gstykalin/kube-forge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update to latest 2.26.0 kubespray version and add dns zones settings to coredns

Browse Source
This commit is contained in:
George Stykalin
2024-12-14 21:56:19 +03:00
parent be9c8a28fd
commit 4294f52703
368 changed files with 37761 additions and 2942 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
kubespray/project/roles/kubernetes/node/defaults/main.yml
View File

@@ -23,14 +23,18 @@ kubelet_kubelet_cgroups_cgroupfs: "/system.slice/kubelet.service"
# Set systemd service hardening features
kubelet_systemd_hardening: false
# Kubelet service dependencies other than container runtime
kubelet_systemd_wants_dependencies: []
# List of secure IPs for kubelet
kubelet_secure_addresses: >-
{%- for host in groups['kube_control_plane'] -%}
kube_node_addresses: >-
{%- for host in (groups['kube_control_plane'] + groups['kube_node'] + groups['etcd']) | unique -%}
{{ hostvars[host]['ip'] | default(fallback_ips[host]) }}{{ ' ' if not loop.last else '' }}
{%- endfor -%}
kubelet_secure_addresses: "localhost link-local {{ kube_pods_subnet }} {{ kube_node_addresses }}"
# Reserve this space for kube resources
# Set to true to reserve resources for kube daemons
# Whether to run kubelet and container-engine daemons in a dedicated cgroup. (Not required for resource reservations).
kube_reserved: false
kube_reserved_cgroups_for_service_slice: kube.slice
kube_reserved_cgroups: "/{{ kube_reserved_cgroups_for_service_slice }}"
@@ -66,14 +70,16 @@ eviction_hard_control_plane: {}
kubelet_status_update_frequency: 10s
# kube-vip
kube_vip_version: v0.5.12
kube_vip_version: v0.8.0
kube_vip_arp_enabled: false
kube_vip_interface:
kube_vip_services_interface:
kube_vip_cidr: 32
kube_vip_dns_mode: first
kube_vip_controlplane_enabled: false
kube_vip_ddns_enabled: false
kube_vip_cp_detect: false
kube_vip_services_enabled: false
kube_vip_leader_election_enabled: "{{ kube_vip_arp_enabled }}"
kube_vip_bgp_enabled: false
@@ -87,6 +93,12 @@ kube_vip_address:
kube_vip_enableServicesElection: false
kube_vip_lb_enable: false
kube_vip_lb_fwdmethod: local
kube_vip_leasename: plndr-cp-lock
kube_vip_svc_leasename: plndr-svcs-lock
kube_vip_leaseduration: 5
kube_vip_renewdeadline: 3
kube_vip_retryperiod: 1
kube_vip_enable_node_labeling: false
# Requests for load balancer app
loadbalancer_apiserver_memory_requests: 32M
@@ -258,4 +270,7 @@ conntrack_modules:
## Enable distributed tracing for kubelet
kubelet_tracing: false
kubelet_tracing_endpoint: 0.0.0.0:4317
kubelet_tracing_sampling_rate_per_million: 100
kubelet_tracing_sampling_rate_per_million: 100
# The maximum number of image pulls in parallel. Set it to a integer great than 1 to enable image pulling in parallel.
kubelet_max_parallel_image_pulls: 1

2
kubespray/project/roles/kubernetes/node/handlers/main.yml
View File

@@ -1,6 +1,6 @@
---
- name: Kubelet | reload systemd
systemd:
systemd_service:
daemon_reload: true
listen: Node | restart kubelet

2
kubespray/project/roles/kubernetes/node/tasks/facts.yml
View File

@@ -8,7 +8,7 @@
executable: /bin/bash
register: docker_cgroup_driver_result
changed_when: false
check_mode: no
check_mode: false
- name: Set kubelet_cgroup_driver_detected fact for docker
set_fact:

4
kubespray/project/roles/kubernetes/node/tasks/install.yml
View File

@@ -3,7 +3,7 @@
copy:
src: "{{ downloads.kubeadm.dest }}"
dest: "{{ bin_dir }}/kubeadm"
mode: 0755
mode: "0755"
remote_src: true
tags:
- kubeadm
@@ -14,7 +14,7 @@
copy:
src: "{{ downloads.kubelet.dest }}"
dest: "{{ bin_dir }}/kubelet"
mode: 0755
mode: "0755"
remote_src: true
tags:
- kubelet

12
kubespray/project/roles/kubernetes/node/tasks/kubelet.yml
View File

@@ -11,8 +11,8 @@
src: "kubelet.env.{{ kubeletConfig_api_version }}.j2"
dest: "{{ kube_config_dir }}/kubelet.env"
setype: "{{ (preinstall_selinux_state != 'disabled') | ternary('etc_t', omit) }}"
backup: yes
mode: 0600
backup: true
mode: "0600"
notify: Node | restart kubelet
tags:
- kubelet
@@ -22,7 +22,7 @@
template:
src: "kubelet-config.{{ kubeletConfig_api_version }}.yaml.j2"
dest: "{{ kube_config_dir }}/kubelet-config.yaml"
mode: 0600
mode: "0600"
notify: Kubelet | restart kubelet
tags:
- kubelet
@@ -32,8 +32,8 @@
template:
src: "kubelet.service.j2"
dest: "/etc/systemd/system/kubelet.service"
backup: "yes"
mode: 0600
backup: true
mode: "0600"
validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:kubelet.service'"
# FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
# Remove once we drop support for systemd < 250
@@ -48,7 +48,7 @@
- name: Enable kubelet
service:
name: kubelet
enabled: yes
enabled: true
state: started
tags:
- kubelet

14
kubespray/project/roles/kubernetes/node/tasks/loadbalancer/haproxy.yml
View File

@@ -8,7 +8,7 @@
file:
path: "{{ haproxy_config_dir }}"
state: directory
mode: 0755
mode: "0755"
owner: root
- name: Haproxy | Write haproxy configuration
@@ -16,19 +16,19 @@
src: "loadbalancer/haproxy.cfg.j2"
dest: "{{ haproxy_config_dir }}/haproxy.cfg"
owner: root
mode: 0755
backup: yes
mode: "0755"
backup: true
- name: Haproxy | Get checksum from config
stat:
path: "{{ haproxy_config_dir }}/haproxy.cfg"
get_attributes: no
get_checksum: yes
get_mime: no
get_attributes: false
get_checksum: true
get_mime: false
register: haproxy_stat
- name: Haproxy | Write static pod
template:
src: manifests/haproxy.manifest.j2
dest: "{{ kube_manifest_dir }}/haproxy.yml"
mode: 0640
mode: "0640"

28
kubespray/project/roles/kubernetes/node/tasks/loadbalancer/kube-vip.yml
View File

@@ -6,8 +6,34 @@
- kube_proxy_mode == 'ipvs' and not kube_proxy_strict_arp
- kube_vip_arp_enabled
- name: Kube-vip | Check if super-admin.conf exists
stat:
path: "{{ kube_config_dir }}/super-admin.conf"
failed_when: false
changed_when: false
register: stat_kube_vip_super_admin
- name: Kube-vip | Check if kubeadm has already run
stat:
path: "/var/lib/kubelet/config.yaml"
get_attributes: false
get_checksum: false
get_mime: false
register: kubeadm_already_run
- name: Kube-vip | Set admin.conf
set_fact:
kube_vip_admin_conf: admin.conf
- name: Kube-vip | Set admin.conf for first Control Plane
set_fact:
kube_vip_admin_conf: super-admin.conf
when:
- inventory_hostname == groups['kube_control_plane'] | first
- (stat_kube_vip_super_admin.stat.exists and stat_kube_vip_super_admin.stat.isreg) or (not kubeadm_already_run.stat.exists )
- name: Kube-vip | Write static pod
template:
src: manifests/kube-vip.manifest.j2
dest: "{{ kube_manifest_dir }}/kube-vip.yml"
mode: 0640
mode: "0640"

14
kubespray/project/roles/kubernetes/node/tasks/loadbalancer/nginx-proxy.yml
View File

@@ -8,7 +8,7 @@
file:
path: "{{ nginx_config_dir }}"
state: directory
mode: 0700
mode: "0700"
owner: root
- name: Nginx-proxy | Write nginx-proxy configuration
@@ -16,19 +16,19 @@
src: "loadbalancer/nginx.conf.j2"
dest: "{{ nginx_config_dir }}/nginx.conf"
owner: root
mode: 0755
backup: yes
mode: "0755"
backup: true
- name: Nginx-proxy | Get checksum from config
stat:
path: "{{ nginx_config_dir }}/nginx.conf"
get_attributes: no
get_checksum: yes
get_mime: no
get_attributes: false
get_checksum: true
get_mime: false
register: nginx_stat
- name: Nginx-proxy | Write static pod
template:
src: manifests/nginx-proxy.manifest.j2
dest: "{{ kube_manifest_dir }}/nginx-proxy.yml"
mode: 0640
mode: "0640"

20
kubespray/project/roles/kubernetes/node/tasks/main.yml
View File

@@ -14,7 +14,7 @@
file:
path: /var/lib/cni
state: directory
mode: 0755
mode: "0755"
- name: Install kubelet binary
import_tasks: install.yml
@@ -51,10 +51,10 @@
ansible.posix.sysctl:
name: net.ipv4.ip_local_reserved_ports
value: "{{ kube_apiserver_node_port_range }}"
sysctl_set: yes
sysctl_set: true
sysctl_file: "{{ sysctl_file_path }}"
state: present
reload: yes
reload: true
when: kube_apiserver_node_port_range is defined
tags:
- kube-proxy
@@ -66,7 +66,7 @@
register: modinfo_br_netfilter
failed_when: modinfo_br_netfilter.rc not in [0, 1]
changed_when: false
check_mode: no
check_mode: false
# TODO: Remove once upstream issue is fixed
# https://github.com/ansible-collections/community.general/issues/7717
@@ -74,7 +74,7 @@
file:
path: "{{ item }}"
state: directory
mode: 0755
mode: "0755"
loop:
- /etc/modules-load.d
- /etc/modprobe.d
@@ -89,7 +89,7 @@
copy:
dest: /etc/modules-load.d/kubespray-br_netfilter.conf
content: br_netfilter
mode: 0644
mode: "0644"
when: modinfo_br_netfilter.rc == 0
# kube-proxy needs net.bridge.bridge-nf-call-iptables enabled when found if br_netfilter is not a module
@@ -97,7 +97,7 @@
command: "sysctl net.bridge.bridge-nf-call-iptables"
failed_when: false
changed_when: false
check_mode: no
check_mode: false
register: sysctl_bridge_nf_call_iptables
- name: Enable bridge-nf-call tables
@@ -106,7 +106,7 @@
state: present
sysctl_file: "{{ sysctl_file_path }}"
value: "1"
reload: yes
reload: true
when: sysctl_bridge_nf_call_iptables.rc == 0
with_items:
- net.bridge.bridge-nf-call-iptables
@@ -162,7 +162,7 @@
content: "{{ openstack_cacert | b64decode if openstack_cacert_is_base64 else omit }}"
dest: "{{ kube_config_dir }}/openstack-cacert.pem"
group: "{{ kube_cert_group }}"
mode: 0640
mode: "0640"
when:
- cloud_provider is defined
- cloud_provider == 'openstack'
@@ -176,7 +176,7 @@
src: "cloud-configs/{{ cloud_provider }}-cloud-config.j2"
dest: "{{ kube_config_dir }}/cloud_config"
group: "{{ kube_cert_group }}"
mode: 0640
mode: "0640"
when:
- cloud_provider is defined
- cloud_provider in [ 'openstack', 'azure', 'vsphere', 'aws', 'gce' ]

2
kubespray/project/roles/kubernetes/node/tasks/pre_upgrade.yml
View File

@@ -11,7 +11,7 @@
executable: /bin/bash
failed_when: false
changed_when: false
check_mode: no
check_mode: false
register: kubelet_container_check
- name: "Pre-upgrade | copy /var/lib/cni from kubelet"

17
kubespray/project/roles/kubernetes/node/templates/kubelet-config.v1beta1.yaml.j2
View File

@@ -62,9 +62,10 @@ clusterDNS:
{# Node reserved CPU/memory #}
{% if kube_reserved | bool %}
kubeReservedCgroup: {{ kube_reserved_cgroups }}
{% endif %}
kubeReserved:
{% if is_kube_master | bool %}
cpu: {{ kube_master_cpu_reserved }}
cpu: "{{ kube_master_cpu_reserved }}"
memory: {{ kube_master_memory_reserved }}
{% if kube_master_ephemeral_storage_reserved is defined %}
ephemeral-storage: {{ kube_master_ephemeral_storage_reserved }}
@@ -73,7 +74,7 @@ kubeReserved:
pid: "{{ kube_master_pid_reserved }}"
{% endif %}
{% else %}
cpu: {{ kube_cpu_reserved }}
cpu: "{{ kube_cpu_reserved }}"
memory: {{ kube_memory_reserved }}
{% if kube_ephemeral_storage_reserved is defined %}
ephemeral-storage: {{ kube_ephemeral_storage_reserved }}
@@ -82,12 +83,11 @@ kubeReserved:
pid: "{{ kube_pid_reserved }}"
{% endif %}
{% endif %}
{% endif %}
{% if system_reserved | bool %}
systemReservedCgroup: {{ system_reserved_cgroups }}
systemReserved:
{% if is_kube_master | bool %}
cpu: {{ system_master_cpu_reserved }}
cpu: "{{ system_master_cpu_reserved }}"
memory: {{ system_master_memory_reserved }}
{% if system_master_ephemeral_storage_reserved is defined %}
ephemeral-storage: {{ system_master_ephemeral_storage_reserved }}
@@ -96,7 +96,7 @@ systemReserved:
pid: "{{ system_master_pid_reserved }}"
{% endif %}
{% else %}
cpu: {{ system_cpu_reserved }}
cpu: "{{ system_cpu_reserved }}"
memory: {{ system_memory_reserved }}
{% if system_ephemeral_storage_reserved is defined %}
ephemeral-storage: {{ system_ephemeral_storage_reserved }}
@@ -160,6 +160,10 @@ seccompDefault: {{ kubelet_seccomp_default | bool }}
{% if kubelet_cpu_manager_policy is defined %}
cpuManagerPolicy: {{ kubelet_cpu_manager_policy }}
{% endif %}
{% if kubelet_cpu_manager_policy_options is defined %}
cpuManagerPolicyOptions:
{{ kubelet_cpu_manager_policy_options | to_nice_yaml(indent=2) }}
{% endif %}
{% if kubelet_topology_manager_policy is defined %}
topologyManagerPolicy: {{ kubelet_topology_manager_policy }}
{% endif %}
@@ -170,4 +174,5 @@ topologyManagerScope: {{ kubelet_topology_manager_scope }}
tracing:
endpoint: {{ kubelet_tracing_endpoint }}
samplingRatePerMillion: {{ kubelet_tracing_sampling_rate_per_million }}
{% endif %}
{% endif %}
maxParallelImagePulls: {{ kubelet_max_parallel_image_pulls }}

5
kubespray/project/roles/kubernetes/node/templates/kubelet.service.j2
View File

@@ -7,6 +7,11 @@ Wants=docker.socket
{% else %}
Wants={{ container_manager }}.service
{% endif %}
{% for kubelet_dependency in kubelet_systemd_wants_dependencies|default([]) %}
{% if kubelet_dependency|length > 0 %}
Wants={{ kubelet_dependency }}
{% endif %}
{% endfor %}
[Service]
EnvironmentFile=-{{ kube_config_dir }}/kubelet.env

28
kubespray/project/roles/kubernetes/node/templates/manifests/kube-vip.manifest.j2
View File

@@ -1,4 +1,4 @@
# Inspired by https://github.com/kube-vip/kube-vip/blob/v0.5.11/pkg/kubevip/config_generator.go#L13
# Inspired by https://github.com/kube-vip/kube-vip/blob/v0.8.0/pkg/kubevip/config_generator.go#L103
apiVersion: v1
kind: Pod
metadata:
@@ -16,6 +16,8 @@ spec:
value: {{ kube_vip_arp_enabled | string | to_json }}
- name: port
value: {{ kube_apiserver_port | string | to_json }}
- name: vip_nodename
value: {{ inventory_hostname }}
{% if kube_vip_interface %}
- name: vip_interface
value: {{ kube_vip_interface | string | to_json }}
@@ -28,6 +30,10 @@ spec:
- name: vip_cidr
value: {{ kube_vip_cidr | string | to_json }}
{% endif %}
{% if kube_vip_dns_mode %}
- name: dns_mode
value: {{ kube_vip_dns_mode | string | to_json }}
{% endif %}
{% if kube_vip_controlplane_enabled %}
- name: cp_enable
value: "true"
@@ -35,11 +41,17 @@ spec:
value: kube-system
- name: vip_ddns
value: {{ kube_vip_ddns_enabled | string | to_json }}
- name: cp_detect
value: {{ kube_vip_cp_detect | string | to_json }}
{% endif %}
{% if kube_vip_services_enabled %}
- name: svc_enable
value: "true"
{% endif %}
{% if kube_vip_svc_leasename %}
- name: svc_leasename
value: {{ kube_vip_svc_leasename | string | to_json }}
{% endif %}
{% if kube_vip_enableServicesElection %}
- name: svc_election
value: "true"
@@ -47,12 +59,18 @@ spec:
{% if kube_vip_leader_election_enabled %}
- name: vip_leaderelection
value: "true"
- name: vip_leasename
value: {{ kube_vip_leasename | string | to_json }}
- name: vip_leaseduration
value: "5"
value: {{ kube_vip_leaseduration | string | to_json }}
- name: vip_renewdeadline
value: "3"
value: {{ kube_vip_renewdeadline | string | to_json }}
- name: vip_retryperiod
value: "1"
value: {{ kube_vip_retryperiod | string | to_json }}
{% endif %}
{% if kube_vip_enable_node_labeling %}
- name: enable_node_labeling
value: {{ kube_vip_enable_node_labeling | string | to_json }}
{% endif %}
{% if kube_vip_bgp_enabled %}
- name: bgp_enable
@@ -101,6 +119,6 @@ spec:
hostNetwork: true
volumes:
- hostPath:
path: /etc/kubernetes/admin.conf
path: /etc/kubernetes/{{kube_vip_admin_conf}}
name: kubeconfig
status: {}

2
kubespray/project/roles/kubernetes/node/vars/ubuntu-24.yml Normal file
View File

@@ -0,0 +1,2 @@
---
kube_resolv_conf: "/run/systemd/resolve/resolv.conf"