update to latest 2.26.0 kubespray version and add dns zones settings to coredns
This commit is contained in:
@@ -240,3 +240,6 @@ kubeadm_upgrade_auto_cert_renewal: true
|
||||
kube_apiserver_tracing: false
|
||||
kube_apiserver_tracing_endpoint: 0.0.0.0:4317
|
||||
kube_apiserver_tracing_sampling_rate_per_million: 100
|
||||
|
||||
# Enable kubeadm file discovery if anonymous access has been removed
|
||||
kubeadm_use_file_discovery: "{{ remove_anonymous_access }}"
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
- name: Master | reload systemd
|
||||
systemd:
|
||||
systemd_service:
|
||||
daemon_reload: true
|
||||
listen: Master | restart kubelet
|
||||
|
||||
@@ -81,7 +81,7 @@
|
||||
endpoint: "{{ kube_scheduler_bind_address if kube_scheduler_bind_address != '0.0.0.0' else 'localhost' }}"
|
||||
uri:
|
||||
url: https://{{ endpoint }}:10259/healthz
|
||||
validate_certs: no
|
||||
validate_certs: false
|
||||
register: scheduler_result
|
||||
until: scheduler_result.status == 200
|
||||
retries: 60
|
||||
@@ -95,7 +95,7 @@
|
||||
endpoint: "{{ kube_controller_manager_bind_address if kube_controller_manager_bind_address != '0.0.0.0' else 'localhost' }}"
|
||||
uri:
|
||||
url: https://{{ endpoint }}:10257/healthz
|
||||
validate_certs: no
|
||||
validate_certs: false
|
||||
register: controller_manager_result
|
||||
until: controller_manager_result.status == 200
|
||||
retries: 60
|
||||
@@ -107,7 +107,7 @@
|
||||
- name: Master | wait for the apiserver to be running
|
||||
uri:
|
||||
url: "{{ kube_apiserver_endpoint }}/healthz"
|
||||
validate_certs: no
|
||||
validate_certs: false
|
||||
register: result
|
||||
until: result.status == 200
|
||||
retries: 60
|
||||
|
||||
@@ -3,16 +3,16 @@
|
||||
- name: Check which kube-control nodes are already members of the cluster
|
||||
command: "{{ bin_dir }}/kubectl get nodes --selector=node-role.kubernetes.io/control-plane -o json"
|
||||
register: kube_control_planes_raw
|
||||
ignore_errors: yes
|
||||
ignore_errors: true
|
||||
changed_when: false
|
||||
|
||||
- name: Set fact joined_control_planes
|
||||
set_fact:
|
||||
joined_control_planes: "{{ ((kube_control_planes_raw.stdout | from_json)['items']) | default([]) | map(attribute='metadata') | map(attribute='name') | list }}"
|
||||
delegate_to: item
|
||||
delegate_to: "{{ item }}"
|
||||
loop: "{{ groups['kube_control_plane'] }}"
|
||||
when: kube_control_planes_raw is succeeded
|
||||
run_once: yes
|
||||
run_once: true
|
||||
|
||||
- name: Set fact first_kube_control_plane
|
||||
set_fact:
|
||||
|
||||
@@ -2,9 +2,9 @@
|
||||
- name: Check if secret for encrypting data at rest already exist
|
||||
stat:
|
||||
path: "{{ kube_cert_dir }}/secrets_encryption.yaml"
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: secrets_encryption_file
|
||||
|
||||
- name: Slurp secrets_encryption file if it exists
|
||||
@@ -37,4 +37,4 @@
|
||||
dest: "{{ kube_cert_dir }}/secrets_encryption.yaml"
|
||||
owner: root
|
||||
group: "{{ kube_cert_group }}"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
src: "{{ kube_cert_dir }}/{{ item }}"
|
||||
dest: "{{ kube_cert_dir }}/{{ item }}.old"
|
||||
mode: preserve
|
||||
remote_src: yes
|
||||
remote_src: true
|
||||
with_items:
|
||||
- apiserver.crt
|
||||
- apiserver.key
|
||||
@@ -19,7 +19,7 @@
|
||||
src: "{{ kube_config_dir }}/{{ item }}"
|
||||
dest: "{{ kube_config_dir }}/{{ item }}.old"
|
||||
mode: preserve
|
||||
remote_src: yes
|
||||
remote_src: true
|
||||
with_items:
|
||||
- admin.conf
|
||||
- controller-manager.conf
|
||||
|
||||
@@ -25,5 +25,5 @@
|
||||
path: "{{ etcd_data_dir }}"
|
||||
owner: "{{ etcd_owner }}"
|
||||
group: "{{ etcd_owner }}"
|
||||
mode: 0700
|
||||
mode: "0700"
|
||||
when: etcd_deployment_type == "kubeadm"
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
dest: "{{ kube_config_dir }}/{{ item }}"
|
||||
regexp: '^ server: https'
|
||||
line: ' server: {{ kube_apiserver_endpoint }}'
|
||||
backup: yes
|
||||
backup: true
|
||||
with_items:
|
||||
- admin.conf
|
||||
- controller-manager.conf
|
||||
|
||||
@@ -25,7 +25,7 @@
|
||||
- name: Parse certificate key if not set
|
||||
set_fact:
|
||||
kubeadm_certificate_key: "{{ hostvars[groups['kube_control_plane'][0]]['kubeadm_upload_cert'].stdout_lines[-1] | trim }}"
|
||||
run_once: yes
|
||||
run_once: true
|
||||
when:
|
||||
- hostvars[groups['kube_control_plane'][0]]['kubeadm_upload_cert'] is defined
|
||||
- hostvars[groups['kube_control_plane'][0]]['kubeadm_upload_cert'] is not skipped
|
||||
@@ -34,8 +34,8 @@
|
||||
template:
|
||||
src: "kubeadm-controlplane.{{ kubeadmConfig_api_version }}.yaml.j2"
|
||||
dest: "{{ kube_config_dir }}/kubeadm-controlplane.yaml"
|
||||
mode: 0640
|
||||
backup: yes
|
||||
mode: "0640"
|
||||
backup: true
|
||||
when:
|
||||
- inventory_hostname != first_kube_control_plane
|
||||
- not kubeadm_already_run.stat.exists
|
||||
@@ -63,6 +63,26 @@
|
||||
- kubeadm_already_run is not defined or not kubeadm_already_run.stat.exists
|
||||
- not kube_external_ca_mode
|
||||
|
||||
- name: Get kubeconfig for join discovery process
|
||||
command: "{{ kubectl }} -n kube-public get cm cluster-info -o jsonpath='{.data.kubeconfig}'"
|
||||
register: kubeconfig_file_discovery
|
||||
run_once: true
|
||||
delegate_to: "{{ groups['kube_control_plane'] | first }}"
|
||||
when:
|
||||
- kubeadm_use_file_discovery
|
||||
- kubeadm_already_run is not defined or not kubeadm_already_run.stat.exists
|
||||
|
||||
- name: Copy discovery kubeconfig
|
||||
copy:
|
||||
dest: "{{ kube_config_dir }}/cluster-info-discovery-kubeconfig.yaml"
|
||||
content: "{{ kubeconfig_file_discovery.stdout }}"
|
||||
owner: "root"
|
||||
mode: "0644"
|
||||
when:
|
||||
- inventory_hostname != first_kube_control_plane
|
||||
- kubeadm_use_file_discovery
|
||||
- kubeadm_already_run is not defined or not kubeadm_already_run.stat.exists
|
||||
|
||||
- name: Joining control plane node to the cluster.
|
||||
command: >-
|
||||
{{ bin_dir }}/kubeadm join
|
||||
|
||||
@@ -13,9 +13,9 @@
|
||||
- name: Kubeadm | Check if kubeadm has already run
|
||||
stat:
|
||||
path: "/var/lib/kubelet/config.yaml"
|
||||
get_attributes: no
|
||||
get_checksum: no
|
||||
get_mime: no
|
||||
get_attributes: false
|
||||
get_checksum: false
|
||||
get_mime: false
|
||||
register: kubeadm_already_run
|
||||
|
||||
- name: Kubeadm | Backup kubeadm certs / kubeconfig
|
||||
@@ -51,35 +51,35 @@
|
||||
file:
|
||||
path: "{{ audit_policy_file | dirname }}"
|
||||
state: directory
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kubernetes_audit | default(false) or kubernetes_audit_webhook | default(false)
|
||||
|
||||
- name: Write api audit policy yaml
|
||||
template:
|
||||
src: apiserver-audit-policy.yaml.j2
|
||||
dest: "{{ audit_policy_file }}"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kubernetes_audit | default(false) or kubernetes_audit_webhook | default(false)
|
||||
|
||||
- name: Write api audit webhook config yaml
|
||||
template:
|
||||
src: apiserver-audit-webhook-config.yaml.j2
|
||||
dest: "{{ audit_webhook_config_file }}"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kubernetes_audit_webhook | default(false)
|
||||
|
||||
- name: Create apiserver tracing config directory
|
||||
file:
|
||||
path: "{{ kube_config_dir }}/tracing"
|
||||
state: directory
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kube_apiserver_tracing
|
||||
|
||||
- name: Write apiserver tracing config yaml
|
||||
template:
|
||||
src: apiserver-tracing.yaml.j2
|
||||
dest: "{{ kube_config_dir }}/tracing/apiserver-tracing.yaml"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kube_apiserver_tracing
|
||||
|
||||
# Nginx LB(default), If kubeadm_config_api_fqdn is defined, use other LB by kubeadm controlPlaneEndpoint.
|
||||
@@ -96,27 +96,27 @@
|
||||
template:
|
||||
src: "kubeadm-config.{{ kubeadmConfig_api_version }}.yaml.j2"
|
||||
dest: "{{ kube_config_dir }}/kubeadm-config.yaml"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
|
||||
- name: Kubeadm | Create directory to store admission control configurations
|
||||
file:
|
||||
path: "{{ kube_config_dir }}/admission-controls"
|
||||
state: directory
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kube_apiserver_admission_control_config_file
|
||||
|
||||
- name: Kubeadm | Push admission control config file
|
||||
template:
|
||||
src: "admission-controls.yaml.j2"
|
||||
dest: "{{ kube_config_dir }}/admission-controls/admission-controls.yaml"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kube_apiserver_admission_control_config_file
|
||||
|
||||
- name: Kubeadm | Push admission control config files
|
||||
template:
|
||||
src: "{{ item | lower }}.yaml.j2"
|
||||
dest: "{{ kube_config_dir }}/admission-controls/{{ item | lower }}.yaml"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when:
|
||||
- kube_apiserver_admission_control_config_file
|
||||
- item in kube_apiserver_admission_plugins_needs_configuration
|
||||
@@ -126,7 +126,7 @@
|
||||
template:
|
||||
src: "podnodeselector.yaml.j2"
|
||||
dest: "{{ kube_config_dir }}/admission-controls/podnodeselector.yaml"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when:
|
||||
- kube_apiserver_admission_plugins_podnodeselector_default_node_selector is defined
|
||||
- kube_apiserver_admission_plugins_podnodeselector_default_node_selector | length > 0
|
||||
@@ -178,7 +178,7 @@
|
||||
file:
|
||||
path: "{{ kubeadm_patches.dest_dir }}"
|
||||
state: directory
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kubeadm_patches is defined and kubeadm_patches.enabled
|
||||
|
||||
- name: Kubeadm | Copy kubeadm patches from inventory files
|
||||
@@ -186,7 +186,7 @@
|
||||
src: "{{ kubeadm_patches.source_dir }}/"
|
||||
dest: "{{ kubeadm_patches.dest_dir }}"
|
||||
owner: "root"
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
when: kubeadm_patches is defined and kubeadm_patches.enabled
|
||||
|
||||
- name: Kubeadm | Initialize first master
|
||||
@@ -221,12 +221,16 @@
|
||||
{{ bin_dir }}/kubeadm --kubeconfig {{ kube_config_dir }}/admin.conf token create {{ kubeadm_token }}
|
||||
changed_when: false
|
||||
when:
|
||||
- inventory_hostname == first_kube_control_plane
|
||||
- inventory_hostname == first_kube_control_plane
|
||||
- kubeadm_token is defined
|
||||
- kubeadm_refresh_token
|
||||
tags:
|
||||
- kubeadm_token
|
||||
|
||||
- name: Remove binding to anonymous user
|
||||
command: "{{ kubectl }} -n kube-public delete rolebinding kubeadm:bootstrap-signer-clusterinfo --ignore-not-found"
|
||||
when: inventory_hostname == first_kube_control_plane and remove_anonymous_access
|
||||
|
||||
- name: Create kubeadm token for joining nodes with 24h expiration (default)
|
||||
command: "{{ bin_dir }}/kubeadm --kubeconfig {{ kube_config_dir }}/admin.conf token create"
|
||||
changed_when: false
|
||||
|
||||
@@ -15,7 +15,6 @@
|
||||
{{ bin_dir }}/kubeadm
|
||||
upgrade apply -y {{ kube_version }}
|
||||
--certificate-renewal={{ kubeadm_upgrade_auto_cert_renewal }}
|
||||
--config={{ kube_config_dir }}/kubeadm-config.yaml
|
||||
--ignore-preflight-errors=all
|
||||
--allow-experimental-upgrades
|
||||
--etcd-upgrade={{ (etcd_deployment_type == "kubeadm") | bool | lower }}
|
||||
@@ -37,7 +36,6 @@
|
||||
{{ bin_dir }}/kubeadm
|
||||
upgrade apply -y {{ kube_version }}
|
||||
--certificate-renewal={{ kubeadm_upgrade_auto_cert_renewal }}
|
||||
--config={{ kube_config_dir }}/kubeadm-config.yaml
|
||||
--ignore-preflight-errors=all
|
||||
--allow-experimental-upgrades
|
||||
--etcd-upgrade={{ (etcd_deployment_type == "kubeadm") | bool | lower }}
|
||||
@@ -53,6 +51,10 @@
|
||||
PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
|
||||
notify: Master | restart kubelet
|
||||
|
||||
- name: Kubeadm | Remove binding to anonymous user
|
||||
command: "{{ kubectl }} -n kube-public delete rolebinding kubeadm:bootstrap-signer-clusterinfo --ignore-not-found"
|
||||
when: remove_anonymous_access
|
||||
|
||||
- name: Kubeadm | clean kubectl cache to refresh api types
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
path: "{{ kube_config_dir }}/kubelet.conf"
|
||||
regexp: '^ client-certificate-data: '
|
||||
line: ' client-certificate: /var/lib/kubelet/pki/kubelet-client-current.pem'
|
||||
backup: yes
|
||||
backup: true
|
||||
notify:
|
||||
- "Master | reload kubelet"
|
||||
|
||||
@@ -13,6 +13,6 @@
|
||||
path: "{{ kube_config_dir }}/kubelet.conf"
|
||||
regexp: '^ client-key-data: '
|
||||
line: ' client-key: /var/lib/kubelet/pki/kubelet-client-current.pem'
|
||||
backup: yes
|
||||
backup: true
|
||||
notify:
|
||||
- "Master | reload kubelet"
|
||||
|
||||
@@ -8,21 +8,21 @@
|
||||
template:
|
||||
src: webhook-token-auth-config.yaml.j2
|
||||
dest: "{{ kube_config_dir }}/webhook-token-auth-config.yaml"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kube_webhook_token_auth | default(false)
|
||||
|
||||
- name: Create webhook authorization config
|
||||
template:
|
||||
src: webhook-authorization-config.yaml.j2
|
||||
dest: "{{ kube_config_dir }}/webhook-authorization-config.yaml"
|
||||
mode: 0640
|
||||
mode: "0640"
|
||||
when: kube_webhook_authorization | default(false)
|
||||
|
||||
- name: Create kube-scheduler config
|
||||
template:
|
||||
src: kubescheduler-config.yaml.j2
|
||||
dest: "{{ kube_config_dir }}/kubescheduler-config.yaml"
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
|
||||
- name: Apply Kubernetes encrypt at rest config
|
||||
import_tasks: encrypt-at-rest.yml
|
||||
@@ -35,7 +35,7 @@
|
||||
copy:
|
||||
src: "{{ downloads.kubectl.dest }}"
|
||||
dest: "{{ bin_dir }}/kubectl"
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
remote_src: true
|
||||
tags:
|
||||
- kubectl
|
||||
@@ -53,7 +53,7 @@
|
||||
path: /etc/bash_completion.d/kubectl.sh
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
when: ansible_os_family in ["Debian","RedHat"]
|
||||
tags:
|
||||
- kubectl
|
||||
@@ -101,13 +101,13 @@
|
||||
template:
|
||||
src: k8s-certs-renew.sh.j2
|
||||
dest: "{{ bin_dir }}/k8s-certs-renew.sh"
|
||||
mode: 0755
|
||||
mode: "0755"
|
||||
|
||||
- name: Renew K8S control plane certificates monthly 1/2
|
||||
template:
|
||||
src: "{{ item }}.j2"
|
||||
dest: "/etc/systemd/system/{{ item }}"
|
||||
mode: 0644
|
||||
mode: "0644"
|
||||
validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:{{item}}'"
|
||||
# FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
|
||||
# Remove once we drop support for systemd < 250
|
||||
@@ -118,9 +118,9 @@
|
||||
when: auto_renew_certificates
|
||||
|
||||
- name: Renew K8S control plane certificates monthly 2/2
|
||||
systemd:
|
||||
systemd_service:
|
||||
name: k8s-certs-renew.timer
|
||||
enabled: yes
|
||||
enabled: true
|
||||
state: started
|
||||
daemon_reload: "{{ k8s_certs_units is changed }}"
|
||||
when: auto_renew_certificates
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
apiVersion: apiserver.config.k8s.io/v1beta1
|
||||
kind: TracingConfiguration
|
||||
endpoint: {{ kube_apiserver_tracing_endpoint }}
|
||||
samplingRatePerMillion: {{ kube_apiserver_tracing_sampling_rate_per_million }}
|
||||
samplingRatePerMillion: {{ kube_apiserver_tracing_sampling_rate_per_million }}
|
||||
|
||||
@@ -14,7 +14,7 @@ certificateKey: {{ kubeadm_certificate_key }}
|
||||
{% endif %}
|
||||
nodeRegistration:
|
||||
{% if kube_override_hostname | default('') %}
|
||||
name: {{ kube_override_hostname }}
|
||||
name: "{{ kube_override_hostname }}"
|
||||
{% endif %}
|
||||
{% if inventory_hostname in groups['kube_control_plane'] and inventory_hostname not in groups['kube_node'] %}
|
||||
taints:
|
||||
@@ -76,17 +76,17 @@ etcd:
|
||||
{% endfor %}
|
||||
serverCertSANs:
|
||||
{% for san in etcd_cert_alt_names %}
|
||||
- {{ san }}
|
||||
- "{{ san }}"
|
||||
{% endfor %}
|
||||
{% for san in etcd_cert_alt_ips %}
|
||||
- {{ san }}
|
||||
- "{{ san }}"
|
||||
{% endfor %}
|
||||
peerCertSANs:
|
||||
{% for san in etcd_cert_alt_names %}
|
||||
- {{ san }}
|
||||
- "{{ san }}"
|
||||
{% endfor %}
|
||||
{% for san in etcd_cert_alt_ips %}
|
||||
- {{ san }}
|
||||
- "{{ san }}"
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
dns:
|
||||
@@ -294,7 +294,7 @@ apiServer:
|
||||
{% endif %}
|
||||
certSANs:
|
||||
{% for san in apiserver_sans %}
|
||||
- {{ san }}
|
||||
- "{{ san }}"
|
||||
{% endfor %}
|
||||
timeoutForControlPlane: 5m0s
|
||||
controllerManager:
|
||||
@@ -416,7 +416,7 @@ conntrack:
|
||||
tcpEstablishedTimeout: {{ kube_proxy_conntrack_tcp_established_timeout }}
|
||||
enableProfiling: {{ kube_proxy_enable_profiling }}
|
||||
healthzBindAddress: {{ kube_proxy_healthz_bind_address }}
|
||||
hostnameOverride: {{ kube_override_hostname }}
|
||||
hostnameOverride: "{{ kube_override_hostname }}"
|
||||
iptables:
|
||||
masqueradeAll: {{ kube_proxy_masquerade_all }}
|
||||
masqueradeBit: {{ kube_proxy_masquerade_bit }}
|
||||
|
||||
@@ -1,6 +1,10 @@
|
||||
apiVersion: kubeadm.k8s.io/v1beta3
|
||||
kind: JoinConfiguration
|
||||
discovery:
|
||||
{% if kubeadm_use_file_discovery %}
|
||||
file:
|
||||
kubeConfigPath: {{ kube_config_dir }}/cluster-info-discovery-kubeconfig.yaml
|
||||
{% else %}
|
||||
bootstrapToken:
|
||||
{% if kubeadm_config_api_fqdn is defined %}
|
||||
apiServerEndpoint: {{ kubeadm_config_api_fqdn }}:{{ loadbalancer_apiserver.port | default(kube_apiserver_port) }}
|
||||
@@ -9,6 +13,7 @@ discovery:
|
||||
{% endif %}
|
||||
token: {{ kubeadm_token }}
|
||||
unsafeSkipCAVerification: true
|
||||
{% endif %}
|
||||
timeout: {{ discovery_timeout }}
|
||||
tlsBootstrapToken: {{ kubeadm_token }}
|
||||
controlPlane:
|
||||
|
||||
Reference in New Issue
Block a user