gstykalin/kube-forge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update to latest 2.26.0 kubespray version and add dns zones settings to coredns

Browse Source
This commit is contained in:
George Stykalin
2024-12-14 21:56:19 +03:00
parent be9c8a28fd
commit 4294f52703
368 changed files with 37761 additions and 2942 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
kubespray/project/roles/kubernetes/preinstall/defaults/main.yml
View File

@@ -6,18 +6,6 @@ epel_enabled: false
# Kubespray sets this to true after clusterDNS is running to apply changes to the host resolv.conf
dns_late: false
common_required_pkgs:
- "{{ (ansible_distribution == 'openSUSE Tumbleweed') | ternary('openssl-1_1', 'openssl') }}"
- curl
- rsync
- socat
- unzip
- e2fsprogs
- xfsprogs
- ebtables
- bash-completion
- tar
# Set to true if your network does not support IPv6
# This may be necessary for pulling Docker images from
# GCE docker repository
@@ -98,6 +86,13 @@ ntp_servers:
ntp_restrict:
- "127.0.0.1"
- "::1"
# Specify whether to filter interfaces
ntp_filter_interface: false
# Specify the interfaces
# Only takes effect when ntp_filter_interface is true
# ntp_interfaces:
# - ignore wildcard
# - listen xxx
# The NTP driftfile path
# Only takes effect when ntp_manage_config is true.
ntp_driftfile: /var/lib/ntp/ntp.drift
@@ -135,21 +130,12 @@ supported_os_distributions:
# Extending some distributions into the redhat os family
redhat_os_family_extensions:
- "Kylin Linux Advanced Server"
- "openEuler"
- "UnionTech"
- "UniontechOS"
# Extending some distributions into the debian os family
debian_os_family_extensions:
- "UnionTech OS Server 20"
# Sets DNSStubListener=no, useful if you get "0.0.0.0:53: bind: address already in use"
systemd_resolved_disable_stub_listener: "{{ ansible_os_family in ['Flatcar', 'Flatcar Container Linux by Kinvolk'] }}"
# Used to disable File Access Policy Daemon service.
# If service is enabled, the CNI plugin installation will fail
disable_fapolicyd: true
# Enable 0120-growpart-azure-centos-7 tasks
growpart_azure_enabled: true

80
kubespray/project/roles/kubernetes/preinstall/files/pkgs-schema.json Normal file
View File

@@ -0,0 +1,80 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://kubespray.io/internal/os_packages.schema.json",
"title": "Os packages",
"description": "Criteria for selecting packages to install on Kubernetes nodes during installation by Kubespray",
"type": "object",
"patternProperties": {
".*": {
"type": "object",
"additionalProperties": false,
"properties": {
"enabled": {
"description": "Escape hatch to filter packages. The value is expected to be pre-resolved to a boolean by Jinja",
"type": "boolean",
"default": true
},
"groups": {
"description": "Match if the host is in one of these groups. If not specified match any host.",
"type": "array",
"minItems": 1,
"items":{
"type": "string",
"pattern": "^[0-9A-Za-z_]*$"
}
},
"os": {
"type": "object",
"description": "If not specified match any OS. Otherwise, must match by 'families' or 'distributions' to be included.",
"additionalProperties": false,
"minProperties": 1,
"properties": {
"families": {
"description": "Match if ansible_os_family is part of the list.",
"type": "array",
"minItems": 1,
"items": {
"type": "string"
}
},
"distributions": {
"type": "object",
"description": "Match if ansible_distribution match one of defined keys.",
"minProperties": 1,
"patternProperties": {
".*": {
"description": "Match if either the value is the empty hash, or one major_versions/versions/releases contains the corresponding variable ('ansible_distrbution_*')",
"type": "object",
"additionalProperties": false,
"properties": {
"major_versions": {
"type": "array",
"minItems": 1,
"items": {
"type": "string"
}
},
"versions": {
"type": "array",
"minItems": 1,
"items": {
"type": "string"
}
},
"releases": {
"type": "array",
"minItems": 1,
"items": {
"type": "string"
}
}
}
}
}
}
}
}
}
}
}
}

73
kubespray/project/roles/kubernetes/preinstall/gen-gitinfos.sh
View File

@@ -1,73 +0,0 @@
#!/bin/sh
set -e
# Text color variables
txtbld=$(tput bold) # Bold
bldred=${txtbld}$(tput setaf 1) # red
bldgre=${txtbld}$(tput setaf 2) # green
bldylw=${txtbld}$(tput setaf 3) # yellow
txtrst=$(tput sgr0) # Reset
err=${bldred}ERROR${txtrst}
info=${bldgre}INFO${txtrst}
warn=${bldylw}WARNING${txtrst}
usage()
{
cat << EOF
Generates a file which contains useful git informations
Usage : $(basename $0) [global|diff]
ex :
Generate git information
$(basename $0) global
Generate diff from latest tag
$(basename $0) diff
EOF
}
if [ $# != 1 ]; then
printf "\n$err : Needs 1 argument\n"
usage
exit 2
fi;
current_commit=$(git rev-parse HEAD)
latest_tag=$(git describe --abbrev=0 --tags)
latest_tag_commit=$(git show-ref -s ${latest_tag})
tags_list=$(git tag --points-at "${latest_tag}")
case ${1} in
"global")
cat<<EOF
deployment date="$(date '+%d-%m-%Y %Hh%M')"
deployment_timestamp=$(date '+%s')
user="$USER"
current commit (HEAD)="${current_commit}"
current_commit_timestamp=$(git log -1 --pretty=format:%ct)
latest tag(s) (current branch)="${tags_list}"
latest tag commit="${latest_tag_commit}"
current branch="$(git rev-parse --abbrev-ref HEAD)"
branches list="$(git describe --contains --all HEAD)"
git root directory="$(git rev-parse --show-toplevel)"
EOF
if ! git diff-index --quiet HEAD --; then
printf "unstaged changes=\"/etc/.git-ansible.diff\""
fi
if [ "${current_commit}" = "${latest_tag_commit}" ]; then
printf "\ncurrent_commit_tag=\"${latest_tag}\""
else
printf "\nlast tag was "$(git describe --tags | awk -F- '{print $2}')" commits ago =\""
printf "$(git log --pretty=format:" %h - %s" ${latest_tag}..HEAD)\""
fi
;;
"diff")
git diff
;;
*)
usage
printf "$err: Unknown argument ${1}"
exit 1;
;;
esac

14
kubespray/project/roles/kubernetes/preinstall/handlers/main.yml
View File

@@ -31,9 +31,9 @@
- name: Preinstall | kube-apiserver configured
stat:
path: "{{ kube_manifest_dir }}/kube-apiserver.yaml"
get_attributes: no
get_checksum: no
get_mime: no
get_attributes: false
get_checksum: false
get_mime: false
register: kube_apiserver_set
when: inventory_hostname in groups['kube_control_plane'] and dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'
listen: Preinstall | propagate resolvconf to k8s components
@@ -42,9 +42,9 @@
- name: Preinstall | kube-controller configured
stat:
path: "{{ kube_manifest_dir }}/kube-controller-manager.yaml"
get_attributes: no
get_checksum: no
get_mime: no
get_attributes: false
get_checksum: false
get_mime: false
register: kube_controller_set
when: inventory_hostname in groups['kube_control_plane'] and dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'
listen: Preinstall | propagate resolvconf to k8s components
@@ -109,7 +109,7 @@
- name: Preinstall | wait for the apiserver to be running
uri:
url: "{{ kube_apiserver_endpoint }}/healthz"
validate_certs: no
validate_certs: false
register: result
until: result.status == 200
retries: 60

6
kubespray/project/roles/kubernetes/preinstall/tasks/0010-swapoff.yml
View File

@@ -2,9 +2,9 @@
- name: Check if /etc/fstab exists
stat:
path: "/etc/fstab"
get_attributes: no
get_checksum: no
get_mime: no
get_attributes: false
get_checksum: false
get_mime: false
register: fstab_file
- name: Remove swapfile from /etc/fstab

106
kubespray/project/roles/kubernetes/preinstall/tasks/0020-set_facts.yml
View File

@@ -1,11 +1,4 @@
---
- name: Force binaries directory for Flatcar Container Linux by Kinvolk
set_fact:
bin_dir: "/opt/bin"
when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
tags:
- facts
- name: Set os_family fact for other redhat-based operating systems
set_fact:
ansible_os_family: "RedHat"
@@ -14,61 +7,33 @@
tags:
- facts
- name: Set os_family fact for other debian-based operating systems
set_fact:
ansible_os_family: "Debian"
when: ansible_distribution in debian_os_family_extensions
tags:
- facts
- name: Check if booted with ostree
stat:
path: /run/ostree-booted
get_attributes: no
get_checksum: no
get_mime: no
register: ostree
- name: Set is_fedora_coreos
lineinfile:
path: /etc/os-release
line: "VARIANT_ID=coreos"
state: present
check_mode: yes
register: os_variant_coreos
changed_when: false
- name: Set is_fedora_coreos
set_fact:
is_fedora_coreos: "{{ ostree.stat.exists and os_variant_coreos is not changed }}"
- name: Check resolvconf
command: which resolvconf
register: resolvconf
failed_when: false
changed_when: false
check_mode: no
check_mode: false
- name: Check existence of /etc/resolvconf/resolv.conf.d
stat:
path: /etc/resolvconf/resolv.conf.d
get_attributes: no
get_checksum: no
get_mime: no
get_attributes: false
get_checksum: false
get_mime: false
failed_when: false
register: resolvconfd_path
- name: Check status of /etc/resolv.conf
stat:
path: /etc/resolv.conf
follow: no
get_attributes: no
get_checksum: no
get_mime: no
follow: false
get_attributes: false
get_checksum: false
get_mime: false
failed_when: false
register: resolvconf_stat
- name: Fetch resolconf
- name: Fetch resolvconf
when: resolvconf_stat.stat.exists is defined and resolvconf_stat.stat.exists
block:
@@ -107,7 +72,7 @@
register: systemd_resolved_enabled
failed_when: false
changed_when: false
check_mode: no
check_mode: false
- name: Set default dns if remove_default_searchdomains is false
set_fact:
@@ -129,9 +94,9 @@
- name: Check if kubelet is configured
stat:
path: "{{ kube_config_dir }}/kubelet.env"
get_attributes: no
get_checksum: no
get_mime: no
get_attributes: false
get_checksum: false
get_mime: false
register: kubelet_configured
changed_when: false
@@ -156,9 +121,9 @@
- name: Check if /etc/dhclient.conf exists
stat:
path: /etc/dhclient.conf
get_attributes: no
get_checksum: no
get_mime: no
get_attributes: false
get_checksum: false
get_mime: false
register: dhclient_stat
- name: Target dhclient conf file for /etc/dhclient.conf
@@ -169,9 +134,9 @@
- name: Check if /etc/dhcp/dhclient.conf exists
stat:
path: /etc/dhcp/dhclient.conf
get_attributes: no
get_checksum: no
get_mime: no
get_attributes: false
get_checksum: false
get_mime: false
register: dhcp_dhclient_stat
- name: Target dhclient conf file for /etc/dhcp/dhclient.conf
@@ -220,8 +185,8 @@
set_fact:
nameserverentries: |-
{{ (([nodelocaldns_ip] if enable_nodelocaldns else []) + (coredns_server | d([]) if not enable_nodelocaldns else []) + nameservers | d([]) + cloud_resolver | d([]) + (configured_nameservers | d([]) if not disable_host_nameservers | d() | bool else [])) | unique | join(',') }}
supersede_nameserver:
supersede domain-name-servers {{ (([nodelocaldns_ip] if enable_nodelocaldns else []) + (coredns_server | d([]) if not enable_nodelocaldns else []) + nameservers | d([]) + cloud_resolver | d([]) + (configured_nameservers | d([]) if not disable_host_nameservers | d() | bool else [])) | unique | join(', ') }};
dhclient_supersede_nameserver_entries_list: |-
{{ (([nodelocaldns_ip] if enable_nodelocaldns else []) + (coredns_server | d([]) if not enable_nodelocaldns else []) + nameservers | d([]) + cloud_resolver | d([]) + (configured_nameservers | d([]) if not disable_host_nameservers | d() | bool else [])) | unique }}
when: not dns_early or dns_late
# This task should run instead of the above task when cluster/nodelocal DNS hasn't
@@ -230,23 +195,16 @@
set_fact:
nameserverentries: |-
{{ (nameservers | d([]) + cloud_resolver | d([]) + configured_nameservers | d([])) | unique | join(',') }}
supersede_nameserver:
supersede domain-name-servers {{ (nameservers | d([]) + cloud_resolver | d([])) | unique | join(', ') }};
dhclient_supersede_nameserver_entries_list: |-
{{ (nameservers | d([]) + cloud_resolver | d([])) | unique }}
when: dns_early and not dns_late
- name: Gather os specific variables
include_vars: "{{ item }}"
with_first_found:
- files:
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower | replace('/', '_') }}.yml"
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_release }}.yml"
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
- "{{ ansible_distribution | lower }}.yml"
- "{{ ansible_os_family | lower }}.yml"
- defaults.yml
paths:
- ../vars
skip: true
- name: Generate supersede_nameserver from dhclient_supersede_nameserver_entries_list
set_fact:
supersede_nameserver: |-
{%- if dhclient_supersede_nameserver_entries_list | length > 0 -%}
supersede domain-name-servers {{ dhclient_supersede_nameserver_entries_list | join(', ') }};
{%- endif -%}
- name: Set etcd vars if using kubeadm mode
set_fact:
@@ -260,9 +218,9 @@
- name: Check /usr readonly
stat:
path: "/usr"
get_attributes: no
get_checksum: no
get_mime: no
get_attributes: false
get_checksum: false
get_mime: false
register: usr
- name: Set alternate flexvolume path

40
kubespray/project/roles/kubernetes/preinstall/tasks/0040-verify-settings.yml
View File

@@ -1,10 +1,7 @@
---
- name: Stop if either kube_control_plane or kube_node group is empty
- name: Stop if kube_control_plane group is empty
assert:
that: "groups.get( item )"
with_items:
- kube_control_plane
- kube_node
that: groups.get( 'kube_control_plane' )
run_once: true
when: not ignore_assert_errors
@@ -47,7 +44,7 @@
assert:
that: item.value | type_debug == 'bool'
msg: "{{ item.value }} isn't a bool"
run_once: yes
run_once: true
with_items:
- { name: download_run_once, value: "{{ download_run_once }}" }
- { name: deploy_netchecker, value: "{{ deploy_netchecker }}" }
@@ -77,6 +74,13 @@
- not ignore_assert_errors
- inventory_hostname in groups['kube_node']
# This command will fail if cgroups are not enabled on the node.
# For reference: https://kubernetes.io/docs/concepts/architecture/cgroups/#check-cgroup-version
- name: Stop if cgroups are not enabled on nodes
command: stat -fc %T /sys/fs/cgroup/
changed_when: false
when: not ignore_assert_errors
# This assertion will fail on the safe side: One can indeed schedule more pods
# on a node than the CIDR-range has space for when additional pods use the host
# network namespace. It is impossible to ascertain the number of such pods at
@@ -168,21 +172,21 @@
that:
- kube_service_addresses | ansible.utils.ipaddr('net')
msg: "kube_service_addresses = '{{ kube_service_addresses }}' is not a valid network range"
run_once: yes
run_once: true
- name: "Check that kube_pods_subnet is a network range"
assert:
that:
- kube_pods_subnet | ansible.utils.ipaddr('net')
msg: "kube_pods_subnet = '{{ kube_pods_subnet }}' is not a valid network range"
run_once: yes
run_once: true
- name: "Check that kube_pods_subnet does not collide with kube_service_addresses"
assert:
that:
- kube_pods_subnet | ansible.utils.ipaddr(kube_service_addresses) | string == 'None'
msg: "kube_pods_subnet cannot be the same network segment as kube_service_addresses"
run_once: yes
run_once: true
- name: "Check that IP range is enough for the nodes"
assert:
@@ -190,7 +194,7 @@
- 2 ** (kube_network_node_prefix - kube_pods_subnet | ansible.utils.ipaddr('prefix')) >= groups['k8s_cluster'] | length
msg: "Not enough IPs are available for the desired node count."
when: kube_network_plugin != 'calico'
run_once: yes
run_once: true
- name: Stop if unknown dns mode
assert:
@@ -242,7 +246,7 @@
# TODO: Clean this task up when we drop backward compatibility support for `etcd_kubeadm_enabled`
- name: Stop if etcd deployment type is not host or kubeadm when container_manager != docker and etcd_kubeadm_enabled is not defined
run_once: yes
run_once: true
when: etcd_kubeadm_enabled is defined
block:
- name: Warn the user if they are still using `etcd_kubeadm_enabled`
@@ -288,7 +292,7 @@
assert:
that: containerd_version is version(containerd_min_version_required, '>=')
msg: "containerd_version is too low. Minimum version {{ containerd_min_version_required }}"
run_once: yes
run_once: true
when:
- containerd_version not in ['latest', 'edge', 'stable']
- container_manager == 'containerd'
@@ -316,3 +320,15 @@
when:
- kube_apiserver_enable_admission_plugins is defined
- kube_apiserver_enable_admission_plugins | length > 0
- name: Verify that the packages list structure is valid
ansible.utils.validate:
criteria: "{{ lookup('file', 'pkgs-schema.json') }}"
data: "{{ pkgs }}"
- name: Verify that the packages list is sorted
vars:
pkgs_lists: "{{ pkgs.keys() | list }}"
assert:
that: "pkgs_lists | sort == pkgs_lists"
fail_msg: "pkgs is not sorted: {{ pkgs_lists | ansible.utils.fact_diff(pkgs_lists | sort) }}"

16
kubespray/project/roles/kubernetes/preinstall/tasks/0050-create_directories.yml
View File

@@ -4,7 +4,7 @@
path: "{{ item }}"
state: directory
owner: "{{ kube_owner }}"
mode: 0755
mode: "0755"
when: inventory_hostname in groups['k8s_cluster']
become: true
tags:
@@ -28,7 +28,7 @@
path: "{{ item }}"
state: directory
owner: root
mode: 0755
mode: "0755"
when: inventory_hostname in groups['k8s_cluster']
become: true
tags:
@@ -48,9 +48,9 @@
- name: Check if kubernetes kubeadm compat cert dir exists
stat:
path: "{{ kube_cert_compat_dir }}"
get_attributes: no
get_checksum: no
get_mime: no
get_attributes: false
get_checksum: false
get_mime: false
register: kube_cert_compat_dir_check
when:
- inventory_hostname in groups['k8s_cluster']
@@ -61,7 +61,7 @@
src: "{{ kube_cert_dir }}"
dest: "{{ kube_cert_compat_dir }}"
state: link
mode: 0755
mode: "0755"
when:
- inventory_hostname in groups['k8s_cluster']
- kube_cert_dir != kube_cert_compat_dir
@@ -72,7 +72,7 @@
path: "{{ item }}"
state: directory
owner: "{{ kube_owner }}"
mode: 0755
mode: "0755"
with_items:
- "/etc/cni/net.d"
- "/opt/cni/bin"
@@ -93,7 +93,7 @@
path: "{{ item }}"
state: directory
owner: "{{ kube_owner }}"
mode: 0755
mode: "0755"
with_items:
- "/var/lib/calico"
when:

6
kubespray/project/roles/kubernetes/preinstall/tasks/0060-resolvconf.yml
View File

@@ -16,10 +16,10 @@
options ndots:{{ ndots }} timeout:{{ dns_timeout | default('2') }} attempts:{{ dns_attempts | default('2') }}
state: present
insertbefore: BOF
create: yes
create: true
backup: "{{ not resolvconf_stat.stat.islnk }}"
marker: "# Ansible entries {mark}"
mode: 0644
mode: "0644"
notify: Preinstall | propagate resolvconf to k8s components
- name: Remove search/domain/nameserver options before block
@@ -53,6 +53,6 @@
dest: "{{ resolveconf_cloud_init_conf }}"
src: resolvconf.j2
owner: root
mode: 0644
mode: "0644"
notify: Preinstall | update resolvconf for Flatcar Container Linux by Kinvolk
when: ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]

4
kubespray/project/roles/kubernetes/preinstall/tasks/0061-systemd-resolved.yml
View File

@@ -3,7 +3,7 @@
file:
state: directory
name: /etc/systemd/resolved.conf.d/
mode: 0755
mode: "0755"
- name: Write Kubespray DNS settings to systemd-resolved
template:
@@ -11,5 +11,5 @@
dest: /etc/systemd/resolved.conf.d/kubespray.conf
owner: root
group: root
mode: 0644
mode: "0644"
notify: Preinstall | Restart systemd-resolved

6
kubespray/project/roles/kubernetes/preinstall/tasks/0062-networkmanager-unmanaged-devices.yml
View File

@@ -3,7 +3,7 @@
file:
path: "/etc/NetworkManager/conf.d"
state: directory
recurse: yes
recurse: true
- name: NetworkManager | Prevent NetworkManager from managing Calico interfaces (cali*/tunl*/vxlan.calico)
copy:
@@ -11,7 +11,7 @@
[keyfile]
unmanaged-devices+=interface-name:cali*;interface-name:tunl*;interface-name:vxlan.calico;interface-name:vxlan-v6.calico
dest: /etc/NetworkManager/conf.d/calico.conf
mode: 0644
mode: "0644"
when:
- kube_network_plugin == "calico"
notify: Preinstall | reload NetworkManager
@@ -24,5 +24,5 @@
[keyfile]
unmanaged-devices+=interface-name:kube-ipvs0;interface-name:nodelocaldns
dest: /etc/NetworkManager/conf.d/k8s.conf
mode: 0644
mode: "0644"
notify: Preinstall | reload NetworkManager

6
kubespray/project/roles/kubernetes/preinstall/tasks/0063-networkmanager-dns.yml
View File

@@ -6,7 +6,7 @@
option: servers
value: "{{ nameserverentries }}"
mode: '0600'
backup: yes
backup: true
when:
- nameserverentries != "127.0.0.53" or systemd_resolved_enabled.rc != 0
notify: Preinstall | update resolvconf for networkmanager
@@ -23,7 +23,7 @@
option: searches
value: "{{ (default_searchdomains | default([]) + searchdomains | default([])) | join(',') }}"
mode: '0600'
backup: yes
backup: true
notify: Preinstall | update resolvconf for networkmanager
- name: NetworkManager | Add DNS options to NM configuration
@@ -33,5 +33,5 @@
option: options
value: "ndots:{{ ndots }},timeout:{{ dns_timeout | default('2') }},attempts:{{ dns_attempts | default('2') }}"
mode: '0600'
backup: yes
backup: true
notify: Preinstall | update resolvconf for networkmanager

50
kubespray/project/roles/kubernetes/preinstall/tasks/0070-system-packages.yml
View File

@@ -30,11 +30,11 @@
Pin-Priority: 1001
dest: "/etc/apt/preferences.d/libseccomp2"
owner: "root"
mode: 0644
mode: "0644"
- name: Update package management cache (APT)
apt:
update_cache: yes
update_cache: true
cache_valid_time: 3600
when: ansible_os_family == "Debian"
tags:
@@ -48,20 +48,6 @@
- ansible_os_family == "RedHat"
- not is_fedora_coreos
- name: Install python3-dnf for latest RedHat versions
command: dnf install -y python3-dnf
register: dnf_task_result
until: dnf_task_result is succeeded
retries: 4
delay: "{{ retry_stagger | random + 3 }}"
when:
- ansible_distribution == "Fedora"
- ansible_distribution_major_version | int >= 30
- not is_fedora_coreos
changed_when: False
tags:
- bootstrap-os
- name: Install epel-release on RHEL derivatives
package:
name: epel-release
@@ -73,27 +59,29 @@
tags:
- bootstrap-os
- name: Update common_required_pkgs with ipvsadm when kube_proxy_mode is ipvs
set_fact:
common_required_pkgs: "{{ common_required_pkgs | default([]) + ['ipvsadm', 'ipset'] }}"
when: kube_proxy_mode == 'ipvs'
- name: Install packages requirements
vars:
# The json_query for selecting packages name is split for readability
# see files/pkgs-schema.json for the structure of `pkgs`
# and the matching semantics
full_query: "[? value | (enabled == null || enabled) && ( {{ filters_os }} ) && ( {{ filters_groups }} ) ].key"
filters_groups: "groups | @ == null || [? contains(`{{ group_names }}`, @)]"
filters_os: "os == null || (os | ( {{ filters_family }} ) || ( {{ filters_distro }} ))"
dquote: !unsafe '"'
# necessary to workaround Ansible escaping
filters_distro: "distributions.{{ dquote }}{{ ansible_distribution }}{{ dquote }} |
@ == `{}` ||
contains(not_null(major_versions, `[]`), '{{ ansible_distribution_major_version }}') ||
contains(not_null(versions, `[]`), '{{ ansible_distribution_version }}') ||
contains(not_null(releases, `[]`), '{{ ansible_distribution_release }}')"
filters_family: "families && contains(families, '{{ ansible_os_family }}')"
package:
name: "{{ required_pkgs | default([]) | union(common_required_pkgs | default([])) }}"
name: "{{ pkgs | dict2items | to_json|from_json | community.general.json_query(full_query) }}"
state: present
register: pkgs_task_result
until: pkgs_task_result is succeeded
retries: "{{ pkg_install_retries }}"
delay: "{{ retry_stagger | random + 3 }}"
when: not (ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk", "ClearLinux"] or is_fedora_coreos)
when: not (ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"] or is_fedora_coreos)
tags:
- bootstrap-os
- name: Install ipvsadm for ClearLinux
package:
name: ipvsadm
state: present
when:
- ansible_os_family in ["ClearLinux"]
- kube_proxy_mode == 'ipvs'

40
kubespray/project/roles/kubernetes/preinstall/tasks/0080-system-configurations.yml
View File

@@ -3,9 +3,9 @@
- name: Confirm selinux deployed
stat:
path: /etc/selinux/config
get_attributes: no
get_checksum: no
get_mime: no
get_attributes: false
get_checksum: false
get_mime: false
when:
- ansible_os_family == "RedHat"
- "'Amazon' not in ansible_distribution"
@@ -27,9 +27,9 @@
dest: /etc/gai.conf
line: "precedence ::ffff:0:0/96 100"
state: present
create: yes
backup: yes
mode: 0644
create: true
backup: true
mode: "0644"
when:
- disable_ipv6_dns
- not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
@@ -47,9 +47,9 @@
- name: Stat sysctl file configuration
stat:
path: "{{ sysctl_file_path }}"
get_attributes: no
get_checksum: no
get_mime: no
get_attributes: false
get_checksum: false
get_mime: false
register: sysctl_file_stat
tags:
- bootstrap-os
@@ -67,7 +67,7 @@
file:
name: "{{ sysctl_file_path | dirname }}"
state: directory
mode: 0755
mode: "0755"
- name: Enable ip forwarding
ansible.posix.sysctl:
@@ -75,7 +75,7 @@
name: net.ipv4.ip_forward
value: "1"
state: present
reload: yes
reload: true
- name: Enable ipv6 forwarding
ansible.posix.sysctl:
@@ -83,15 +83,15 @@
name: net.ipv6.conf.all.forwarding
value: "1"
state: present
reload: yes
reload: true
when: enable_dual_stack_networks | bool
- name: Check if we need to set fs.may_detach_mounts
stat:
path: /proc/sys/fs/may_detach_mounts
get_attributes: no
get_checksum: no
get_mime: no
get_attributes: false
get_checksum: false
get_mime: false
register: fs_may_detach_mounts
ignore_errors: true # noqa ignore-errors
@@ -101,16 +101,16 @@
name: fs.may_detach_mounts
value: 1
state: present
reload: yes
reload: true
when: fs_may_detach_mounts.stat.exists | d(false)
- name: Ensure kube-bench parameters are set
- name: Ensure kubelet expected parameters are set
ansible.posix.sysctl:
sysctl_file: "{{ sysctl_file_path }}"
name: "{{ item.name }}"
value: "{{ item.value }}"
state: present
reload: yes
reload: true
with_items:
- { name: kernel.keys.root_maxbytes, value: 25000000 }
- { name: kernel.keys.root_maxkeys, value: 1000000 }
@@ -133,12 +133,12 @@
name: "{{ item.name }}"
value: "{{ item.value }}"
state: present
reload: yes
reload: true
with_items: "{{ additional_sysctl }}"
- name: Disable fapolicyd service
failed_when: false
systemd:
systemd_service:
name: fapolicyd
state: stopped
enabled: false

2
kubespray/project/roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml
View File

@@ -40,7 +40,7 @@
template:
src: "{{ ntp_config_file | basename }}.j2"
dest: "{{ ntp_config_file }}"
mode: 0644
mode: "0644"
notify: Preinstall | restart ntp
when:
- ntp_manage_config

20
kubespray/project/roles/kubernetes/preinstall/tasks/0090-etchosts.yml
View File

@@ -11,19 +11,19 @@
{% endfor %}
delegate_to: localhost
connection: local
delegate_facts: yes
run_once: yes
delegate_facts: true
run_once: true
- name: Hosts | populate inventory into hosts file
blockinfile:
path: /etc/hosts
block: "{{ hostvars.localhost.etc_hosts_inventory_block }}"
state: "{{ 'present' if populate_inventory_to_hosts_file else 'absent' }}"
create: yes
backup: yes
unsafe_writes: yes
create: true
backup: true
unsafe_writes: true
marker: "# Ansible inventory hosts {mark}"
mode: 0644
mode: "0644"
- name: Hosts | populate kubernetes loadbalancer address into hosts file
lineinfile:
@@ -31,8 +31,8 @@
regexp: ".*{{ apiserver_loadbalancer_domain_name }}$"
line: "{{ loadbalancer_apiserver.address }} {{ apiserver_loadbalancer_domain_name }}"
state: present
backup: yes
unsafe_writes: yes
backup: true
unsafe_writes: true
when:
- populate_loadbalancer_apiserver_to_hosts_file
- loadbalancer_apiserver is defined
@@ -69,8 +69,8 @@
line: "{{ item.key }} {{ item.value | join(' ') }}"
regexp: "^{{ item.key }}.*$"
state: present
backup: yes
unsafe_writes: yes
backup: true
unsafe_writes: true
loop: "{{ etc_hosts_localhosts_dict_target | default({}) | dict2items }}"
# gather facts to update ansible_fqdn

12
kubespray/project/roles/kubernetes/preinstall/tasks/0100-dhclient-hooks.yml
View File

@@ -2,16 +2,16 @@
- name: Configure dhclient to supersede search/domain/nameservers
blockinfile:
block: |-
{% for item in [supersede_domain, supersede_search, supersede_nameserver] -%}
{% for item in [supersede_domain, supersede_search, supersede_nameserver] | reject('equalto', '') -%}
{{ item }}
{% endfor %}
path: "{{ dhclientconffile }}"
create: yes
create: true
state: present
insertbefore: BOF
backup: yes
backup: true
marker: "# Ansible entries {mark}"
mode: 0644
mode: "0644"
notify: Preinstall | propagate resolvconf to k8s components
- name: Configure dhclient hooks for resolv.conf (non-RH)
@@ -19,7 +19,7 @@
src: dhclient_dnsupdate.sh.j2
dest: "{{ dhclienthookfile }}"
owner: root
mode: 0755
mode: "0755"
notify: Preinstall | propagate resolvconf to k8s components
when: ansible_os_family not in [ "RedHat", "Suse" ]
@@ -28,6 +28,6 @@
src: dhclient_dnsupdate_rh.sh.j2
dest: "{{ dhclienthookfile }}"
owner: root
mode: 0755
mode: "0755"
notify: Preinstall | propagate resolvconf to k8s components
when: ansible_os_family == "RedHat"

2
kubespray/project/roles/kubernetes/preinstall/tasks/0110-dhclient-hooks-undo.yml
View File

@@ -7,7 +7,7 @@
blockinfile:
path: "{{ dhclientconffile }}"
state: absent
backup: yes
backup: true
marker: "# Ansible entries {mark}"
notify: Preinstall | propagate resolvconf to k8s components

44
kubespray/project/roles/kubernetes/preinstall/tasks/0120-growpart-azure-centos-7.yml
View File

@@ -1,44 +0,0 @@
---
# Running growpart seems to be only required on Azure, as other Cloud Providers do this at boot time
- name: Install growpart
package:
name: cloud-utils-growpart
state: present
- name: Gather mounts facts
setup:
gather_subset: 'mounts'
- name: Search root filesystem device
vars:
query: "[?mount=='/'].device"
_root_device: "{{ ansible_mounts | json_query(query) }}"
set_fact:
device: "{{ _root_device | first | regex_replace('([^0-9]+)[0-9]+', '\\1') }}"
partition: "{{ _root_device | first | regex_replace('[^0-9]+([0-9]+)', '\\1') }}"
root_device: "{{ _root_device }}"
- name: Check if growpart needs to be run
command: growpart -N {{ device }} {{ partition }}
failed_when: False
changed_when: "'NOCHANGE:' not in growpart_needed.stdout"
register: growpart_needed
environment:
LC_ALL: C
- name: Check fs type
command: file -Ls {{ root_device }}
changed_when: False
register: fs_type
- name: Run growpart # noqa no-handler
command: growpart {{ device }} {{ partition }}
when: growpart_needed.changed
environment:
LC_ALL: C
- name: Run xfs_growfs # noqa no-handler
command: xfs_growfs {{ root_device }}
when: growpart_needed.changed and 'XFS' in fs_type.stdout

17
kubespray/project/roles/kubernetes/preinstall/tasks/main.yml
View File

@@ -68,6 +68,7 @@
- not dns_late
tags:
- bootstrap-os
- system-packages
- name: Apply system configurations
import_tasks: 0080-system-configurations.yml
@@ -120,25 +121,15 @@
- name: Check if we are running inside a Azure VM
stat:
path: /var/lib/waagent/
get_attributes: no
get_checksum: no
get_mime: no
get_attributes: false
get_checksum: false
get_mime: false
register: azure_check
when:
- not dns_late
tags:
- bootstrap-os
- name: Grow partition on azure CentOS
import_tasks: 0120-growpart-azure-centos-7.yml
when:
- not dns_late
- azure_check.stat.exists
- ansible_os_family == "RedHat"
- growpart_azure_enabled
tags:
- bootstrap-os
- name: Run calico checks
include_role:
name: network_plugin/calico

7
kubespray/project/roles/kubernetes/preinstall/templates/ntp.conf.j2
View File

@@ -35,6 +35,13 @@ restrict -6 default kod notrap nomodify nopeer noquery limited
restrict {{ item }}
{% endfor %}
# Needed for filtering interfaces
{% if ntp_filter_interface %}
{% for item in ntp_interfaces %}
interface {{ item }}
{% endfor %}
{% endif %}
# Needed for adding pool entries
restrict source notrap nomodify noquery

7
kubespray/project/roles/kubernetes/preinstall/vars/amazon.yml
View File

@@ -1,7 +0,0 @@
---
required_pkgs:
- libselinux-python
- device-mapper-libs
- nss
- conntrack-tools
- libseccomp

8
kubespray/project/roles/kubernetes/preinstall/vars/centos.yml
View File

@@ -1,8 +0,0 @@
---
required_pkgs:
- "{{ ((ansible_distribution_major_version | int) < 8) | ternary('libselinux-python', 'python3-libselinux') }}"
- device-mapper-libs
- nss
- conntrack
- container-selinux
- libseccomp

10
kubespray/project/roles/kubernetes/preinstall/vars/debian-11.yml
View File

@@ -1,10 +0,0 @@
---
required_pkgs:
- python3-apt
- gnupg
- apt-transport-https
- software-properties-common
- conntrack
- iptables
- apparmor
- libseccomp2

11
kubespray/project/roles/kubernetes/preinstall/vars/debian-12.yml
View File

@@ -1,11 +0,0 @@
---
required_pkgs:
- python3-apt
- gnupg
- apt-transport-https
- software-properties-common
- conntrack
- iptables
- apparmor
- libseccomp2
- mergerfs

9
kubespray/project/roles/kubernetes/preinstall/vars/debian.yml
View File

@@ -1,9 +0,0 @@
---
required_pkgs:
- python-apt
- aufs-tools
- apt-transport-https
- software-properties-common
- conntrack
- apparmor
- libseccomp2

8
kubespray/project/roles/kubernetes/preinstall/vars/fedora.yml
View File

@@ -1,8 +0,0 @@
---
required_pkgs:
- iptables
- libselinux-python3
- device-mapper-libs
- conntrack
- container-selinux
- libseccomp

103
kubespray/project/roles/kubernetes/preinstall/vars/main.yml Normal file
View File

@@ -0,0 +1,103 @@
---
pkgs:
apparmor: &debian_family_base
os:
families:
- Debian
apt-transport-https: *debian_family_base
aufs-tools: &deb_10
groups:
- k8s_cluster
os:
distributions:
Debian:
major_versions:
- "10"
bash-completion: {}
conntrack: &deb_redhat
groups:
- k8s_cluster
os:
families:
- Debian
- RedHat
conntrack-tools:
groups:
- k8s_cluster
os:
families:
- Suse
distributions:
Amazon: {}
container-selinux: &redhat_family
groups:
- k8s_cluster
os:
families:
- RedHat
curl: {}
device-mapper:
groups:
- k8s_cluster
os:
families:
- Suse
device-mapper-libs: *redhat_family
e2fsprogs: {}
ebtables: {}
gnupg: &debian
groups:
- k8s_cluster
os:
distributions:
Debian:
major_versions:
- "11"
- "12"
ipset:
enabled: "{{ kube_proxy_mode != 'ipvs' }}"
groups:
- k8s_cluster
iptables: *deb_redhat
ipvsadm:
enabled: "{{ kube_proxy_mode == 'ipvs' }}"
groups:
- k8s_cluster
libseccomp: *redhat_family
libseccomp2:
groups:
- k8s_cluster
os:
families:
- Suse
- Debian
libselinux-python: # TODO: Handle rehat_family + major < 8
os:
distributions:
Amazon: {}
libselinux-python3:
os:
distributions:
Fedora: {}
mergerfs:
os:
distributions:
Debian:
major_versions:
- "12"
nss: *redhat_family
openssl: {}
python-apt: *deb_10
# TODO: not for debian 10
python3-apt: *debian_family_base
python3-libselinux:
os:
distributions:
RedHat: {}
CentOS: {}
rsync: {}
socat: {}
software-properties-common: *debian_family_base
tar: {}
unzip: {}
xfsprogs: {}

8
kubespray/project/roles/kubernetes/preinstall/vars/redhat.yml
View File

@@ -1,8 +0,0 @@
---
required_pkgs:
- "{{ ((ansible_distribution_major_version | int) < 8) | ternary('libselinux-python', 'python3-libselinux') }}"
- device-mapper-libs
- nss
- conntrack
- container-selinux
- libseccomp

5
kubespray/project/roles/kubernetes/preinstall/vars/suse.yml
View File

@@ -1,5 +0,0 @@
---
required_pkgs:
- device-mapper
- conntrack-tools
- libseccomp2

8
kubespray/project/roles/kubernetes/preinstall/vars/ubuntu.yml
View File

@@ -1,8 +0,0 @@
---
required_pkgs:
- python3-apt
- apt-transport-https
- software-properties-common
- conntrack
- apparmor
- libseccomp2