update to latest 2.26.0 kubespray version and add dns zones settings to coredns
This commit is contained in:
@@ -30,9 +30,9 @@
|
||||
copy:
|
||||
src: "{{ kube_config_dir }}/admin.conf"
|
||||
dest: "{{ ansible_env.HOME | default('/root') }}/.kube/config"
|
||||
remote_src: yes
|
||||
remote_src: true
|
||||
mode: "0600"
|
||||
backup: yes
|
||||
backup: true
|
||||
|
||||
- name: Create kube artifacts dir
|
||||
file:
|
||||
@@ -41,8 +41,8 @@
|
||||
state: directory
|
||||
delegate_to: localhost
|
||||
connection: local
|
||||
become: no
|
||||
run_once: yes
|
||||
become: false
|
||||
run_once: true
|
||||
when: kubeconfig_localhost
|
||||
|
||||
- name: Wait for k8s apiserver
|
||||
@@ -54,7 +54,7 @@
|
||||
- name: Get admin kubeconfig from remote host
|
||||
slurp:
|
||||
src: "{{ kube_config_dir }}/admin.conf"
|
||||
run_once: yes
|
||||
run_once: true
|
||||
register: raw_admin_kubeconfig
|
||||
when: kubeconfig_localhost
|
||||
|
||||
@@ -80,24 +80,24 @@
|
||||
copy:
|
||||
content: "{{ final_admin_kubeconfig | to_nice_yaml(indent=2) }}"
|
||||
dest: "{{ artifacts_dir }}/admin.conf"
|
||||
mode: 0600
|
||||
mode: "0600"
|
||||
delegate_to: localhost
|
||||
connection: local
|
||||
become: no
|
||||
run_once: yes
|
||||
become: false
|
||||
run_once: true
|
||||
when: kubeconfig_localhost
|
||||
|
||||
- name: Copy kubectl binary to ansible host
|
||||
fetch:
|
||||
src: "{{ bin_dir }}/kubectl"
|
||||
dest: "{{ artifacts_dir }}/kubectl"
|
||||
flat: yes
|
||||
validate_checksum: no
|
||||
flat: true
|
||||
validate_checksum: false
|
||||
register: copy_binary_result
|
||||
until: copy_binary_result is not failed
|
||||
retries: 20
|
||||
become: no
|
||||
run_once: yes
|
||||
become: false
|
||||
run_once: true
|
||||
when: kubectl_localhost
|
||||
|
||||
- name: Create helper script kubectl.sh on ansible host
|
||||
@@ -106,9 +106,9 @@
|
||||
#!/bin/bash
|
||||
${BASH_SOURCE%/*}/kubectl --kubeconfig=${BASH_SOURCE%/*}/admin.conf "$@"
|
||||
dest: "{{ artifacts_dir }}/kubectl.sh"
|
||||
mode: 0755
|
||||
become: no
|
||||
run_once: yes
|
||||
mode: "0755"
|
||||
become: false
|
||||
run_once: true
|
||||
delegate_to: localhost
|
||||
connection: local
|
||||
when: kubectl_localhost and kubeconfig_localhost
|
||||
|
||||
@@ -240,3 +240,6 @@ kubeadm_upgrade_auto_cert_renewal: true
|
||||
kube_apiserver_tracing: false
|
||||
kube_apiserver_tracing_endpoint: 0.0.0.0:4317
|
||||
kube_apiserver_tracing_sampling_rate_per_million: 100
|
||||
|
||||
# Enable kubeadm file discovery if anonymous access has been removed
|
||||
kubeadm_use_file_discovery: "{{ remove_anonymous_access }}"
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
- name: Master | reload systemd
|
||||
systemd:
|
||||
systemd_service:
|
||||
daemon_reload: true
|
||||
listen: Master | restart kubelet
|
||||
|
||||
@@ -81,7 +81,7 @@
|
||||
endpoint: "{{ kube_scheduler_bind_address if kube_scheduler_bind_address != '0.0.0.0' else 'localhost' }}"
|
||||
uri:
|
||||
url: https://{{ endpoint }}:10259/healthz
|
||||
validate_certs: no
|
||||
validate_certs: false
|
||||
register: scheduler_result
|
||||
until: scheduler_result.status == 200
|
||||
retries: 60
|
||||
@@ -95,7 +95,7 @@
|
||||
endpoint: "{{ kube_controller_manager_bind_address if kube_controller_manager_bind_address != '0.0.0.0' else 'localhost' }}"
|
||||
uri:
|
||||
url: https://{{ endpoint }}:10257/healthz
|
||||
validate_certs: no
|
||||
validate_certs: false
|
||||
register: controller_manager_result
|
||||
until: controller_manager_result.status == 200
|
||||
retries: 60
|
||||
@@ -107,7 +107,7 @@
|
||||
- name: Master | wait for the apiserver to be running
|
||||
uri:
|
||||
url: "{{ kube_apiserver_endpoint }}/healthz"
|
||||
validate_certs: no
|
||||
validate_certs: false
|
||||
register: result
|
||||
until: result.status == 200
|
||||
retries: 60
|
||||
|
||||
@@ -3,16 +3,16 @@
|
||||
- name: Check which kube-control nodes are already members of the cluster
|
||||
command: "{{ bin_dir }}/kubectl get nodes --selector=node-role.kubernetes.io/control-plane -o json"
|
||||
register: kube_control_planes_raw
|
||||
ignore_errors: yes
|
||||
ignore_errors: true
|
||||
changed_when: false
|
||||
|
||||
- name: Set fact joined_control_planes
|
||||
set_fact:
|
||||
joined_control_planes: "{{ ((kube_control_planes_raw.stdout | from_json)['items']) | default([]) | map(attribute='metadata') | map(attribute='name') | list }}"
|
||||
delegate_to: item
|
||||
delegate_to: "{{ item }}"
|
||||
loop: "{{ groups['kube_control_plane'] }}"
|
||||
when: kube_control_planes_raw is succeeded
|
||||
run_once: yes
|
||||
run_once: true
|
||||
|
||||
- name: Set fact first_kube_control_plane
|
||||
set_fact:
|
||||
|
||||
@@ -2,9 +2,9 @@
|
||||
- name: Check if secret for encrypting data at rest already exist
|
||||
stat:
|
||||
path: "{{ kube_cert_dir }}/secrets_encryption.yaml"
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: secrets_encryption_file
|
||||
|
||||
- name: Slurp secrets_encryption file if it exists
|
||||
@@ -37,4 +37,4 @@
|
||||
dest: "{{ kube_cert_dir }}/secrets_encryption.yaml"
|
||||
owner: root
|
||||
group: "{{ kube_cert_group }}"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
src: "{{ kube_cert_dir }}/{{ item }}"
|
||||
dest: "{{ kube_cert_dir }}/{{ item }}.old"
|
||||
mode: preserve
|
||||
remote_src: yes
|
||||
remote_src: true
|
||||
with_items:
|
||||
- apiserver.crt
|
||||
- apiserver.key
|
||||
@@ -19,7 +19,7 @@
|
||||
src: "{{ kube_config_dir }}/{{ item }}"
|
||||
dest: "{{ kube_config_dir }}/{{ item }}.old"
|
||||
mode: preserve
|
||||
remote_src: yes
|
||||
remote_src: true
|
||||
with_items:
|
||||
- admin.conf
|
||||
- controller-manager.conf
|
||||
|
||||
@@ -25,5 +25,5 @@
|
||||
path: "{{ etcd_data_dir }}"
|
||||
owner: "{{ etcd_owner }}"
|
||||
group: "{{ etcd_owner }}"
|
||||
mode: 0700
|
||||
mode: "0700"
|
||||
when: etcd_deployment_type == "kubeadm"
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
dest: "{{ kube_config_dir }}/{{ item }}"
|
||||
regexp: '^ server: https'
|
||||
line: ' server: {{ kube_apiserver_endpoint }}'
|
||||
backup: yes
|
||||
backup: true
|
||||
with_items:
|
||||
- admin.conf
|
||||
- controller-manager.conf
|
||||
|
||||
@@ -25,7 +25,7 @@
|
||||
- name: Parse certificate key if not set
|
||||
set_fact:
|
||||
kubeadm_certificate_key: "{{ hostvars[groups['kube_control_plane'][0]]['kubeadm_upload_cert'].stdout_lines[-1] | trim }}"
|
||||
run_once: yes
|
||||
run_once: true
|
||||
when:
|
||||
- hostvars[groups['kube_control_plane'][0]]['kubeadm_upload_cert'] is defined
|
||||
- hostvars[groups['kube_control_plane'][0]]['kubeadm_upload_cert'] is not skipped
|
||||
@@ -34,8 +34,8 @@
|
||||
template:
|
||||
src: "kubeadm-controlplane.{{ kubeadmConfig_api_version }}.yaml.j2"
|
||||
dest: "{{ kube_config_dir }}/kubeadm-controlplane.yaml"
|
||||
mode: 0640
|
||||
backup: yes
|
||||
mode: "0640"
|
||||
backup: true
|
||||
when:
|
||||
- inventory_hostname != first_kube_control_plane
|
||||
- not kubeadm_already_run.stat.exists
|
||||
@@ -63,6 +63,26 @@
|
||||
- kubeadm_already_run is not defined or not kubeadm_already_run.stat.exists
|
||||
- not kube_external_ca_mode
|
||||
|
||||
- name: Get kubeconfig for join discovery process
|
||||
command: "{{ kubectl }} -n kube-public get cm cluster-info -o jsonpath='{.data.kubeconfig}'"
|
||||
register: kubeconfig_file_discovery
|
||||
run_once: true
|
||||
delegate_to: "{{ groups['kube_control_plane'] | first }}"
|
||||
when:
|
||||
- kubeadm_use_file_discovery
|
||||
- kubeadm_already_run is not defined or not kubeadm_already_run.stat.exists
|
||||
|
||||
- name: Copy discovery kubeconfig
|
||||
copy:
|
||||
dest: "{{ kube_config_dir }}/cluster-info-discovery-kubeconfig.yaml"
|
||||
content: "{{ kubeconfig_file_discovery.stdout }}"
|
||||
owner: "root"
|
||||
mode: "0644"
|
||||
when:
|
||||
- inventory_hostname != first_kube_control_plane
|
||||
- kubeadm_use_file_discovery
|
||||
- kubeadm_already_run is not defined or not kubeadm_already_run.stat.exists
|
||||
|
||||
- name: Joining control plane node to the cluster.
|
||||
command: >-
|
||||
{{ bin_dir }}/kubeadm join
|
||||
|
||||
@@ -13,9 +13,9 @@
|
||||
- name: Kubeadm | Check if kubeadm has already run
|
||||
stat:
|
||||
path: "/var/lib/kubelet/config.yaml"
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: kubeadm_already_run
|
||||
|
||||
- name: Kubeadm | Backup kubeadm certs / kubeconfig
|
||||
@@ -51,35 +51,35 @@
|
||||
file:
|
||||
path: "{{ audit_policy_file | dirname }}"
|
||||
state: directory
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kubernetes_audit | default(false) or kubernetes_audit_webhook | default(false)
|
||||
|
||||
- name: Write api audit policy yaml
|
||||
template:
|
||||
src: apiserver-audit-policy.yaml.j2
|
||||
dest: "{{ audit_policy_file }}"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kubernetes_audit | default(false) or kubernetes_audit_webhook | default(false)
|
||||
|
||||
- name: Write api audit webhook config yaml
|
||||
template:
|
||||
src: apiserver-audit-webhook-config.yaml.j2
|
||||
dest: "{{ audit_webhook_config_file }}"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kubernetes_audit_webhook | default(false)
|
||||
|
||||
- name: Create apiserver tracing config directory
|
||||
file:
|
||||
path: "{{ kube_config_dir }}/tracing"
|
||||
state: directory
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kube_apiserver_tracing
|
||||
|
||||
- name: Write apiserver tracing config yaml
|
||||
template:
|
||||
src: apiserver-tracing.yaml.j2
|
||||
dest: "{{ kube_config_dir }}/tracing/apiserver-tracing.yaml"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kube_apiserver_tracing
|
||||
|
||||
# Nginx LB(default), If kubeadm_config_api_fqdn is defined, use other LB by kubeadm controlPlaneEndpoint.
|
||||
@@ -96,27 +96,27 @@
|
||||
template:
|
||||
src: "kubeadm-config.{{ kubeadmConfig_api_version }}.yaml.j2"
|
||||
dest: "{{ kube_config_dir }}/kubeadm-config.yaml"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
|
||||
- name: Kubeadm | Create directory to store admission control configurations
|
||||
file:
|
||||
path: "{{ kube_config_dir }}/admission-controls"
|
||||
state: directory
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kube_apiserver_admission_control_config_file
|
||||
|
||||
- name: Kubeadm | Push admission control config file
|
||||
template:
|
||||
src: "admission-controls.yaml.j2"
|
||||
dest: "{{ kube_config_dir }}/admission-controls/admission-controls.yaml"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kube_apiserver_admission_control_config_file
|
||||
|
||||
- name: Kubeadm | Push admission control config files
|
||||
template:
|
||||
src: "{{ item | lower }}.yaml.j2"
|
||||
dest: "{{ kube_config_dir }}/admission-controls/{{ item | lower }}.yaml"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when:
|
||||
- kube_apiserver_admission_control_config_file
|
||||
- item in kube_apiserver_admission_plugins_needs_configuration
|
||||
@@ -126,7 +126,7 @@
|
||||
template:
|
||||
src: "podnodeselector.yaml.j2"
|
||||
dest: "{{ kube_config_dir }}/admission-controls/podnodeselector.yaml"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when:
|
||||
- kube_apiserver_admission_plugins_podnodeselector_default_node_selector is defined
|
||||
- kube_apiserver_admission_plugins_podnodeselector_default_node_selector | length > 0
|
||||
@@ -178,7 +178,7 @@
|
||||
file:
|
||||
path: "{{ kubeadm_patches.dest_dir }}"
|
||||
state: directory
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kubeadm_patches is defined and kubeadm_patches.enabled
|
||||
|
||||
- name: Kubeadm | Copy kubeadm patches from inventory files
|
||||
@@ -186,7 +186,7 @@
|
||||
src: "{{ kubeadm_patches.source_dir }}/"
|
||||
dest: "{{ kubeadm_patches.dest_dir }}"
|
||||
owner: "root"
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
when: kubeadm_patches is defined and kubeadm_patches.enabled
|
||||
|
||||
- name: Kubeadm | Initialize first master
|
||||
@@ -221,12 +221,16 @@
|
||||
{{ bin_dir }}/kubeadm --kubeconfig {{ kube_config_dir }}/admin.conf token create {{ kubeadm_token }}
|
||||
changed_when: false
|
||||
when:
|
||||
- inventory_hostname == first_kube_control_plane
|
||||
- inventory_hostname == first_kube_control_plane
|
||||
- kubeadm_token is defined
|
||||
- kubeadm_refresh_token
|
||||
tags:
|
||||
- kubeadm_token
|
||||
|
||||
- name: Remove binding to anonymous user
|
||||
command: "{{ kubectl }} -n kube-public delete rolebinding kubeadm:bootstrap-signer-clusterinfo --ignore-not-found"
|
||||
when: inventory_hostname == first_kube_control_plane and remove_anonymous_access
|
||||
|
||||
- name: Create kubeadm token for joining nodes with 24h expiration (default)
|
||||
command: "{{ bin_dir }}/kubeadm --kubeconfig {{ kube_config_dir }}/admin.conf token create"
|
||||
changed_when: false
|
||||
|
||||
@@ -15,7 +15,6 @@
|
||||
{{ bin_dir }}/kubeadm
|
||||
upgrade apply -y {{ kube_version }}
|
||||
--certificate-renewal={{ kubeadm_upgrade_auto_cert_renewal }}
|
||||
--config={{ kube_config_dir }}/kubeadm-config.yaml
|
||||
--ignore-preflight-errors=all
|
||||
--allow-experimental-upgrades
|
||||
--etcd-upgrade={{ (etcd_deployment_type == "kubeadm") | bool | lower }}
|
||||
@@ -37,7 +36,6 @@
|
||||
{{ bin_dir }}/kubeadm
|
||||
upgrade apply -y {{ kube_version }}
|
||||
--certificate-renewal={{ kubeadm_upgrade_auto_cert_renewal }}
|
||||
--config={{ kube_config_dir }}/kubeadm-config.yaml
|
||||
--ignore-preflight-errors=all
|
||||
--allow-experimental-upgrades
|
||||
--etcd-upgrade={{ (etcd_deployment_type == "kubeadm") | bool | lower }}
|
||||
@@ -53,6 +51,10 @@
|
||||
PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
|
||||
notify: Master | restart kubelet
|
||||
|
||||
- name: Kubeadm | Remove binding to anonymous user
|
||||
command: "{{ kubectl }} -n kube-public delete rolebinding kubeadm:bootstrap-signer-clusterinfo --ignore-not-found"
|
||||
when: remove_anonymous_access
|
||||
|
||||
- name: Kubeadm | clean kubectl cache to refresh api types
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
path: "{{ kube_config_dir }}/kubelet.conf"
|
||||
regexp: '^ client-certificate-data: '
|
||||
line: ' client-certificate: /var/lib/kubelet/pki/kubelet-client-current.pem'
|
||||
backup: yes
|
||||
backup: true
|
||||
notify:
|
||||
- "Master | reload kubelet"
|
||||
|
||||
@@ -13,6 +13,6 @@
|
||||
path: "{{ kube_config_dir }}/kubelet.conf"
|
||||
regexp: '^ client-key-data: '
|
||||
line: ' client-key: /var/lib/kubelet/pki/kubelet-client-current.pem'
|
||||
backup: yes
|
||||
backup: true
|
||||
notify:
|
||||
- "Master | reload kubelet"
|
||||
|
||||
@@ -8,21 +8,21 @@
|
||||
template:
|
||||
src: webhook-token-auth-config.yaml.j2
|
||||
dest: "{{ kube_config_dir }}/webhook-token-auth-config.yaml"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kube_webhook_token_auth | default(false)
|
||||
|
||||
- name: Create webhook authorization config
|
||||
template:
|
||||
src: webhook-authorization-config.yaml.j2
|
||||
dest: "{{ kube_config_dir }}/webhook-authorization-config.yaml"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kube_webhook_authorization | default(false)
|
||||
|
||||
- name: Create kube-scheduler config
|
||||
template:
|
||||
src: kubescheduler-config.yaml.j2
|
||||
dest: "{{ kube_config_dir }}/kubescheduler-config.yaml"
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
|
||||
- name: Apply Kubernetes encrypt at rest config
|
||||
import_tasks: encrypt-at-rest.yml
|
||||
@@ -35,7 +35,7 @@
|
||||
copy:
|
||||
src: "{{ downloads.kubectl.dest }}"
|
||||
dest: "{{ bin_dir }}/kubectl"
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
remote_src: true
|
||||
tags:
|
||||
- kubectl
|
||||
@@ -53,7 +53,7 @@
|
||||
path: /etc/bash_completion.d/kubectl.sh
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
when: ansible_os_family in ["Debian","RedHat"]
|
||||
tags:
|
||||
- kubectl
|
||||
@@ -101,13 +101,13 @@
|
||||
template:
|
||||
src: k8s-certs-renew.sh.j2
|
||||
dest: "{{ bin_dir }}/k8s-certs-renew.sh"
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
|
||||
- name: Renew K8S control plane certificates monthly 1/2
|
||||
template:
|
||||
src: "{{ item }}.j2"
|
||||
dest: "/etc/systemd/system/{{ item }}"
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:{{item}}'"
|
||||
# FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
|
||||
# Remove once we drop support for systemd < 250
|
||||
@@ -118,9 +118,9 @@
|
||||
when: auto_renew_certificates
|
||||
|
||||
- name: Renew K8S control plane certificates monthly 2/2
|
||||
systemd:
|
||||
systemd_service:
|
||||
name: k8s-certs-renew.timer
|
||||
enabled: yes
|
||||
enabled: true
|
||||
state: started
|
||||
daemon_reload: "{{ k8s_certs_units is changed }}"
|
||||
when: auto_renew_certificates
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
apiVersion: apiserver.config.k8s.io/v1beta1
|
||||
kind: TracingConfiguration
|
||||
endpoint: {{ kube_apiserver_tracing_endpoint }}
|
||||
samplingRatePerMillion: {{ kube_apiserver_tracing_sampling_rate_per_million }}
|
||||
samplingRatePerMillion: {{ kube_apiserver_tracing_sampling_rate_per_million }}
|
||||
|
||||
@@ -14,7 +14,7 @@ certificateKey: {{ kubeadm_certificate_key }}
|
||||
{% endif %}
|
||||
nodeRegistration:
|
||||
{% if kube_override_hostname | default('') %}
|
||||
name: {{ kube_override_hostname }}
|
||||
name: "{{ kube_override_hostname }}"
|
||||
{% endif %}
|
||||
{% if inventory_hostname in groups['kube_control_plane'] and inventory_hostname not in groups['kube_node'] %}
|
||||
taints:
|
||||
@@ -76,17 +76,17 @@ etcd:
|
||||
{% endfor %}
|
||||
serverCertSANs:
|
||||
{% for san in etcd_cert_alt_names %}
|
||||
- {{ san }}
|
||||
- "{{ san }}"
|
||||
{% endfor %}
|
||||
{% for san in etcd_cert_alt_ips %}
|
||||
- {{ san }}
|
||||
- "{{ san }}"
|
||||
{% endfor %}
|
||||
peerCertSANs:
|
||||
{% for san in etcd_cert_alt_names %}
|
||||
- {{ san }}
|
||||
- "{{ san }}"
|
||||
{% endfor %}
|
||||
{% for san in etcd_cert_alt_ips %}
|
||||
- {{ san }}
|
||||
- "{{ san }}"
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
dns:
|
||||
@@ -294,7 +294,7 @@ apiServer:
|
||||
{% endif %}
|
||||
certSANs:
|
||||
{% for san in apiserver_sans %}
|
||||
- {{ san }}
|
||||
- "{{ san }}"
|
||||
{% endfor %}
|
||||
timeoutForControlPlane: 5m0s
|
||||
controllerManager:
|
||||
@@ -416,7 +416,7 @@ conntrack:
|
||||
tcpEstablishedTimeout: {{ kube_proxy_conntrack_tcp_established_timeout }}
|
||||
enableProfiling: {{ kube_proxy_enable_profiling }}
|
||||
healthzBindAddress: {{ kube_proxy_healthz_bind_address }}
|
||||
hostnameOverride: {{ kube_override_hostname }}
|
||||
hostnameOverride: "{{ kube_override_hostname }}"
|
||||
iptables:
|
||||
masqueradeAll: {{ kube_proxy_masquerade_all }}
|
||||
masqueradeBit: {{ kube_proxy_masquerade_bit }}
|
||||
|
||||
@@ -1,6 +1,10 @@
|
||||
apiVersion: kubeadm.k8s.io/v1beta3
|
||||
kind: JoinConfiguration
|
||||
discovery:
|
||||
{% if kubeadm_use_file_discovery %}
|
||||
file:
|
||||
kubeConfigPath: {{ kube_config_dir }}/cluster-info-discovery-kubeconfig.yaml
|
||||
{% else %}
|
||||
bootstrapToken:
|
||||
{% if kubeadm_config_api_fqdn is defined %}
|
||||
apiServerEndpoint: {{ kubeadm_config_api_fqdn }}:{{ loadbalancer_apiserver.port | default(kube_apiserver_port) }}
|
||||
@@ -9,6 +13,7 @@ discovery:
|
||||
{% endif %}
|
||||
token: {{ kubeadm_token }}
|
||||
unsafeSkipCAVerification: true
|
||||
{% endif %}
|
||||
timeout: {{ discovery_timeout }}
|
||||
tlsBootstrapToken: {{ kubeadm_token }}
|
||||
controlPlane:
|
||||
|
||||
@@ -4,6 +4,9 @@
|
||||
discovery_timeout: 60s
|
||||
kubeadm_join_timeout: 120s
|
||||
|
||||
# Enable kubeadm file discovery if anonymous access has been removed
|
||||
kubeadm_use_file_discovery: "{{ remove_anonymous_access }}"
|
||||
|
||||
# If non-empty, will use this string as identification instead of the actual hostname
|
||||
kube_override_hostname: >-
|
||||
{%- if cloud_provider is defined and cloud_provider in ['aws'] -%}
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
- name: Kubeadm | reload systemd
|
||||
systemd:
|
||||
systemd_service:
|
||||
daemon_reload: true
|
||||
listen: Kubeadm | restart kubelet
|
||||
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
template:
|
||||
src: "kubeadm-client.conf.{{ kubeadmConfig_api_version }}.j2"
|
||||
dest: "{{ kube_config_dir }}/kubeadm-cert-controlplane.conf"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
vars:
|
||||
kubeadm_cert_controlplane: true
|
||||
|
||||
|
||||
@@ -14,17 +14,17 @@
|
||||
- name: Check if kubelet.conf exists
|
||||
stat:
|
||||
path: "{{ kube_config_dir }}/kubelet.conf"
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: kubelet_conf
|
||||
|
||||
- name: Check if kubeadm CA cert is accessible
|
||||
stat:
|
||||
path: "{{ kube_cert_dir }}/ca.crt"
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: kubeadm_ca_stat
|
||||
delegate_to: "{{ groups['kube_control_plane'][0] }}"
|
||||
run_once: true
|
||||
@@ -57,19 +57,37 @@
|
||||
set_fact:
|
||||
kubeadmConfig_api_version: v1beta3
|
||||
|
||||
- name: Get kubeconfig for join discovery process
|
||||
command: "{{ kubectl }} -n kube-public get cm cluster-info -o jsonpath='{.data.kubeconfig}'"
|
||||
register: kubeconfig_file_discovery
|
||||
run_once: true
|
||||
delegate_to: "{{ groups['kube_control_plane'] | first }}"
|
||||
when: kubeadm_use_file_discovery
|
||||
|
||||
- name: Copy discovery kubeconfig
|
||||
copy:
|
||||
dest: "{{ kube_config_dir }}/cluster-info-discovery-kubeconfig.yaml"
|
||||
content: "{{ kubeconfig_file_discovery.stdout }}"
|
||||
owner: "root"
|
||||
mode: "0644"
|
||||
when:
|
||||
- not is_kube_master
|
||||
- not kubelet_conf.stat.exists
|
||||
- kubeadm_use_file_discovery
|
||||
|
||||
- name: Create kubeadm client config
|
||||
template:
|
||||
src: "kubeadm-client.conf.{{ kubeadmConfig_api_version }}.j2"
|
||||
dest: "{{ kube_config_dir }}/kubeadm-client.conf"
|
||||
backup: yes
|
||||
mode: 0640
|
||||
backup: true
|
||||
mode: "0640"
|
||||
when: not is_kube_master
|
||||
|
||||
- name: Kubeadm | Create directory to store kubeadm patches
|
||||
file:
|
||||
path: "{{ kubeadm_patches.dest_dir }}"
|
||||
state: directory
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kubeadm_patches is defined and kubeadm_patches.enabled
|
||||
|
||||
- name: Kubeadm | Copy kubeadm patches from inventory files
|
||||
@@ -77,7 +95,7 @@
|
||||
src: "{{ kubeadm_patches.source_dir }}/"
|
||||
dest: "{{ kubeadm_patches.dest_dir }}"
|
||||
owner: "root"
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
when: kubeadm_patches is defined and kubeadm_patches.enabled
|
||||
|
||||
- name: Join to cluster if needed
|
||||
@@ -122,7 +140,7 @@
|
||||
dest: "{{ kube_config_dir }}/kubelet.conf"
|
||||
regexp: 'server:'
|
||||
line: ' server: {{ kube_apiserver_endpoint }}'
|
||||
backup: yes
|
||||
backup: true
|
||||
when:
|
||||
- kubeadm_config_api_fqdn is not defined
|
||||
- not is_kube_master
|
||||
@@ -134,12 +152,23 @@
|
||||
dest: "{{ kube_config_dir }}/kubelet.conf"
|
||||
regexp: '^ server: https'
|
||||
line: ' server: {{ kube_apiserver_endpoint }}'
|
||||
backup: yes
|
||||
backup: true
|
||||
when:
|
||||
- not is_kube_master
|
||||
- loadbalancer_apiserver is defined
|
||||
notify: Kubeadm | restart kubelet
|
||||
|
||||
- name: Get current resourceVersion of kube-proxy configmap
|
||||
command: "{{ kubectl }} get configmap kube-proxy -n kube-system -o jsonpath='{.metadata.resourceVersion}'"
|
||||
register: original_configmap_resource_version
|
||||
run_once: true
|
||||
delegate_to: "{{ groups['kube_control_plane'] | first }}"
|
||||
delegate_facts: false
|
||||
when:
|
||||
- kube_proxy_deployed
|
||||
tags:
|
||||
- kube-proxy
|
||||
|
||||
# FIXME(mattymo): Need to point to localhost, otherwise masters will all point
|
||||
# incorrectly to first master, creating SPoF.
|
||||
- name: Update server field in kube-proxy kubeconfig
|
||||
@@ -176,6 +205,17 @@
|
||||
tags:
|
||||
- kube-proxy
|
||||
|
||||
- name: Get new resourceVersion of kube-proxy configmap
|
||||
command: "{{ kubectl }} get configmap kube-proxy -n kube-system -o jsonpath='{.metadata.resourceVersion}'"
|
||||
register: new_configmap_resource_version
|
||||
run_once: true
|
||||
delegate_to: "{{ groups['kube_control_plane'] | first }}"
|
||||
delegate_facts: false
|
||||
when:
|
||||
- kube_proxy_deployed
|
||||
tags:
|
||||
- kube-proxy
|
||||
|
||||
- name: Set ca.crt file permission
|
||||
file:
|
||||
path: "{{ kube_cert_dir }}/ca.crt"
|
||||
@@ -192,6 +232,7 @@
|
||||
- kubeadm_config_api_fqdn is not defined or loadbalancer_apiserver is defined
|
||||
- kubeadm_discovery_address != kube_apiserver_endpoint | replace("https://", "") or loadbalancer_apiserver is defined
|
||||
- kube_proxy_deployed
|
||||
- original_configmap_resource_version.stdout != new_configmap_resource_version.stdout
|
||||
tags:
|
||||
- kube-proxy
|
||||
|
||||
|
||||
@@ -2,6 +2,10 @@
|
||||
apiVersion: kubeadm.k8s.io/v1beta3
|
||||
kind: JoinConfiguration
|
||||
discovery:
|
||||
{% if kubeadm_use_file_discovery %}
|
||||
file:
|
||||
kubeConfigPath: {{ kube_config_dir }}/cluster-info-discovery-kubeconfig.yaml
|
||||
{% else %}
|
||||
bootstrapToken:
|
||||
{% if kubeadm_config_api_fqdn is defined %}
|
||||
apiServerEndpoint: {{ kubeadm_config_api_fqdn }}:{{ loadbalancer_apiserver.port | default(kube_apiserver_port) }}
|
||||
@@ -14,6 +18,7 @@ discovery:
|
||||
- sha256:{{ kubeadm_ca_hash.stdout }}
|
||||
{% else %}
|
||||
unsafeSkipCAVerification: true
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
timeout: {{ discovery_timeout }}
|
||||
tlsBootstrapToken: {{ kubeadm_token }}
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
- name: Kubernetes Apps | Wait for kube-apiserver
|
||||
uri:
|
||||
url: "{{ kube_apiserver_endpoint }}/healthz"
|
||||
validate_certs: no
|
||||
validate_certs: false
|
||||
client_cert: "{{ kube_apiserver_client_cert }}"
|
||||
client_key: "{{ kube_apiserver_client_key }}"
|
||||
register: result
|
||||
@@ -42,7 +42,7 @@
|
||||
|
||||
- name: Set label to node
|
||||
command: >-
|
||||
{{ kubectl }} label node {{ kube_override_hostname | default(inventory_hostname) }} {{ item }} --overwrite=true
|
||||
{{ kubectl }} label node {% if kube_override_hostname %}{{ kube_override_hostname }}{% else %}{{ inventory_hostname }}{% endif %} {{ item }} --overwrite=true
|
||||
loop: "{{ role_node_labels + inventory_node_labels }}"
|
||||
delegate_to: "{{ groups['kube_control_plane'][0] }}"
|
||||
changed_when: false
|
||||
|
||||
@@ -23,14 +23,18 @@ kubelet_kubelet_cgroups_cgroupfs: "/system.slice/kubelet.service"
|
||||
# Set systemd service hardening features
|
||||
kubelet_systemd_hardening: false
|
||||
|
||||
# Kubelet service dependencies other than container runtime
|
||||
kubelet_systemd_wants_dependencies: []
|
||||
|
||||
# List of secure IPs for kubelet
|
||||
kubelet_secure_addresses: >-
|
||||
{%- for host in groups['kube_control_plane'] -%}
|
||||
kube_node_addresses: >-
|
||||
{%- for host in (groups['kube_control_plane'] + groups['kube_node'] + groups['etcd']) | unique -%}
|
||||
{{ hostvars[host]['ip'] | default(fallback_ips[host]) }}{{ ' ' if not loop.last else '' }}
|
||||
{%- endfor -%}
|
||||
kubelet_secure_addresses: "localhost link-local {{ kube_pods_subnet }} {{ kube_node_addresses }}"
|
||||
|
||||
# Reserve this space for kube resources
|
||||
# Set to true to reserve resources for kube daemons
|
||||
# Whether to run kubelet and container-engine daemons in a dedicated cgroup. (Not required for resource reservations).
|
||||
kube_reserved: false
|
||||
kube_reserved_cgroups_for_service_slice: kube.slice
|
||||
kube_reserved_cgroups: "/{{ kube_reserved_cgroups_for_service_slice }}"
|
||||
@@ -66,14 +70,16 @@ eviction_hard_control_plane: {}
|
||||
kubelet_status_update_frequency: 10s
|
||||
|
||||
# kube-vip
|
||||
kube_vip_version: v0.5.12
|
||||
kube_vip_version: v0.8.0
|
||||
|
||||
kube_vip_arp_enabled: false
|
||||
kube_vip_interface:
|
||||
kube_vip_services_interface:
|
||||
kube_vip_cidr: 32
|
||||
kube_vip_dns_mode: first
|
||||
kube_vip_controlplane_enabled: false
|
||||
kube_vip_ddns_enabled: false
|
||||
kube_vip_cp_detect: false
|
||||
kube_vip_services_enabled: false
|
||||
kube_vip_leader_election_enabled: "{{ kube_vip_arp_enabled }}"
|
||||
kube_vip_bgp_enabled: false
|
||||
@@ -87,6 +93,12 @@ kube_vip_address:
|
||||
kube_vip_enableServicesElection: false
|
||||
kube_vip_lb_enable: false
|
||||
kube_vip_lb_fwdmethod: local
|
||||
kube_vip_leasename: plndr-cp-lock
|
||||
kube_vip_svc_leasename: plndr-svcs-lock
|
||||
kube_vip_leaseduration: 5
|
||||
kube_vip_renewdeadline: 3
|
||||
kube_vip_retryperiod: 1
|
||||
kube_vip_enable_node_labeling: false
|
||||
|
||||
# Requests for load balancer app
|
||||
loadbalancer_apiserver_memory_requests: 32M
|
||||
@@ -258,4 +270,7 @@ conntrack_modules:
|
||||
## Enable distributed tracing for kubelet
|
||||
kubelet_tracing: false
|
||||
kubelet_tracing_endpoint: 0.0.0.0:4317
|
||||
kubelet_tracing_sampling_rate_per_million: 100
|
||||
kubelet_tracing_sampling_rate_per_million: 100
|
||||
|
||||
# The maximum number of image pulls in parallel. Set it to a integer great than 1 to enable image pulling in parallel.
|
||||
kubelet_max_parallel_image_pulls: 1
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
- name: Kubelet | reload systemd
|
||||
systemd:
|
||||
systemd_service:
|
||||
daemon_reload: true
|
||||
listen: Node | restart kubelet
|
||||
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
executable: /bin/bash
|
||||
register: docker_cgroup_driver_result
|
||||
changed_when: false
|
||||
check_mode: no
|
||||
check_mode: false
|
||||
|
||||
- name: Set kubelet_cgroup_driver_detected fact for docker
|
||||
set_fact:
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
copy:
|
||||
src: "{{ downloads.kubeadm.dest }}"
|
||||
dest: "{{ bin_dir }}/kubeadm"
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
remote_src: true
|
||||
tags:
|
||||
- kubeadm
|
||||
@@ -14,7 +14,7 @@
|
||||
copy:
|
||||
src: "{{ downloads.kubelet.dest }}"
|
||||
dest: "{{ bin_dir }}/kubelet"
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
remote_src: true
|
||||
tags:
|
||||
- kubelet
|
||||
|
||||
@@ -11,8 +11,8 @@
|
||||
src: "kubelet.env.{{ kubeletConfig_api_version }}.j2"
|
||||
dest: "{{ kube_config_dir }}/kubelet.env"
|
||||
setype: "{{ (preinstall_selinux_state != 'disabled') | ternary('etc_t', omit) }}"
|
||||
backup: yes
|
||||
mode: 0600
|
||||
backup: true
|
||||
mode: "0600"
|
||||
notify: Node | restart kubelet
|
||||
tags:
|
||||
- kubelet
|
||||
@@ -22,7 +22,7 @@
|
||||
template:
|
||||
src: "kubelet-config.{{ kubeletConfig_api_version }}.yaml.j2"
|
||||
dest: "{{ kube_config_dir }}/kubelet-config.yaml"
|
||||
mode: 0600
|
||||
mode: "0600"
|
||||
notify: Kubelet | restart kubelet
|
||||
tags:
|
||||
- kubelet
|
||||
@@ -32,8 +32,8 @@
|
||||
template:
|
||||
src: "kubelet.service.j2"
|
||||
dest: "/etc/systemd/system/kubelet.service"
|
||||
backup: "yes"
|
||||
mode: 0600
|
||||
backup: true
|
||||
mode: "0600"
|
||||
validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:kubelet.service'"
|
||||
# FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
|
||||
# Remove once we drop support for systemd < 250
|
||||
@@ -48,7 +48,7 @@
|
||||
- name: Enable kubelet
|
||||
service:
|
||||
name: kubelet
|
||||
enabled: yes
|
||||
enabled: true
|
||||
state: started
|
||||
tags:
|
||||
- kubelet
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
file:
|
||||
path: "{{ haproxy_config_dir }}"
|
||||
state: directory
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
owner: root
|
||||
|
||||
- name: Haproxy | Write haproxy configuration
|
||||
@@ -16,19 +16,19 @@
|
||||
src: "loadbalancer/haproxy.cfg.j2"
|
||||
dest: "{{ haproxy_config_dir }}/haproxy.cfg"
|
||||
owner: root
|
||||
mode: 0755
|
||||
backup: yes
|
||||
mode: "0755"
|
||||
backup: true
|
||||
|
||||
- name: Haproxy | Get checksum from config
|
||||
stat:
|
||||
path: "{{ haproxy_config_dir }}/haproxy.cfg"
|
||||
get_attributes: no
|
||||
get_checksum: yes
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: true
|
||||
get_mime: false
|
||||
register: haproxy_stat
|
||||
|
||||
- name: Haproxy | Write static pod
|
||||
template:
|
||||
src: manifests/haproxy.manifest.j2
|
||||
dest: "{{ kube_manifest_dir }}/haproxy.yml"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
|
||||
@@ -6,8 +6,34 @@
|
||||
- kube_proxy_mode == 'ipvs' and not kube_proxy_strict_arp
|
||||
- kube_vip_arp_enabled
|
||||
|
||||
- name: Kube-vip | Check if super-admin.conf exists
|
||||
stat:
|
||||
path: "{{ kube_config_dir }}/super-admin.conf"
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
register: stat_kube_vip_super_admin
|
||||
|
||||
- name: Kube-vip | Check if kubeadm has already run
|
||||
stat:
|
||||
path: "/var/lib/kubelet/config.yaml"
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: kubeadm_already_run
|
||||
|
||||
- name: Kube-vip | Set admin.conf
|
||||
set_fact:
|
||||
kube_vip_admin_conf: admin.conf
|
||||
|
||||
- name: Kube-vip | Set admin.conf for first Control Plane
|
||||
set_fact:
|
||||
kube_vip_admin_conf: super-admin.conf
|
||||
when:
|
||||
- inventory_hostname == groups['kube_control_plane'] | first
|
||||
- (stat_kube_vip_super_admin.stat.exists and stat_kube_vip_super_admin.stat.isreg) or (not kubeadm_already_run.stat.exists )
|
||||
|
||||
- name: Kube-vip | Write static pod
|
||||
template:
|
||||
src: manifests/kube-vip.manifest.j2
|
||||
dest: "{{ kube_manifest_dir }}/kube-vip.yml"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
file:
|
||||
path: "{{ nginx_config_dir }}"
|
||||
state: directory
|
||||
mode: 0700
|
||||
mode: "0700"
|
||||
owner: root
|
||||
|
||||
- name: Nginx-proxy | Write nginx-proxy configuration
|
||||
@@ -16,19 +16,19 @@
|
||||
src: "loadbalancer/nginx.conf.j2"
|
||||
dest: "{{ nginx_config_dir }}/nginx.conf"
|
||||
owner: root
|
||||
mode: 0755
|
||||
backup: yes
|
||||
mode: "0755"
|
||||
backup: true
|
||||
|
||||
- name: Nginx-proxy | Get checksum from config
|
||||
stat:
|
||||
path: "{{ nginx_config_dir }}/nginx.conf"
|
||||
get_attributes: no
|
||||
get_checksum: yes
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: true
|
||||
get_mime: false
|
||||
register: nginx_stat
|
||||
|
||||
- name: Nginx-proxy | Write static pod
|
||||
template:
|
||||
src: manifests/nginx-proxy.manifest.j2
|
||||
dest: "{{ kube_manifest_dir }}/nginx-proxy.yml"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
file:
|
||||
path: /var/lib/cni
|
||||
state: directory
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
|
||||
- name: Install kubelet binary
|
||||
import_tasks: install.yml
|
||||
@@ -51,10 +51,10 @@
|
||||
ansible.posix.sysctl:
|
||||
name: net.ipv4.ip_local_reserved_ports
|
||||
value: "{{ kube_apiserver_node_port_range }}"
|
||||
sysctl_set: yes
|
||||
sysctl_set: true
|
||||
sysctl_file: "{{ sysctl_file_path }}"
|
||||
state: present
|
||||
reload: yes
|
||||
reload: true
|
||||
when: kube_apiserver_node_port_range is defined
|
||||
tags:
|
||||
- kube-proxy
|
||||
@@ -66,7 +66,7 @@
|
||||
register: modinfo_br_netfilter
|
||||
failed_when: modinfo_br_netfilter.rc not in [0, 1]
|
||||
changed_when: false
|
||||
check_mode: no
|
||||
check_mode: false
|
||||
|
||||
# TODO: Remove once upstream issue is fixed
|
||||
# https://github.com/ansible-collections/community.general/issues/7717
|
||||
@@ -74,7 +74,7 @@
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
loop:
|
||||
- /etc/modules-load.d
|
||||
- /etc/modprobe.d
|
||||
@@ -89,7 +89,7 @@
|
||||
copy:
|
||||
dest: /etc/modules-load.d/kubespray-br_netfilter.conf
|
||||
content: br_netfilter
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
when: modinfo_br_netfilter.rc == 0
|
||||
|
||||
# kube-proxy needs net.bridge.bridge-nf-call-iptables enabled when found if br_netfilter is not a module
|
||||
@@ -97,7 +97,7 @@
|
||||
command: "sysctl net.bridge.bridge-nf-call-iptables"
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
check_mode: no
|
||||
check_mode: false
|
||||
register: sysctl_bridge_nf_call_iptables
|
||||
|
||||
- name: Enable bridge-nf-call tables
|
||||
@@ -106,7 +106,7 @@
|
||||
state: present
|
||||
sysctl_file: "{{ sysctl_file_path }}"
|
||||
value: "1"
|
||||
reload: yes
|
||||
reload: true
|
||||
when: sysctl_bridge_nf_call_iptables.rc == 0
|
||||
with_items:
|
||||
- net.bridge.bridge-nf-call-iptables
|
||||
@@ -162,7 +162,7 @@
|
||||
content: "{{ openstack_cacert | b64decode if openstack_cacert_is_base64 else omit }}"
|
||||
dest: "{{ kube_config_dir }}/openstack-cacert.pem"
|
||||
group: "{{ kube_cert_group }}"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when:
|
||||
- cloud_provider is defined
|
||||
- cloud_provider == 'openstack'
|
||||
@@ -176,7 +176,7 @@
|
||||
src: "cloud-configs/{{ cloud_provider }}-cloud-config.j2"
|
||||
dest: "{{ kube_config_dir }}/cloud_config"
|
||||
group: "{{ kube_cert_group }}"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when:
|
||||
- cloud_provider is defined
|
||||
- cloud_provider in [ 'openstack', 'azure', 'vsphere', 'aws', 'gce' ]
|
||||
|
||||
@@ -11,7 +11,7 @@
|
||||
executable: /bin/bash
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
check_mode: no
|
||||
check_mode: false
|
||||
register: kubelet_container_check
|
||||
|
||||
- name: "Pre-upgrade | copy /var/lib/cni from kubelet"
|
||||
|
||||
@@ -62,9 +62,10 @@ clusterDNS:
|
||||
{# Node reserved CPU/memory #}
|
||||
{% if kube_reserved | bool %}
|
||||
kubeReservedCgroup: {{ kube_reserved_cgroups }}
|
||||
{% endif %}
|
||||
kubeReserved:
|
||||
{% if is_kube_master | bool %}
|
||||
cpu: {{ kube_master_cpu_reserved }}
|
||||
cpu: "{{ kube_master_cpu_reserved }}"
|
||||
memory: {{ kube_master_memory_reserved }}
|
||||
{% if kube_master_ephemeral_storage_reserved is defined %}
|
||||
ephemeral-storage: {{ kube_master_ephemeral_storage_reserved }}
|
||||
@@ -73,7 +74,7 @@ kubeReserved:
|
||||
pid: "{{ kube_master_pid_reserved }}"
|
||||
{% endif %}
|
||||
{% else %}
|
||||
cpu: {{ kube_cpu_reserved }}
|
||||
cpu: "{{ kube_cpu_reserved }}"
|
||||
memory: {{ kube_memory_reserved }}
|
||||
{% if kube_ephemeral_storage_reserved is defined %}
|
||||
ephemeral-storage: {{ kube_ephemeral_storage_reserved }}
|
||||
@@ -82,12 +83,11 @@ kubeReserved:
|
||||
pid: "{{ kube_pid_reserved }}"
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% if system_reserved | bool %}
|
||||
systemReservedCgroup: {{ system_reserved_cgroups }}
|
||||
systemReserved:
|
||||
{% if is_kube_master | bool %}
|
||||
cpu: {{ system_master_cpu_reserved }}
|
||||
cpu: "{{ system_master_cpu_reserved }}"
|
||||
memory: {{ system_master_memory_reserved }}
|
||||
{% if system_master_ephemeral_storage_reserved is defined %}
|
||||
ephemeral-storage: {{ system_master_ephemeral_storage_reserved }}
|
||||
@@ -96,7 +96,7 @@ systemReserved:
|
||||
pid: "{{ system_master_pid_reserved }}"
|
||||
{% endif %}
|
||||
{% else %}
|
||||
cpu: {{ system_cpu_reserved }}
|
||||
cpu: "{{ system_cpu_reserved }}"
|
||||
memory: {{ system_memory_reserved }}
|
||||
{% if system_ephemeral_storage_reserved is defined %}
|
||||
ephemeral-storage: {{ system_ephemeral_storage_reserved }}
|
||||
@@ -160,6 +160,10 @@ seccompDefault: {{ kubelet_seccomp_default | bool }}
|
||||
{% if kubelet_cpu_manager_policy is defined %}
|
||||
cpuManagerPolicy: {{ kubelet_cpu_manager_policy }}
|
||||
{% endif %}
|
||||
{% if kubelet_cpu_manager_policy_options is defined %}
|
||||
cpuManagerPolicyOptions:
|
||||
{{ kubelet_cpu_manager_policy_options | to_nice_yaml(indent=2) }}
|
||||
{% endif %}
|
||||
{% if kubelet_topology_manager_policy is defined %}
|
||||
topologyManagerPolicy: {{ kubelet_topology_manager_policy }}
|
||||
{% endif %}
|
||||
@@ -170,4 +174,5 @@ topologyManagerScope: {{ kubelet_topology_manager_scope }}
|
||||
tracing:
|
||||
endpoint: {{ kubelet_tracing_endpoint }}
|
||||
samplingRatePerMillion: {{ kubelet_tracing_sampling_rate_per_million }}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
maxParallelImagePulls: {{ kubelet_max_parallel_image_pulls }}
|
||||
|
||||
@@ -7,6 +7,11 @@ Wants=docker.socket
|
||||
{% else %}
|
||||
Wants={{ container_manager }}.service
|
||||
{% endif %}
|
||||
{% for kubelet_dependency in kubelet_systemd_wants_dependencies|default([]) %}
|
||||
{% if kubelet_dependency|length > 0 %}
|
||||
Wants={{ kubelet_dependency }}
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
|
||||
[Service]
|
||||
EnvironmentFile=-{{ kube_config_dir }}/kubelet.env
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Inspired by https://github.com/kube-vip/kube-vip/blob/v0.5.11/pkg/kubevip/config_generator.go#L13
|
||||
# Inspired by https://github.com/kube-vip/kube-vip/blob/v0.8.0/pkg/kubevip/config_generator.go#L103
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
@@ -16,6 +16,8 @@ spec:
|
||||
value: {{ kube_vip_arp_enabled | string | to_json }}
|
||||
- name: port
|
||||
value: {{ kube_apiserver_port | string | to_json }}
|
||||
- name: vip_nodename
|
||||
value: {{ inventory_hostname }}
|
||||
{% if kube_vip_interface %}
|
||||
- name: vip_interface
|
||||
value: {{ kube_vip_interface | string | to_json }}
|
||||
@@ -28,6 +30,10 @@ spec:
|
||||
- name: vip_cidr
|
||||
value: {{ kube_vip_cidr | string | to_json }}
|
||||
{% endif %}
|
||||
{% if kube_vip_dns_mode %}
|
||||
- name: dns_mode
|
||||
value: {{ kube_vip_dns_mode | string | to_json }}
|
||||
{% endif %}
|
||||
{% if kube_vip_controlplane_enabled %}
|
||||
- name: cp_enable
|
||||
value: "true"
|
||||
@@ -35,11 +41,17 @@ spec:
|
||||
value: kube-system
|
||||
- name: vip_ddns
|
||||
value: {{ kube_vip_ddns_enabled | string | to_json }}
|
||||
- name: cp_detect
|
||||
value: {{ kube_vip_cp_detect | string | to_json }}
|
||||
{% endif %}
|
||||
{% if kube_vip_services_enabled %}
|
||||
- name: svc_enable
|
||||
value: "true"
|
||||
{% endif %}
|
||||
{% if kube_vip_svc_leasename %}
|
||||
- name: svc_leasename
|
||||
value: {{ kube_vip_svc_leasename | string | to_json }}
|
||||
{% endif %}
|
||||
{% if kube_vip_enableServicesElection %}
|
||||
- name: svc_election
|
||||
value: "true"
|
||||
@@ -47,12 +59,18 @@ spec:
|
||||
{% if kube_vip_leader_election_enabled %}
|
||||
- name: vip_leaderelection
|
||||
value: "true"
|
||||
- name: vip_leasename
|
||||
value: {{ kube_vip_leasename | string | to_json }}
|
||||
- name: vip_leaseduration
|
||||
value: "5"
|
||||
value: {{ kube_vip_leaseduration | string | to_json }}
|
||||
- name: vip_renewdeadline
|
||||
value: "3"
|
||||
value: {{ kube_vip_renewdeadline | string | to_json }}
|
||||
- name: vip_retryperiod
|
||||
value: "1"
|
||||
value: {{ kube_vip_retryperiod | string | to_json }}
|
||||
{% endif %}
|
||||
{% if kube_vip_enable_node_labeling %}
|
||||
- name: enable_node_labeling
|
||||
value: {{ kube_vip_enable_node_labeling | string | to_json }}
|
||||
{% endif %}
|
||||
{% if kube_vip_bgp_enabled %}
|
||||
- name: bgp_enable
|
||||
@@ -101,6 +119,6 @@ spec:
|
||||
hostNetwork: true
|
||||
volumes:
|
||||
- hostPath:
|
||||
path: /etc/kubernetes/admin.conf
|
||||
path: /etc/kubernetes/{{kube_vip_admin_conf}}
|
||||
name: kubeconfig
|
||||
status: {}
|
||||
|
||||
@@ -0,0 +1,2 @@
|
||||
---
|
||||
kube_resolv_conf: "/run/systemd/resolve/resolv.conf"
|
||||
@@ -6,18 +6,6 @@ epel_enabled: false
|
||||
# Kubespray sets this to true after clusterDNS is running to apply changes to the host resolv.conf
|
||||
dns_late: false
|
||||
|
||||
common_required_pkgs:
|
||||
- "{{ (ansible_distribution == 'openSUSE Tumbleweed') | ternary('openssl-1_1', 'openssl') }}"
|
||||
- curl
|
||||
- rsync
|
||||
- socat
|
||||
- unzip
|
||||
- e2fsprogs
|
||||
- xfsprogs
|
||||
- ebtables
|
||||
- bash-completion
|
||||
- tar
|
||||
|
||||
# Set to true if your network does not support IPv6
|
||||
# This may be necessary for pulling Docker images from
|
||||
# GCE docker repository
|
||||
@@ -98,6 +86,13 @@ ntp_servers:
|
||||
ntp_restrict:
|
||||
- "127.0.0.1"
|
||||
- "::1"
|
||||
# Specify whether to filter interfaces
|
||||
ntp_filter_interface: false
|
||||
# Specify the interfaces
|
||||
# Only takes effect when ntp_filter_interface is true
|
||||
# ntp_interfaces:
|
||||
# - ignore wildcard
|
||||
# - listen xxx
|
||||
# The NTP driftfile path
|
||||
# Only takes effect when ntp_manage_config is true.
|
||||
ntp_driftfile: /var/lib/ntp/ntp.drift
|
||||
@@ -135,21 +130,12 @@ supported_os_distributions:
|
||||
|
||||
# Extending some distributions into the redhat os family
|
||||
redhat_os_family_extensions:
|
||||
- "Kylin Linux Advanced Server"
|
||||
- "openEuler"
|
||||
- "UnionTech"
|
||||
- "UniontechOS"
|
||||
|
||||
# Extending some distributions into the debian os family
|
||||
debian_os_family_extensions:
|
||||
- "UnionTech OS Server 20"
|
||||
|
||||
# Sets DNSStubListener=no, useful if you get "0.0.0.0:53: bind: address already in use"
|
||||
systemd_resolved_disable_stub_listener: "{{ ansible_os_family in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] }}"
|
||||
|
||||
# Used to disable File Access Policy Daemon service.
|
||||
# If service is enabled, the CNI plugin installation will fail
|
||||
disable_fapolicyd: true
|
||||
|
||||
# Enable 0120-growpart-azure-centos-7 tasks
|
||||
growpart_azure_enabled: true
|
||||
|
||||
@@ -0,0 +1,80 @@
|
||||
{
|
||||
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||||
"$id": "https://kubespray.io/internal/os_packages.schema.json",
|
||||
"title": "Os packages",
|
||||
"description": "Criteria for selecting packages to install on Kubernetes nodes during installation by Kubespray",
|
||||
"type": "object",
|
||||
"patternProperties": {
|
||||
".*": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"description": "Escape hatch to filter packages. The value is expected to be pre-resolved to a boolean by Jinja",
|
||||
"type": "boolean",
|
||||
"default": true
|
||||
},
|
||||
"groups": {
|
||||
"description": "Match if the host is in one of these groups. If not specified match any host.",
|
||||
"type": "array",
|
||||
"minItems": 1,
|
||||
"items":{
|
||||
"type": "string",
|
||||
"pattern": "^[0-9A-Za-z_]*$"
|
||||
}
|
||||
},
|
||||
"os": {
|
||||
"type": "object",
|
||||
"description": "If not specified match any OS. Otherwise, must match by 'families' or 'distributions' to be included.",
|
||||
"additionalProperties": false,
|
||||
"minProperties": 1,
|
||||
"properties": {
|
||||
"families": {
|
||||
"description": "Match if ansible_os_family is part of the list.",
|
||||
"type": "array",
|
||||
"minItems": 1,
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"distributions": {
|
||||
"type": "object",
|
||||
"description": "Match if ansible_distribution match one of defined keys.",
|
||||
"minProperties": 1,
|
||||
"patternProperties": {
|
||||
".*": {
|
||||
"description": "Match if either the value is the empty hash, or one major_versions/versions/releases contains the corresponding variable ('ansible_distrbution_*')",
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"major_versions": {
|
||||
"type": "array",
|
||||
"minItems": 1,
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"versions": {
|
||||
"type": "array",
|
||||
"minItems": 1,
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"releases": {
|
||||
"type": "array",
|
||||
"minItems": 1,
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,73 +0,0 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
# Text color variables
|
||||
txtbld=$(tput bold) # Bold
|
||||
bldred=${txtbld}$(tput setaf 1) # red
|
||||
bldgre=${txtbld}$(tput setaf 2) # green
|
||||
bldylw=${txtbld}$(tput setaf 3) # yellow
|
||||
txtrst=$(tput sgr0) # Reset
|
||||
err=${bldred}ERROR${txtrst}
|
||||
info=${bldgre}INFO${txtrst}
|
||||
warn=${bldylw}WARNING${txtrst}
|
||||
|
||||
usage()
|
||||
{
|
||||
cat << EOF
|
||||
Generates a file which contains useful git informations
|
||||
|
||||
Usage : $(basename $0) [global|diff]
|
||||
ex :
|
||||
Generate git information
|
||||
$(basename $0) global
|
||||
Generate diff from latest tag
|
||||
$(basename $0) diff
|
||||
EOF
|
||||
}
|
||||
|
||||
if [ $# != 1 ]; then
|
||||
printf "\n$err : Needs 1 argument\n"
|
||||
usage
|
||||
exit 2
|
||||
fi;
|
||||
|
||||
current_commit=$(git rev-parse HEAD)
|
||||
latest_tag=$(git describe --abbrev=0 --tags)
|
||||
latest_tag_commit=$(git show-ref -s ${latest_tag})
|
||||
tags_list=$(git tag --points-at "${latest_tag}")
|
||||
|
||||
case ${1} in
|
||||
"global")
|
||||
cat<<EOF
|
||||
deployment date="$(date '+%d-%m-%Y %Hh%M')"
|
||||
deployment_timestamp=$(date '+%s')
|
||||
user="$USER"
|
||||
current commit (HEAD)="${current_commit}"
|
||||
current_commit_timestamp=$(git log -1 --pretty=format:%ct)
|
||||
latest tag(s) (current branch)="${tags_list}"
|
||||
latest tag commit="${latest_tag_commit}"
|
||||
current branch="$(git rev-parse --abbrev-ref HEAD)"
|
||||
branches list="$(git describe --contains --all HEAD)"
|
||||
git root directory="$(git rev-parse --show-toplevel)"
|
||||
EOF
|
||||
if ! git diff-index --quiet HEAD --; then
|
||||
printf "unstaged changes=\"/etc/.git-ansible.diff\""
|
||||
fi
|
||||
|
||||
if [ "${current_commit}" = "${latest_tag_commit}" ]; then
|
||||
printf "\ncurrent_commit_tag=\"${latest_tag}\""
|
||||
else
|
||||
printf "\nlast tag was "$(git describe --tags | awk -F- '{print $2}')" commits ago =\""
|
||||
printf "$(git log --pretty=format:" %h - %s" ${latest_tag}..HEAD)\""
|
||||
fi
|
||||
;;
|
||||
|
||||
"diff")
|
||||
git diff
|
||||
;;
|
||||
*)
|
||||
usage
|
||||
printf "$err: Unknown argument ${1}"
|
||||
exit 1;
|
||||
;;
|
||||
esac
|
||||
@@ -31,9 +31,9 @@
|
||||
- name: Preinstall | kube-apiserver configured
|
||||
stat:
|
||||
path: "{{ kube_manifest_dir }}/kube-apiserver.yaml"
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: kube_apiserver_set
|
||||
when: inventory_hostname in groups['kube_control_plane'] and dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'
|
||||
listen: Preinstall | propagate resolvconf to k8s components
|
||||
@@ -42,9 +42,9 @@
|
||||
- name: Preinstall | kube-controller configured
|
||||
stat:
|
||||
path: "{{ kube_manifest_dir }}/kube-controller-manager.yaml"
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: kube_controller_set
|
||||
when: inventory_hostname in groups['kube_control_plane'] and dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'
|
||||
listen: Preinstall | propagate resolvconf to k8s components
|
||||
@@ -109,7 +109,7 @@
|
||||
- name: Preinstall | wait for the apiserver to be running
|
||||
uri:
|
||||
url: "{{ kube_apiserver_endpoint }}/healthz"
|
||||
validate_certs: no
|
||||
validate_certs: false
|
||||
register: result
|
||||
until: result.status == 200
|
||||
retries: 60
|
||||
|
||||
@@ -2,9 +2,9 @@
|
||||
- name: Check if /etc/fstab exists
|
||||
stat:
|
||||
path: "/etc/fstab"
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: fstab_file
|
||||
|
||||
- name: Remove swapfile from /etc/fstab
|
||||
|
||||
@@ -1,11 +1,4 @@
|
||||
---
|
||||
- name: Force binaries directory for Flatcar Container Linux by Kinvolk
|
||||
set_fact:
|
||||
bin_dir: "/opt/bin"
|
||||
when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
|
||||
tags:
|
||||
- facts
|
||||
|
||||
- name: Set os_family fact for other redhat-based operating systems
|
||||
set_fact:
|
||||
ansible_os_family: "RedHat"
|
||||
@@ -14,61 +7,33 @@
|
||||
tags:
|
||||
- facts
|
||||
|
||||
- name: Set os_family fact for other debian-based operating systems
|
||||
set_fact:
|
||||
ansible_os_family: "Debian"
|
||||
when: ansible_distribution in debian_os_family_extensions
|
||||
tags:
|
||||
- facts
|
||||
|
||||
- name: Check if booted with ostree
|
||||
stat:
|
||||
path: /run/ostree-booted
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
register: ostree
|
||||
|
||||
- name: Set is_fedora_coreos
|
||||
lineinfile:
|
||||
path: /etc/os-release
|
||||
line: "VARIANT_ID=coreos"
|
||||
state: present
|
||||
check_mode: yes
|
||||
register: os_variant_coreos
|
||||
changed_when: false
|
||||
|
||||
- name: Set is_fedora_coreos
|
||||
set_fact:
|
||||
is_fedora_coreos: "{{ ostree.stat.exists and os_variant_coreos is not changed }}"
|
||||
|
||||
- name: Check resolvconf
|
||||
command: which resolvconf
|
||||
register: resolvconf
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
check_mode: no
|
||||
check_mode: false
|
||||
|
||||
- name: Check existence of /etc/resolvconf/resolv.conf.d
|
||||
stat:
|
||||
path: /etc/resolvconf/resolv.conf.d
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
failed_when: false
|
||||
register: resolvconfd_path
|
||||
|
||||
- name: Check status of /etc/resolv.conf
|
||||
stat:
|
||||
path: /etc/resolv.conf
|
||||
follow: no
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
follow: false
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
failed_when: false
|
||||
register: resolvconf_stat
|
||||
|
||||
- name: Fetch resolconf
|
||||
- name: Fetch resolvconf
|
||||
when: resolvconf_stat.stat.exists is defined and resolvconf_stat.stat.exists
|
||||
block:
|
||||
|
||||
@@ -107,7 +72,7 @@
|
||||
register: systemd_resolved_enabled
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
check_mode: no
|
||||
check_mode: false
|
||||
|
||||
- name: Set default dns if remove_default_searchdomains is false
|
||||
set_fact:
|
||||
@@ -129,9 +94,9 @@
|
||||
- name: Check if kubelet is configured
|
||||
stat:
|
||||
path: "{{ kube_config_dir }}/kubelet.env"
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: kubelet_configured
|
||||
changed_when: false
|
||||
|
||||
@@ -156,9 +121,9 @@
|
||||
- name: Check if /etc/dhclient.conf exists
|
||||
stat:
|
||||
path: /etc/dhclient.conf
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: dhclient_stat
|
||||
|
||||
- name: Target dhclient conf file for /etc/dhclient.conf
|
||||
@@ -169,9 +134,9 @@
|
||||
- name: Check if /etc/dhcp/dhclient.conf exists
|
||||
stat:
|
||||
path: /etc/dhcp/dhclient.conf
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: dhcp_dhclient_stat
|
||||
|
||||
- name: Target dhclient conf file for /etc/dhcp/dhclient.conf
|
||||
@@ -220,8 +185,8 @@
|
||||
set_fact:
|
||||
nameserverentries: |-
|
||||
{{ (([nodelocaldns_ip] if enable_nodelocaldns else []) + (coredns_server | d([]) if not enable_nodelocaldns else []) + nameservers | d([]) + cloud_resolver | d([]) + (configured_nameservers | d([]) if not disable_host_nameservers | d() | bool else [])) | unique | join(',') }}
|
||||
supersede_nameserver:
|
||||
supersede domain-name-servers {{ (([nodelocaldns_ip] if enable_nodelocaldns else []) + (coredns_server | d([]) if not enable_nodelocaldns else []) + nameservers | d([]) + cloud_resolver | d([]) + (configured_nameservers | d([]) if not disable_host_nameservers | d() | bool else [])) | unique | join(', ') }};
|
||||
dhclient_supersede_nameserver_entries_list: |-
|
||||
{{ (([nodelocaldns_ip] if enable_nodelocaldns else []) + (coredns_server | d([]) if not enable_nodelocaldns else []) + nameservers | d([]) + cloud_resolver | d([]) + (configured_nameservers | d([]) if not disable_host_nameservers | d() | bool else [])) | unique }}
|
||||
when: not dns_early or dns_late
|
||||
|
||||
# This task should run instead of the above task when cluster/nodelocal DNS hasn't
|
||||
@@ -230,23 +195,16 @@
|
||||
set_fact:
|
||||
nameserverentries: |-
|
||||
{{ (nameservers | d([]) + cloud_resolver | d([]) + configured_nameservers | d([])) | unique | join(',') }}
|
||||
supersede_nameserver:
|
||||
supersede domain-name-servers {{ (nameservers | d([]) + cloud_resolver | d([])) | unique | join(', ') }};
|
||||
dhclient_supersede_nameserver_entries_list: |-
|
||||
{{ (nameservers | d([]) + cloud_resolver | d([])) | unique }}
|
||||
when: dns_early and not dns_late
|
||||
|
||||
- name: Gather os specific variables
|
||||
include_vars: "{{ item }}"
|
||||
with_first_found:
|
||||
- files:
|
||||
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower | replace('/', '_') }}.yml"
|
||||
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_release }}.yml"
|
||||
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
|
||||
- "{{ ansible_distribution | lower }}.yml"
|
||||
- "{{ ansible_os_family | lower }}.yml"
|
||||
- defaults.yml
|
||||
paths:
|
||||
- ../vars
|
||||
skip: true
|
||||
- name: Generate supersede_nameserver from dhclient_supersede_nameserver_entries_list
|
||||
set_fact:
|
||||
supersede_nameserver: |-
|
||||
{%- if dhclient_supersede_nameserver_entries_list | length > 0 -%}
|
||||
supersede domain-name-servers {{ dhclient_supersede_nameserver_entries_list | join(', ') }};
|
||||
{%- endif -%}
|
||||
|
||||
- name: Set etcd vars if using kubeadm mode
|
||||
set_fact:
|
||||
@@ -260,9 +218,9 @@
|
||||
- name: Check /usr readonly
|
||||
stat:
|
||||
path: "/usr"
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: usr
|
||||
|
||||
- name: Set alternate flexvolume path
|
||||
|
||||
@@ -1,10 +1,7 @@
|
||||
---
|
||||
- name: Stop if either kube_control_plane or kube_node group is empty
|
||||
- name: Stop if kube_control_plane group is empty
|
||||
assert:
|
||||
that: "groups.get( item )"
|
||||
with_items:
|
||||
- kube_control_plane
|
||||
- kube_node
|
||||
that: groups.get( 'kube_control_plane' )
|
||||
run_once: true
|
||||
when: not ignore_assert_errors
|
||||
|
||||
@@ -47,7 +44,7 @@
|
||||
assert:
|
||||
that: item.value | type_debug == 'bool'
|
||||
msg: "{{ item.value }} isn't a bool"
|
||||
run_once: yes
|
||||
run_once: true
|
||||
with_items:
|
||||
- { name: download_run_once, value: "{{ download_run_once }}" }
|
||||
- { name: deploy_netchecker, value: "{{ deploy_netchecker }}" }
|
||||
@@ -77,6 +74,13 @@
|
||||
- not ignore_assert_errors
|
||||
- inventory_hostname in groups['kube_node']
|
||||
|
||||
# This command will fail if cgroups are not enabled on the node.
|
||||
# For reference: https://kubernetes.io/docs/concepts/architecture/cgroups/#check-cgroup-version
|
||||
- name: Stop if cgroups are not enabled on nodes
|
||||
command: stat -fc %T /sys/fs/cgroup/
|
||||
changed_when: false
|
||||
when: not ignore_assert_errors
|
||||
|
||||
# This assertion will fail on the safe side: One can indeed schedule more pods
|
||||
# on a node than the CIDR-range has space for when additional pods use the host
|
||||
# network namespace. It is impossible to ascertain the number of such pods at
|
||||
@@ -168,21 +172,21 @@
|
||||
that:
|
||||
- kube_service_addresses | ansible.utils.ipaddr('net')
|
||||
msg: "kube_service_addresses = '{{ kube_service_addresses }}' is not a valid network range"
|
||||
run_once: yes
|
||||
run_once: true
|
||||
|
||||
- name: "Check that kube_pods_subnet is a network range"
|
||||
assert:
|
||||
that:
|
||||
- kube_pods_subnet | ansible.utils.ipaddr('net')
|
||||
msg: "kube_pods_subnet = '{{ kube_pods_subnet }}' is not a valid network range"
|
||||
run_once: yes
|
||||
run_once: true
|
||||
|
||||
- name: "Check that kube_pods_subnet does not collide with kube_service_addresses"
|
||||
assert:
|
||||
that:
|
||||
- kube_pods_subnet | ansible.utils.ipaddr(kube_service_addresses) | string == 'None'
|
||||
msg: "kube_pods_subnet cannot be the same network segment as kube_service_addresses"
|
||||
run_once: yes
|
||||
run_once: true
|
||||
|
||||
- name: "Check that IP range is enough for the nodes"
|
||||
assert:
|
||||
@@ -190,7 +194,7 @@
|
||||
- 2 ** (kube_network_node_prefix - kube_pods_subnet | ansible.utils.ipaddr('prefix')) >= groups['k8s_cluster'] | length
|
||||
msg: "Not enough IPs are available for the desired node count."
|
||||
when: kube_network_plugin != 'calico'
|
||||
run_once: yes
|
||||
run_once: true
|
||||
|
||||
- name: Stop if unknown dns mode
|
||||
assert:
|
||||
@@ -242,7 +246,7 @@
|
||||
|
||||
# TODO: Clean this task up when we drop backward compatibility support for `etcd_kubeadm_enabled`
|
||||
- name: Stop if etcd deployment type is not host or kubeadm when container_manager != docker and etcd_kubeadm_enabled is not defined
|
||||
run_once: yes
|
||||
run_once: true
|
||||
when: etcd_kubeadm_enabled is defined
|
||||
block:
|
||||
- name: Warn the user if they are still using `etcd_kubeadm_enabled`
|
||||
@@ -288,7 +292,7 @@
|
||||
assert:
|
||||
that: containerd_version is version(containerd_min_version_required, '>=')
|
||||
msg: "containerd_version is too low. Minimum version {{ containerd_min_version_required }}"
|
||||
run_once: yes
|
||||
run_once: true
|
||||
when:
|
||||
- containerd_version not in ['latest', 'edge', 'stable']
|
||||
- container_manager == 'containerd'
|
||||
@@ -316,3 +320,15 @@
|
||||
when:
|
||||
- kube_apiserver_enable_admission_plugins is defined
|
||||
- kube_apiserver_enable_admission_plugins | length > 0
|
||||
|
||||
- name: Verify that the packages list structure is valid
|
||||
ansible.utils.validate:
|
||||
criteria: "{{ lookup('file', 'pkgs-schema.json') }}"
|
||||
data: "{{ pkgs }}"
|
||||
|
||||
- name: Verify that the packages list is sorted
|
||||
vars:
|
||||
pkgs_lists: "{{ pkgs.keys() | list }}"
|
||||
assert:
|
||||
that: "pkgs_lists | sort == pkgs_lists"
|
||||
fail_msg: "pkgs is not sorted: {{ pkgs_lists | ansible.utils.fact_diff(pkgs_lists | sort) }}"
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
owner: "{{ kube_owner }}"
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
when: inventory_hostname in groups['k8s_cluster']
|
||||
become: true
|
||||
tags:
|
||||
@@ -28,7 +28,7 @@
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
owner: root
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
when: inventory_hostname in groups['k8s_cluster']
|
||||
become: true
|
||||
tags:
|
||||
@@ -48,9 +48,9 @@
|
||||
- name: Check if kubernetes kubeadm compat cert dir exists
|
||||
stat:
|
||||
path: "{{ kube_cert_compat_dir }}"
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: kube_cert_compat_dir_check
|
||||
when:
|
||||
- inventory_hostname in groups['k8s_cluster']
|
||||
@@ -61,7 +61,7 @@
|
||||
src: "{{ kube_cert_dir }}"
|
||||
dest: "{{ kube_cert_compat_dir }}"
|
||||
state: link
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
when:
|
||||
- inventory_hostname in groups['k8s_cluster']
|
||||
- kube_cert_dir != kube_cert_compat_dir
|
||||
@@ -72,7 +72,7 @@
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
owner: "{{ kube_owner }}"
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
with_items:
|
||||
- "/etc/cni/net.d"
|
||||
- "/opt/cni/bin"
|
||||
@@ -93,7 +93,7 @@
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
owner: "{{ kube_owner }}"
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
with_items:
|
||||
- "/var/lib/calico"
|
||||
when:
|
||||
|
||||
@@ -16,10 +16,10 @@
|
||||
options ndots:{{ ndots }} timeout:{{ dns_timeout | default('2') }} attempts:{{ dns_attempts | default('2') }}
|
||||
state: present
|
||||
insertbefore: BOF
|
||||
create: yes
|
||||
create: true
|
||||
backup: "{{ not resolvconf_stat.stat.islnk }}"
|
||||
marker: "# Ansible entries {mark}"
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
notify: Preinstall | propagate resolvconf to k8s components
|
||||
|
||||
- name: Remove search/domain/nameserver options before block
|
||||
@@ -53,6 +53,6 @@
|
||||
dest: "{{ resolveconf_cloud_init_conf }}"
|
||||
src: resolvconf.j2
|
||||
owner: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
notify: Preinstall | update resolvconf for Flatcar Container Linux by Kinvolk
|
||||
when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
file:
|
||||
state: directory
|
||||
name: /etc/systemd/resolved.conf.d/
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
|
||||
- name: Write Kubespray DNS settings to systemd-resolved
|
||||
template:
|
||||
@@ -11,5 +11,5 @@
|
||||
dest: /etc/systemd/resolved.conf.d/kubespray.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
notify: Preinstall | Restart systemd-resolved
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
file:
|
||||
path: "/etc/NetworkManager/conf.d"
|
||||
state: directory
|
||||
recurse: yes
|
||||
recurse: true
|
||||
|
||||
- name: NetworkManager | Prevent NetworkManager from managing Calico interfaces (cali*/tunl*/vxlan.calico)
|
||||
copy:
|
||||
@@ -11,7 +11,7 @@
|
||||
[keyfile]
|
||||
unmanaged-devices+=interface-name:cali*;interface-name:tunl*;interface-name:vxlan.calico;interface-name:vxlan-v6.calico
|
||||
dest: /etc/NetworkManager/conf.d/calico.conf
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
when:
|
||||
- kube_network_plugin == "calico"
|
||||
notify: Preinstall | reload NetworkManager
|
||||
@@ -24,5 +24,5 @@
|
||||
[keyfile]
|
||||
unmanaged-devices+=interface-name:kube-ipvs0;interface-name:nodelocaldns
|
||||
dest: /etc/NetworkManager/conf.d/k8s.conf
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
notify: Preinstall | reload NetworkManager
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
option: servers
|
||||
value: "{{ nameserverentries }}"
|
||||
mode: '0600'
|
||||
backup: yes
|
||||
backup: true
|
||||
when:
|
||||
- nameserverentries != "127.0.0.53" or systemd_resolved_enabled.rc != 0
|
||||
notify: Preinstall | update resolvconf for networkmanager
|
||||
@@ -23,7 +23,7 @@
|
||||
option: searches
|
||||
value: "{{ (default_searchdomains | default([]) + searchdomains | default([])) | join(',') }}"
|
||||
mode: '0600'
|
||||
backup: yes
|
||||
backup: true
|
||||
notify: Preinstall | update resolvconf for networkmanager
|
||||
|
||||
- name: NetworkManager | Add DNS options to NM configuration
|
||||
@@ -33,5 +33,5 @@
|
||||
option: options
|
||||
value: "ndots:{{ ndots }},timeout:{{ dns_timeout | default('2') }},attempts:{{ dns_attempts | default('2') }}"
|
||||
mode: '0600'
|
||||
backup: yes
|
||||
backup: true
|
||||
notify: Preinstall | update resolvconf for networkmanager
|
||||
|
||||
@@ -30,11 +30,11 @@
|
||||
Pin-Priority: 1001
|
||||
dest: "/etc/apt/preferences.d/libseccomp2"
|
||||
owner: "root"
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
|
||||
- name: Update package management cache (APT)
|
||||
apt:
|
||||
update_cache: yes
|
||||
update_cache: true
|
||||
cache_valid_time: 3600
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
@@ -48,20 +48,6 @@
|
||||
- ansible_os_family == "RedHat"
|
||||
- not is_fedora_coreos
|
||||
|
||||
- name: Install python3-dnf for latest RedHat versions
|
||||
command: dnf install -y python3-dnf
|
||||
register: dnf_task_result
|
||||
until: dnf_task_result is succeeded
|
||||
retries: 4
|
||||
delay: "{{ retry_stagger | random + 3 }}"
|
||||
when:
|
||||
- ansible_distribution == "Fedora"
|
||||
- ansible_distribution_major_version | int >= 30
|
||||
- not is_fedora_coreos
|
||||
changed_when: False
|
||||
tags:
|
||||
- bootstrap-os
|
||||
|
||||
- name: Install epel-release on RHEL derivatives
|
||||
package:
|
||||
name: epel-release
|
||||
@@ -73,27 +59,29 @@
|
||||
tags:
|
||||
- bootstrap-os
|
||||
|
||||
- name: Update common_required_pkgs with ipvsadm when kube_proxy_mode is ipvs
|
||||
set_fact:
|
||||
common_required_pkgs: "{{ common_required_pkgs | default([]) + ['ipvsadm', 'ipset'] }}"
|
||||
when: kube_proxy_mode == 'ipvs'
|
||||
|
||||
- name: Install packages requirements
|
||||
vars:
|
||||
# The json_query for selecting packages name is split for readability
|
||||
# see files/pkgs-schema.json for the structure of `pkgs`
|
||||
# and the matching semantics
|
||||
full_query: "[? value | (enabled == null || enabled) && ( {{ filters_os }} ) && ( {{ filters_groups }} ) ].key"
|
||||
filters_groups: "groups | @ == null || [? contains(`{{ group_names }}`, @)]"
|
||||
filters_os: "os == null || (os | ( {{ filters_family }} ) || ( {{ filters_distro }} ))"
|
||||
dquote: !unsafe '"'
|
||||
# necessary to workaround Ansible escaping
|
||||
filters_distro: "distributions.{{ dquote }}{{ ansible_distribution }}{{ dquote }} |
|
||||
@ == `{}` ||
|
||||
contains(not_null(major_versions, `[]`), '{{ ansible_distribution_major_version }}') ||
|
||||
contains(not_null(versions, `[]`), '{{ ansible_distribution_version }}') ||
|
||||
contains(not_null(releases, `[]`), '{{ ansible_distribution_release }}')"
|
||||
filters_family: "families && contains(families, '{{ ansible_os_family }}')"
|
||||
package:
|
||||
name: "{{ required_pkgs | default([]) | union(common_required_pkgs | default([])) }}"
|
||||
name: "{{ pkgs | dict2items | to_json|from_json | community.general.json_query(full_query) }}"
|
||||
state: present
|
||||
register: pkgs_task_result
|
||||
until: pkgs_task_result is succeeded
|
||||
retries: "{{ pkg_install_retries }}"
|
||||
delay: "{{ retry_stagger | random + 3 }}"
|
||||
when: not (ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk", "ClearLinux"] or is_fedora_coreos)
|
||||
when: not (ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] or is_fedora_coreos)
|
||||
tags:
|
||||
- bootstrap-os
|
||||
|
||||
- name: Install ipvsadm for ClearLinux
|
||||
package:
|
||||
name: ipvsadm
|
||||
state: present
|
||||
when:
|
||||
- ansible_os_family in ["ClearLinux"]
|
||||
- kube_proxy_mode == 'ipvs'
|
||||
|
||||
@@ -3,9 +3,9 @@
|
||||
- name: Confirm selinux deployed
|
||||
stat:
|
||||
path: /etc/selinux/config
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
when:
|
||||
- ansible_os_family == "RedHat"
|
||||
- "'Amazon' not in ansible_distribution"
|
||||
@@ -27,9 +27,9 @@
|
||||
dest: /etc/gai.conf
|
||||
line: "precedence ::ffff:0:0/96 100"
|
||||
state: present
|
||||
create: yes
|
||||
backup: yes
|
||||
mode: 0644
|
||||
create: true
|
||||
backup: true
|
||||
mode: "0644"
|
||||
when:
|
||||
- disable_ipv6_dns
|
||||
- not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
|
||||
@@ -47,9 +47,9 @@
|
||||
- name: Stat sysctl file configuration
|
||||
stat:
|
||||
path: "{{ sysctl_file_path }}"
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: sysctl_file_stat
|
||||
tags:
|
||||
- bootstrap-os
|
||||
@@ -67,7 +67,7 @@
|
||||
file:
|
||||
name: "{{ sysctl_file_path | dirname }}"
|
||||
state: directory
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
|
||||
- name: Enable ip forwarding
|
||||
ansible.posix.sysctl:
|
||||
@@ -75,7 +75,7 @@
|
||||
name: net.ipv4.ip_forward
|
||||
value: "1"
|
||||
state: present
|
||||
reload: yes
|
||||
reload: true
|
||||
|
||||
- name: Enable ipv6 forwarding
|
||||
ansible.posix.sysctl:
|
||||
@@ -83,15 +83,15 @@
|
||||
name: net.ipv6.conf.all.forwarding
|
||||
value: "1"
|
||||
state: present
|
||||
reload: yes
|
||||
reload: true
|
||||
when: enable_dual_stack_networks | bool
|
||||
|
||||
- name: Check if we need to set fs.may_detach_mounts
|
||||
stat:
|
||||
path: /proc/sys/fs/may_detach_mounts
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: fs_may_detach_mounts
|
||||
ignore_errors: true # noqa ignore-errors
|
||||
|
||||
@@ -101,16 +101,16 @@
|
||||
name: fs.may_detach_mounts
|
||||
value: 1
|
||||
state: present
|
||||
reload: yes
|
||||
reload: true
|
||||
when: fs_may_detach_mounts.stat.exists | d(false)
|
||||
|
||||
- name: Ensure kube-bench parameters are set
|
||||
- name: Ensure kubelet expected parameters are set
|
||||
ansible.posix.sysctl:
|
||||
sysctl_file: "{{ sysctl_file_path }}"
|
||||
name: "{{ item.name }}"
|
||||
value: "{{ item.value }}"
|
||||
state: present
|
||||
reload: yes
|
||||
reload: true
|
||||
with_items:
|
||||
- { name: kernel.keys.root_maxbytes, value: 25000000 }
|
||||
- { name: kernel.keys.root_maxkeys, value: 1000000 }
|
||||
@@ -133,12 +133,12 @@
|
||||
name: "{{ item.name }}"
|
||||
value: "{{ item.value }}"
|
||||
state: present
|
||||
reload: yes
|
||||
reload: true
|
||||
with_items: "{{ additional_sysctl }}"
|
||||
|
||||
- name: Disable fapolicyd service
|
||||
failed_when: false
|
||||
systemd:
|
||||
systemd_service:
|
||||
name: fapolicyd
|
||||
state: stopped
|
||||
enabled: false
|
||||
|
||||
@@ -40,7 +40,7 @@
|
||||
template:
|
||||
src: "{{ ntp_config_file | basename }}.j2"
|
||||
dest: "{{ ntp_config_file }}"
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
notify: Preinstall | restart ntp
|
||||
when:
|
||||
- ntp_manage_config
|
||||
|
||||
@@ -11,19 +11,19 @@
|
||||
{% endfor %}
|
||||
delegate_to: localhost
|
||||
connection: local
|
||||
delegate_facts: yes
|
||||
run_once: yes
|
||||
delegate_facts: true
|
||||
run_once: true
|
||||
|
||||
- name: Hosts | populate inventory into hosts file
|
||||
blockinfile:
|
||||
path: /etc/hosts
|
||||
block: "{{ hostvars.localhost.etc_hosts_inventory_block }}"
|
||||
state: "{{ 'present' if populate_inventory_to_hosts_file else 'absent' }}"
|
||||
create: yes
|
||||
backup: yes
|
||||
unsafe_writes: yes
|
||||
create: true
|
||||
backup: true
|
||||
unsafe_writes: true
|
||||
marker: "# Ansible inventory hosts {mark}"
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
|
||||
- name: Hosts | populate kubernetes loadbalancer address into hosts file
|
||||
lineinfile:
|
||||
@@ -31,8 +31,8 @@
|
||||
regexp: ".*{{ apiserver_loadbalancer_domain_name }}$"
|
||||
line: "{{ loadbalancer_apiserver.address }} {{ apiserver_loadbalancer_domain_name }}"
|
||||
state: present
|
||||
backup: yes
|
||||
unsafe_writes: yes
|
||||
backup: true
|
||||
unsafe_writes: true
|
||||
when:
|
||||
- populate_loadbalancer_apiserver_to_hosts_file
|
||||
- loadbalancer_apiserver is defined
|
||||
@@ -69,8 +69,8 @@
|
||||
line: "{{ item.key }} {{ item.value | join(' ') }}"
|
||||
regexp: "^{{ item.key }}.*$"
|
||||
state: present
|
||||
backup: yes
|
||||
unsafe_writes: yes
|
||||
backup: true
|
||||
unsafe_writes: true
|
||||
loop: "{{ etc_hosts_localhosts_dict_target | default({}) | dict2items }}"
|
||||
|
||||
# gather facts to update ansible_fqdn
|
||||
|
||||
@@ -2,16 +2,16 @@
|
||||
- name: Configure dhclient to supersede search/domain/nameservers
|
||||
blockinfile:
|
||||
block: |-
|
||||
{% for item in [supersede_domain, supersede_search, supersede_nameserver] -%}
|
||||
{% for item in [supersede_domain, supersede_search, supersede_nameserver] | reject('equalto', '') -%}
|
||||
{{ item }}
|
||||
{% endfor %}
|
||||
path: "{{ dhclientconffile }}"
|
||||
create: yes
|
||||
create: true
|
||||
state: present
|
||||
insertbefore: BOF
|
||||
backup: yes
|
||||
backup: true
|
||||
marker: "# Ansible entries {mark}"
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
notify: Preinstall | propagate resolvconf to k8s components
|
||||
|
||||
- name: Configure dhclient hooks for resolv.conf (non-RH)
|
||||
@@ -19,7 +19,7 @@
|
||||
src: dhclient_dnsupdate.sh.j2
|
||||
dest: "{{ dhclienthookfile }}"
|
||||
owner: root
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
notify: Preinstall | propagate resolvconf to k8s components
|
||||
when: ansible_os_family not in [ "RedHat", "Suse" ]
|
||||
|
||||
@@ -28,6 +28,6 @@
|
||||
src: dhclient_dnsupdate_rh.sh.j2
|
||||
dest: "{{ dhclienthookfile }}"
|
||||
owner: root
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
notify: Preinstall | propagate resolvconf to k8s components
|
||||
when: ansible_os_family == "RedHat"
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
blockinfile:
|
||||
path: "{{ dhclientconffile }}"
|
||||
state: absent
|
||||
backup: yes
|
||||
backup: true
|
||||
marker: "# Ansible entries {mark}"
|
||||
notify: Preinstall | propagate resolvconf to k8s components
|
||||
|
||||
|
||||
@@ -1,44 +0,0 @@
|
||||
---
|
||||
|
||||
# Running growpart seems to be only required on Azure, as other Cloud Providers do this at boot time
|
||||
|
||||
- name: Install growpart
|
||||
package:
|
||||
name: cloud-utils-growpart
|
||||
state: present
|
||||
|
||||
- name: Gather mounts facts
|
||||
setup:
|
||||
gather_subset: 'mounts'
|
||||
|
||||
- name: Search root filesystem device
|
||||
vars:
|
||||
query: "[?mount=='/'].device"
|
||||
_root_device: "{{ ansible_mounts | json_query(query) }}"
|
||||
set_fact:
|
||||
device: "{{ _root_device | first | regex_replace('([^0-9]+)[0-9]+', '\\1') }}"
|
||||
partition: "{{ _root_device | first | regex_replace('[^0-9]+([0-9]+)', '\\1') }}"
|
||||
root_device: "{{ _root_device }}"
|
||||
|
||||
- name: Check if growpart needs to be run
|
||||
command: growpart -N {{ device }} {{ partition }}
|
||||
failed_when: False
|
||||
changed_when: "'NOCHANGE:' not in growpart_needed.stdout"
|
||||
register: growpart_needed
|
||||
environment:
|
||||
LC_ALL: C
|
||||
|
||||
- name: Check fs type
|
||||
command: file -Ls {{ root_device }}
|
||||
changed_when: False
|
||||
register: fs_type
|
||||
|
||||
- name: Run growpart # noqa no-handler
|
||||
command: growpart {{ device }} {{ partition }}
|
||||
when: growpart_needed.changed
|
||||
environment:
|
||||
LC_ALL: C
|
||||
|
||||
- name: Run xfs_growfs # noqa no-handler
|
||||
command: xfs_growfs {{ root_device }}
|
||||
when: growpart_needed.changed and 'XFS' in fs_type.stdout
|
||||
@@ -68,6 +68,7 @@
|
||||
- not dns_late
|
||||
tags:
|
||||
- bootstrap-os
|
||||
- system-packages
|
||||
|
||||
- name: Apply system configurations
|
||||
import_tasks: 0080-system-configurations.yml
|
||||
@@ -120,25 +121,15 @@
|
||||
- name: Check if we are running inside a Azure VM
|
||||
stat:
|
||||
path: /var/lib/waagent/
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: azure_check
|
||||
when:
|
||||
- not dns_late
|
||||
tags:
|
||||
- bootstrap-os
|
||||
|
||||
- name: Grow partition on azure CentOS
|
||||
import_tasks: 0120-growpart-azure-centos-7.yml
|
||||
when:
|
||||
- not dns_late
|
||||
- azure_check.stat.exists
|
||||
- ansible_os_family == "RedHat"
|
||||
- growpart_azure_enabled
|
||||
tags:
|
||||
- bootstrap-os
|
||||
|
||||
- name: Run calico checks
|
||||
include_role:
|
||||
name: network_plugin/calico
|
||||
|
||||
@@ -35,6 +35,13 @@ restrict -6 default kod notrap nomodify nopeer noquery limited
|
||||
restrict {{ item }}
|
||||
{% endfor %}
|
||||
|
||||
# Needed for filtering interfaces
|
||||
{% if ntp_filter_interface %}
|
||||
{% for item in ntp_interfaces %}
|
||||
interface {{ item }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
# Needed for adding pool entries
|
||||
restrict source notrap nomodify noquery
|
||||
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
---
|
||||
required_pkgs:
|
||||
- libselinux-python
|
||||
- device-mapper-libs
|
||||
- nss
|
||||
- conntrack-tools
|
||||
- libseccomp
|
||||
@@ -1,8 +0,0 @@
|
||||
---
|
||||
required_pkgs:
|
||||
- "{{ ((ansible_distribution_major_version | int) < 8) | ternary('libselinux-python', 'python3-libselinux') }}"
|
||||
- device-mapper-libs
|
||||
- nss
|
||||
- conntrack
|
||||
- container-selinux
|
||||
- libseccomp
|
||||
@@ -1,10 +0,0 @@
|
||||
---
|
||||
required_pkgs:
|
||||
- python3-apt
|
||||
- gnupg
|
||||
- apt-transport-https
|
||||
- software-properties-common
|
||||
- conntrack
|
||||
- iptables
|
||||
- apparmor
|
||||
- libseccomp2
|
||||
@@ -1,11 +0,0 @@
|
||||
---
|
||||
required_pkgs:
|
||||
- python3-apt
|
||||
- gnupg
|
||||
- apt-transport-https
|
||||
- software-properties-common
|
||||
- conntrack
|
||||
- iptables
|
||||
- apparmor
|
||||
- libseccomp2
|
||||
- mergerfs
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
required_pkgs:
|
||||
- python-apt
|
||||
- aufs-tools
|
||||
- apt-transport-https
|
||||
- software-properties-common
|
||||
- conntrack
|
||||
- apparmor
|
||||
- libseccomp2
|
||||
@@ -1,8 +0,0 @@
|
||||
---
|
||||
required_pkgs:
|
||||
- iptables
|
||||
- libselinux-python3
|
||||
- device-mapper-libs
|
||||
- conntrack
|
||||
- container-selinux
|
||||
- libseccomp
|
||||
103
kubespray/project/roles/kubernetes/preinstall/vars/main.yml
Normal file
103
kubespray/project/roles/kubernetes/preinstall/vars/main.yml
Normal file
@@ -0,0 +1,103 @@
|
||||
---
|
||||
pkgs:
|
||||
apparmor: &debian_family_base
|
||||
os:
|
||||
families:
|
||||
- Debian
|
||||
apt-transport-https: *debian_family_base
|
||||
aufs-tools: &deb_10
|
||||
groups:
|
||||
- k8s_cluster
|
||||
os:
|
||||
distributions:
|
||||
Debian:
|
||||
major_versions:
|
||||
- "10"
|
||||
bash-completion: {}
|
||||
conntrack: &deb_redhat
|
||||
groups:
|
||||
- k8s_cluster
|
||||
os:
|
||||
families:
|
||||
- Debian
|
||||
- RedHat
|
||||
conntrack-tools:
|
||||
groups:
|
||||
- k8s_cluster
|
||||
os:
|
||||
families:
|
||||
- Suse
|
||||
distributions:
|
||||
Amazon: {}
|
||||
container-selinux: &redhat_family
|
||||
groups:
|
||||
- k8s_cluster
|
||||
os:
|
||||
families:
|
||||
- RedHat
|
||||
curl: {}
|
||||
device-mapper:
|
||||
groups:
|
||||
- k8s_cluster
|
||||
os:
|
||||
families:
|
||||
- Suse
|
||||
device-mapper-libs: *redhat_family
|
||||
e2fsprogs: {}
|
||||
ebtables: {}
|
||||
gnupg: &debian
|
||||
groups:
|
||||
- k8s_cluster
|
||||
os:
|
||||
distributions:
|
||||
Debian:
|
||||
major_versions:
|
||||
- "11"
|
||||
- "12"
|
||||
ipset:
|
||||
enabled: "{{ kube_proxy_mode != 'ipvs' }}"
|
||||
groups:
|
||||
- k8s_cluster
|
||||
iptables: *deb_redhat
|
||||
ipvsadm:
|
||||
enabled: "{{ kube_proxy_mode == 'ipvs' }}"
|
||||
groups:
|
||||
- k8s_cluster
|
||||
libseccomp: *redhat_family
|
||||
libseccomp2:
|
||||
groups:
|
||||
- k8s_cluster
|
||||
os:
|
||||
families:
|
||||
- Suse
|
||||
- Debian
|
||||
libselinux-python: # TODO: Handle rehat_family + major < 8
|
||||
os:
|
||||
distributions:
|
||||
Amazon: {}
|
||||
libselinux-python3:
|
||||
os:
|
||||
distributions:
|
||||
Fedora: {}
|
||||
mergerfs:
|
||||
os:
|
||||
distributions:
|
||||
Debian:
|
||||
major_versions:
|
||||
- "12"
|
||||
nss: *redhat_family
|
||||
openssl: {}
|
||||
python-apt: *deb_10
|
||||
# TODO: not for debian 10
|
||||
python3-apt: *debian_family_base
|
||||
python3-libselinux:
|
||||
os:
|
||||
distributions:
|
||||
RedHat: {}
|
||||
CentOS: {}
|
||||
rsync: {}
|
||||
socat: {}
|
||||
software-properties-common: *debian_family_base
|
||||
tar: {}
|
||||
unzip: {}
|
||||
xfsprogs: {}
|
||||
@@ -1,8 +0,0 @@
|
||||
---
|
||||
required_pkgs:
|
||||
- "{{ ((ansible_distribution_major_version | int) < 8) | ternary('libselinux-python', 'python3-libselinux') }}"
|
||||
- device-mapper-libs
|
||||
- nss
|
||||
- conntrack
|
||||
- container-selinux
|
||||
- libseccomp
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
required_pkgs:
|
||||
- device-mapper
|
||||
- conntrack-tools
|
||||
- libseccomp2
|
||||
@@ -1,8 +0,0 @@
|
||||
---
|
||||
required_pkgs:
|
||||
- python3-apt
|
||||
- apt-transport-https
|
||||
- software-properties-common
|
||||
- conntrack
|
||||
- apparmor
|
||||
- libseccomp2
|
||||
@@ -2,9 +2,9 @@
|
||||
- name: "Check_tokens | check if the tokens have already been generated on first master"
|
||||
stat:
|
||||
path: "{{ kube_token_dir }}/known_tokens.csv"
|
||||
get_attributes: no
|
||||
get_checksum: yes
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: true
|
||||
get_mime: false
|
||||
delegate_to: "{{ groups['kube_control_plane'][0] }}"
|
||||
register: known_tokens_master
|
||||
run_once: true
|
||||
@@ -23,9 +23,9 @@
|
||||
- name: "Check tokens | check if a cert already exists"
|
||||
stat:
|
||||
path: "{{ kube_token_dir }}/known_tokens.csv"
|
||||
get_attributes: no
|
||||
get_checksum: yes
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: true
|
||||
get_mime: false
|
||||
register: known_tokens
|
||||
|
||||
- name: "Check_tokens | Set 'sync_tokens' to true"
|
||||
|
||||
@@ -3,8 +3,8 @@
|
||||
copy:
|
||||
src: "kube-gen-token.sh"
|
||||
dest: "{{ kube_script_dir }}/kube-gen-token.sh"
|
||||
mode: 0700
|
||||
run_once: yes
|
||||
mode: "0700"
|
||||
run_once: true
|
||||
delegate_to: "{{ groups['kube_control_plane'][0] }}"
|
||||
when: gen_tokens | default(false)
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
- "{{ groups['kube_control_plane'] }}"
|
||||
register: gentoken_master
|
||||
changed_when: "'Added' in gentoken_master.stdout"
|
||||
run_once: yes
|
||||
run_once: true
|
||||
delegate_to: "{{ groups['kube_control_plane'][0] }}"
|
||||
when: gen_tokens | default(false)
|
||||
|
||||
@@ -30,14 +30,14 @@
|
||||
- "{{ groups['kube_node'] }}"
|
||||
register: gentoken_node
|
||||
changed_when: "'Added' in gentoken_node.stdout"
|
||||
run_once: yes
|
||||
run_once: true
|
||||
delegate_to: "{{ groups['kube_control_plane'][0] }}"
|
||||
when: gen_tokens | default(false)
|
||||
|
||||
- name: Gen_tokens | Get list of tokens from first master
|
||||
command: "find {{ kube_token_dir }} -maxdepth 1 -type f"
|
||||
register: tokens_list
|
||||
check_mode: no
|
||||
check_mode: false
|
||||
delegate_to: "{{ groups['kube_control_plane'][0] }}"
|
||||
run_once: true
|
||||
when: sync_tokens | default(false)
|
||||
@@ -47,7 +47,7 @@
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: tokens_data
|
||||
check_mode: no
|
||||
check_mode: false
|
||||
delegate_to: "{{ groups['kube_control_plane'][0] }}"
|
||||
run_once: true
|
||||
when: sync_tokens | default(false)
|
||||
|
||||
@@ -11,7 +11,7 @@
|
||||
file:
|
||||
path: "{{ kube_token_dir }}"
|
||||
state: directory
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
group: "{{ kube_cert_group }}"
|
||||
|
||||
- name: Generate tokens
|
||||
|
||||
Reference in New Issue
Block a user