJ4EgA8fFekmJq8PsJPT5vo1VUUJxxN7IPuFSf/oRMKcoKLEGuzwF5Ck
+bNvFvUNk14+4IPgL5ZC7gRRmaMPVS7AAN+YsWPZmAthLSUkfU2ZcesZTgX5h0wid
+Yrbx0wKBgQCZe+gvgohB7HS4gMHdgV1P3jS/0EX5b/A0cxutHRJ0uKD+rbtNtl81
+XUpzM19FT5fI4HN3EmsRBVVdnkojDlIsNRL1GhzItEWr/SRbvk5+xoQZSflKg1Gw
+xYAyIZG6tpjCopsjYdBHxg5b7v5jFYhHbX1X1zt4mfuW1O5lyWmAfQ==
+-----END RSA PRIVATE KEY-----

src/agent/ansible/secrets/users/token.csv

@@ -0,0 +1,2 @@
+U588HUCyR3OcnN4rFxVJ6AyVSc6Sy3X6,admin,admin,"Admins,Users"
+YA4OM8VTCw370WPiED6UsSZtzIACTnPg,fabric,fabric,"Users"

src/agent/ansible/vars/aws.yml

@@ -63,7 +63,7 @@ cluster: {
 
   flannel_repo: "https://github.com/coreos/flannel/releases/download/v0.7.1/flannel-v0.7.1-linux-amd64.tar.gz",
   etcd_repo: "https://github.com/coreos/etcd/releases/download/v3.2.0/etcd-v3.2.0-linux-amd64.tar.gz",
-  k8s_repo: "https://storage.googleapis.com/kubernetes-release/release/v1.7.0/bin/linux/amd64/",
+  k8s_repo: "https://storage.googleapis.com/kubernetes-release/release/v1.9.1/bin/linux/amd64/",
   go_repo: "https://dl.google.com/go/go1.9.2.linux-amd64.tar.gz",
 
   # If volume want to be used, specify a size in GB, make volume size 0 if wish

src/agent/ansible/vars/os.yml

@@ -58,7 +58,7 @@ cluster: {
 
   flannel_repo: "https://github.com/coreos/flannel/releases/download/v0.7.1/flannel-v0.7.1-linux-amd64.tar.gz",
   etcd_repo: "https://github.com/coreos/etcd/releases/download/v3.2.0/etcd-v3.2.0-linux-amd64.tar.gz",
-  k8s_repo: "https://storage.googleapis.com/kubernetes-release/release/v1.7.0/bin/linux/amd64/",
+  k8s_repo: "https://storage.googleapis.com/kubernetes-release/release/v1.9.1/bin/linux/amd64/",
   go_repo: "https://dl.google.com/go/go1.9.2.linux-amd64.tar.gz",
 
   # If volume want to be used, specify a size in GB, make volume size 0 if wish

src/agent/ansible/vars/vb.yml

@@ -54,7 +54,7 @@ cluster: {
 
   flannel_repo: "https://github.com/coreos/flannel/releases/download/v0.7.1/flannel-v0.7.1-linux-amd64.tar.gz",
   etcd_repo: "https://github.com/coreos/etcd/releases/download/v3.2.0/etcd-v3.2.0-linux-amd64.tar.gz",
-  k8s_repo: "https://storage.googleapis.com/kubernetes-release/release/v1.7.0/bin/linux/amd64/",
+  k8s_repo: "https://storage.googleapis.com/kubernetes-release/release/v1.9.1/bin/linux/amd64/",
   go_repo: "https://dl.google.com/go/go1.9.2.linux-amd64.tar.gz",
 
   # If volume want to be used, specify a size in GB, make volume size 0 if wish