kube-forge v2: embede python with ansible (kubespray) and cobra as cli building tool
This commit is contained in:
@@ -0,0 +1,198 @@
|
||||
---
|
||||
# advertised host IP for kubelet. This affects network plugin config. Take caution
|
||||
# add ipv6 manual for dualstack mode because ipv4 priority in main_ip for dualstack
|
||||
kubelet_address: "{{ main_ips | join(',') }}"
|
||||
|
||||
# bind address for kubelet. Set to :: to listen on all interfaces
|
||||
kubelet_bind_address: "{{ main_ip | default('::') }}"
|
||||
|
||||
# resolv.conf to base dns config
|
||||
kube_resolv_conf: "/etc/resolv.conf"
|
||||
|
||||
# Set to empty to avoid cgroup creation
|
||||
kubelet_enforce_node_allocatable: "\"\""
|
||||
|
||||
# Set runtime and kubelet cgroups when using systemd as cgroup driver (default)
|
||||
kube_service_cgroups: "{% if kube_reserved %}{{ kube_reserved_cgroups_for_service_slice }}{% else %}system.slice{% endif %}"
|
||||
kubelet_runtime_cgroups: "/{{ kube_service_cgroups }}/{{ container_manager }}.service"
|
||||
kubelet_kubelet_cgroups: "/{{ kube_service_cgroups }}/kubelet.service"
|
||||
|
||||
# Set runtime and kubelet cgroups when using cgroupfs as cgroup driver
|
||||
kubelet_runtime_cgroups_cgroupfs: "/system.slice/{{ container_manager }}.service"
|
||||
kubelet_kubelet_cgroups_cgroupfs: "/system.slice/kubelet.service"
|
||||
|
||||
# Set systemd service hardening features
|
||||
kubelet_systemd_hardening: false
|
||||
|
||||
# Kubelet service dependencies other than container runtime
|
||||
kubelet_systemd_wants_dependencies: []
|
||||
|
||||
# List of secure IPs for kubelet
|
||||
# don't forget ipv6 addresses for dualstack(because "main_ip" prioritizes ipv4)
|
||||
kube_node_addresses: >-
|
||||
{%- for host in (groups['k8s_cluster'] | union(groups['etcd'])) -%}
|
||||
{{ hostvars[host]['main_ips'] | join(' ') }}{{ ' ' if not loop.last else '' }}
|
||||
{%- endfor -%}
|
||||
kubelet_secure_addresses: "localhost link-local {{ kube_pods_subnets | regex_replace(',', ' ') }} {{ kube_node_addresses }}"
|
||||
|
||||
# Reserve this space for kube resources
|
||||
# Whether to run kubelet and container-engine daemons in a dedicated cgroup. (Not required for resource reservations).
|
||||
kube_reserved: false
|
||||
kube_reserved_cgroups: "/{{ kube_reserved_cgroups_for_service_slice }}"
|
||||
kube_memory_reserved: "256Mi"
|
||||
kube_cpu_reserved: "100m"
|
||||
kube_ephemeral_storage_reserved: "500Mi"
|
||||
kube_pid_reserved: "1000"
|
||||
|
||||
# Set to true to reserve resources for system daemons
|
||||
system_reserved: false
|
||||
system_reserved_cgroups_for_service_slice: system.slice
|
||||
system_reserved_cgroups: "/{{ system_reserved_cgroups_for_service_slice }}"
|
||||
system_memory_reserved: "512Mi"
|
||||
system_cpu_reserved: "500m"
|
||||
system_ephemeral_storage_reserved: "500Mi"
|
||||
system_pid_reserved: 1000
|
||||
|
||||
## Eviction Thresholds to avoid system OOMs
|
||||
# https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#eviction-thresholds
|
||||
eviction_hard: {}
|
||||
eviction_hard_control_plane: {}
|
||||
|
||||
kubelet_status_update_frequency: 10s
|
||||
|
||||
# kube-vip
|
||||
kube_vip_version: 0.8.0
|
||||
|
||||
kube_vip_arp_enabled: false
|
||||
kube_vip_interface:
|
||||
kube_vip_services_interface:
|
||||
kube_vip_cidr: 32
|
||||
kube_vip_dns_mode: first
|
||||
kube_vip_controlplane_enabled: false
|
||||
kube_vip_ddns_enabled: false
|
||||
kube_vip_cp_detect: false
|
||||
kube_vip_services_enabled: false
|
||||
kube_vip_leader_election_enabled: "{{ kube_vip_arp_enabled }}"
|
||||
kube_vip_bgp_enabled: false
|
||||
kube_vip_bgp_routerid:
|
||||
kube_vip_local_as: 65000
|
||||
kube_vip_bgp_peeraddress:
|
||||
kube_vip_bgp_peerpass:
|
||||
kube_vip_bgp_peeras: 65000
|
||||
kube_vip_bgppeers:
|
||||
kube_vip_address:
|
||||
kube_vip_enableServicesElection: false
|
||||
kube_vip_lb_enable: false
|
||||
kube_vip_leasename: plndr-cp-lock
|
||||
kube_vip_svc_leasename: plndr-svcs-lock
|
||||
kube_vip_leaseduration: 5
|
||||
kube_vip_renewdeadline: 3
|
||||
kube_vip_retryperiod: 1
|
||||
kube_vip_enable_node_labeling: false
|
||||
|
||||
# Requests for load balancer app
|
||||
loadbalancer_apiserver_memory_requests: 32M
|
||||
loadbalancer_apiserver_cpu_requests: 25m
|
||||
|
||||
loadbalancer_apiserver_keepalive_timeout: 5m
|
||||
loadbalancer_apiserver_pod_name: "{% if loadbalancer_apiserver_type == 'nginx' %}nginx-proxy{% else %}haproxy{% endif %}"
|
||||
|
||||
# Uncomment if you need to enable deprecated runtimes
|
||||
# kube_api_runtime_config:
|
||||
# - apps/v1beta1=true
|
||||
# - apps/v1beta2=true
|
||||
# - extensions/v1beta1/daemonsets=true
|
||||
# - extensions/v1beta1/deployments=true
|
||||
# - extensions/v1beta1/replicasets=true
|
||||
# - extensions/v1beta1/networkpolicies=true
|
||||
|
||||
# A port range to reserve for services with NodePort visibility.
|
||||
# Inclusive at both ends of the range.
|
||||
kube_apiserver_node_port_range: "30000-32767"
|
||||
|
||||
# Configure the amount of pods able to run on single node
|
||||
# default is equal to application default
|
||||
kubelet_max_pods: 110
|
||||
|
||||
# Sets the maximum number of processes running per Pod
|
||||
# Default value -1 = unlimited
|
||||
kubelet_pod_pids_limit: -1
|
||||
|
||||
## Support parameters to be passed to kubelet via kubelet-config.yaml
|
||||
kubelet_config_extra_args: {}
|
||||
|
||||
## Parameters to be passed to kubelet via kubelet-config.yaml when cgroupfs is used as cgroup driver
|
||||
kubelet_config_extra_args_cgroupfs:
|
||||
systemCgroups: /system.slice
|
||||
cgroupRoot: /
|
||||
|
||||
# Maximum number of container log files that can be present for a container.
|
||||
kubelet_logfiles_max_nr: 5
|
||||
|
||||
# Maximum size of the container log file before it is rotated
|
||||
kubelet_logfiles_max_size: 10Mi
|
||||
|
||||
## Support custom flags to be passed to kubelet
|
||||
kubelet_custom_flags: []
|
||||
|
||||
# The read-only port for the Kubelet to serve on with no authentication/authorization.
|
||||
kube_read_only_port: 0
|
||||
|
||||
# Port for healthz for Kubelet
|
||||
kubelet_healthz_port: 10248
|
||||
|
||||
# Bind address for healthz for Kubelet
|
||||
kubelet_healthz_bind_address: 127.0.0.1
|
||||
|
||||
# sysctl_file_path to add sysctl conf to
|
||||
sysctl_file_path: "/etc/sysctl.d/99-sysctl.conf"
|
||||
|
||||
## Support tls min version, Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
|
||||
# tls_min_version: ""
|
||||
|
||||
## Support tls cipher suites.
|
||||
# tls_cipher_suites:
|
||||
# - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
|
||||
# - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
|
||||
# - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||||
# - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
|
||||
# - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
||||
# - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
# - TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
|
||||
# - TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
|
||||
# - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
# - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
# - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
# - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
# - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
# - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
# - TLS_ECDHE_RSA_WITH_RC4_128_SHA
|
||||
# - TLS_RSA_WITH_3DES_EDE_CBC_SHA
|
||||
# - TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
# - TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||
# - TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
# - TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
# - TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
# - TLS_RSA_WITH_RC4_128_SHA
|
||||
|
||||
kube_proxy_ipvs_modules:
|
||||
- ip_vs
|
||||
- ip_vs_rr
|
||||
- ip_vs_wrr
|
||||
- ip_vs_sh
|
||||
- ip_vs_wlc
|
||||
- ip_vs_lc
|
||||
|
||||
# Kubespray will use the first module of this list which it can successfully modprobe
|
||||
conntrack_modules:
|
||||
- nf_conntrack
|
||||
- nf_conntrack_ipv4
|
||||
|
||||
|
||||
## Enable distributed tracing for kubelet
|
||||
kubelet_tracing: false
|
||||
kubelet_tracing_endpoint: "[::]:4317"
|
||||
kubelet_tracing_sampling_rate_per_million: 100
|
||||
|
||||
# The maximum number of image pulls in parallel. Set it to a integer great than 1 to enable image pulling in parallel.
|
||||
kubelet_max_parallel_image_pulls: 1
|
||||
@@ -0,0 +1,11 @@
|
||||
---
|
||||
- name: Kubelet | reload systemd
|
||||
systemd_service:
|
||||
daemon_reload: true
|
||||
listen: Node | restart kubelet
|
||||
|
||||
- name: Kubelet | restart kubelet
|
||||
service:
|
||||
name: kubelet
|
||||
state: restarted
|
||||
listen: Node | restart kubelet
|
||||
@@ -0,0 +1,62 @@
|
||||
---
|
||||
- name: Gather cgroups facts for docker
|
||||
when: container_manager == 'docker'
|
||||
block:
|
||||
- name: Look up docker cgroup driver
|
||||
shell: "set -o pipefail && docker info | grep 'Cgroup Driver' | awk -F': ' '{ print $2; }'"
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: docker_cgroup_driver_result
|
||||
changed_when: false
|
||||
check_mode: false
|
||||
|
||||
- name: Set kubelet_cgroup_driver_detected fact for docker
|
||||
set_fact:
|
||||
kubelet_cgroup_driver_detected: "{{ docker_cgroup_driver_result.stdout }}"
|
||||
|
||||
- name: Gather cgroups facts for crio
|
||||
when: container_manager == 'crio'
|
||||
block:
|
||||
- name: Look up crio cgroup driver
|
||||
shell: "set -o pipefail && {{ bin_dir }}/{{ crio_status_command }} info | grep 'cgroup driver' | awk -F': ' '{ print $2; }'"
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: crio_cgroup_driver_result
|
||||
changed_when: false
|
||||
|
||||
- name: Set kubelet_cgroup_driver_detected fact for crio
|
||||
set_fact:
|
||||
kubelet_cgroup_driver_detected: "{{ crio_cgroup_driver_result.stdout }}"
|
||||
|
||||
- name: Set kubelet_cgroup_driver_detected fact for containerd
|
||||
when: container_manager == 'containerd'
|
||||
set_fact:
|
||||
kubelet_cgroup_driver_detected: >-
|
||||
{%- if containerd_use_systemd_cgroup -%}systemd{%- else -%}cgroupfs{%- endif -%}
|
||||
|
||||
- name: Set kubelet_cgroup_driver
|
||||
set_fact:
|
||||
kubelet_cgroup_driver: "{{ kubelet_cgroup_driver_detected }}"
|
||||
when: kubelet_cgroup_driver is undefined
|
||||
|
||||
- name: Set kubelet_cgroups options when cgroupfs is used
|
||||
set_fact:
|
||||
kubelet_runtime_cgroups: "{{ kubelet_runtime_cgroups_cgroupfs }}"
|
||||
kubelet_kubelet_cgroups: "{{ kubelet_kubelet_cgroups_cgroupfs }}"
|
||||
when: kubelet_cgroup_driver == 'cgroupfs'
|
||||
|
||||
- name: Set kubelet_config_extra_args options when cgroupfs is used
|
||||
set_fact:
|
||||
kubelet_config_extra_args: "{{ kubelet_config_extra_args | combine(kubelet_config_extra_args_cgroupfs) }}"
|
||||
when: kubelet_cgroup_driver == 'cgroupfs'
|
||||
|
||||
- name: Os specific vars
|
||||
include_vars: "{{ item }}"
|
||||
with_first_found:
|
||||
- files:
|
||||
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower | replace('/', '_') }}.yml"
|
||||
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_release }}.yml"
|
||||
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
|
||||
- "{{ ansible_distribution | lower }}.yml"
|
||||
- "{{ ansible_os_family | lower }}.yml"
|
||||
skip: true
|
||||
@@ -0,0 +1,22 @@
|
||||
---
|
||||
- name: Install | Copy kubeadm binary from download dir
|
||||
copy:
|
||||
src: "{{ downloads.kubeadm.dest }}"
|
||||
dest: "{{ bin_dir }}/kubeadm"
|
||||
mode: "0755"
|
||||
remote_src: true
|
||||
tags:
|
||||
- kubeadm
|
||||
when:
|
||||
- not ('kube_control_plane' in group_names)
|
||||
|
||||
- name: Install | Copy kubelet binary from download dir
|
||||
copy:
|
||||
src: "{{ downloads.kubelet.dest }}"
|
||||
dest: "{{ bin_dir }}/kubelet"
|
||||
mode: "0755"
|
||||
remote_src: true
|
||||
tags:
|
||||
- kubelet
|
||||
- upgrade
|
||||
notify: Node | restart kubelet
|
||||
@@ -0,0 +1,55 @@
|
||||
---
|
||||
- name: Set kubelet api version to v1beta1
|
||||
set_fact:
|
||||
kubeletConfig_api_version: v1beta1
|
||||
tags:
|
||||
- kubelet
|
||||
- kubeadm
|
||||
|
||||
- name: Write kubelet environment config file (kubeadm)
|
||||
template:
|
||||
src: "kubelet.env.{{ kubeletConfig_api_version }}.j2"
|
||||
dest: "{{ kube_config_dir }}/kubelet.env"
|
||||
setype: "{{ (preinstall_selinux_state != 'disabled') | ternary('etc_t', omit) }}"
|
||||
backup: true
|
||||
mode: "0600"
|
||||
notify: Node | restart kubelet
|
||||
tags:
|
||||
- kubelet
|
||||
- kubeadm
|
||||
|
||||
- name: Write kubelet config file
|
||||
template:
|
||||
src: "kubelet-config.{{ kubeletConfig_api_version }}.yaml.j2"
|
||||
dest: "{{ kube_config_dir }}/kubelet-config.yaml"
|
||||
mode: "0600"
|
||||
notify: Kubelet | restart kubelet
|
||||
tags:
|
||||
- kubelet
|
||||
- kubeadm
|
||||
|
||||
- name: Write kubelet systemd init file
|
||||
template:
|
||||
src: "kubelet.service.j2"
|
||||
dest: "/etc/systemd/system/kubelet.service"
|
||||
backup: true
|
||||
mode: "0600"
|
||||
validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:kubelet.service'"
|
||||
# FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
|
||||
# Remove once we drop support for systemd < 250
|
||||
notify: Node | restart kubelet
|
||||
tags:
|
||||
- kubelet
|
||||
- kubeadm
|
||||
|
||||
- name: Flush_handlers and reload-systemd
|
||||
meta: flush_handlers
|
||||
|
||||
- name: Enable kubelet
|
||||
service:
|
||||
name: kubelet
|
||||
enabled: true
|
||||
state: started
|
||||
tags:
|
||||
- kubelet
|
||||
notify: Kubelet | restart kubelet
|
||||
@@ -0,0 +1,34 @@
|
||||
---
|
||||
- name: Haproxy | Cleanup potentially deployed nginx-proxy
|
||||
file:
|
||||
path: "{{ kube_manifest_dir }}/nginx-proxy.yml"
|
||||
state: absent
|
||||
|
||||
- name: Haproxy | Make haproxy directory
|
||||
file:
|
||||
path: "{{ haproxy_config_dir }}"
|
||||
state: directory
|
||||
mode: "0755"
|
||||
owner: root
|
||||
|
||||
- name: Haproxy | Write haproxy configuration
|
||||
template:
|
||||
src: "loadbalancer/haproxy.cfg.j2"
|
||||
dest: "{{ haproxy_config_dir }}/haproxy.cfg"
|
||||
owner: root
|
||||
mode: "0755"
|
||||
backup: true
|
||||
|
||||
- name: Haproxy | Get checksum from config
|
||||
stat:
|
||||
path: "{{ haproxy_config_dir }}/haproxy.cfg"
|
||||
get_attributes: false
|
||||
get_checksum: true
|
||||
get_mime: false
|
||||
register: haproxy_stat
|
||||
|
||||
- name: Haproxy | Write static pod
|
||||
template:
|
||||
src: manifests/haproxy.manifest.j2
|
||||
dest: "{{ kube_manifest_dir }}/haproxy.yml"
|
||||
mode: "0640"
|
||||
@@ -0,0 +1,39 @@
|
||||
---
|
||||
- name: Kube-vip | Check cluster settings for kube-vip
|
||||
fail:
|
||||
msg: "kube-vip require kube_proxy_strict_arp = true, see https://github.com/kube-vip/kube-vip/blob/main/docs/kubernetes/arp/index.md"
|
||||
when:
|
||||
- kube_proxy_mode == 'ipvs' and not kube_proxy_strict_arp
|
||||
- kube_vip_arp_enabled
|
||||
|
||||
- name: Kube-vip | Check if super-admin.conf exists
|
||||
stat:
|
||||
path: "{{ kube_config_dir }}/super-admin.conf"
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
register: stat_kube_vip_super_admin
|
||||
|
||||
- name: Kube-vip | Check if kubeadm has already run
|
||||
stat:
|
||||
path: "/var/lib/kubelet/config.yaml"
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: kubeadm_already_run
|
||||
|
||||
- name: Kube-vip | Set admin.conf
|
||||
set_fact:
|
||||
kube_vip_admin_conf: admin.conf
|
||||
|
||||
- name: Kube-vip | Set admin.conf for first Control Plane
|
||||
set_fact:
|
||||
kube_vip_admin_conf: super-admin.conf
|
||||
when:
|
||||
- inventory_hostname == groups['kube_control_plane'] | first
|
||||
- (stat_kube_vip_super_admin.stat.exists and stat_kube_vip_super_admin.stat.isreg) or (not kubeadm_already_run.stat.exists )
|
||||
|
||||
- name: Kube-vip | Write static pod
|
||||
template:
|
||||
src: manifests/kube-vip.manifest.j2
|
||||
dest: "{{ kube_manifest_dir }}/kube-vip.yml"
|
||||
mode: "0640"
|
||||
@@ -0,0 +1,34 @@
|
||||
---
|
||||
- name: Haproxy | Cleanup potentially deployed haproxy
|
||||
file:
|
||||
path: "{{ kube_manifest_dir }}/haproxy.yml"
|
||||
state: absent
|
||||
|
||||
- name: Nginx-proxy | Make nginx directory
|
||||
file:
|
||||
path: "{{ nginx_config_dir }}"
|
||||
state: directory
|
||||
mode: "0700"
|
||||
owner: root
|
||||
|
||||
- name: Nginx-proxy | Write nginx-proxy configuration
|
||||
template:
|
||||
src: "loadbalancer/nginx.conf.j2"
|
||||
dest: "{{ nginx_config_dir }}/nginx.conf"
|
||||
owner: root
|
||||
mode: "0755"
|
||||
backup: true
|
||||
|
||||
- name: Nginx-proxy | Get checksum from config
|
||||
stat:
|
||||
path: "{{ nginx_config_dir }}/nginx.conf"
|
||||
get_attributes: false
|
||||
get_checksum: true
|
||||
get_mime: false
|
||||
register: nginx_stat
|
||||
|
||||
- name: Nginx-proxy | Write static pod
|
||||
template:
|
||||
src: manifests/nginx-proxy.manifest.j2
|
||||
dest: "{{ kube_manifest_dir }}/nginx-proxy.yml"
|
||||
mode: "0640"
|
||||
@@ -0,0 +1,148 @@
|
||||
---
|
||||
- name: Fetch facts
|
||||
import_tasks: facts.yml
|
||||
tags:
|
||||
- facts
|
||||
- kubelet
|
||||
|
||||
- name: Ensure /var/lib/cni exists
|
||||
file:
|
||||
path: /var/lib/cni
|
||||
state: directory
|
||||
mode: "0755"
|
||||
|
||||
- name: Install kubelet binary
|
||||
import_tasks: install.yml
|
||||
tags:
|
||||
- kubelet
|
||||
|
||||
- name: Install kube-vip
|
||||
import_tasks: loadbalancer/kube-vip.yml
|
||||
when:
|
||||
- ('kube_control_plane' in group_names)
|
||||
- kube_vip_enabled
|
||||
tags:
|
||||
- kube-vip
|
||||
|
||||
- name: Install nginx-proxy
|
||||
import_tasks: loadbalancer/nginx-proxy.yml
|
||||
when:
|
||||
- ('kube_control_plane' not in group_names) or (kube_apiserver_bind_address != '::')
|
||||
- loadbalancer_apiserver_localhost
|
||||
- loadbalancer_apiserver_type == 'nginx'
|
||||
tags:
|
||||
- nginx
|
||||
|
||||
- name: Install haproxy
|
||||
import_tasks: loadbalancer/haproxy.yml
|
||||
when:
|
||||
- ('kube_control_plane' not in group_names) or (kube_apiserver_bind_address != '::')
|
||||
- loadbalancer_apiserver_localhost
|
||||
- loadbalancer_apiserver_type == 'haproxy'
|
||||
tags:
|
||||
- haproxy
|
||||
|
||||
- name: Ensure nodePort range is reserved
|
||||
ansible.posix.sysctl:
|
||||
name: net.ipv4.ip_local_reserved_ports
|
||||
value: "{{ kube_apiserver_node_port_range }}"
|
||||
sysctl_set: true
|
||||
sysctl_file: "{{ sysctl_file_path }}"
|
||||
state: present
|
||||
reload: true
|
||||
when: kube_apiserver_node_port_range is defined
|
||||
tags:
|
||||
- kube-proxy
|
||||
|
||||
- name: Verify if br_netfilter module exists
|
||||
command: "modinfo br_netfilter"
|
||||
environment:
|
||||
PATH: "{{ ansible_env.PATH }}:/sbin" # Make sure we can workaround RH's conservative path management
|
||||
register: modinfo_br_netfilter
|
||||
failed_when: modinfo_br_netfilter.rc not in [0, 1]
|
||||
changed_when: false
|
||||
check_mode: false
|
||||
|
||||
# TODO: Remove once upstream issue is fixed
|
||||
# https://github.com/ansible-collections/community.general/issues/7717
|
||||
- name: Verify br_netfilter module path exists
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: "0755"
|
||||
loop:
|
||||
- /etc/modules-load.d
|
||||
- /etc/modprobe.d
|
||||
|
||||
- name: Enable br_netfilter module
|
||||
community.general.modprobe:
|
||||
name: br_netfilter
|
||||
state: present
|
||||
when: modinfo_br_netfilter.rc == 0
|
||||
|
||||
- name: Persist br_netfilter module
|
||||
copy:
|
||||
dest: /etc/modules-load.d/kubespray-br_netfilter.conf
|
||||
content: br_netfilter
|
||||
mode: "0644"
|
||||
when: modinfo_br_netfilter.rc == 0
|
||||
|
||||
# kube-proxy needs net.bridge.bridge-nf-call-iptables enabled when found if br_netfilter is not a module
|
||||
- name: Check if bridge-nf-call-iptables key exists
|
||||
command: "sysctl net.bridge.bridge-nf-call-iptables"
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
check_mode: false
|
||||
register: sysctl_bridge_nf_call_iptables
|
||||
|
||||
- name: Enable bridge-nf-call tables
|
||||
ansible.posix.sysctl:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
sysctl_file: "{{ sysctl_file_path }}"
|
||||
value: "1"
|
||||
reload: true
|
||||
when: sysctl_bridge_nf_call_iptables.rc == 0
|
||||
with_items:
|
||||
- net.bridge.bridge-nf-call-iptables
|
||||
- net.bridge.bridge-nf-call-arptables
|
||||
- net.bridge.bridge-nf-call-ip6tables
|
||||
|
||||
- name: Modprobe Kernel Module for IPVS
|
||||
community.general.modprobe:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
persistent: present
|
||||
loop: "{{ kube_proxy_ipvs_modules }}"
|
||||
when: kube_proxy_mode == 'ipvs'
|
||||
tags:
|
||||
- kube-proxy
|
||||
|
||||
- name: Modprobe conntrack module
|
||||
community.general.modprobe:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
persistent: present
|
||||
register: modprobe_conntrack_module
|
||||
ignore_errors: true # noqa ignore-errors
|
||||
loop: "{{ conntrack_modules }}"
|
||||
when:
|
||||
- kube_proxy_mode == 'ipvs'
|
||||
- "(modprobe_conntrack_module|default({'rc': 1})).rc != 0" # loop until first success
|
||||
tags:
|
||||
- kube-proxy
|
||||
|
||||
- name: Modprobe Kernel Module for nftables
|
||||
community.general.modprobe:
|
||||
name: "nf_tables"
|
||||
state: present
|
||||
persistent: present
|
||||
when: kube_proxy_mode == 'nftables'
|
||||
tags:
|
||||
- kube-proxy
|
||||
|
||||
- name: Install kubelet
|
||||
import_tasks: kubelet.yml
|
||||
tags:
|
||||
- kubelet
|
||||
- kubeadm
|
||||
@@ -0,0 +1,2 @@
|
||||
[Service]
|
||||
Environment={% if http_proxy %}"HTTP_PROXY={{ http_proxy }}"{% endif %} {% if https_proxy %}"HTTPS_PROXY={{ https_proxy }}"{% endif %} {% if no_proxy %}"NO_PROXY={{ no_proxy }}"{% endif %}
|
||||
@@ -0,0 +1,136 @@
|
||||
apiVersion: kubelet.config.k8s.io/v1beta1
|
||||
kind: KubeletConfiguration
|
||||
nodeStatusUpdateFrequency: "{{ kubelet_status_update_frequency }}"
|
||||
failSwapOn: {{ kubelet_fail_swap_on }}
|
||||
authentication:
|
||||
anonymous:
|
||||
enabled: false
|
||||
webhook:
|
||||
enabled: {{ kubelet_authentication_token_webhook }}
|
||||
x509:
|
||||
clientCAFile: {{ kube_cert_dir }}/ca.crt
|
||||
authorization:
|
||||
{% if kubelet_authorization_mode_webhook %}
|
||||
mode: Webhook
|
||||
{% else %}
|
||||
mode: AlwaysAllow
|
||||
{% endif %}
|
||||
{% if kubelet_enforce_node_allocatable is defined and kubelet_enforce_node_allocatable != "\"\"" %}
|
||||
{% set kubelet_enforce_node_allocatable_list = kubelet_enforce_node_allocatable.split(",") %}
|
||||
enforceNodeAllocatable:
|
||||
{% for item in kubelet_enforce_node_allocatable_list %}
|
||||
- {{ item }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
staticPodPath: {{ kube_manifest_dir }}
|
||||
cgroupDriver: {{ kubelet_cgroup_driver | default('systemd') }}
|
||||
containerLogMaxFiles: {{ kubelet_logfiles_max_nr }}
|
||||
containerLogMaxSize: {{ kubelet_logfiles_max_size }}
|
||||
containerRuntimeEndpoint : {{ cri_socket }}
|
||||
maxPods: {{ kubelet_max_pods }}
|
||||
podPidsLimit: {{ kubelet_pod_pids_limit }}
|
||||
address: "{{ kubelet_bind_address }}"
|
||||
readOnlyPort: {{ kube_read_only_port }}
|
||||
healthzPort: {{ kubelet_healthz_port }}
|
||||
healthzBindAddress: "{{ kubelet_healthz_bind_address }}"
|
||||
kubeletCgroups: {{ kubelet_kubelet_cgroups }}
|
||||
clusterDomain: {{ dns_domain }}
|
||||
{% if kubelet_protect_kernel_defaults | bool %}
|
||||
protectKernelDefaults: true
|
||||
{% endif %}
|
||||
{% if kubelet_rotate_certificates | bool %}
|
||||
rotateCertificates: true
|
||||
{% endif %}
|
||||
{% if kubelet_rotate_server_certificates | bool %}
|
||||
serverTLSBootstrap: true
|
||||
{% endif %}
|
||||
{# DNS settings for kubelet #}
|
||||
{% if enable_nodelocaldns %}
|
||||
{% set kubelet_cluster_dns = [nodelocaldns_ip] %}
|
||||
{% elif dns_mode in ['coredns'] %}
|
||||
{% set kubelet_cluster_dns = [skydns_server] %}
|
||||
{% elif dns_mode == 'coredns_dual' %}
|
||||
{% set kubelet_cluster_dns = [skydns_server,skydns_server_secondary] %}
|
||||
{% elif dns_mode == 'manual' %}
|
||||
{% set kubelet_cluster_dns = [manual_dns_server] %}
|
||||
{% else %}
|
||||
{% set kubelet_cluster_dns = [] %}
|
||||
{% endif %}
|
||||
clusterDNS:
|
||||
{% for dns_address in kubelet_cluster_dns %}
|
||||
- {{ dns_address }}
|
||||
{% endfor %}
|
||||
{# Node reserved CPU/memory #}
|
||||
{% for scope in "kube", "system" %}
|
||||
{% if lookup('ansible.builtin.vars', scope + "_reserved") | bool %}
|
||||
{{ scope }}ReservedCgroup: {{ lookup('ansible.builtin.vars', scope + '_reserved_cgroups') }}
|
||||
{% endif %}
|
||||
{{ scope }}Reserved:
|
||||
{% for resource in "cpu", "memory", "ephemeral-storage", "pid" %}
|
||||
{{ resource }}: "{{ lookup('ansible.builtin.vars', scope + '_' ~ (resource | replace('-', '_')) + '_reserved') }}"
|
||||
{% endfor %}
|
||||
{% endfor %}
|
||||
{% if eviction_hard is defined and eviction_hard %}
|
||||
evictionHard:
|
||||
{{ eviction_hard | to_nice_yaml(indent=2) | indent(2) }}
|
||||
{% endif %}
|
||||
resolvConf: "{{ kube_resolv_conf }}"
|
||||
{% if kubelet_config_extra_args %}
|
||||
{{ kubelet_config_extra_args | to_nice_yaml(indent=2) }}
|
||||
{% endif %}
|
||||
{% if kubelet_feature_gates or kube_feature_gates %}
|
||||
featureGates:
|
||||
{% for feature in (kubelet_feature_gates | default(kube_feature_gates, true)) %}
|
||||
{{ feature | replace("=", ": ") }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if tls_min_version is defined %}
|
||||
tlsMinVersion: {{ tls_min_version }}
|
||||
{% endif %}
|
||||
{% if tls_cipher_suites is defined %}
|
||||
tlsCipherSuites:
|
||||
{% for tls in tls_cipher_suites %}
|
||||
- {{ tls }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
eventRecordQPS: {{ kubelet_event_record_qps }}
|
||||
shutdownGracePeriod: {{ kubelet_shutdown_grace_period }}
|
||||
shutdownGracePeriodCriticalPods: {{ kubelet_shutdown_grace_period_critical_pods }}
|
||||
{% if not kubelet_fail_swap_on %}
|
||||
memorySwap:
|
||||
swapBehavior: {{ kubelet_swap_behavior }}
|
||||
{% endif %}
|
||||
{% if kubelet_streaming_connection_idle_timeout is defined %}
|
||||
streamingConnectionIdleTimeout: {{ kubelet_streaming_connection_idle_timeout }}
|
||||
{% endif %}
|
||||
{% if kubelet_image_gc_high_threshold is defined %}
|
||||
imageGCHighThresholdPercent: {{ kubelet_image_gc_high_threshold }}
|
||||
{% endif %}
|
||||
{% if kubelet_image_gc_low_threshold is defined %}
|
||||
imageGCLowThresholdPercent: {{ kubelet_image_gc_low_threshold }}
|
||||
{% endif %}
|
||||
{% if kubelet_make_iptables_util_chains is defined %}
|
||||
makeIPTablesUtilChains: {{ kubelet_make_iptables_util_chains | bool }}
|
||||
{% endif %}
|
||||
{% if kubelet_seccomp_default is defined %}
|
||||
seccompDefault: {{ kubelet_seccomp_default | bool }}
|
||||
{% endif %}
|
||||
{% if kubelet_cpu_manager_policy is defined %}
|
||||
cpuManagerPolicy: {{ kubelet_cpu_manager_policy }}
|
||||
{% endif %}
|
||||
{% if kubelet_cpu_manager_policy_options is defined %}
|
||||
cpuManagerPolicyOptions:
|
||||
{{ kubelet_cpu_manager_policy_options | to_nice_yaml(indent=2) | indent(width=2) }}
|
||||
{% endif %}
|
||||
{% if kubelet_topology_manager_policy is defined %}
|
||||
topologyManagerPolicy: {{ kubelet_topology_manager_policy }}
|
||||
{% endif %}
|
||||
{% if kubelet_topology_manager_scope is defined %}
|
||||
topologyManagerScope: {{ kubelet_topology_manager_scope }}
|
||||
{% endif %}
|
||||
{% if kubelet_tracing %}
|
||||
tracing:
|
||||
endpoint: "{{ kubelet_tracing_endpoint }}"
|
||||
samplingRatePerMillion: {{ kubelet_tracing_sampling_rate_per_million }}
|
||||
{% endif %}
|
||||
maxParallelImagePulls: {{ kubelet_max_parallel_image_pulls }}
|
||||
@@ -0,0 +1,30 @@
|
||||
KUBE_LOG_LEVEL="--v={{ kube_log_level }}"
|
||||
KUBELET_ADDRESS="--node-ip={{ kubelet_address }}"
|
||||
{% if kube_override_hostname|default('') %}
|
||||
KUBELET_HOSTNAME="--hostname-override={{ kube_override_hostname }}"
|
||||
{% endif %}
|
||||
|
||||
{# Base kubelet args #}
|
||||
{% set kubelet_args_base -%}
|
||||
{# start kubeadm specific settings #}
|
||||
--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf \
|
||||
--config={{ kube_config_dir }}/kubelet-config.yaml \
|
||||
--kubeconfig={{ kube_config_dir }}/kubelet.conf \
|
||||
{# end kubeadm specific settings #}
|
||||
--runtime-cgroups={{ kubelet_runtime_cgroups }} \
|
||||
{% endset %}
|
||||
|
||||
KUBELET_ARGS="{{ kubelet_args_base }} {{ kubelet_custom_flags | join(' ') }}"
|
||||
{% if kubelet_flexvolumes_plugins_dir is defined %}
|
||||
KUBELET_VOLUME_PLUGIN="--volume-plugin-dir={{ kubelet_flexvolumes_plugins_dir }}"
|
||||
{% endif %}
|
||||
{% if kube_network_plugin is defined and kube_network_plugin == "cloud" %}
|
||||
KUBELET_NETWORK_PLUGIN="--hairpin-mode=promiscuous-bridge --network-plugin=kubenet"
|
||||
{% endif %}
|
||||
{% if cloud_provider == "external" %}
|
||||
KUBELET_CLOUDPROVIDER="--cloud-provider={{ cloud_provider }}"
|
||||
{% else %}
|
||||
KUBELET_CLOUDPROVIDER=""
|
||||
{% endif %}
|
||||
|
||||
PATH={{ bin_dir }}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
@@ -0,0 +1,57 @@
|
||||
[Unit]
|
||||
Description=Kubernetes Kubelet Server
|
||||
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
|
||||
After={{ container_manager }}.service
|
||||
{% if container_manager == 'docker' %}
|
||||
Wants=docker.socket
|
||||
{% else %}
|
||||
Wants={{ container_manager }}.service
|
||||
{% endif %}
|
||||
{% for kubelet_dependency in kubelet_systemd_wants_dependencies|default([]) %}
|
||||
{% if kubelet_dependency|length > 0 %}
|
||||
Wants={{ kubelet_dependency }}
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
|
||||
[Service]
|
||||
EnvironmentFile=-{{ kube_config_dir }}/kubelet.env
|
||||
{% if system_reserved|bool %}
|
||||
ExecStartPre=/bin/mkdir -p /sys/fs/cgroup/cpu/{{ system_reserved_cgroups_for_service_slice }}
|
||||
ExecStartPre=/bin/mkdir -p /sys/fs/cgroup/cpuacct/{{ system_reserved_cgroups_for_service_slice }}
|
||||
ExecStartPre=/bin/mkdir -p /sys/fs/cgroup/cpuset/{{ system_reserved_cgroups_for_service_slice }}
|
||||
ExecStartPre=/bin/mkdir -p /sys/fs/cgroup/hugetlb/{{ system_reserved_cgroups_for_service_slice }}
|
||||
ExecStartPre=/bin/mkdir -p /sys/fs/cgroup/memory/{{ system_reserved_cgroups_for_service_slice }}
|
||||
ExecStartPre=/bin/mkdir -p /sys/fs/cgroup/pids/{{ system_reserved_cgroups_for_service_slice }}
|
||||
ExecStartPre=/bin/mkdir -p /sys/fs/cgroup/systemd/{{ system_reserved_cgroups_for_service_slice }}
|
||||
{% endif %}
|
||||
{% if kube_reserved|bool %}
|
||||
ExecStartPre=/bin/mkdir -p /sys/fs/cgroup/cpu/{{ kube_reserved_cgroups_for_service_slice }}
|
||||
ExecStartPre=/bin/mkdir -p /sys/fs/cgroup/cpuacct/{{ kube_reserved_cgroups_for_service_slice }}
|
||||
ExecStartPre=/bin/mkdir -p /sys/fs/cgroup/cpuset/{{ kube_reserved_cgroups_for_service_slice }}
|
||||
ExecStartPre=/bin/mkdir -p /sys/fs/cgroup/hugetlb/{{ kube_reserved_cgroups_for_service_slice }}
|
||||
ExecStartPre=/bin/mkdir -p /sys/fs/cgroup/memory/{{ kube_reserved_cgroups_for_service_slice }}
|
||||
ExecStartPre=/bin/mkdir -p /sys/fs/cgroup/pids/{{ kube_reserved_cgroups_for_service_slice }}
|
||||
ExecStartPre=/bin/mkdir -p /sys/fs/cgroup/systemd/{{ kube_reserved_cgroups_for_service_slice }}
|
||||
{% endif %}
|
||||
ExecStart={{ bin_dir }}/kubelet \
|
||||
$KUBE_LOGTOSTDERR \
|
||||
$KUBE_LOG_LEVEL \
|
||||
$KUBELET_API_SERVER \
|
||||
$KUBELET_ADDRESS \
|
||||
$KUBELET_PORT \
|
||||
$KUBELET_HOSTNAME \
|
||||
$KUBELET_ARGS \
|
||||
$DOCKER_SOCKET \
|
||||
$KUBELET_NETWORK_PLUGIN \
|
||||
$KUBELET_VOLUME_PLUGIN \
|
||||
$KUBELET_CLOUDPROVIDER
|
||||
Restart=always
|
||||
RestartSec=10s
|
||||
{% if kubelet_systemd_hardening %}
|
||||
# Hardening setup
|
||||
IPAddressDeny=any
|
||||
IPAddressAllow={{ kubelet_secure_addresses }}
|
||||
{% endif %}
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,49 @@
|
||||
global
|
||||
maxconn 4000
|
||||
log 127.0.0.1 local0
|
||||
|
||||
defaults
|
||||
mode http
|
||||
log global
|
||||
option httplog
|
||||
option dontlognull
|
||||
option http-server-close
|
||||
option redispatch
|
||||
retries 5
|
||||
timeout http-request 5m
|
||||
timeout queue 5m
|
||||
timeout connect 30s
|
||||
timeout client {{ loadbalancer_apiserver_keepalive_timeout }}
|
||||
timeout server 15m
|
||||
timeout http-keep-alive 30s
|
||||
timeout check 30s
|
||||
maxconn 4000
|
||||
|
||||
{% if loadbalancer_apiserver_healthcheck_port is defined -%}
|
||||
frontend healthz
|
||||
bind 0.0.0.0:{{ loadbalancer_apiserver_healthcheck_port }}
|
||||
{% if ipv6_stack -%}
|
||||
bind :::{{ loadbalancer_apiserver_healthcheck_port }}
|
||||
{% endif -%}
|
||||
mode http
|
||||
monitor-uri /healthz
|
||||
{% endif %}
|
||||
|
||||
frontend kube_api_frontend
|
||||
bind 127.0.0.1:{{ loadbalancer_apiserver_port|default(kube_apiserver_port) }}
|
||||
{% if ipv6_stack -%}
|
||||
bind [::1]:{{ loadbalancer_apiserver_port|default(kube_apiserver_port) }};
|
||||
{% endif -%}
|
||||
mode tcp
|
||||
option tcplog
|
||||
default_backend kube_api_backend
|
||||
|
||||
backend kube_api_backend
|
||||
mode tcp
|
||||
balance leastconn
|
||||
default-server inter 15s downinter 15s rise 2 fall 2 slowstart 60s maxconn 1000 maxqueue 256 weight 100
|
||||
option httpchk GET /healthz
|
||||
http-check expect status 200
|
||||
{% for host in groups['kube_control_plane'] -%}
|
||||
server {{ host }} {{ hostvars[host]['main_access_ip'] | ansible.utils.ipwrap }}:{{ kube_apiserver_port }} check check-ssl verify none
|
||||
{% endfor -%}
|
||||
@@ -0,0 +1,60 @@
|
||||
error_log stderr notice;
|
||||
|
||||
worker_processes 2;
|
||||
worker_rlimit_nofile 130048;
|
||||
worker_shutdown_timeout 10s;
|
||||
|
||||
events {
|
||||
multi_accept on;
|
||||
use epoll;
|
||||
worker_connections 16384;
|
||||
}
|
||||
|
||||
stream {
|
||||
upstream kube_apiserver {
|
||||
least_conn;
|
||||
{% for host in groups['kube_control_plane'] -%}
|
||||
server {{ hostvars[host]['main_access_ip'] | ansible.utils.ipwrap }}:{{ kube_apiserver_port }};
|
||||
{% endfor -%}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 127.0.0.1:{{ loadbalancer_apiserver_port|default(kube_apiserver_port) }};
|
||||
{% if ipv6_stack -%}
|
||||
listen [::1]:{{ loadbalancer_apiserver_port|default(kube_apiserver_port) }};
|
||||
{% endif -%}
|
||||
proxy_pass kube_apiserver;
|
||||
proxy_timeout 10m;
|
||||
proxy_connect_timeout 1s;
|
||||
}
|
||||
}
|
||||
|
||||
http {
|
||||
aio threads;
|
||||
aio_write on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
|
||||
keepalive_timeout {{ loadbalancer_apiserver_keepalive_timeout }};
|
||||
keepalive_requests 100;
|
||||
reset_timedout_connection on;
|
||||
server_tokens off;
|
||||
autoindex off;
|
||||
|
||||
{% if loadbalancer_apiserver_healthcheck_port is defined -%}
|
||||
server {
|
||||
listen {{ loadbalancer_apiserver_healthcheck_port }};
|
||||
{% if ipv6_stack -%}
|
||||
listen [::]:{{ loadbalancer_apiserver_healthcheck_port }};
|
||||
{% endif -%}
|
||||
location /healthz {
|
||||
access_log off;
|
||||
return 200;
|
||||
}
|
||||
location /stub_status {
|
||||
stub_status on;
|
||||
access_log off;
|
||||
}
|
||||
}
|
||||
{% endif %}
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: {{ loadbalancer_apiserver_pod_name }}
|
||||
namespace: kube-system
|
||||
labels:
|
||||
addonmanager.kubernetes.io/mode: Reconcile
|
||||
k8s-app: kube-haproxy
|
||||
annotations:
|
||||
haproxy-cfg-checksum: "{{ haproxy_stat.stat.checksum }}"
|
||||
spec:
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
priorityClassName: system-node-critical
|
||||
containers:
|
||||
- name: haproxy
|
||||
image: {{ haproxy_image_repo }}:{{ haproxy_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
resources:
|
||||
requests:
|
||||
cpu: {{ loadbalancer_apiserver_cpu_requests }}
|
||||
memory: {{ loadbalancer_apiserver_memory_requests }}
|
||||
{% if loadbalancer_apiserver_healthcheck_port is defined -%}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: {{ loadbalancer_apiserver_healthcheck_port }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: {{ loadbalancer_apiserver_healthcheck_port }}
|
||||
{% endif -%}
|
||||
volumeMounts:
|
||||
- mountPath: /usr/local/etc/haproxy/
|
||||
name: etc-haproxy
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: etc-haproxy
|
||||
hostPath:
|
||||
path: {{ haproxy_config_dir }}
|
||||
@@ -0,0 +1,129 @@
|
||||
# Inspired by https://github.com/kube-vip/kube-vip/blob/v0.8.0/pkg/kubevip/config_generator.go#L103
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: kube-vip
|
||||
namespace: kube-system
|
||||
labels:
|
||||
addonmanager.kubernetes.io/mode: Reconcile
|
||||
k8s-app: kube-vip
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- manager
|
||||
env:
|
||||
- name: vip_arp
|
||||
value: {{ kube_vip_arp_enabled | string | to_json }}
|
||||
- name: port
|
||||
value: {{ kube_apiserver_port | string | to_json }}
|
||||
- name: vip_nodename
|
||||
value: {{ inventory_hostname }}
|
||||
{% if kube_vip_interface %}
|
||||
- name: vip_interface
|
||||
value: {{ kube_vip_interface | string | to_json }}
|
||||
{% endif %}
|
||||
{% if kube_vip_services_interface %}
|
||||
- name: vip_servicesinterface
|
||||
value: {{ kube_vip_services_interface | string | to_json }}
|
||||
{% endif %}
|
||||
{% if kube_vip_cidr %}
|
||||
- name: vip_cidr
|
||||
value: {{ kube_vip_cidr | string | to_json }}
|
||||
{% endif %}
|
||||
{% if kube_vip_dns_mode %}
|
||||
- name: dns_mode
|
||||
value: {{ kube_vip_dns_mode | string | to_json }}
|
||||
{% endif %}
|
||||
{% if kube_vip_controlplane_enabled %}
|
||||
- name: cp_enable
|
||||
value: "true"
|
||||
- name: cp_namespace
|
||||
value: kube-system
|
||||
- name: vip_ddns
|
||||
value: {{ kube_vip_ddns_enabled | string | to_json }}
|
||||
- name: cp_detect
|
||||
value: {{ kube_vip_cp_detect | string | to_json }}
|
||||
{% endif %}
|
||||
{% if kube_vip_services_enabled %}
|
||||
- name: svc_enable
|
||||
value: "true"
|
||||
{% endif %}
|
||||
{% if kube_vip_svc_leasename %}
|
||||
- name: svc_leasename
|
||||
value: {{ kube_vip_svc_leasename | string | to_json }}
|
||||
{% endif %}
|
||||
{% if kube_vip_enableServicesElection %}
|
||||
- name: svc_election
|
||||
value: "true"
|
||||
{% endif %}
|
||||
{% if kube_vip_leader_election_enabled %}
|
||||
- name: vip_leaderelection
|
||||
value: "true"
|
||||
- name: vip_leasename
|
||||
value: {{ kube_vip_leasename | string | to_json }}
|
||||
- name: vip_leaseduration
|
||||
value: {{ kube_vip_leaseduration | string | to_json }}
|
||||
- name: vip_renewdeadline
|
||||
value: {{ kube_vip_renewdeadline | string | to_json }}
|
||||
- name: vip_retryperiod
|
||||
value: {{ kube_vip_retryperiod | string | to_json }}
|
||||
{% endif %}
|
||||
{% if kube_vip_enable_node_labeling %}
|
||||
- name: enable_node_labeling
|
||||
value: {{ kube_vip_enable_node_labeling | string | to_json }}
|
||||
{% endif %}
|
||||
{% if kube_vip_bgp_enabled %}
|
||||
- name: bgp_enable
|
||||
value: "true"
|
||||
- name: bgp_routerid
|
||||
value: {{ kube_vip_bgp_routerid | string | to_json }}
|
||||
- name: bgp_as
|
||||
value: {{ kube_vip_local_as | string | to_json }}
|
||||
- name: bgp_peeraddress
|
||||
value: {{ kube_vip_bgp_peeraddress | to_json }}
|
||||
- name: bgp_peerpass
|
||||
value: {{ kube_vip_bgp_peerpass | to_json }}
|
||||
- name: bgp_peeras
|
||||
value: {{ kube_vip_bgp_peeras | string | to_json }}
|
||||
{% if kube_vip_bgppeers %}
|
||||
- name: bgp_peers
|
||||
value: {{ kube_vip_bgppeers | join(',') | to_json }}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
- name: address
|
||||
value: {{ kube_vip_address | to_json }}
|
||||
{% if kube_vip_lb_enable %}
|
||||
- name: lb_enable
|
||||
value: "true"
|
||||
{% endif %}
|
||||
{% if kube_vip_lb_fwdmethod %}
|
||||
- name: lb_fwdmethod
|
||||
value: {{ kube_vip_lb_fwdmethod | string | to_json }}
|
||||
{% endif %}
|
||||
image: {{ kube_vip_image_repo }}:{{ kube_vip_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
name: kube-vip
|
||||
resources: {}
|
||||
{% if kube_vip_lb_fwdmethod == "masquerade" %}
|
||||
securityContext:
|
||||
privileged: true
|
||||
{% else %}
|
||||
securityContext:
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
{% endif %}
|
||||
volumeMounts:
|
||||
- mountPath: /etc/kubernetes/admin.conf
|
||||
name: kubeconfig
|
||||
hostAliases:
|
||||
- hostnames:
|
||||
- kubernetes
|
||||
ip: 127.0.0.1
|
||||
hostNetwork: true
|
||||
volumes:
|
||||
- hostPath:
|
||||
path: /etc/kubernetes/{{kube_vip_admin_conf}}
|
||||
name: kubeconfig
|
||||
status: {}
|
||||
@@ -0,0 +1,42 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: {{ loadbalancer_apiserver_pod_name }}
|
||||
namespace: kube-system
|
||||
labels:
|
||||
addonmanager.kubernetes.io/mode: Reconcile
|
||||
k8s-app: kube-nginx
|
||||
annotations:
|
||||
nginx-cfg-checksum: "{{ nginx_stat.stat.checksum }}"
|
||||
spec:
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
priorityClassName: system-node-critical
|
||||
containers:
|
||||
- name: nginx-proxy
|
||||
image: {{ nginx_image_repo }}:{{ nginx_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
resources:
|
||||
requests:
|
||||
cpu: {{ loadbalancer_apiserver_cpu_requests }}
|
||||
memory: {{ loadbalancer_apiserver_memory_requests }}
|
||||
{% if loadbalancer_apiserver_healthcheck_port is defined -%}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: {{ loadbalancer_apiserver_healthcheck_port }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: {{ loadbalancer_apiserver_healthcheck_port }}
|
||||
{% endif -%}
|
||||
volumeMounts:
|
||||
- mountPath: /etc/nginx
|
||||
name: etc-nginx
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: etc-nginx
|
||||
hostPath:
|
||||
path: {{ nginx_config_dir }}
|
||||
@@ -0,0 +1,19 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Config
|
||||
clusters:
|
||||
- name: local
|
||||
cluster:
|
||||
certificate-authority: {{ kube_cert_dir }}/ca.pem
|
||||
server: "{{ kube_apiserver_endpoint }}"
|
||||
users:
|
||||
- name: kubelet
|
||||
user:
|
||||
client-certificate: {{ kube_cert_dir }}/node-{{ inventory_hostname }}.pem
|
||||
client-key: {{ kube_cert_dir }}/node-{{ inventory_hostname }}-key.pem
|
||||
contexts:
|
||||
- context:
|
||||
cluster: local
|
||||
user: kubelet
|
||||
name: kubelet-{{ cluster_name }}
|
||||
current-context: kubelet-{{ cluster_name }}
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
kube_resolv_conf: "/run/systemd/resolve/resolv.conf"
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
kube_resolv_conf: "/run/systemd/resolve/resolv.conf"
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
kube_resolv_conf: "/run/systemd/resolve/resolv.conf"
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
kube_resolv_conf: "/run/systemd/resolve/resolv.conf"
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
kube_resolv_conf: "/run/systemd/resolve/resolv.conf"
|
||||
Reference in New Issue
Block a user