gstykalin/kube-forge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update to latest 2.26.0 kubespray version and add dns zones settings to coredns

Browse Source
This commit is contained in:
George Stykalin
2024-12-14 21:56:19 +03:00
parent be9c8a28fd
commit 4294f52703
368 changed files with 37761 additions and 2942 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
kubespray/project/roles/network_plugin/calico/rr/tasks/pre.yml
View File

@@ -3,7 +3,7 @@
service:
name: calico-rr
state: stopped
enabled: no
enabled: false
failed_when: false
- name: Calico-rr | Delete obsolete files

8
kubespray/project/roles/network_plugin/calico/tasks/calico_apiserver_certs.yml
View File

@@ -9,7 +9,7 @@
template:
src: "calico-apiserver-ns.yml.j2"
dest: "{{ kube_config_dir }}/calico-apiserver-ns.yml"
mode: 0644
mode: "0644"
- name: Calico | Apply ns manifests
kube:
@@ -21,21 +21,21 @@
file:
path: /etc/calico/certs
state: directory
mode: 0755
mode: "0755"
when: calico_apiserver_secret.rc != 0
- name: Calico | Copy ssl script for apiserver certs
template:
src: make-ssl-calico.sh.j2
dest: "{{ bin_dir }}/make-ssl-apiserver.sh"
mode: 0755
mode: "0755"
when: calico_apiserver_secret.rc != 0
- name: Calico | Copy ssl config for apiserver certs
copy:
src: openssl.conf
dest: /etc/calico/certs/openssl.conf
mode: 0644
mode: "0644"
when: calico_apiserver_secret.rc != 0
- name: Calico | Generate apiserver certs

55
kubespray/project/roles/network_plugin/calico/tasks/check.yml
View File

@@ -4,7 +4,7 @@
that:
- ipip is not defined
msg: "'ipip' configuration variable is deprecated, please configure your inventory with 'calico_ipip_mode' set to 'Always' or 'CrossSubnet' according to your specific needs"
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
- name: Stop if legacy encapsulation variables are detected (ipip_mode)
@@ -12,7 +12,7 @@
that:
- ipip_mode is not defined
msg: "'ipip_mode' configuration variable is deprecated, please configure your inventory with 'calico_ipip_mode' set to 'Always' or 'CrossSubnet' according to your specific needs"
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
- name: Stop if legacy encapsulation variables are detected (calcio_ipam_autoallocateblocks)
@@ -20,7 +20,7 @@
that:
- calcio_ipam_autoallocateblocks is not defined
msg: "'calcio_ipam_autoallocateblocks' configuration variable is deprecated, it's a typo, please configure your inventory with 'calico_ipam_autoallocateblocks' set to 'true' or 'false' according to your specific needs"
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
@@ -32,7 +32,7 @@
msg: "When using cloud_provider azure and network_plugin calico calico_ipip_mode must be 'Never' and calico_vxlan_mode 'Always' or 'CrossSubnet'"
when:
- cloud_provider is defined and cloud_provider == 'azure'
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
- name: Stop if supported Calico versions
@@ -40,21 +40,21 @@
that:
- "calico_version in calico_crds_archive_checksums.keys()"
msg: "Calico version not supported {{ calico_version }} not in {{ calico_crds_archive_checksums.keys() }}"
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
- name: Check if calicoctl.sh exists
stat:
path: "{{ bin_dir }}/calicoctl.sh"
register: calicoctl_sh_exists
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
- name: Check if calico ready
command: "{{ bin_dir }}/calicoctl.sh get ClusterInformation default"
register: calico_ready
run_once: True
ignore_errors: True
run_once: true
ignore_errors: true
retries: 5
delay: 10
until: calico_ready.rc == 0
@@ -62,7 +62,7 @@
when: calicoctl_sh_exists.stat.exists
- name: Check that current calico version is enough for upgrade
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
when: calicoctl_sh_exists.stat.exists and calico_ready.rc == 0
block:
@@ -82,15 +82,16 @@
Minimum version is {{ calico_min_version_required }} supported by the previous kubespray release.
But current version is {{ calico_version_on_server.stdout }}.
- name: "Check that cluster_id is set if calico_rr enabled"
- name: "Check that cluster_id is set and a valid IPv4 address if calico_rr enabled"
assert:
that:
- cluster_id is defined
msg: "A unique cluster_id is required if using calico_rr"
- cluster_id is ansible.utils.ipv4
msg: "A unique cluster_id is required if using calico_rr, and it must be a valid IPv4 address"
when:
- peer_with_calico_rr
- inventory_hostname == groups['kube_control_plane'][0]
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
- name: "Check that calico_rr nodes are in k8s_cluster group"
@@ -100,7 +101,7 @@
msg: "calico_rr must be a child group of k8s_cluster group"
when:
- '"calico_rr" in group_names'
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
- name: "Check vars defined correctly"
@@ -109,7 +110,7 @@
- "calico_pool_name is defined"
- "calico_pool_name is match('^[a-zA-Z0-9-_\\\\.]{2,63}$')"
msg: "calico_pool_name contains invalid characters"
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
- name: "Check calico network backend defined correctly"
@@ -117,11 +118,11 @@
that:
- "calico_network_backend in ['bird', 'vxlan', 'none']"
msg: "calico network backend is not 'bird', 'vxlan' or 'none'"
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
- name: "Check ipip and vxlan mode defined correctly"
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
assert:
that:
@@ -136,7 +137,7 @@
msg: "IP in IP and VXLAN mode is mutualy exclusive modes"
when:
- "calico_ipip_mode in ['Always', 'CrossSubnet']"
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
- name: "Check ipip and vxlan mode if simultaneously enabled"
@@ -146,23 +147,23 @@
msg: "IP in IP and VXLAN mode is mutualy exclusive modes"
when:
- "calico_vxlan_mode in ['Always', 'CrossSubnet']"
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
- name: "Get Calico {{ calico_pool_name }} configuration"
command: "{{ bin_dir }}/calicoctl.sh get ipPool {{ calico_pool_name }} -o json"
failed_when: False
changed_when: False
check_mode: no
failed_when: false
changed_when: false
check_mode: false
register: calico
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
- name: "Set calico_pool_conf"
set_fact:
calico_pool_conf: '{{ calico.stdout | from_json }}'
when: calico.rc == 0 and calico.stdout
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
- name: "Check if inventory match current cluster configuration"
@@ -175,7 +176,7 @@
msg: "Your inventory doesn't match the current cluster configuration"
when:
- calico_pool_conf is defined
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
- name: "Check kdd calico_datastore if calico_apiserver_enabled"
@@ -184,7 +185,7 @@
msg: "When using calico apiserver you need to use the kubernetes datastore"
when:
- calico_apiserver_enabled
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
- name: "Check kdd calico_datastore if typha_enabled"
@@ -193,7 +194,7 @@
msg: "When using typha you need to use the kubernetes datastore"
when:
- typha_enabled
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"
- name: "Check ipip mode is Never for calico ipv6"
@@ -203,5 +204,5 @@
msg: "Calico doesn't support ipip tunneling for the IPv6"
when:
- enable_dual_stack_networks
run_once: True
run_once: true
delegate_to: "{{ groups['kube_control_plane'][0] }}"

54
kubespray/project/roles/network_plugin/calico/tasks/install.yml
View File

@@ -13,14 +13,14 @@
copy:
src: "{{ downloads.calicoctl.dest }}"
dest: "{{ bin_dir }}/calicoctl"
mode: 0755
remote_src: yes
mode: "0755"
remote_src: true
- name: Calico | Create calico certs directory
file:
dest: "{{ calico_cert_dir }}"
state: directory
mode: 0750
mode: "0750"
owner: root
group: root
when: calico_datastore == "etcd"
@@ -30,8 +30,8 @@
src: "{{ etcd_cert_dir }}/{{ item.s }}"
dest: "{{ calico_cert_dir }}/{{ item.d }}"
state: hard
mode: 0640
force: yes
mode: "0640"
force: true
with_items:
- {s: "{{ kube_etcd_cacert_file }}", d: "ca_cert.crt"}
- {s: "{{ kube_etcd_cert_file }}", d: "cert.crt"}
@@ -54,14 +54,14 @@
template:
src: "calicoctl.{{ calico_datastore }}.sh.j2"
dest: "{{ bin_dir }}/calicoctl.sh"
mode: 0755
mode: "0755"
owner: root
group: root
- name: Calico | wait for etcd
uri:
url: "{{ etcd_access_addresses.split(',') | first }}/health"
validate_certs: no
validate_certs: false
client_cert: "{{ calico_cert_dir }}/cert.crt"
client_key: "{{ calico_cert_dir }}/key.pem"
register: result
@@ -142,7 +142,7 @@
assemble:
src: "{{ calico_kdd_path }}"
dest: "{{ kube_config_dir }}/kdd-crds.yml"
mode: 0644
mode: "0644"
delimiter: "---\n"
regexp: ".*\\.yaml"
remote_src: true
@@ -165,8 +165,8 @@
- name: Calico | Get existing FelixConfiguration
command: "{{ bin_dir }}/calicoctl.sh get felixconfig default -o json"
register: _felix_cmd
ignore_errors: True
changed_when: False
ignore_errors: true
changed_when: false
- name: Calico | Set kubespray FelixConfiguration
set_fact:
@@ -201,7 +201,7 @@
command:
cmd: "{{ bin_dir }}/calicoctl.sh apply -f -"
stdin: "{{ _felix_config is string | ternary(_felix_config, _felix_config | to_json) }}"
changed_when: False
changed_when: false
- name: Calico | Configure Calico IP Pool
when:
@@ -210,8 +210,8 @@
- name: Calico | Get existing calico network pool
command: "{{ bin_dir }}/calicoctl.sh get ippool {{ calico_pool_name }} -o json"
register: _calico_pool_cmd
ignore_errors: True
changed_when: False
ignore_errors: true
changed_when: false
- name: Calico | Set kubespray calico network pool
set_fact:
@@ -251,7 +251,7 @@
command:
cmd: "{{ bin_dir }}/calicoctl.sh apply -f -"
stdin: "{{ _calico_pool is string | ternary(_calico_pool, _calico_pool | to_json) }}"
changed_when: False
changed_when: false
- name: Calico | Configure Calico IPv6 Pool
when:
@@ -261,8 +261,8 @@
- name: Calico | Get existing calico ipv6 network pool
command: "{{ bin_dir }}/calicoctl.sh get ippool {{ calico_pool_name }}-ipv6 -o json"
register: _calico_pool_ipv6_cmd
ignore_errors: True
changed_when: False
ignore_errors: true
changed_when: false
- name: Calico | Set kubespray calico network pool
set_fact:
@@ -302,19 +302,19 @@
command:
cmd: "{{ bin_dir }}/calicoctl.sh apply -f -"
stdin: "{{ _calico_pool_ipv6 is string | ternary(_calico_pool_ipv6, _calico_pool_ipv6 | to_json) }}"
changed_when: False
changed_when: false
- name: Populate Service External IPs
set_fact:
_service_external_ips: "{{ _service_external_ips | default([]) + [{'cidr': item}] }}"
with_items: "{{ calico_advertise_service_external_ips }}"
run_once: yes
run_once: true
- name: Populate Service LoadBalancer IPs
set_fact:
_service_loadbalancer_ips: "{{ _service_loadbalancer_ips | default([]) + [{'cidr': item}] }}"
with_items: "{{ calico_advertise_service_loadbalancer_ips }}"
run_once: yes
run_once: true
- name: "Determine nodeToNodeMesh needed state"
set_fact:
@@ -322,7 +322,7 @@
when:
- peer_with_router | default(false) or peer_with_calico_rr | default(false)
- inventory_hostname in groups['k8s_cluster']
run_once: yes
run_once: true
- name: Calico | Configure Calico BGP
when:
@@ -331,8 +331,8 @@
- name: Calico | Get existing BGP Configuration
command: "{{ bin_dir }}/calicoctl.sh get bgpconfig default -o json"
register: _bgp_config_cmd
ignore_errors: True
changed_when: False
ignore_errors: true
changed_when: false
- name: Calico | Set kubespray BGP Configuration
set_fact:
@@ -366,13 +366,13 @@
command:
cmd: "{{ bin_dir }}/calicoctl.sh apply -f -"
stdin: "{{ _bgp_config is string | ternary(_bgp_config, _bgp_config | to_json) }}"
changed_when: False
changed_when: false
- name: Calico | Create calico manifests
template:
src: "{{ item.file }}.j2"
dest: "{{ kube_config_dir }}/{{ item.file }}"
mode: 0644
mode: "0644"
with_items:
- {name: calico-config, file: calico-config.yml, type: cm}
- {name: calico-node, file: calico-node.yml, type: ds}
@@ -389,7 +389,7 @@
template:
src: "{{ item.file }}.j2"
dest: "{{ kube_config_dir }}/{{ item.file }}"
mode: 0644
mode: "0644"
with_items:
- {name: calico, file: calico-typha.yml, type: typha}
register: calico_node_typha_manifest
@@ -416,7 +416,7 @@
template:
src: "{{ item.file }}.j2"
dest: "{{ kube_config_dir }}/{{ item.file }}"
mode: 0644
mode: "0644"
with_items:
- {name: calico, file: calico-apiserver.yml, type: calico-apiserver}
register: calico_apiserver_manifest
@@ -469,7 +469,7 @@
template:
src: "{{ item.file }}.j2"
dest: "{{ kube_config_dir }}/{{ item.file }}"
mode: 0644
mode: "0644"
with_items:
- {name: calico, file: calico-ipamconfig.yml, type: ipam}
when:

40
kubespray/project/roles/network_plugin/calico/tasks/peer_with_router.yml
View File

@@ -19,10 +19,42 @@
until: output.rc == 0
delay: "{{ retry_stagger | random + 3 }}"
with_items:
- "{{ peers | selectattr('scope', 'defined') | selectattr('scope', 'equalto', 'global') | list | default([]) }}"
- "{{ peers | default([]) | selectattr('scope', 'defined') | selectattr('scope', 'equalto', 'global') | list }}"
when:
- inventory_hostname == groups['kube_control_plane'][0]
- name: Calico | Get node for per node peering
command:
cmd: "{{ bin_dir }}/calicoctl.sh get node {{ inventory_hostname }}"
register: output_get_node
when:
- inventory_hostname in groups['k8s_cluster']
- local_as is defined
- groups['calico_rr'] | default([]) | length == 0
delegate_to: "{{ groups['kube_control_plane'][0] }}"
- name: Calico | Patch node asNumber for per node peering
command:
cmd: |-
{{ bin_dir }}/calicoctl.sh patch node "{{ inventory_hostname }}" --patch '{{ patch is string | ternary(patch, patch | to_json) }}'
vars:
patch: >
{"spec": {
"bgp": {
"asNumber": "{{ local_as }}"
},
"orchRefs": [{"nodeName": "{{ inventory_hostname }}", "orchestrator": "k8s"}]
}}
register: output
retries: 0
until: output.rc == 0
delay: "{{ retry_stagger | random + 3 }}"
when:
- inventory_hostname in groups['k8s_cluster']
- local_as is defined
- groups['calico_rr'] | default([]) | length == 0
- output_get_node.rc == 0
- name: Calico | Configure node asNumber for per node peering
command:
cmd: "{{ bin_dir }}/calicoctl.sh apply -f -"
@@ -48,6 +80,7 @@
- inventory_hostname in groups['k8s_cluster']
- local_as is defined
- groups['calico_rr'] | default([]) | length == 0
- output_get_node.rc != 0
- name: Calico | Configure peering with router(s) at node scope
command:
@@ -64,6 +97,9 @@
"asNumber": "{{ item.as }}",
"node": "{{ inventory_hostname }}",
"peerIP": "{{ item.router_id }}",
{% if calico_version is version('v3.26.0', '>=') and (item.filters | default([]) | length > 0) %}
"filters": {{ item.filters }},
{% endif %}
"sourceAddress": "{{ item.sourceaddress | default('UseNodeIP') }}"
}}
register: output
@@ -71,7 +107,7 @@
until: output.rc == 0
delay: "{{ retry_stagger | random + 3 }}"
with_items:
- "{{ peers | selectattr('scope', 'undefined') | list | default([]) | union(peers | selectattr('scope', 'defined') | selectattr('scope', 'equalto', 'node') | list | default([])) }}"
- "{{ peers | default([]) | selectattr('scope', 'undefined') | list | union(peers | default([]) | selectattr('scope', 'defined') | selectattr('scope', 'equalto', 'node') | list ) }}"
delegate_to: "{{ groups['kube_control_plane'][0] }}"
when:
- inventory_hostname in groups['k8s_cluster']

8
kubespray/project/roles/network_plugin/calico/tasks/repos.yml
View File

@@ -10,11 +10,11 @@
file: _copr:copr.fedorainfracloud.org:jdoss:wireguard
description: Copr repo for wireguard owned by jdoss
baseurl: "{{ calico_wireguard_repo }}"
gpgcheck: yes
gpgcheck: true
gpgkey: https://download.copr.fedorainfracloud.org/results/jdoss/wireguard/pubkey.gpg
skip_if_unavailable: yes
enabled: yes
repo_gpgcheck: no
skip_if_unavailable: true
enabled: true
repo_gpgcheck: false
when:
- ansible_os_family in ['RedHat']
- ansible_distribution not in ['Fedora']

12
kubespray/project/roles/network_plugin/calico/tasks/reset.yml
View File

@@ -2,9 +2,9 @@
- name: Reset | check vxlan.calico network device
stat:
path: /sys/class/net/vxlan.calico
get_attributes: no
get_checksum: no
get_mime: no
get_attributes: false
get_checksum: false
get_mime: false
register: vxlan
- name: Reset | remove the network vxlan.calico device created by calico
@@ -14,9 +14,9 @@
- name: Reset | check dummy0 network device
stat:
path: /sys/class/net/dummy0
get_attributes: no
get_checksum: no
get_mime: no
get_attributes: false
get_checksum: false
get_mime: false
register: dummy0
- name: Reset | remove the network device created by calico

7
kubespray/project/roles/network_plugin/calico/tasks/typha_certs.yml
View File

@@ -9,21 +9,22 @@
file:
path: /etc/calico/certs
state: directory
mode: 0755
mode: "0755"
when: typha_server_secret.rc != 0
- name: Calico | Copy ssl script for typha certs
template:
src: make-ssl-calico.sh.j2
dest: "{{ bin_dir }}/make-ssl-typha.sh"
mode: 0755
mode: "0755"
when: typha_server_secret.rc != 0
- name: Calico | Copy ssl config for typha certs
copy:
src: openssl.conf
dest: /etc/calico/certs/openssl.conf
mode: 0644
mode: "0644"
when: typha_server_secret.rc != 0
- name: Calico | Generate typha certs

22
kubespray/project/roles/network_plugin/calico/templates/calico-apiserver.yml.j2
View File

@@ -72,6 +72,15 @@ spec:
initialDelaySeconds: 90
periodSeconds: 10
name: calico-apiserver
{% if calico_version is version('v3.28.0', '>=') %}
readinessProbe:
httpGet:
path: /readyz
port: 5443
scheme: HTTPS
timeoutSeconds: 5
periodSeconds: 60
{% else %}
readinessProbe:
exec:
command:
@@ -79,6 +88,7 @@ spec:
failureThreshold: 5
initialDelaySeconds: 5
periodSeconds: 10
{% endif %}
securityContext:
privileged: false
runAsUser: 0
@@ -157,6 +167,7 @@ rules:
- networksets
- bgpconfigurations
- bgppeers
- bgpfilters
- felixconfigurations
- kubecontrollersconfigurations
- ippools
@@ -172,7 +183,16 @@ rules:
- create
- update
- delete
{% if calico_version is version('v3.28.0', '>=') %}
- apiGroups:
- policy
resourceNames:
- calico-apiserver
resources:
- podsecuritypolicies
verbs:
- use
{% endif %}
---
apiVersion: rbac.authorization.k8s.io/v1

1
kubespray/project/roles/network_plugin/calico/templates/calico-config.yml.j2
View File

@@ -102,4 +102,3 @@ data:
}
]
}

5
kubespray/project/roles/network_plugin/calico/templates/calico-cr.yml.j2
View File

@@ -16,6 +16,11 @@ rules:
- pods/status
verbs:
- patch
- apiGroups: [""]
resources:
- nodes/status
verbs:
- update
- apiGroups: ["crd.projectcalico.org"]
resources:
- blockaffinities

11
kubespray/project/roles/network_plugin/calico/templates/calico-node.yml.j2
View File

@@ -38,7 +38,7 @@ spec:
# deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
terminationGracePeriodSeconds: 0
initContainers:
{% if calico_datastore == "kdd" %}
{% if calico_datastore == "kdd" and not calico_ipam_host_local %}
# This container performs upgrade from host-local IPAM to calico-ipam.
# It can be deleted if this is a fresh installation, or if you have already
# upgraded to use calico-ipam.
@@ -310,6 +310,10 @@ spec:
value: "{{ calico_node_ignorelooserpf }}"
- name: CALICO_MANAGE_CNI
value: "true"
{% if calico_ipam_host_local %}
- name: USE_POD_CIDR
value: "true"
{% endif %}
{% if calico_node_extra_envs is defined %}
{% for key in calico_node_extra_envs %}
- name: {{ key }}
@@ -407,9 +411,11 @@ spec:
- name: var-run-calico
hostPath:
path: /var/run/calico
type: DirectoryOrCreate
- name: var-lib-calico
hostPath:
path: /var/lib/calico
type: DirectoryOrCreate
# Used to install CNI.
- name: cni-net-dir
hostPath:
@@ -417,6 +423,7 @@ spec:
- name: cni-bin-dir
hostPath:
path: /opt/cni/bin
type: DirectoryOrCreate
{% if calico_datastore == "etcd" %}
# Mount in the etcd TLS secrets.
- name: etcd-certs
@@ -428,7 +435,7 @@ spec:
hostPath:
path: /run/xtables.lock
type: FileOrCreate
{% if calico_datastore == "kdd" %}
{% if calico_datastore == "kdd" and not calico_ipam_host_local %}
# Mount in the directory for host-local IPAM allocations. This is
# used when upgrading from host-local to calico-ipam, and can be removed
# if not using the upgrade-ipam init container.

9
kubespray/project/roles/network_plugin/calico/templates/calico-typha.yml.j2
View File

@@ -136,11 +136,10 @@ spec:
name: cacert
readOnly: true
{% endif %}
# Needed for version >=3.7 when the 'host-local' ipam is used
# Should never happen given templates/cni-calico.conflist.j2
# Configure route aggregation based on pod CIDR.
# - name: USE_POD_CIDR
# value: "true"
{% if calico_ipam_host_local %}
- name: USE_POD_CIDR
value: "true"
{% endif %}
livenessProbe:
httpGet:
path: /liveness