gstykalin/kube-forge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update to latest 2.26.0 kubespray version and add dns zones settings to coredns

Browse Source
This commit is contained in:
George Stykalin
2024-12-14 21:56:19 +03:00
parent be9c8a28fd
commit 4294f52703
368 changed files with 37761 additions and 2942 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
config.sample.yaml
View File

@@ -5,7 +5,7 @@ credentials:
hosts: hosts:
- hostname: t1-disk-lt-k8s-test-master-01 - hostname: t1-disk-lt-k8s-test-master-01
ip: "10.100.20.49" ip: "10.100.20.47"
roles: [control_plane, etcd] roles: [control_plane, etcd]
- hostname: t1-disk-lt-k8s-test-slave-01 - hostname: t1-disk-lt-k8s-test-slave-01
@@ -13,24 +13,45 @@ hosts:
roles: [node] roles: [node]
- hostname: t1-disk-lt-k8s-test-slave-02 - hostname: t1-disk-lt-k8s-test-slave-02
ip: "10.100.20.47" ip: "10.100.20.49"
roles: [node] roles: [node]
orchestrator: orchestrator:
version: v1.29.0 version: v1.30.3
cluster_name: cluster.local cluster_name: cluster.local
kubelet_dir: "/var/lib/kubelet" kubelet_dir: "/app/k8s/kubelet"
container_engine: container_engine:
install: true install: true
type: "containerd" type: "containerd"
data_dir: "/var/lib/containerd" data_dir: "/app/containerd"
state_dir: "/run/containerd" state_dir: "/app/containerd-state"
dns: dns:
servers: servers:
- 8.8.8.8 - 8.8.8.8
- 8.8.4.4 - 8.8.4.4
- 1.1.1.1 - 1.1.1.1
disable_host_nameservers: false disable_host_nameservers: false
coredns_external_zones:
[]
# - zones:
# - example.com
# - example.io:1053
# nameservers:
# - 1.1.1.1
# - 2.2.2.2
# cache: 5
# - zones:
# - https://mycompany.local:4453
# nameservers:
# - 192.168.0.53
# cache: 0
# - zones:
# - mydomain.tld
# nameservers:
# - 10.233.0.3
# cache: 5
# rewrite:
# - name website.tld website.namespace.svc.cluster.local
ping_access_ip: true ping_access_ip: true
auto_renew_certificates: true auto_renew_certificates: true
pod_security_policy_enabled: true pod_security_policy_enabled: true
@@ -41,6 +62,20 @@ orchestrator:
skip_verify: false skip_verify: false
modules: modules:
admin_password: changeit
observability:
enabled: false
cicd:
enabled: false
secrets_storage:
enabled: false
registry:
enabled: false
additional: additional:
cert_manager: cert_manager:
enabled: true enabled: true

1
internal/config/orchestrator.go
View File

@@ -3,6 +3,7 @@ package config
type Dns struct { type Dns struct {
Servers []string `yaml:"servers" env-default:"8.8.8.8,8.8.4.4"` Servers []string `yaml:"servers" env-default:"8.8.8.8,8.8.4.4"`
DisableHostNameservers bool `yaml:"disable_host_nameservers"` DisableHostNameservers bool `yaml:"disable_host_nameservers"`
CoreDNSExternalZones []interface{} `yaml:"coredns_external_zones"`
} }
type RegistryMirror struct { type RegistryMirror struct {

5
internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl
View File

@@ -183,7 +183,10 @@ nodelocaldns_health_port: 9254
nodelocaldns_second_health_port: 9256 nodelocaldns_second_health_port: 9256
nodelocaldns_bind_metrics_host_ip: false nodelocaldns_bind_metrics_host_ip: false
nodelocaldns_secondary_skew_seconds: 5 nodelocaldns_secondary_skew_seconds: 5
# nodelocaldns_external_zones: {{- if .Orchestrator.Dns.CoreDNSExternalZones }}
coredns_external_zones:
{{- .Orchestrator.Dns.CoreDNSExternalZones | toYaml | nindent 2 }}
{{- end }}
# - zones: # - zones:
# - example.com # - example.com
# - example.io:1053 # - example.io:1053

1
kubespray/env/cmdline vendored
View File

@@ -1 +0,0 @@
-b -v --become

2
kubespray/env/extravars vendored
View File

@@ -1,2 +0,0 @@
---
ansible_sudo_pass: nF5S8nuKi87Dh42Jnjik

3
kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml
View File

@@ -17,7 +17,7 @@ kube_token_dir: "{{ kube_config_dir }}/tokens"
kube_api_anonymous_auth: true kube_api_anonymous_auth: true
## Change this to use another Kubernetes version, e.g. a current beta release ## Change this to use another Kubernetes version, e.g. a current beta release
kube_version: v1.29.0 kube_version: v1.30.3
# Where the binaries will be downloaded. # Where the binaries will be downloaded.
# Note: ensure that you've enough disk space (about 1G) # Note: ensure that you've enough disk space (about 1G)
@@ -179,7 +179,6 @@ nodelocaldns_health_port: 9254
nodelocaldns_second_health_port: 9256 nodelocaldns_second_health_port: 9256
nodelocaldns_bind_metrics_host_ip: false nodelocaldns_bind_metrics_host_ip: false
nodelocaldns_secondary_skew_seconds: 5 nodelocaldns_secondary_skew_seconds: 5
# nodelocaldns_external_zones:
# - zones: # - zones:
# - example.com # - example.com
# - example.io:1053 # - example.io:1053

28
kubespray/inventory/hosts
View File

@@ -1,31 +1,17 @@
t1-disk-lt-k8s-master-01 ansible_host=10.100.20.43 ip=10.100.20.43 t1-disk-lt-k8s-test-master-01 ansible_host=10.100.20.47 ip=10.100.20.47
t1-disk-lt-k8s-master-02 ansible_host=10.100.20.38 ip=10.100.20.38 t1-disk-lt-k8s-test-slave-01 ansible_host=10.100.20.48 ip=10.100.20.48
t1-disk-lt-k8s-master-03 ansible_host=10.100.20.42 ip=10.100.20.42 t1-disk-lt-k8s-test-slave-02 ansible_host=10.100.20.49 ip=10.100.20.49
t1-disk-lt-k8s-slave-01 ansible_host=10.100.20.40 ip=10.100.20.40
t1-disk-lt-k8s-slave-02 ansible_host=10.100.20.41 ip=10.100.20.41
t1-disk-lt-k8s-slave-03 ansible_host=10.100.20.39 ip=10.100.20.39
t1-disk-lt-k8s-slave-04 ansible_host=10.100.20.45 ip=10.100.20.45
t1-disk-lt-k8s-slave-05 ansible_host=10.100.20.44 ip=10.100.20.44
t1-disk-lt-k8s-slave-06 ansible_host=10.100.20.50 ip=10.100.20.50
[kube_control_plane] [kube_control_plane]
t1-disk-lt-k8s-master-01 t1-disk-lt-k8s-test-master-01
t1-disk-lt-k8s-master-02
t1-disk-lt-k8s-master-03
[etcd] [etcd]
t1-disk-lt-k8s-master-01 t1-disk-lt-k8s-test-master-01
t1-disk-lt-k8s-master-02
t1-disk-lt-k8s-master-03
[kube_node] [kube_node]
t1-disk-lt-k8s-slave-01 t1-disk-lt-k8s-test-slave-01
t1-disk-lt-k8s-slave-02 t1-disk-lt-k8s-test-slave-02
t1-disk-lt-k8s-slave-03
t1-disk-lt-k8s-slave-04
t1-disk-lt-k8s-slave-05
t1-disk-lt-k8s-slave-06
[k8s_cluster:children] [k8s_cluster:children]
kube_control_plane kube_control_plane

5
kubespray/project/ansible_version.yml
View File

@@ -2,10 +2,10 @@
- name: Check Ansible version - name: Check Ansible version
hosts: all hosts: all
gather_facts: false gather_facts: false
become: no become: false
run_once: true run_once: true
vars: vars:
minimal_ansible_version: 2.15.5 # 2.15 versions before 2.15.5 are known to be buggy for kubespray minimal_ansible_version: 2.16.4
maximal_ansible_version: 2.17.0 maximal_ansible_version: 2.17.0
tags: always tags: always
tasks: tasks:
@@ -25,7 +25,6 @@
tags: tags:
- check - check
# CentOS 7 provides too old jinja version
- name: "Check that jinja is not too old (install via pip)" - name: "Check that jinja is not too old (install via pip)"
assert: assert:
msg: "Your Jinja version is too old, install via pip" msg: "Your Jinja version is too old, install via pip"

2
kubespray/project/boilerplate.yml
View File

@@ -51,7 +51,7 @@
- name: Install bastion ssh config - name: Install bastion ssh config
hosts: bastion[0] hosts: bastion[0]
gather_facts: False gather_facts: false
environment: "{{ proxy_disable_env }}" environment: "{{ proxy_disable_env }}"
roles: roles:
- { role: kubespray-defaults } - { role: kubespray-defaults }

41
kubespray/project/cluster.yml
View File

@@ -7,17 +7,13 @@
- name: Prepare for etcd install - name: Prepare for etcd install
hosts: k8s_cluster:etcd hosts: k8s_cluster:etcd
gather_facts: False gather_facts: false
any_errors_fatal: "{{ any_errors_fatal | default(true) }}" any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
environment: "{{ proxy_disable_env }}" environment: "{{ proxy_disable_env }}"
roles: roles:
- { role: kubespray-defaults } - { role: kubespray-defaults }
- { role: kubernetes/preinstall, tags: preinstall } - { role: kubernetes/preinstall, tags: preinstall }
- { - { role: "container-engine", tags: "container-engine", when: deploy_container_engine }
role: "container-engine",
tags: "container-engine",
when: deploy_container_engine,
}
- { role: download, tags: download, when: "not skip_downloads" } - { role: download, tags: download, when: "not skip_downloads" }
- name: Install etcd - name: Install etcd
@@ -25,7 +21,7 @@
- name: Install Kubernetes nodes - name: Install Kubernetes nodes
hosts: k8s_cluster hosts: k8s_cluster
gather_facts: False gather_facts: false
any_errors_fatal: "{{ any_errors_fatal | default(true) }}" any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
environment: "{{ proxy_disable_env }}" environment: "{{ proxy_disable_env }}"
roles: roles:
@@ -34,7 +30,7 @@
- name: Install the control plane - name: Install the control plane
hosts: kube_control_plane hosts: kube_control_plane
gather_facts: False gather_facts: false
any_errors_fatal: "{{ any_errors_fatal | default(true) }}" any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
environment: "{{ proxy_disable_env }}" environment: "{{ proxy_disable_env }}"
roles: roles:
@@ -45,12 +41,12 @@
- name: Invoke kubeadm and install a CNI - name: Invoke kubeadm and install a CNI
hosts: k8s_cluster hosts: k8s_cluster
gather_facts: False gather_facts: false
any_errors_fatal: "{{ any_errors_fatal | default(true) }}" any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
environment: "{{ proxy_disable_env }}" environment: "{{ proxy_disable_env }}"
roles: roles:
- { role: kubespray-defaults } - { role: kubespray-defaults }
- { role: kubernetes/kubeadm, tags: kubeadm } - { role: kubernetes/kubeadm, tags: kubeadm}
- { role: kubernetes/node-label, tags: node-label } - { role: kubernetes/node-label, tags: node-label }
- { role: kubernetes/node-taint, tags: node-taint } - { role: kubernetes/node-taint, tags: node-taint }
- { role: network_plugin, tags: network } - { role: network_plugin, tags: network }
@@ -58,50 +54,41 @@
- name: Install Calico Route Reflector - name: Install Calico Route Reflector
hosts: calico_rr hosts: calico_rr
gather_facts: False gather_facts: false
any_errors_fatal: "{{ any_errors_fatal | default(true) }}" any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
environment: "{{ proxy_disable_env }}" environment: "{{ proxy_disable_env }}"
roles: roles:
- { role: kubespray-defaults } - { role: kubespray-defaults }
- { role: network_plugin/calico/rr, tags: ["network", "calico_rr"] } - { role: network_plugin/calico/rr, tags: ['network', 'calico_rr'] }
- name: Patch Kubernetes for Windows - name: Patch Kubernetes for Windows
hosts: kube_control_plane[0] hosts: kube_control_plane[0]
gather_facts: False gather_facts: false
any_errors_fatal: "{{ any_errors_fatal | default(true) }}" any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
environment: "{{ proxy_disable_env }}" environment: "{{ proxy_disable_env }}"
roles: roles:
- { role: kubespray-defaults } - { role: kubespray-defaults }
- { role: win_nodes/kubernetes_patch, tags: ["master", "win_nodes"] } - { role: win_nodes/kubernetes_patch, tags: ["master", "win_nodes"] }
- name: Install Kubernetes and Helm apps - name: Install Kubernetes apps
hosts: kube_control_plane hosts: kube_control_plane
gather_facts: False gather_facts: false
any_errors_fatal: "{{ any_errors_fatal | default(true) }}" any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
environment: "{{ proxy_disable_env }}" environment: "{{ proxy_disable_env }}"
roles: roles:
- { role: kubespray-defaults } - { role: kubespray-defaults }
- { - { role: kubernetes-apps/external_cloud_controller, tags: external-cloud-controller }
role: kubernetes-apps/external_cloud_controller,
tags: external-cloud-controller,
}
- { role: kubernetes-apps/network_plugin, tags: network } - { role: kubernetes-apps/network_plugin, tags: network }
- { role: kubernetes-apps/policy_controller, tags: policy-controller } - { role: kubernetes-apps/policy_controller, tags: policy-controller }
- { role: kubernetes-apps/ingress_controller, tags: ingress-controller } - { role: kubernetes-apps/ingress_controller, tags: ingress-controller }
- { role: kubernetes-apps/external_provisioner, tags: external-provisioner } - { role: kubernetes-apps/external_provisioner, tags: external-provisioner }
- { role: kubernetes-apps, tags: apps } - { role: kubernetes-apps, tags: apps }
# - { role: helm-apps, tags: helm-apps }
- name: Apply resolv.conf changes now that cluster DNS is up - name: Apply resolv.conf changes now that cluster DNS is up
hosts: k8s_cluster hosts: k8s_cluster
gather_facts: False gather_facts: false
any_errors_fatal: "{{ any_errors_fatal | default(true) }}" any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
environment: "{{ proxy_disable_env }}" environment: "{{ proxy_disable_env }}"
roles: roles:
- { role: kubespray-defaults } - { role: kubespray-defaults }
- { - { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_late: true }
role: kubernetes/preinstall,
when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'",
tags: resolvconf,
dns_late: true,
}

2
kubespray/project/facts.yml
View File

@@ -15,7 +15,7 @@
- name: Gather facts - name: Gather facts
hosts: k8s_cluster:etcd:calico_rr hosts: k8s_cluster:etcd:calico_rr
gather_facts: False gather_facts: false
tags: always tags: always
tasks: tasks:
- name: Gather minimal facts - name: Gather minimal facts

2
kubespray/project/install_etcd.yml
View File

@@ -16,7 +16,7 @@
- name: Install etcd - name: Install etcd
hosts: etcd:kube_control_plane:_kubespray_needs_etcd hosts: etcd:kube_control_plane:_kubespray_needs_etcd
gather_facts: False gather_facts: false
any_errors_fatal: "{{ any_errors_fatal | default(true) }}" any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
environment: "{{ proxy_disable_env }}" environment: "{{ proxy_disable_env }}"
roles: roles:

8
kubespray/project/remove_node.yml
View File

@@ -4,13 +4,13 @@
- name: Confirm node removal - name: Confirm node removal
hosts: "{{ node | default('etcd:k8s_cluster:calico_rr') }}" hosts: "{{ node | default('etcd:k8s_cluster:calico_rr') }}"
gather_facts: no gather_facts: false
tasks: tasks:
- name: Confirm Execution - name: Confirm Execution
pause: pause:
prompt: "Are you sure you want to delete nodes state? Type 'yes' to delete nodes." prompt: "Are you sure you want to delete nodes state? Type 'yes' to delete nodes."
register: pause_result register: pause_result
run_once: True run_once: true
when: when:
- not (skip_confirmation | default(false) | bool) - not (skip_confirmation | default(false) | bool)
@@ -25,7 +25,7 @@
- name: Reset node - name: Reset node
hosts: "{{ node | default('kube_node') }}" hosts: "{{ node | default('kube_node') }}"
gather_facts: no gather_facts: false
environment: "{{ proxy_disable_env }}" environment: "{{ proxy_disable_env }}"
roles: roles:
- { role: kubespray-defaults, when: reset_nodes | default(True) | bool } - { role: kubespray-defaults, when: reset_nodes | default(True) | bool }
@@ -36,7 +36,7 @@
# Currently cannot remove first master or etcd # Currently cannot remove first master or etcd
- name: Post node removal - name: Post node removal
hosts: "{{ node | default('kube_control_plane[1:]:etcd[1:]') }}" hosts: "{{ node | default('kube_control_plane[1:]:etcd[1:]') }}"
gather_facts: no gather_facts: false
environment: "{{ proxy_disable_env }}" environment: "{{ proxy_disable_env }}"
roles: roles:
- { role: kubespray-defaults, when: reset_nodes | default(True) | bool } - { role: kubespray-defaults, when: reset_nodes | default(True) | bool }

4
kubespray/project/reset.yml
View File

@@ -7,13 +7,13 @@
- name: Reset cluster - name: Reset cluster
hosts: etcd:k8s_cluster:calico_rr hosts: etcd:k8s_cluster:calico_rr
gather_facts: False gather_facts: false
pre_tasks: pre_tasks:
- name: Reset Confirmation - name: Reset Confirmation
pause: pause:
prompt: "Are you sure you want to reset cluster state? Type 'yes' to reset your cluster." prompt: "Are you sure you want to reset cluster state? Type 'yes' to reset your cluster."
register: reset_confirmation_prompt register: reset_confirmation_prompt
run_once: True run_once: true
when: when:
- not (skip_confirmation | default(false) | bool) - not (skip_confirmation | default(false) | bool)
- reset_confirmation is not defined - reset_confirmation is not defined

8
kubespray/project/roles/adduser/defaults/main.yml
View File

@@ -7,14 +7,14 @@ addusers:
etcd: etcd:
name: etcd name: etcd
comment: "Etcd user" comment: "Etcd user"
create_home: no create_home: false
system: yes system: true
shell: /sbin/nologin shell: /sbin/nologin
kube: kube:
name: kube name: kube
comment: "Kubernetes user" comment: "Kubernetes user"
create_home: no create_home: false
system: yes system: true
shell: /sbin/nologin shell: /sbin/nologin
group: "{{ kube_cert_group }}" group: "{{ kube_cert_group }}"

4
kubespray/project/roles/adduser/vars/coreos.yml
View File

@@ -3,6 +3,6 @@ addusers:
- name: kube - name: kube
comment: "Kubernetes user" comment: "Kubernetes user"
shell: /sbin/nologin shell: /sbin/nologin
system: yes system: true
group: "{{ kube_cert_group }}" group: "{{ kube_cert_group }}"
create_home: no create_home: false

8
kubespray/project/roles/adduser/vars/debian.yml
View File

@@ -2,14 +2,14 @@
addusers: addusers:
- name: etcd - name: etcd
comment: "Etcd user" comment: "Etcd user"
create_home: yes create_home: true
home: "{{ etcd_data_dir }}" home: "{{ etcd_data_dir }}"
system: yes system: true
shell: /sbin/nologin shell: /sbin/nologin
- name: kube - name: kube
comment: "Kubernetes user" comment: "Kubernetes user"
create_home: no create_home: false
system: yes system: true
shell: /sbin/nologin shell: /sbin/nologin
group: "{{ kube_cert_group }}" group: "{{ kube_cert_group }}"

8
kubespray/project/roles/adduser/vars/redhat.yml
View File

@@ -2,14 +2,14 @@
addusers: addusers:
- name: etcd - name: etcd
comment: "Etcd user" comment: "Etcd user"
create_home: yes create_home: true
home: "{{ etcd_data_dir }}" home: "{{ etcd_data_dir }}"
system: yes system: true
shell: /sbin/nologin shell: /sbin/nologin
- name: kube - name: kube
comment: "Kubernetes user" comment: "Kubernetes user"
create_home: no create_home: false
system: yes system: true
shell: /sbin/nologin shell: /sbin/nologin
group: "{{ kube_cert_group }}" group: "{{ kube_cert_group }}"

2
kubespray/project/roles/bastion-ssh-config/molecule/default/converge.yml
View File

@@ -12,4 +12,4 @@
dest: "{{ ssh_bastion_confing__name }}" dest: "{{ ssh_bastion_confing__name }}"
owner: "{{ ansible_user }}" owner: "{{ ansible_user }}"
group: "{{ ansible_user }}" group: "{{ ansible_user }}"
mode: 0644 mode: "0644"

2
kubespray/project/roles/bastion-ssh-config/tasks/main.yml
View File

@@ -19,4 +19,4 @@
template: template:
src: "{{ ssh_bastion_confing__name }}.j2" src: "{{ ssh_bastion_confing__name }}.j2"
dest: "{{ playbook_dir }}/{{ ssh_bastion_confing__name }}" dest: "{{ playbook_dir }}/{{ ssh_bastion_confing__name }}"
mode: 0640 mode: "0640"

4
kubespray/project/roles/bootstrap-os/defaults/main.yml
View File

@@ -11,6 +11,10 @@ coreos_locksmithd_disable: false
# Install public repo on Oracle Linux # Install public repo on Oracle Linux
use_oracle_public_repo: true use_oracle_public_repo: true
## Ubuntu specific variables
# Disable unattended-upgrades for Linux kernel and all packages start with linux- on Ubuntu
ubuntu_kernel_unattended_upgrades_disabled: false
fedora_coreos_packages: fedora_coreos_packages:
- python - python
- python3-libselinux - python3-libselinux

2
kubespray/project/roles/bootstrap-os/molecule/default/converge.yml
View File

@@ -1,6 +1,6 @@
--- ---
- name: Converge - name: Converge
hosts: all hosts: all
gather_facts: no gather_facts: false
roles: roles:
- role: bootstrap-os - role: bootstrap-os

6
kubespray/project/roles/bootstrap-os/molecule/default/molecule.yml
View File

@@ -19,12 +19,6 @@ platforms:
memory: 1024 memory: 1024
provider_options: provider_options:
driver: kvm driver: kvm
- name: centos7
box: centos/7
cpus: 1
memory: 512
provider_options:
driver: kvm
- name: almalinux8 - name: almalinux8
box: almalinux/8 box: almalinux/8
cpus: 1 cpus: 1

11
kubespray/project/roles/bootstrap-os/tasks/bootstrap-amazon.yml → kubespray/project/roles/bootstrap-os/tasks/amzn.yml
View File

@@ -1,13 +1,16 @@
--- ---
- name: Enable selinux-ng repo for Amazon Linux for container-selinux
command: amazon-linux-extras enable selinux-ng
- name: Enable EPEL repo for Amazon Linux - name: Enable EPEL repo for Amazon Linux
yum_repository: yum_repository:
name: epel name: epel
file: epel file: epel
description: Extra Packages for Enterprise Linux 7 - $basearch description: Extra Packages for Enterprise Linux 7 - $basearch
baseurl: http://download.fedoraproject.org/pub/epel/7/$basearch baseurl: http://download.fedoraproject.org/pub/epel/7/$basearch
gpgcheck: yes gpgcheck: true
gpgkey: http://download.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-7 gpgkey: http://download.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-7
skip_if_unavailable: yes skip_if_unavailable: true
enabled: yes enabled: true
repo_gpgcheck: no repo_gpgcheck: false
when: epel_enabled when: epel_enabled

37
kubespray/project/roles/bootstrap-os/tasks/bootstrap-coreos.yml
View File

@@ -1,37 +0,0 @@
---
# CoreOS ships without Python installed
- name: Check if bootstrap is needed
raw: stat /opt/bin/.bootstrapped
register: need_bootstrap
failed_when: false
changed_when: false
tags:
- facts
- name: Force binaries directory for Container Linux by CoreOS and Flatcar
set_fact:
bin_dir: "/opt/bin"
tags:
- facts
- name: Run bootstrap.sh
script: bootstrap.sh
become: true
environment: "{{ proxy_env }}"
when:
- need_bootstrap.rc != 0
- name: Set the ansible_python_interpreter fact
set_fact:
ansible_python_interpreter: "{{ bin_dir }}/python"
tags:
- facts
- name: Disable auto-upgrade
systemd:
name: locksmithd.service
masked: true
state: stopped
when:
- coreos_locksmithd_disable

18
kubespray/project/roles/bootstrap-os/tasks/bootstrap-centos.yml → kubespray/project/roles/bootstrap-os/tasks/centos.yml
View File

@@ -12,7 +12,7 @@
value: "{{ http_proxy | default(omit) }}" value: "{{ http_proxy | default(omit) }}"
state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}" state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
no_extra_spaces: true no_extra_spaces: true
mode: 0644 mode: "0644"
become: true become: true
when: not skip_http_proxy_on_os_packages when: not skip_http_proxy_on_os_packages
@@ -21,7 +21,7 @@
get_url: get_url:
url: https://yum.oracle.com/public-yum-ol7.repo url: https://yum.oracle.com/public-yum-ol7.repo
dest: /etc/yum.repos.d/public-yum-ol7.repo dest: /etc/yum.repos.d/public-yum-ol7.repo
mode: 0644 mode: "0644"
when: when:
- use_oracle_public_repo | default(true) - use_oracle_public_repo | default(true)
- '''ID="ol"'' in os_release.stdout_lines' - '''ID="ol"'' in os_release.stdout_lines'
@@ -34,7 +34,7 @@
section: "{{ item }}" section: "{{ item }}"
option: enabled option: enabled
value: "1" value: "1"
mode: 0644 mode: "0644"
with_items: with_items:
- ol7_latest - ol7_latest
- ol7_addons - ol7_addons
@@ -59,7 +59,7 @@
section: "ol{{ ansible_distribution_major_version }}_addons" section: "ol{{ ansible_distribution_major_version }}_addons"
option: "{{ item.option }}" option: "{{ item.option }}"
value: "{{ item.value }}" value: "{{ item.value }}"
mode: 0644 mode: "0644"
with_items: with_items:
- { option: "name", value: "ol{{ ansible_distribution_major_version }}_addons" } - { option: "name", value: "ol{{ ansible_distribution_major_version }}_addons" }
- { option: "enabled", value: "1" } - { option: "enabled", value: "1" }
@@ -75,12 +75,12 @@
section: "extras" section: "extras"
option: "{{ item.option }}" option: "{{ item.option }}"
value: "{{ item.value }}" value: "{{ item.value }}"
mode: 0644 mode: "0644"
with_items: with_items:
- { option: "name", value: "CentOS-{{ ansible_distribution_major_version }} - Extras" } - { option: "name", value: "CentOS-{{ ansible_distribution_major_version }} - Extras" }
- { option: "enabled", value: "1" } - { option: "enabled", value: "1" }
- { option: "gpgcheck", value: "0" } - { option: "gpgcheck", value: "0" }
- { option: "baseurl", value: "http://mirror.centos.org/{{ 'altarch' if (ansible_distribution_major_version | int) <= 7 and ansible_architecture == 'aarch64' else 'centos' }}/{{ ansible_distribution_major_version }}/extras/$basearch/{% if ansible_distribution_major_version | int > 7 %}os/{% endif %}" } - { option: "baseurl", value: "http://mirror.centos.org/centos/{{ ansible_distribution_major_version }}/extras/$basearch/os/" }
when: when:
- use_oracle_public_repo | default(true) - use_oracle_public_repo | default(true)
- '''ID="ol"'' in os_release.stdout_lines' - '''ID="ol"'' in os_release.stdout_lines'
@@ -92,9 +92,9 @@
- name: Check presence of fastestmirror.conf - name: Check presence of fastestmirror.conf
stat: stat:
path: /etc/yum/pluginconf.d/fastestmirror.conf path: /etc/yum/pluginconf.d/fastestmirror.conf
get_attributes: no get_attributes: false
get_checksum: no get_checksum: false
get_mime: no get_mime: false
register: fastestmirror register: fastestmirror
# the fastestmirror plugin can actually slow down Ansible deployments # the fastestmirror plugin can actually slow down Ansible deployments

2
kubespray/project/roles/bootstrap-os/tasks/bootstrap-clearlinux.yml → kubespray/project/roles/bootstrap-os/tasks/clearlinux.yml
View File

@@ -7,7 +7,7 @@
state: present state: present
- name: Make sure docker service is enabled - name: Make sure docker service is enabled
systemd: systemd_service:
name: docker name: docker
masked: false masked: false
enabled: true enabled: true

16
kubespray/project/roles/bootstrap-os/tasks/bootstrap-debian.yml → kubespray/project/roles/bootstrap-os/tasks/debian.yml
View File

@@ -55,22 +55,10 @@
raw: apt-get update --allow-releaseinfo-change raw: apt-get update --allow-releaseinfo-change
become: true become: true
when: when:
- '''ID=debian'' in os_release.stdout_lines' - os_release_dict['ID'] == 'debian'
- '''VERSION_ID="10"'' in os_release.stdout_lines or ''VERSION_ID="11"'' in os_release.stdout_lines' - os_release_dict['VERSION_ID'] in ["10", "11"]
register: bootstrap_update_apt_result register: bootstrap_update_apt_result
changed_when: changed_when:
- '"changed its" in bootstrap_update_apt_result.stdout' - '"changed its" in bootstrap_update_apt_result.stdout'
- '"value from" in bootstrap_update_apt_result.stdout' - '"value from" in bootstrap_update_apt_result.stdout'
ignore_errors: true ignore_errors: true
- name: Set the ansible_python_interpreter fact
set_fact:
ansible_python_interpreter: "/usr/bin/python3"
# Workaround for https://github.com/ansible/ansible/issues/25543
- name: Install dbus for the hostname module
package:
name: dbus
state: present
use: apt
become: true

8
kubespray/project/roles/bootstrap-os/tasks/bootstrap-fedora-coreos.yml → kubespray/project/roles/bootstrap-os/tasks/fedora-coreos.yml
View File

@@ -28,7 +28,7 @@
raw: "nohup bash -c 'sleep 5s && shutdown -r now'" raw: "nohup bash -c 'sleep 5s && shutdown -r now'"
become: true become: true
ignore_errors: true # noqa ignore-errors ignore_errors: true # noqa ignore-errors
ignore_unreachable: yes ignore_unreachable: true
when: need_bootstrap.rc != 0 when: need_bootstrap.rc != 0
- name: Wait for the reboot to complete - name: Wait for the reboot to complete
@@ -38,9 +38,3 @@
delay: 5 delay: 5
sleep: 5 sleep: 5
when: need_bootstrap.rc != 0 when: need_bootstrap.rc != 0
- name: Store the fact if this is an fedora core os host
set_fact:
is_fedora_coreos: True
tags:
- facts

16
kubespray/project/roles/bootstrap-os/tasks/bootstrap-fedora.yml → kubespray/project/roles/bootstrap-os/tasks/fedora.yml
View File

@@ -17,20 +17,14 @@
value: "{{ http_proxy | default(omit) }}" value: "{{ http_proxy | default(omit) }}"
state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}" state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
no_extra_spaces: true no_extra_spaces: true
mode: 0644 mode: "0644"
become: true become: true
when: not skip_http_proxy_on_os_packages when: not skip_http_proxy_on_os_packages
- name: Install python3 on fedora # libselinux-python3 is required on SELinux enabled hosts
raw: "dnf install --assumeyes --quiet python3" # See https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#managed-node-requirements
- name: Install ansible requirements
raw: "dnf install --assumeyes python3 python3-dnf libselinux-python3"
become: true become: true
when: when:
- need_bootstrap.rc != 0 - need_bootstrap.rc != 0
# libselinux-python3 is required on SELinux enabled hosts
# See https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#managed-node-requirements
- name: Install libselinux-python3
package:
name: libselinux-python3
state: present
become: true

19
kubespray/project/roles/bootstrap-os/tasks/bootstrap-flatcar.yml → kubespray/project/roles/bootstrap-os/tasks/flatcar.yml
View File

@@ -9,12 +9,6 @@
tags: tags:
- facts - facts
- name: Force binaries directory for Flatcar Container Linux by Kinvolk
set_fact:
bin_dir: "/opt/bin"
tags:
- facts
- name: Run bootstrap.sh - name: Run bootstrap.sh
script: bootstrap.sh script: bootstrap.sh
become: true become: true
@@ -22,14 +16,17 @@
when: when:
- need_bootstrap.rc != 0 - need_bootstrap.rc != 0
- name: Set the ansible_python_interpreter fact # Workaround ansible https://github.com/ansible/ansible/pull/82821
# We set the interpreter rather than ansible_python_interpreter to allow
# - using virtual env with task level ansible_python_interpreter later
# - let users specify an ansible_python_interpreter in group_vars
- name: Make interpreter discovery works on Flatcar
set_fact: set_fact:
ansible_python_interpreter: "{{ bin_dir }}/python" ansible_interpreter_python_fallback: "{{ ansible_interpreter_python_fallback + [ '/opt/bin/python' ] }}"
tags:
- facts
- name: Disable auto-upgrade - name: Disable auto-upgrade
systemd: systemd_service:
name: locksmithd.service name: locksmithd.service
masked: true masked: true
state: stopped state: stopped

101
kubespray/project/roles/bootstrap-os/tasks/main.yml
View File

@@ -6,57 +6,39 @@
# This command should always run, even in check mode # This command should always run, even in check mode
check_mode: false check_mode: false
- name: Bootstrap CentOS - name: Include distro specifics vars and tasks
include_tasks: bootstrap-centos.yml vars:
when: '''ID="centos"'' in os_release.stdout_lines or ''ID="ol"'' in os_release.stdout_lines or ''ID="almalinux"'' in os_release.stdout_lines or ''ID="rocky"'' in os_release.stdout_lines or ''ID="kylin"'' in os_release.stdout_lines or ''ID="uos"'' in os_release.stdout_lines or ''ID="openEuler"'' in os_release.stdout_lines' os_release_dict: "{{ os_release.stdout_lines | select('regex', '^.+=.*$') | map('regex_replace', '\"', '') |
map('split', '=') | community.general.dict }}"
block:
- name: Include vars
include_vars: "{{ item }}"
tags:
- facts
with_first_found:
- &search
files:
- "{{ os_release_dict['ID'] }}-{{ os_release_dict['VARIANT_ID'] }}.yml"
- "{{ os_release_dict['ID'] }}.yml"
paths:
- vars/
skip: true
- name: Include tasks
include_tasks: "{{ included_tasks_file }}"
with_first_found:
- <<: *search
paths: []
loop_control:
loop_var: included_tasks_file
- name: Bootstrap Amazon
include_tasks: bootstrap-amazon.yml
when: '''ID="amzn"'' in os_release.stdout_lines'
- name: Bootstrap RedHat
include_tasks: bootstrap-redhat.yml
when: '''ID="rhel"'' in os_release.stdout_lines'
- name: Bootstrap Clear Linux
include_tasks: bootstrap-clearlinux.yml
when: '''ID=clear-linux-os'' in os_release.stdout_lines'
# Fedora CoreOS
- name: Bootstrap Fedora CoreOS
include_tasks: bootstrap-fedora-coreos.yml
when:
- '''ID=fedora'' in os_release.stdout_lines'
- '''VARIANT_ID=coreos'' in os_release.stdout_lines'
- name: Bootstrap Flatcar
include_tasks: bootstrap-flatcar.yml
when: '''ID=flatcar'' in os_release.stdout_lines'
- name: Bootstrap Debian
include_tasks: bootstrap-debian.yml
when: '''ID=debian'' in os_release.stdout_lines or ''ID=ubuntu'' in os_release.stdout_lines'
# Fedora "classic"
- name: Boostrap Fedora
include_tasks: bootstrap-fedora.yml
when:
- '''ID=fedora'' in os_release.stdout_lines'
- '''VARIANT_ID=coreos'' not in os_release.stdout_lines'
- name: Bootstrap OpenSUSE
include_tasks: bootstrap-opensuse.yml
when: '''ID="opensuse-leap"'' in os_release.stdout_lines or ''ID="opensuse-tumbleweed"'' in os_release.stdout_lines'
- name: Create remote_tmp for it is used by another module - name: Create remote_tmp for it is used by another module
file: file:
path: "{{ ansible_remote_tmp | default('~/.ansible/tmp') }}" path: "{{ ansible_remote_tmp | default('~/.ansible/tmp') }}"
state: directory state: directory
mode: 0700 mode: "0700"
# Workaround for https://github.com/ansible/ansible/issues/42726 - name: Gather facts
# (1/3)
- name: Gather host facts to get ansible_os_family
setup: setup:
gather_subset: '!all' gather_subset: '!all'
filter: ansible_* filter: ansible_*
@@ -64,34 +46,7 @@
- name: Assign inventory name to unconfigured hostnames (non-CoreOS, non-Flatcar, Suse and ClearLinux, non-Fedora) - name: Assign inventory name to unconfigured hostnames (non-CoreOS, non-Flatcar, Suse and ClearLinux, non-Fedora)
hostname: hostname:
name: "{{ inventory_hostname }}" name: "{{ inventory_hostname }}"
when: when: override_system_hostname
- override_system_hostname
- ansible_os_family not in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
- not ansible_distribution == "Fedora"
- not is_fedora_coreos
# (2/3)
- name: Assign inventory name to unconfigured hostnames (CoreOS, Flatcar, Suse, ClearLinux and Fedora only)
command: "hostnamectl set-hostname {{ inventory_hostname }}"
register: hostname_changed
become: true
changed_when: false
when: >
override_system_hostname
and (ansible_os_family in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
or is_fedora_coreos
or ansible_distribution == "Fedora")
# (3/3)
- name: Update hostname fact (CoreOS, Flatcar, Suse, ClearLinux and Fedora only)
setup:
gather_subset: '!all'
filter: ansible_hostname
when: >
override_system_hostname
and (ansible_os_family in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
or is_fedora_coreos
or ansible_distribution == "Fedora")
- name: Install ceph-commmon package - name: Install ceph-commmon package
package: package:
@@ -106,4 +61,4 @@
state: directory state: directory
owner: root owner: root
group: root group: root
mode: 0755 mode: "0755"

3
kubespray/project/roles/bootstrap-os/tasks/openEuler.yml Normal file
View File

@@ -0,0 +1,3 @@
---
- name: Import Centos boostrap for openEuler
import_tasks: centos.yml

3
kubespray/project/roles/bootstrap-os/tasks/opensuse-leap.yml Normal file
View File

@@ -0,0 +1,3 @@
---
- name: Import Opensuse bootstrap
import_tasks: opensuse.yml

3
kubespray/project/roles/bootstrap-os/tasks/opensuse-tumbleweed.yml Normal file
View File

@@ -0,0 +1,3 @@
---
- name: Import Opensuse bootstrap
import_tasks: opensuse.yml

6
kubespray/project/roles/bootstrap-os/tasks/bootstrap-opensuse.yml → kubespray/project/roles/bootstrap-os/tasks/opensuse.yml
View File

@@ -8,9 +8,9 @@
- name: Check that /etc/sysconfig/proxy file exists - name: Check that /etc/sysconfig/proxy file exists
stat: stat:
path: /etc/sysconfig/proxy path: /etc/sysconfig/proxy
get_attributes: no get_attributes: false
get_checksum: no get_checksum: false
get_mime: no get_mime: false
register: stat_result register: stat_result
- name: Create the /etc/sysconfig/proxy empty file - name: Create the /etc/sysconfig/proxy empty file

19
kubespray/project/roles/bootstrap-os/tasks/bootstrap-redhat.yml → kubespray/project/roles/bootstrap-os/tasks/redhat.yml
View File

@@ -12,7 +12,7 @@
value: "{{ http_proxy | default(omit) }}" value: "{{ http_proxy | default(omit) }}"
state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}" state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
no_extra_spaces: true no_extra_spaces: true
mode: 0644 mode: "0644"
become: true become: true
when: not skip_http_proxy_on_os_packages when: not skip_http_proxy_on_os_packages
@@ -62,17 +62,6 @@
- rh_subscription_username is defined - rh_subscription_username is defined
- rh_subscription_status.changed - rh_subscription_status.changed
# container-selinux is in extras repo
- name: Enable RHEL 7 repos
community.general.rhsm_repository:
name:
- "rhel-7-server-rpms"
- "rhel-7-server-extras-rpms"
state: "{{ 'enabled' if (rhel_enable_repos | default(True) | bool) else 'disabled' }}"
when:
- ansible_distribution_major_version == "7"
- (not rh_subscription_status.changed) or (rh_subscription_username is defined) or (rh_subscription_org_id is defined)
# container-selinux is in appstream repo # container-selinux is in appstream repo
- name: Enable RHEL 8 repos - name: Enable RHEL 8 repos
community.general.rhsm_repository: community.general.rhsm_repository:
@@ -87,9 +76,9 @@
- name: Check presence of fastestmirror.conf - name: Check presence of fastestmirror.conf
stat: stat:
path: /etc/yum/pluginconf.d/fastestmirror.conf path: /etc/yum/pluginconf.d/fastestmirror.conf
get_attributes: no get_attributes: false
get_checksum: no get_checksum: false
get_mime: no get_mime: false
register: fastestmirror register: fastestmirror
# the fastestmirror plugin can actually slow down Ansible deployments # the fastestmirror plugin can actually slow down Ansible deployments

21
kubespray/project/roles/bootstrap-os/tasks/ubuntu.yml Normal file
View File

@@ -0,0 +1,21 @@
---
- name: Import Debian bootstrap
import_tasks: debian.yml
- name: Check unattended-upgrades file exist
stat:
path: /etc/apt/apt.conf.d/50unattended-upgrades
register: unattended_upgrades_file_stat
when:
- ubuntu_kernel_unattended_upgrades_disabled
- name: Disable kernel unattended-upgrades
lineinfile:
path: "{{ unattended_upgrades_file_stat.stat.path }}"
insertafter: "Unattended-Upgrade::Package-Blacklist"
line: '"linux-";'
state: present
become: true
when:
- ubuntu_kernel_unattended_upgrades_disabled
- unattended_upgrades_file_stat.stat.exists

2
kubespray/project/roles/bootstrap-os/vars/fedora-coreos.yml Normal file
View File

@@ -0,0 +1,2 @@
---
is_fedora_coreos: true

2
kubespray/project/roles/bootstrap-os/vars/flatcar.yml Normal file
View File

@@ -0,0 +1,2 @@
---
bin_dir: "/opt/bin"

6
kubespray/project/roles/container-engine/containerd-common/tasks/main.yml
View File

@@ -2,9 +2,9 @@
- name: Containerd-common | check if fedora coreos - name: Containerd-common | check if fedora coreos
stat: stat:
path: /run/ostree-booted path: /run/ostree-booted
get_attributes: no get_attributes: false
get_checksum: no get_checksum: false
get_mime: no get_mime: false
register: ostree register: ostree
- name: Containerd-common | set is_ostree - name: Containerd-common | set is_ostree

18
kubespray/project/roles/container-engine/containerd/defaults/main.yml
View File

@@ -46,7 +46,11 @@ containerd_base_runtime_specs:
containerd_grpc_max_recv_message_size: 16777216 containerd_grpc_max_recv_message_size: 16777216
containerd_grpc_max_send_message_size: 16777216 containerd_grpc_max_send_message_size: 16777216
containerd_debug_address: ""
containerd_debug_level: "info" containerd_debug_level: "info"
containerd_debug_format: ""
containerd_debug_uid: 0
containerd_debug_gid: 0
containerd_metrics_address: "" containerd_metrics_address: ""
@@ -66,6 +70,12 @@ containerd_enable_unprivileged_ports: false
# If enabled it will allow non root users to use icmp sockets # If enabled it will allow non root users to use icmp sockets
containerd_enable_unprivileged_icmp: false containerd_enable_unprivileged_icmp: false
containerd_enable_selinux: false
containerd_disable_apparmor: false
containerd_tolerate_missing_hugetlb_controller: true
containerd_disable_hugetlb_controller: true
containerd_image_pull_progress_timeout: 5m
containerd_cfg_dir: /etc/containerd containerd_cfg_dir: /etc/containerd
# Extra config to be put in {{ containerd_cfg_dir }}/config.toml literally # Extra config to be put in {{ containerd_cfg_dir }}/config.toml literally
@@ -109,3 +119,11 @@ containerd_supported_distributions:
# Enable container device interface # Enable container device interface
enable_cdi: false enable_cdi: false
# For containerd tracing configuration please check out the official documentation:
# https://github.com/containerd/containerd/blob/main/docs/tracing.md
containerd_tracing_enabled: false
containerd_tracing_endpoint: "0.0.0.0:4317"
containerd_tracing_protocol: "grpc"
containerd_tracing_sampling_ratio: 1.0
containerd_tracing_service_name: "containerd"

8
kubespray/project/roles/container-engine/containerd/handlers/main.yml
View File

@@ -1,11 +1,11 @@
--- ---
- name: Containerd | restart containerd - name: Containerd | restart containerd
systemd: systemd_service:
name: containerd name: containerd
state: restarted state: restarted
enabled: yes enabled: true
daemon-reload: yes daemon-reload: true
masked: no masked: false
listen: Restart containerd listen: Restart containerd
- name: Containerd | wait for containerd - name: Containerd | wait for containerd

4
kubespray/project/roles/container-engine/containerd/molecule/default/prepare.yml
View File

@@ -1,7 +1,7 @@
--- ---
- name: Prepare - name: Prepare
hosts: all hosts: all
gather_facts: False gather_facts: false
become: true become: true
vars: vars:
ignore_assert_errors: true ignore_assert_errors: true
@@ -19,7 +19,7 @@
- name: Prepare CNI - name: Prepare CNI
hosts: all hosts: all
gather_facts: False gather_facts: false
become: true become: true
vars: vars:
ignore_assert_errors: true ignore_assert_errors: true

24
kubespray/project/roles/container-engine/containerd/tasks/main.yml
View File

@@ -35,8 +35,8 @@
unarchive: unarchive:
src: "{{ downloads.containerd.dest }}" src: "{{ downloads.containerd.dest }}"
dest: "{{ containerd_bin_dir }}" dest: "{{ containerd_bin_dir }}"
mode: 0755 mode: "0755"
remote_src: yes remote_src: true
extra_opts: extra_opts:
- --strip-components=1 - --strip-components=1
notify: Restart containerd notify: Restart containerd
@@ -60,7 +60,7 @@
template: template:
src: containerd.service.j2 src: containerd.service.j2
dest: /etc/systemd/system/containerd.service dest: /etc/systemd/system/containerd.service
mode: 0644 mode: "0644"
validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:containerd.service'" validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:containerd.service'"
# FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release) # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
# Remove once we drop support for systemd < 250 # Remove once we drop support for systemd < 250
@@ -70,7 +70,7 @@
file: file:
dest: "{{ item }}" dest: "{{ item }}"
state: directory state: directory
mode: 0755 mode: "0755"
owner: root owner: root
group: root group: root
with_items: with_items:
@@ -83,7 +83,7 @@
template: template:
src: http-proxy.conf.j2 src: http-proxy.conf.j2
dest: "{{ containerd_systemd_dir }}/http-proxy.conf" dest: "{{ containerd_systemd_dir }}/http-proxy.conf"
mode: 0644 mode: "0644"
notify: Restart containerd notify: Restart containerd
when: http_proxy is defined or https_proxy is defined when: http_proxy is defined or https_proxy is defined
@@ -102,7 +102,7 @@
content: "{{ item.value }}" content: "{{ item.value }}"
dest: "{{ containerd_cfg_dir }}/{{ item.key }}" dest: "{{ containerd_cfg_dir }}/{{ item.key }}"
owner: "root" owner: "root"
mode: 0644 mode: "0644"
with_dict: "{{ containerd_base_runtime_specs | default({}) }}" with_dict: "{{ containerd_base_runtime_specs | default({}) }}"
notify: Restart containerd notify: Restart containerd
@@ -111,7 +111,7 @@
src: config.toml.j2 src: config.toml.j2
dest: "{{ containerd_cfg_dir }}/config.toml" dest: "{{ containerd_cfg_dir }}/config.toml"
owner: "root" owner: "root"
mode: 0640 mode: "0640"
notify: Restart containerd notify: Restart containerd
- name: Containerd | Configure containerd registries - name: Containerd | Configure containerd registries
@@ -121,13 +121,13 @@
file: file:
path: "{{ containerd_cfg_dir }}/certs.d/{{ item.prefix }}" path: "{{ containerd_cfg_dir }}/certs.d/{{ item.prefix }}"
state: directory state: directory
mode: 0755 mode: "0755"
loop: "{{ containerd_registries_mirrors }}" loop: "{{ containerd_registries_mirrors }}"
- name: Containerd | Write hosts.toml file - name: Containerd | Write hosts.toml file
template: template:
src: hosts.toml.j2 src: hosts.toml.j2
dest: "{{ containerd_cfg_dir }}/certs.d/{{ item.prefix }}/hosts.toml" dest: "{{ containerd_cfg_dir }}/certs.d/{{ item.prefix }}/hosts.toml"
mode: 0640 mode: "0640"
loop: "{{ containerd_registries_mirrors }}" loop: "{{ containerd_registries_mirrors }}"
# you can sometimes end up in a state where everything is installed # you can sometimes end up in a state where everything is installed
@@ -136,8 +136,8 @@
meta: flush_handlers meta: flush_handlers
- name: Containerd | Ensure containerd is started and enabled - name: Containerd | Ensure containerd is started and enabled
systemd: systemd_service:
name: containerd name: containerd
daemon_reload: yes daemon_reload: true
enabled: yes enabled: true
state: started state: started

25
kubespray/project/roles/container-engine/containerd/templates/config.toml.j2
View File

@@ -3,12 +3,20 @@ root = "{{ containerd_storage_dir }}"
state = "{{ containerd_state_dir }}" state = "{{ containerd_state_dir }}"
oom_score = {{ containerd_oom_score }} oom_score = {{ containerd_oom_score }}
{% if containerd_extra_args is defined %}
{{ containerd_extra_args }}
{% endif %}
[grpc] [grpc]
max_recv_message_size = {{ containerd_grpc_max_recv_message_size }} max_recv_message_size = {{ containerd_grpc_max_recv_message_size }}
max_send_message_size = {{ containerd_grpc_max_send_message_size }} max_send_message_size = {{ containerd_grpc_max_send_message_size }}
[debug] [debug]
address = "{{ containerd_debug_address }}"
level = "{{ containerd_debug_level }}" level = "{{ containerd_debug_level }}"
format = "{{ containerd_debug_format }}"
uid = {{ containerd_debug_uid }}
gid = {{ containerd_debug_gid }}
[metrics] [metrics]
address = "{{ containerd_metrics_address }}" address = "{{ containerd_metrics_address }}"
@@ -20,6 +28,11 @@ oom_score = {{ containerd_oom_score }}
max_container_log_line_size = {{ containerd_max_container_log_line_size }} max_container_log_line_size = {{ containerd_max_container_log_line_size }}
enable_unprivileged_ports = {{ containerd_enable_unprivileged_ports | lower }} enable_unprivileged_ports = {{ containerd_enable_unprivileged_ports | lower }}
enable_unprivileged_icmp = {{ containerd_enable_unprivileged_icmp | lower }} enable_unprivileged_icmp = {{ containerd_enable_unprivileged_icmp | lower }}
enable_selinux = {{ containerd_enable_selinux | lower }}
disable_apparmor = {{ containerd_disable_apparmor | lower }}
tolerate_missing_hugetlb_controller = {{ containerd_tolerate_missing_hugetlb_controller | lower }}
disable_hugetlb_controller = {{ containerd_disable_hugetlb_controller | lower }}
image_pull_progress_timeout = "{{ containerd_image_pull_progress_timeout }}"
{% if enable_cdi %} {% if enable_cdi %}
enable_cdi = true enable_cdi = true
cdi_spec_dirs = ["/etc/cdi", "/var/run/cdi"] cdi_spec_dirs = ["/etc/cdi", "/var/run/cdi"]
@@ -92,6 +105,14 @@ oom_score = {{ containerd_oom_score }}
disable = false disable = false
{% endif %} {% endif %}
{% if containerd_extra_args is defined %} {% if containerd_tracing_enabled %}
{{ containerd_extra_args }} [plugins."io.containerd.tracing.processor.v1.otlp"]
endpoint = "{{ containerd_tracing_endpoint }}"
protocol = "{{ containerd_tracing_protocol }}"
{% if containerd_tracing_protocol == "grpc" %}
insecure = false
{% endif %}
[plugins."io.containerd.internal.v1.tracing"]
sampling_ratio = {{ containerd_tracing_sampling_ratio }}
service_name = "{{ containerd_tracing_service_name }}"
{% endif %} {% endif %}

2
kubespray/project/roles/container-engine/containerd/templates/hosts.toml.j2
View File

@@ -1,4 +1,4 @@
server = "https://{{ item.prefix }}" server = "{{ item.server | default("https://" + item.prefix) }}"
{% for mirror in item.mirrors %} {% for mirror in item.mirrors %}
[host."{{ mirror.host }}"] [host."{{ mirror.host }}"]
capabilities = ["{{ ([ mirror.capabilities ] | flatten ) | join('","') }}"] capabilities = ["{{ ([ mirror.capabilities ] | flatten ) | join('","') }}"]

6
kubespray/project/roles/container-engine/cri-dockerd/handlers/main.yml
View File

@@ -1,9 +1,9 @@
--- ---
- name: Cri-dockerd | reload systemd - name: Cri-dockerd | reload systemd
systemd: systemd_service:
name: cri-dockerd name: cri-dockerd
daemon_reload: true daemon_reload: true
masked: no masked: false
listen: Restart and enable cri-dockerd listen: Restart and enable cri-dockerd
- name: Cri-dockerd | restart docker.service - name: Cri-dockerd | restart docker.service
@@ -27,5 +27,5 @@
- name: Cri-dockerd | enable cri-dockerd service - name: Cri-dockerd | enable cri-dockerd service
service: service:
name: cri-dockerd.service name: cri-dockerd.service
enabled: yes enabled: true
listen: Restart and enable cri-dockerd listen: Restart and enable cri-dockerd

6
kubespray/project/roles/container-engine/cri-dockerd/molecule/default/prepare.yml
View File

@@ -28,7 +28,7 @@
src: "{{ item }}" src: "{{ item }}"
dest: "/tmp/{{ item }}" dest: "/tmp/{{ item }}"
owner: root owner: root
mode: 0644 mode: "0644"
with_items: with_items:
- container.json - container.json
- sandbox.json - sandbox.json
@@ -37,12 +37,12 @@
path: /etc/cni/net.d path: /etc/cni/net.d
state: directory state: directory
owner: "{{ kube_owner }}" owner: "{{ kube_owner }}"
mode: 0755 mode: "0755"
- name: Setup CNI - name: Setup CNI
copy: copy:
src: "{{ item }}" src: "{{ item }}"
dest: "/etc/cni/net.d/{{ item }}" dest: "/etc/cni/net.d/{{ item }}"
owner: root owner: root
mode: 0644 mode: "0644"
with_items: with_items:
- 10-mynet.conf - 10-mynet.conf

4
kubespray/project/roles/container-engine/cri-dockerd/tasks/main.yml
View File

@@ -8,7 +8,7 @@
copy: copy:
src: "{{ local_release_dir }}/cri-dockerd" src: "{{ local_release_dir }}/cri-dockerd"
dest: "{{ bin_dir }}/cri-dockerd" dest: "{{ bin_dir }}/cri-dockerd"
mode: 0755 mode: "0755"
remote_src: true remote_src: true
notify: notify:
- Restart and enable cri-dockerd - Restart and enable cri-dockerd
@@ -17,7 +17,7 @@
template: template:
src: "{{ item }}.j2" src: "{{ item }}.j2"
dest: "/etc/systemd/system/{{ item }}" dest: "/etc/systemd/system/{{ item }}"
mode: 0644 mode: "0644"
validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:{{ item }}'" validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:{{ item }}'"
# FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release) # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
# Remove once we drop support for systemd < 250 # Remove once we drop support for systemd < 250

4
kubespray/project/roles/container-engine/cri-o/handlers/main.yml
View File

@@ -1,6 +1,6 @@
--- ---
- name: CRI-O | reload systemd - name: CRI-O | reload systemd
systemd: systemd_service:
daemon_reload: true daemon_reload: true
listen: Restart crio listen: Restart crio
@@ -8,5 +8,5 @@
service: service:
name: crio name: crio
state: restarted state: restarted
enabled: yes enabled: true
listen: Restart crio listen: Restart crio

10
kubespray/project/roles/container-engine/cri-o/molecule/default/prepare.yml
View File

@@ -1,7 +1,7 @@
--- ---
- name: Prepare - name: Prepare
hosts: all hosts: all
gather_facts: False gather_facts: false
become: true become: true
vars: vars:
ignore_assert_errors: true ignore_assert_errors: true
@@ -19,7 +19,7 @@
- name: Prepare CNI - name: Prepare CNI
hosts: all hosts: all
gather_facts: False gather_facts: false
become: true become: true
vars: vars:
ignore_assert_errors: true ignore_assert_errors: true
@@ -33,7 +33,7 @@
src: "{{ item }}" src: "{{ item }}"
dest: "/tmp/{{ item }}" dest: "/tmp/{{ item }}"
owner: root owner: root
mode: 0644 mode: "0644"
with_items: with_items:
- container.json - container.json
- sandbox.json - sandbox.json
@@ -42,12 +42,12 @@
path: /etc/cni/net.d path: /etc/cni/net.d
state: directory state: directory
owner: "{{ kube_owner }}" owner: "{{ kube_owner }}"
mode: 0755 mode: "0755"
- name: Setup CNI - name: Setup CNI
copy: copy:
src: "{{ item }}" src: "{{ item }}"
dest: "/etc/cni/net.d/{{ item }}" dest: "/etc/cni/net.d/{{ item }}"
owner: root owner: root
mode: 0644 mode: "0644"
with_items: with_items:
- 10-mynet.conf - 10-mynet.conf

50
kubespray/project/roles/container-engine/cri-o/tasks/main.yaml
View File

@@ -5,9 +5,9 @@
- name: Cri-o | check if fedora coreos - name: Cri-o | check if fedora coreos
stat: stat:
path: /run/ostree-booted path: /run/ostree-booted
get_attributes: no get_attributes: false
get_checksum: no get_checksum: false
get_mime: no get_mime: false
register: ostree register: ostree
- name: Cri-o | set is_ostree - name: Cri-o | set is_ostree
@@ -56,27 +56,27 @@
file: file:
path: "{{ item }}" path: "{{ item }}"
state: directory state: directory
mode: 0755 mode: "0755"
- name: Cri-o | install cri-o config - name: Cri-o | install cri-o config
template: template:
src: crio.conf.j2 src: crio.conf.j2
dest: /etc/crio/crio.conf dest: /etc/crio/crio.conf
mode: 0644 mode: "0644"
register: config_install register: config_install
- name: Cri-o | install config.json - name: Cri-o | install config.json
template: template:
src: config.json.j2 src: config.json.j2
dest: /etc/crio/config.json dest: /etc/crio/config.json
mode: 0644 mode: "0644"
register: reg_auth_install register: reg_auth_install
- name: Cri-o | copy binaries - name: Cri-o | copy binaries
copy: copy:
src: "{{ local_release_dir }}/cri-o/bin/{{ item }}" src: "{{ local_release_dir }}/cri-o/bin/{{ item }}"
dest: "{{ bin_dir }}/{{ item }}" dest: "{{ bin_dir }}/{{ item }}"
mode: 0755 mode: "0755"
remote_src: true remote_src: true
with_items: with_items:
- "{{ crio_bin_files }}" - "{{ crio_bin_files }}"
@@ -86,10 +86,24 @@
copy: copy:
src: "{{ local_release_dir }}/cri-o/contrib/crio.service" src: "{{ local_release_dir }}/cri-o/contrib/crio.service"
dest: /etc/systemd/system/crio.service dest: /etc/systemd/system/crio.service
mode: 0755 mode: "0755"
remote_src: true remote_src: true
notify: Restart crio notify: Restart crio
- name: Cri-o | configure crio to use kube reserved cgroups
ansible.builtin.copy:
dest: /etc/systemd/system/crio.service.d/00-slice.conf
owner: root
group: root
mode: '0644'
content: |
[Service]
Slice={{ kube_reserved_cgroups_for_service_slice }}
notify: Restart crio
when:
- kube_reserved is defined and kube_reserved is true
- kube_reserved_cgroups_for_service_slice is defined
- name: Cri-o | update the bin dir for crio.service file - name: Cri-o | update the bin dir for crio.service file
replace: replace:
dest: /etc/systemd/system/crio.service dest: /etc/systemd/system/crio.service
@@ -101,7 +115,7 @@
copy: copy:
src: "{{ local_release_dir }}/cri-o/contrib/policy.json" src: "{{ local_release_dir }}/cri-o/contrib/policy.json"
dest: /etc/containers/policy.json dest: /etc/containers/policy.json
mode: 0755 mode: "0755"
remote_src: true remote_src: true
notify: Restart crio notify: Restart crio
@@ -109,7 +123,7 @@
copy: copy:
src: mounts.conf src: mounts.conf
dest: /etc/containers/mounts.conf dest: /etc/containers/mounts.conf
mode: 0644 mode: "0644"
when: when:
- ansible_os_family == 'RedHat' - ansible_os_family == 'RedHat'
notify: Restart crio notify: Restart crio
@@ -119,7 +133,7 @@
path: /etc/containers/oci/hooks.d path: /etc/containers/oci/hooks.d
state: directory state: directory
owner: root owner: root
mode: 0755 mode: "0755"
- name: Cri-o | set overlay driver - name: Cri-o | set overlay driver
community.general.ini_file: community.general.ini_file:
@@ -127,7 +141,7 @@
section: storage section: storage
option: "{{ item.option }}" option: "{{ item.option }}"
value: "{{ item.value }}" value: "{{ item.value }}"
mode: 0644 mode: "0644"
with_items: with_items:
- option: driver - option: driver
value: '"overlay"' value: '"overlay"'
@@ -143,20 +157,20 @@
section: storage.options.overlay section: storage.options.overlay
option: mountopt option: mountopt
value: '{{ ''"nodev"'' if ansible_kernel is version_compare(("4.18" if ansible_os_family == "RedHat" else "4.19"), "<") else ''"nodev,metacopy=on"'' }}' value: '{{ ''"nodev"'' if ansible_kernel is version_compare(("4.18" if ansible_os_family == "RedHat" else "4.19"), "<") else ''"nodev,metacopy=on"'' }}'
mode: 0644 mode: "0644"
- name: Cri-o | create directory registries configs - name: Cri-o | create directory registries configs
file: file:
path: /etc/containers/registries.conf.d path: /etc/containers/registries.conf.d
state: directory state: directory
owner: root owner: root
mode: 0755 mode: "0755"
- name: Cri-o | write registries configs - name: Cri-o | write registries configs
template: template:
src: registry.conf.j2 src: registry.conf.j2
dest: "/etc/containers/registries.conf.d/10-{{ item.prefix | default(item.location) | regex_replace(':', '_') }}.conf" dest: "/etc/containers/registries.conf.d/10-{{ item.prefix | default(item.location) | regex_replace(':|/', '_') }}.conf"
mode: 0644 mode: "0644"
loop: "{{ crio_registries }}" loop: "{{ crio_registries }}"
notify: Restart crio notify: Restart crio
@@ -164,14 +178,14 @@
template: template:
src: unqualified.conf.j2 src: unqualified.conf.j2
dest: "/etc/containers/registries.conf.d/01-unqualified.conf" dest: "/etc/containers/registries.conf.d/01-unqualified.conf"
mode: 0644 mode: "0644"
notify: Restart crio notify: Restart crio
- name: Cri-o | write cri-o proxy drop-in - name: Cri-o | write cri-o proxy drop-in
template: template:
src: http-proxy.conf.j2 src: http-proxy.conf.j2
dest: /etc/systemd/system/crio.service.d/http-proxy.conf dest: /etc/systemd/system/crio.service.d/http-proxy.conf
mode: 0644 mode: "0644"
notify: Restart crio notify: Restart crio
when: http_proxy is defined or https_proxy is defined when: http_proxy is defined or https_proxy is defined

18
kubespray/project/roles/container-engine/cri-o/tasks/setup-amazon.yaml
View File

@@ -8,7 +8,7 @@
lineinfile: lineinfile:
dest: /etc/yum.repos.d/amzn2-extras.repo dest: /etc/yum.repos.d/amzn2-extras.repo
line: "[amzn2extra-docker]" line: "[amzn2extra-docker]"
check_mode: yes check_mode: true
register: amzn2_extras_docker_repo register: amzn2_extras_docker_repo
when: when:
- amzn2_extras_file_stat.stat.exists - amzn2_extras_file_stat.stat.exists
@@ -19,20 +19,8 @@
section: amzn2extra-docker section: amzn2extra-docker
option: enabled option: enabled
value: "0" value: "0"
backup: yes backup: true
mode: 0644 mode: "0644"
when: when:
- amzn2_extras_file_stat.stat.exists - amzn2_extras_file_stat.stat.exists
- not amzn2_extras_docker_repo.changed - not amzn2_extras_docker_repo.changed
- name: Add container-selinux yum repo
yum_repository:
name: copr:copr.fedorainfracloud.org:lsm5:container-selinux
file: _copr_lsm5-container-selinux.repo
description: Copr repo for container-selinux owned by lsm5
baseurl: https://download.copr.fedorainfracloud.org/results/lsm5/container-selinux/epel-7-$basearch/
gpgcheck: yes
gpgkey: https://download.copr.fedorainfracloud.org/results/lsm5/container-selinux/pubkey.gpg
skip_if_unavailable: yes
enabled: yes
repo_gpgcheck: no

8
kubespray/project/roles/container-engine/cri-o/vars/v1.29.yml
View File

@@ -1,8 +1,12 @@
--- ---
crio_conmon: "{{ bin_dir }}/crio-conmon"
# cri-o binary files # cri-o binary files
crio_bin_files: crio_bin_files:
- conmon - crio-conmon
- conmonrs - crio-conmonrs
- crio-crun
- crio-runc
- crio - crio
- pinns - pinns

4
kubespray/project/roles/container-engine/crictl/handlers/main.yml
View File

@@ -1,7 +1,7 @@
--- ---
- name: Get crictl completion - name: Get crictl completion
command: "{{ bin_dir }}/crictl completion" command: "{{ bin_dir }}/crictl completion"
changed_when: False changed_when: false
register: cri_completion register: cri_completion
check_mode: false check_mode: false
@@ -9,4 +9,4 @@
copy: copy:
dest: /etc/bash_completion.d/crictl dest: /etc/bash_completion.d/crictl
content: "{{ cri_completion.stdout }}" content: "{{ cri_completion.stdout }}"
mode: 0644 mode: "0644"

4
kubespray/project/roles/container-engine/crictl/tasks/crictl.yml
View File

@@ -9,13 +9,13 @@
src: crictl.yaml.j2 src: crictl.yaml.j2
dest: /etc/crictl.yaml dest: /etc/crictl.yaml
owner: root owner: root
mode: 0644 mode: "0644"
- name: Copy crictl binary from download dir - name: Copy crictl binary from download dir
copy: copy:
src: "{{ local_release_dir }}/crictl" src: "{{ local_release_dir }}/crictl"
dest: "{{ bin_dir }}/crictl" dest: "{{ bin_dir }}/crictl"
mode: 0755 mode: "0755"
remote_src: true remote_src: true
notify: notify:
- Get crictl completion - Get crictl completion

2
kubespray/project/roles/container-engine/crun/tasks/main.yml
View File

@@ -8,5 +8,5 @@
copy: copy:
src: "{{ downloads.crun.dest }}" src: "{{ downloads.crun.dest }}"
dest: "{{ bin_dir }}/crun" dest: "{{ bin_dir }}/crun"
mode: 0755 mode: "0755"
remote_src: true remote_src: true

19
kubespray/project/roles/container-engine/docker-storage/defaults/main.yml
View File

@@ -1,19 +0,0 @@
---
docker_container_storage_setup_repository: https://github.com/projectatomic/container-storage-setup.git
docker_container_storage_setup_version: v0.6.0
docker_container_storage_setup_profile_name: kubespray
docker_container_storage_setup_storage_driver: devicemapper
docker_container_storage_setup_container_thinpool: docker-pool
# It must be define a disk path for docker_container_storage_setup_devs.
# Otherwise docker-storage-setup will be executed incorrectly.
# docker_container_storage_setup_devs: /dev/vdb
docker_container_storage_setup_data_size: 40%FREE
docker_container_storage_setup_min_data_size: 2G
docker_container_storage_setup_chunk_size: 512K
docker_container_storage_setup_growpart: "false"
docker_container_storage_setup_auto_extend_pool: "yes"
docker_container_storage_setup_pool_autoextend_threshold: 60
docker_container_storage_setup_pool_autoextend_percent: 20
docker_container_storage_setup_device_wait_timeout: 60
docker_container_storage_setup_wipe_signatures: "false"
docker_container_storage_setup_container_root_lv_size: 40%FREE

23
kubespray/project/roles/container-engine/docker-storage/files/install_container_storage_setup.sh
View File

@@ -1,23 +0,0 @@
#!/bin/sh
set -e
repository=${1:-https://github.com/projectatomic/container-storage-setup.git}
version=${2:-master}
profile_name=${3:-kubespray}
dir=`mktemp -d`
export GIT_DIR=$dir/.git
export GIT_WORK_TREE=$dir
git init
git fetch --depth 1 $repository $version
git merge FETCH_HEAD
make -C $dir install
rm -rf /var/lib/container-storage-setup/$profile_name $dir
set +e
/usr/bin/container-storage-setup create $profile_name /etc/sysconfig/docker-storage-setup && /usr/bin/container-storage-setup activate $profile_name
# FIXME: exit status can be 1 for both fatal and non fatal errors in current release,
# could be improved by matching error strings
exit 0

48
kubespray/project/roles/container-engine/docker-storage/tasks/main.yml
View File

@@ -1,48 +0,0 @@
---
- name: Docker-storage-setup | install git and make
with_items: [git, make]
package:
pkg: "{{ item }}"
state: present
- name: Docker-storage-setup | docker-storage-setup sysconfig template
template:
src: docker-storage-setup.j2
dest: /etc/sysconfig/docker-storage-setup
mode: 0644
- name: Docker-storage-override-directory | docker service storage-setup override dir
file:
dest: /etc/systemd/system/docker.service.d
mode: 0755
owner: root
group: root
state: directory
- name: Docker-storage-override | docker service storage-setup override file
copy:
dest: /etc/systemd/system/docker.service.d/override.conf
content: |-
### This file is managed by Ansible
[Service]
EnvironmentFile=-/etc/sysconfig/docker-storage
owner: root
group: root
mode: 0644
# https://docs.docker.com/engine/installation/linux/docker-ce/centos/#install-using-the-repository
- name: Docker-storage-setup | install lvm2
package:
name: lvm2
state: present
- name: Docker-storage-setup | install and run container-storage-setup
become: yes
script: |
install_container_storage_setup.sh \
{{ docker_container_storage_setup_repository }} \
{{ docker_container_storage_setup_version }} \
{{ docker_container_storage_setup_profile_name }}
notify: Docker | reload systemd

35
kubespray/project/roles/container-engine/docker-storage/templates/docker-storage-setup.j2
View File

@@ -1,35 +0,0 @@
{%if docker_container_storage_setup_storage_driver is defined%}STORAGE_DRIVER={{docker_container_storage_setup_storage_driver}}{%endif%}
{%if docker_container_storage_setup_extra_storage_options is defined%}EXTRA_STORAGE_OPTIONS={{docker_container_storage_setup_extra_storage_options}}{%endif%}
{%if docker_container_storage_setup_devs is defined%}DEVS={{docker_container_storage_setup_devs}}{%endif%}
{%if docker_container_storage_setup_container_thinpool is defined%}CONTAINER_THINPOOL={{docker_container_storage_setup_container_thinpool}}{%endif%}
{%if docker_container_storage_setup_vg is defined%}VG={{docker_container_storage_setup_vg}}{%endif%}
{%if docker_container_storage_setup_root_size is defined%}ROOT_SIZE={{docker_container_storage_setup_root_size}}{%endif%}
{%if docker_container_storage_setup_data_size is defined%}DATA_SIZE={{docker_container_storage_setup_data_size}}{%endif%}
{%if docker_container_storage_setup_min_data_size is defined%}MIN_DATA_SIZE={{docker_container_storage_setup_min_data_size}}{%endif%}
{%if docker_container_storage_setup_chunk_size is defined%}CHUNK_SIZE={{docker_container_storage_setup_chunk_size}}{%endif%}
{%if docker_container_storage_setup_growpart is defined%}GROWPART={{docker_container_storage_setup_growpart}}{%endif%}
{%if docker_container_storage_setup_auto_extend_pool is defined%}AUTO_EXTEND_POOL={{docker_container_storage_setup_auto_extend_pool}}{%endif%}
{%if docker_container_storage_setup_pool_autoextend_threshold is defined%}POOL_AUTOEXTEND_THRESHOLD={{docker_container_storage_setup_pool_autoextend_threshold}}{%endif%}
{%if docker_container_storage_setup_pool_autoextend_percent is defined%}POOL_AUTOEXTEND_PERCENT={{docker_container_storage_setup_pool_autoextend_percent}}{%endif%}
{%if docker_container_storage_setup_device_wait_timeout is defined%}DEVICE_WAIT_TIMEOUT={{docker_container_storage_setup_device_wait_timeout}}{%endif%}
{%if docker_container_storage_setup_wipe_signatures is defined%}WIPE_SIGNATURES={{docker_container_storage_setup_wipe_signatures}}{%endif%}
{%if docker_container_storage_setup_container_root_lv_name is defined%}CONTAINER_ROOT_LV_NAME={{docker_container_storage_setup_container_root_lv_name}}{%endif%}
{%if docker_container_storage_setup_container_root_lv_size is defined%}CONTAINER_ROOT_LV_SIZE={{docker_container_storage_setup_container_root_lv_size}}{%endif%}
{%if docker_container_storage_setup_container_root_lv_mount_path is defined%}CONTAINER_ROOT_LV_MOUNT_PATH={{docker_container_storage_setup_container_root_lv_mount_path}}{%endif%}

2
kubespray/project/roles/container-engine/docker/defaults/main.yml
View File

@@ -1,5 +1,5 @@
--- ---
docker_version: '24.0' docker_version: '26.1'
docker_cli_version: "{{ docker_version }}" docker_cli_version: "{{ docker_version }}"
docker_package_info: docker_package_info:

4
kubespray/project/roles/container-engine/docker/handlers/main.yml
View File

@@ -1,9 +1,9 @@
--- ---
- name: Docker | reload systemd - name: Docker | reload systemd
systemd: systemd_service:
name: docker name: docker
daemon_reload: true daemon_reload: true
masked: no masked: false
listen: Restart docker listen: Restart docker
- name: Docker | reload docker.socket - name: Docker | reload docker.socket

2
kubespray/project/roles/container-engine/docker/meta/main.yml
View File

@@ -1,5 +1,3 @@
--- ---
dependencies: dependencies:
- role: container-engine/containerd-common - role: container-engine/containerd-common
- role: container-engine/docker-storage
when: docker_container_storage_setup and ansible_os_family == "RedHat"

34
kubespray/project/roles/container-engine/docker/tasks/main.yml
View File

@@ -2,22 +2,15 @@
- name: Check if fedora coreos - name: Check if fedora coreos
stat: stat:
path: /run/ostree-booted path: /run/ostree-booted
get_attributes: no get_attributes: false
get_checksum: no get_checksum: false
get_mime: no get_mime: false
register: ostree register: ostree
- name: Set is_ostree - name: Set is_ostree
set_fact: set_fact:
is_ostree: "{{ ostree.stat.exists }}" is_ostree: "{{ ostree.stat.exists }}"
- name: Set docker_version for openEuler
set_fact:
docker_version: '19.03'
when: ansible_distribution == "openEuler"
tags:
- facts
- name: Gather os specific variables - name: Gather os specific variables
include_vars: "{{ item }}" include_vars: "{{ item }}"
with_first_found: with_first_found:
@@ -67,6 +60,17 @@
environment: "{{ proxy_env }}" environment: "{{ proxy_env }}"
when: ansible_pkg_mgr == 'apt' when: ansible_pkg_mgr == 'apt'
# ref to https://github.com/kubernetes-sigs/kubespray/issues/11086
- name: Remove the archived debian apt repository
lineinfile:
path: /etc/apt/sources.list
regexp: 'buster-backports'
state: absent
backup: true
when:
- ansible_os_family == 'Debian'
- ansible_distribution_release == "buster"
- name: Ensure docker-ce repository is enabled - name: Ensure docker-ce repository is enabled
apt_repository: apt_repository:
repo: "{{ item }}" repo: "{{ item }}"
@@ -78,14 +82,14 @@
template: template:
src: "fedora_docker.repo.j2" src: "fedora_docker.repo.j2"
dest: "{{ yum_repo_dir }}/docker.repo" dest: "{{ yum_repo_dir }}/docker.repo"
mode: 0644 mode: "0644"
when: ansible_distribution == "Fedora" and not is_ostree when: ansible_distribution == "Fedora" and not is_ostree
- name: Configure docker repository on RedHat/CentOS/OracleLinux/AlmaLinux/KylinLinux - name: Configure docker repository on RedHat/CentOS/OracleLinux/AlmaLinux/KylinLinux
template: template:
src: "rh_docker.repo.j2" src: "rh_docker.repo.j2"
dest: "{{ yum_repo_dir }}/docker-ce.repo" dest: "{{ yum_repo_dir }}/docker-ce.repo"
mode: 0644 mode: "0644"
when: when:
- ansible_os_family == "RedHat" - ansible_os_family == "RedHat"
- ansible_distribution != "Fedora" - ansible_distribution != "Fedora"
@@ -96,7 +100,11 @@
name: "{{ item }}" name: "{{ item }}"
selection: install selection: install
when: ansible_pkg_mgr == 'apt' when: ansible_pkg_mgr == 'apt'
register: ret
changed_when: false changed_when: false
failed_when:
- ret is failed
- ret.msg != ( "Failed to find package '" + item + "' to perform selection 'install'." )
with_items: with_items:
- "{{ containerd_package }}" - "{{ containerd_package }}"
- docker-ce - docker-ce
@@ -175,7 +183,7 @@
- name: Ensure docker service is started and enabled - name: Ensure docker service is started and enabled
service: service:
name: "{{ item }}" name: "{{ item }}"
enabled: yes enabled: true
state: started state: started
with_items: with_items:
- docker - docker

6
kubespray/project/roles/container-engine/docker/tasks/reset.yml
View File

@@ -6,8 +6,8 @@
- name: Docker | Find docker packages - name: Docker | Find docker packages
set_fact: set_fact:
docker_packages_list: "{{ ansible_facts.packages.keys() | select('search', '^docker*') }}" docker_packages_list: "{{ ansible_facts.packages.keys() | select('search', '^docker+') }}"
containerd_package: "{{ ansible_facts.packages.keys() | select('search', '^containerd*') }}" containerd_package: "{{ ansible_facts.packages.keys() | select('search', '^containerd+') }}"
- name: Docker | Stop all running container - name: Docker | Stop all running container
shell: "set -o pipefail && {{ docker_bin_dir }}/docker ps -q | xargs -r {{ docker_bin_dir }}/docker kill" shell: "set -o pipefail && {{ docker_bin_dir }}/docker ps -q | xargs -r {{ docker_bin_dir }}/docker kill"
@@ -102,5 +102,5 @@
ignore_errors: true # noqa ignore-errors ignore_errors: true # noqa ignore-errors
- name: Docker | systemctl daemon-reload # noqa no-handler - name: Docker | systemctl daemon-reload # noqa no-handler
systemd: systemd_service:
daemon_reload: true daemon_reload: true

8
kubespray/project/roles/container-engine/docker/tasks/set_facts_dns.yml
View File

@@ -21,9 +21,9 @@
shell: set -o pipefail && grep "^nameserver" /etc/resolv.conf | sed -r 's/^nameserver\s*([^#\s]+)\s*(#.*)?/\1/' shell: set -o pipefail && grep "^nameserver" /etc/resolv.conf | sed -r 's/^nameserver\s*([^#\s]+)\s*(#.*)?/\1/'
args: args:
executable: /bin/bash executable: /bin/bash
changed_when: False changed_when: false
register: system_nameservers register: system_nameservers
check_mode: no check_mode: false
- name: Check system search domains - name: Check system search domains
# noqa risky-shell-pipe - if resolf.conf has no search domain, grep will exit 1 which would force us to add failed_when: false # noqa risky-shell-pipe - if resolf.conf has no search domain, grep will exit 1 which would force us to add failed_when: false
@@ -31,9 +31,9 @@
shell: grep "^search" /etc/resolv.conf | sed -r 's/^search\s*([^#]+)\s*(#.*)?/\1/' shell: grep "^search" /etc/resolv.conf | sed -r 's/^search\s*([^#]+)\s*(#.*)?/\1/'
args: args:
executable: /bin/bash executable: /bin/bash
changed_when: False changed_when: false
register: system_search_domains register: system_search_domains
check_mode: no check_mode: false
- name: Add system nameservers to docker options - name: Add system nameservers to docker options
set_fact: set_fact:

24
kubespray/project/roles/container-engine/docker/tasks/systemd.yml
View File

@@ -3,31 +3,21 @@
file: file:
path: /etc/systemd/system/docker.service.d path: /etc/systemd/system/docker.service.d
state: directory state: directory
mode: 0755 mode: "0755"
- name: Write docker proxy drop-in - name: Write docker proxy drop-in
template: template:
src: http-proxy.conf.j2 src: http-proxy.conf.j2
dest: /etc/systemd/system/docker.service.d/http-proxy.conf dest: /etc/systemd/system/docker.service.d/http-proxy.conf
mode: 0644 mode: "0644"
notify: Restart docker notify: Restart docker
when: http_proxy is defined or https_proxy is defined when: http_proxy is defined or https_proxy is defined
- name: Get systemd version
# noqa command-instead-of-module - systemctl is called intentionally here
shell: set -o pipefail && systemctl --version | head -n 1 | cut -d " " -f 2
args:
executable: /bin/bash
register: systemd_version
when: not is_ostree
changed_when: false
check_mode: false
- name: Write docker.service systemd file - name: Write docker.service systemd file
template: template:
src: docker.service.j2 src: docker.service.j2
dest: /etc/systemd/system/docker.service dest: /etc/systemd/system/docker.service
mode: 0644 mode: "0644"
register: docker_service_file register: docker_service_file
notify: Restart docker notify: Restart docker
when: when:
@@ -38,14 +28,14 @@
template: template:
src: docker-options.conf.j2 src: docker-options.conf.j2
dest: "/etc/systemd/system/docker.service.d/docker-options.conf" dest: "/etc/systemd/system/docker.service.d/docker-options.conf"
mode: 0644 mode: "0644"
notify: Restart docker notify: Restart docker
- name: Write docker dns systemd drop-in - name: Write docker dns systemd drop-in
template: template:
src: docker-dns.conf.j2 src: docker-dns.conf.j2
dest: "/etc/systemd/system/docker.service.d/docker-dns.conf" dest: "/etc/systemd/system/docker.service.d/docker-dns.conf"
mode: 0644 mode: "0644"
notify: Restart docker notify: Restart docker
when: dns_mode != 'none' and resolvconf_mode == 'docker_dns' when: dns_mode != 'none' and resolvconf_mode == 'docker_dns'
@@ -53,14 +43,14 @@
copy: copy:
src: cleanup-docker-orphans.sh src: cleanup-docker-orphans.sh
dest: "{{ bin_dir }}/cleanup-docker-orphans.sh" dest: "{{ bin_dir }}/cleanup-docker-orphans.sh"
mode: 0755 mode: "0755"
when: docker_orphan_clean_up | bool when: docker_orphan_clean_up | bool
- name: Write docker orphan clean up systemd drop-in - name: Write docker orphan clean up systemd drop-in
template: template:
src: docker-orphan-cleanup.conf.j2 src: docker-orphan-cleanup.conf.j2
dest: "/etc/systemd/system/docker.service.d/docker-orphan-cleanup.conf" dest: "/etc/systemd/system/docker.service.d/docker-orphan-cleanup.conf"
mode: 0644 mode: "0644"
notify: Restart docker notify: Restart docker
when: docker_orphan_clean_up | bool when: docker_orphan_clean_up | bool

16
kubespray/project/roles/container-engine/docker/templates/docker.service.j2
View File

@@ -1,19 +1,11 @@
[Unit] [Unit]
Description=Docker Application Container Engine Description=Docker Application Container Engine
Documentation=http://docs.docker.com Documentation=http://docs.docker.com
{% if ansible_os_family == "RedHat" %} After=network.target docker.socket containerd.service lvm2-monitor.service SuSEfirewall2.service
After=network.target {{ ' docker-storage-setup.service' if docker_container_storage_setup else '' }} containerd.service {% if ansible_os_family != "Suse" %}
BindsTo=containerd.service BindsTo=containerd.service
{{ 'Wants=docker-storage-setup.service' if docker_container_storage_setup else '' }}
{% elif ansible_os_family == "Debian" %}
After=network.target docker.socket containerd.service
BindsTo=containerd.service
Wants=docker.socket
{% elif ansible_os_family == "Suse" %}
After=network.target lvm2-monitor.service SuSEfirewall2.service
# After=network.target containerd.service
# BindsTo=containerd.service
{% endif %} {% endif %}
Wants=docker.socket
[Service] [Service]
Type=notify Type=notify
@@ -31,9 +23,7 @@ ExecStart={{ docker_bin_dir }}/dockerd \
$DOCKER_OPTS \ $DOCKER_OPTS \
$DOCKER_STORAGE_OPTIONS \ $DOCKER_STORAGE_OPTIONS \
$DOCKER_DNS_OPTIONS $DOCKER_DNS_OPTIONS
{% if not is_ostree and systemd_version.stdout|int >= 226 %}
TasksMax=infinity TasksMax=infinity
{% endif %}
LimitNOFILE=1048576 LimitNOFILE=1048576
LimitNPROC=1048576 LimitNPROC=1048576
LimitCORE=infinity LimitCORE=infinity

2
kubespray/project/roles/container-engine/docker/vars/amazon.yml
View File

@@ -6,6 +6,8 @@ docker_versioned_pkg:
'18.09': docker-18.09.9ce-2.amzn2 '18.09': docker-18.09.9ce-2.amzn2
'19.03': docker-19.03.13ce-1.amzn2 '19.03': docker-19.03.13ce-1.amzn2
'20.10': docker-20.10.7-5.amzn2 '20.10': docker-20.10.7-5.amzn2
'24.0': docker-24.0.5-1.amzn2
'25.0': docker-25.0.3-1.amzn2
docker_version: "latest" docker_version: "latest"

18
kubespray/project/roles/container-engine/docker/vars/debian.yml
View File

@@ -22,9 +22,11 @@ containerd_versioned_pkg:
'1.6.15': "{{ containerd_package }}=1.6.15-1" '1.6.15': "{{ containerd_package }}=1.6.15-1"
'1.6.16': "{{ containerd_package }}=1.6.16-1" '1.6.16': "{{ containerd_package }}=1.6.16-1"
'1.6.18': "{{ containerd_package }}=1.6.18-1" '1.6.18': "{{ containerd_package }}=1.6.18-1"
'1.6.28': "{{ containerd_package }}=1.6.28-1" '1.6.28': "{{ containerd_package }}=1.6.28-2"
'stable': "{{ containerd_package }}=1.6.28-1" '1.6.31': "{{ containerd_package }}=1.6.31-1"
'edge': "{{ containerd_package }}=1.6.28-1" '1.6.32': "{{ containerd_package }}=1.6.32-1"
'stable': "{{ containerd_package }}=1.6.32-1"
'edge': "{{ containerd_package }}=1.6.32-1"
# https://download.docker.com/linux/debian/ # https://download.docker.com/linux/debian/
docker_versioned_pkg: docker_versioned_pkg:
@@ -34,6 +36,9 @@ docker_versioned_pkg:
'20.10': docker-ce=5:20.10.20~3-0~debian-{{ ansible_distribution_release | lower }} '20.10': docker-ce=5:20.10.20~3-0~debian-{{ ansible_distribution_release | lower }}
'23.0': docker-ce=5:23.0.6-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} '23.0': docker-ce=5:23.0.6-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
'24.0': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} '24.0': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
'25.0': docker-ce=5:25.0.5-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
'26.0': docker-ce=5:26.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
'26.1': docker-ce=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
'stable': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} 'stable': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
'edge': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} 'edge': docker-ce=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
@@ -44,8 +49,11 @@ docker_cli_versioned_pkg:
'20.10': docker-ce-cli=5:20.10.20~3-0~debian-{{ ansible_distribution_release | lower }} '20.10': docker-ce-cli=5:20.10.20~3-0~debian-{{ ansible_distribution_release | lower }}
'23.0': docker-ce-cli=5:23.0.6-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} '23.0': docker-ce-cli=5:23.0.6-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
'24.0': docker-ce-cli=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} '24.0': docker-ce-cli=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
'stable': docker-ce-cli=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} '25.0': docker-ce-cli=5:25.0.5-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
'edge': docker-ce-cli=5:24.0.9-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }} '26.0': docker-ce-cli=5:26.0.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
'26.1': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
'stable': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
'edge': docker-ce-cli=5:26.1.2-1~debian.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release | lower }}
docker_package_info: docker_package_info:
pkgs: pkgs:

20
kubespray/project/roles/container-engine/docker/vars/fedora.yml
View File

@@ -22,9 +22,11 @@ containerd_versioned_pkg:
'1.6.15': "{{ containerd_package }}-1.6.15-3.1.fc{{ ansible_distribution_major_version }}" '1.6.15': "{{ containerd_package }}-1.6.15-3.1.fc{{ ansible_distribution_major_version }}"
'1.6.16': "{{ containerd_package }}-1.6.16-3.1.fc{{ ansible_distribution_major_version }}" '1.6.16': "{{ containerd_package }}-1.6.16-3.1.fc{{ ansible_distribution_major_version }}"
'1.6.18': "{{ containerd_package }}-1.6.18-3.1.fc{{ ansible_distribution_major_version }}" '1.6.18': "{{ containerd_package }}-1.6.18-3.1.fc{{ ansible_distribution_major_version }}"
'1.6.28': "{{ containerd_package }}-1.6.28-3.1.fc{{ ansible_distribution_major_version }}" '1.6.28': "{{ containerd_package }}-1.6.28-3.2.fc{{ ansible_distribution_major_version }}"
'stable': "{{ containerd_package }}-1.6.28-3.1.fc{{ ansible_distribution_major_version }}" '1.6.31': "{{ containerd_package }}-1.6.31-3.1.fc{{ ansible_distribution_major_version }}"
'edge': "{{ containerd_package }}-1.6.28-3.1.fc{{ ansible_distribution_major_version }}" '1.6.32': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}"
'stable': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}"
'edge': "{{ containerd_package }}-1.6.32-3.1.fc{{ ansible_distribution_major_version }}"
# https://docs.docker.com/install/linux/docker-ce/fedora/ # https://docs.docker.com/install/linux/docker-ce/fedora/
# https://download.docker.com/linux/fedora/<fedora-version>/x86_64/stable/Packages/ # https://download.docker.com/linux/fedora/<fedora-version>/x86_64/stable/Packages/
@@ -34,8 +36,10 @@ docker_versioned_pkg:
'20.10': docker-ce-20.10.20-3.fc{{ ansible_distribution_major_version }} '20.10': docker-ce-20.10.20-3.fc{{ ansible_distribution_major_version }}
'23.0': docker-ce-3:23.0.6-1.fc{{ ansible_distribution_major_version }} '23.0': docker-ce-3:23.0.6-1.fc{{ ansible_distribution_major_version }}
'24.0': docker-ce-3:24.0.9-1.fc{{ ansible_distribution_major_version }} '24.0': docker-ce-3:24.0.9-1.fc{{ ansible_distribution_major_version }}
'stable': docker-ce-3:24.0.9-1.fc{{ ansible_distribution_major_version }} '26.0': docker-ce-3:26.0.2-1.fc{{ ansible_distribution_major_version }}
'edge': docker-ce-3:24.0.9-1.fc{{ ansible_distribution_major_version }} '26.1': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }}
'stable': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }}
'edge': docker-ce-3:26.1.2-1.fc{{ ansible_distribution_major_version }}
docker_cli_versioned_pkg: docker_cli_versioned_pkg:
'latest': docker-ce-cli 'latest': docker-ce-cli
@@ -43,8 +47,10 @@ docker_cli_versioned_pkg:
'20.10': docker-ce-cli-20.10.20-3.fc{{ ansible_distribution_major_version }} '20.10': docker-ce-cli-20.10.20-3.fc{{ ansible_distribution_major_version }}
'23.0': docker-ce-cli-1:23.0.6-1.fc{{ ansible_distribution_major_version }} '23.0': docker-ce-cli-1:23.0.6-1.fc{{ ansible_distribution_major_version }}
'24.0': docker-ce-cli-1:24.0.9-1.fc{{ ansible_distribution_major_version }} '24.0': docker-ce-cli-1:24.0.9-1.fc{{ ansible_distribution_major_version }}
'stable': docker-ce-cli-1:24.0.9-1.fc{{ ansible_distribution_major_version }} '26.0': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
'edge': docker-ce-cli-1:24.0.9-1.fc{{ ansible_distribution_major_version }} '26.1': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
'stable': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
'edge': docker-ce-cli-1:26.0.2-1.fc{{ ansible_distribution_major_version }}
docker_package_info: docker_package_info:
enablerepo: "docker-ce" enablerepo: "docker-ce"

86
kubespray/project/roles/container-engine/docker/vars/kylin.yml
View File

@@ -1,54 +1,62 @@
--- ---
docker_version: 26.1
docker_cli_version: "{{ docker_version }}"
docker_rh_repo_base_url: 'https://download.docker.com/linux/centos/8/$basearch/stable'
# containerd versions are only relevant for docker # containerd versions are only relevant for docker
containerd_versioned_pkg: containerd_versioned_pkg:
'latest': "{{ containerd_package }}" 'latest': "{{ containerd_package }}"
'1.3.7': "{{ containerd_package }}-1.3.7-3.1.el{{ ansible_distribution_major_version }}" '1.3.7': "{{ containerd_package }}-1.3.7-3.1.el8"
'1.3.9': "{{ containerd_package }}-1.3.9-3.1.el{{ ansible_distribution_major_version }}" '1.3.9': "{{ containerd_package }}-1.3.9-3.1.el8"
'1.4.3': "{{ containerd_package }}-1.4.3-3.2.el{{ ansible_distribution_major_version }}" '1.4.3': "{{ containerd_package }}-1.4.3-3.2.el8"
'1.4.4': "{{ containerd_package }}-1.4.4-3.1.el{{ ansible_distribution_major_version }}" '1.4.4': "{{ containerd_package }}-1.4.4-3.1.el8"
'1.4.6': "{{ containerd_package }}-1.4.6-3.1.el{{ ansible_distribution_major_version }}" '1.4.6': "{{ containerd_package }}-1.4.6-3.1.el8"
'1.4.9': "{{ containerd_package }}-1.4.9-3.1.el{{ ansible_distribution_major_version }}" '1.4.9': "{{ containerd_package }}-1.4.9-3.1.el8"
'1.4.12': "{{ containerd_package }}-1.4.12-3.1.el{{ ansible_distribution_major_version }}" '1.4.12': "{{ containerd_package }}-1.4.12-3.1.el8"
'1.6.4': "{{ containerd_package }}-1.6.4-3.1.el{{ ansible_distribution_major_version }}" '1.6.4': "{{ containerd_package }}-1.6.4-3.1.el8"
'1.6.6': "{{ containerd_package }}-1.6.6-3.1.el{{ ansible_distribution_major_version }}" '1.6.6': "{{ containerd_package }}-1.6.6-3.1.el8"
'1.6.7': "{{ containerd_package }}-1.6.7-3.1.el{{ ansible_distribution_major_version }}" '1.6.7': "{{ containerd_package }}-1.6.7-3.1.el8"
'1.6.8': "{{ containerd_package }}-1.6.8-3.1.el{{ ansible_distribution_major_version }}" '1.6.8': "{{ containerd_package }}-1.6.8-3.1.el8"
'1.6.9': "{{ containerd_package }}-1.6.9-3.1.el{{ ansible_distribution_major_version }}" '1.6.9': "{{ containerd_package }}-1.6.9-3.1.el8"
'1.6.10': "{{ containerd_package }}-1.6.10-3.1.el{{ ansible_distribution_major_version }}" '1.6.10': "{{ containerd_package }}-1.6.10-3.1.el8"
'1.6.11': "{{ containerd_package }}-1.6.11-3.1.el{{ ansible_distribution_major_version }}" '1.6.11': "{{ containerd_package }}-1.6.11-3.1.el8"
'1.6.12': "{{ containerd_package }}-1.6.12-3.1.el{{ ansible_distribution_major_version }}" '1.6.12': "{{ containerd_package }}-1.6.12-3.1.el8"
'1.6.13': "{{ containerd_package }}-1.6.13-3.1.el{{ ansible_distribution_major_version }}" '1.6.13': "{{ containerd_package }}-1.6.13-3.1.el8"
'1.6.14': "{{ containerd_package }}-1.6.14-3.1.el{{ ansible_distribution_major_version }}" '1.6.14': "{{ containerd_package }}-1.6.14-3.1.el8"
'1.6.15': "{{ containerd_package }}-1.6.15-3.1.el{{ ansible_distribution_major_version }}" '1.6.15': "{{ containerd_package }}-1.6.15-3.1.el8"
'1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_distribution_major_version }}" '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el8"
'1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_distribution_major_version }}" '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el8"
'1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}" '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el8"
'stable': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}" '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el8"
'edge': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}" '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el8"
'stable': "{{ containerd_package }}-1.6.32-3.1.el8"
docker_version: 19.03 'edge': "{{ containerd_package }}-1.6.32-3.1.el8"
docker_cli_version: 19.03
# https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package # https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package
# https://download.docker.com/linux/centos/<centos_version>>/x86_64/stable/Packages/ # https://download.docker.com/linux/centos/8/x86_64/stable/Packages/
# or do 'yum --showduplicates list docker-engine' # or do 'yum --showduplicates list docker-engine'
docker_versioned_pkg: docker_versioned_pkg:
'latest': docker-ce 'latest': docker-ce
'18.09': docker-ce-3:18.09.9-3.el{{ ansible_distribution_major_version }} '18.09': docker-ce-3:18.09.9-3.el8
'19.03': docker-ce-3:19.03.15-3.el{{ ansible_distribution_major_version }} '19.03': docker-ce-3:19.03.15-3.el8
'23.0': docker-ce-3:23.0.6-1.el{{ ansible_distribution_major_version }} '23.0': docker-ce-3:23.0.6-1.el8
'24.0': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }} '24.0': docker-ce-3:24.0.9-1.el8
'stable': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }} '26.0': docker-ce-26.0.2-1.el8
'edge': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }} '26.1': docker-ce-26.1.2-1.el8
'stable': docker-ce-26.1.2-1.el8
'edge': docker-ce-26.1.2-1.el8
docker_cli_versioned_pkg: docker_cli_versioned_pkg:
'latest': docker-ce-cli 'latest': docker-ce-cli
'18.09': docker-ce-cli-1:18.09.9-3.el{{ ansible_distribution_major_version }} '18.09': docker-ce-cli-1:18.09.9-3.el8
'19.03': docker-ce-cli-1:19.03.15-3.el{{ ansible_distribution_major_version }} '19.03': docker-ce-cli-1:19.03.15-3.el8
'23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_distribution_major_version }} '23.0': docker-ce-cli-1:23.0.6-1.el8
'24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }} '24.0': docker-ce-cli-1:24.0.9-1.el8
'stable': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }} '26.0': docker-ce-cli-26.0.2-1.el8
'edge': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }} '26.1': docker-ce-cli-26.1.2-1.el8
'stable': docker-ce-cli-26.1.2-1.el8
'edge': docker-ce-cli-26.1.2-1.el8
docker_package_info: docker_package_info:
enablerepo: "docker-ce" enablerepo: "docker-ce"

1
kubespray/project/roles/container-engine/docker/vars/openeuler.yml Symbolic link
View File

@@ -0,0 +1 @@
kylin.yml

18
kubespray/project/roles/container-engine/docker/vars/redhat-7.yml
View File

@@ -23,8 +23,10 @@ containerd_versioned_pkg:
'1.6.16': "{{ containerd_package }}-1.6.16-3.1.el7" '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el7"
'1.6.18': "{{ containerd_package }}-1.6.18-3.1.el7" '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el7"
'1.6.28': "{{ containerd_package }}-1.6.28-3.1.el7" '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el7"
'stable': "{{ containerd_package }}-1.6.28-3.1.el7" '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el7"
'edge': "{{ containerd_package }}-1.6.18-3.1.el7" '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el7"
'stable': "{{ containerd_package }}-1.6.32-3.1.el7"
'edge': "{{ containerd_package }}-1.6.32-3.1.el7"
# https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package # https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package
# https://download.docker.com/linux/centos/<centos_version>>/x86_64/stable/Packages/ # https://download.docker.com/linux/centos/<centos_version>>/x86_64/stable/Packages/
@@ -36,8 +38,10 @@ docker_versioned_pkg:
'20.10': docker-ce-20.10.20-3.el7 '20.10': docker-ce-20.10.20-3.el7
'23.0': docker-ce-23.0.6-1.el7 '23.0': docker-ce-23.0.6-1.el7
'24.0': docker-ce-24.0.9-1.el7 '24.0': docker-ce-24.0.9-1.el7
'stable': docker-ce-24.0.9-1.el7 '26.0': docker-ce-26.0.2-1.el7
'edge': docker-ce-24.0.9-1.el7 '26.1': docker-ce-26.1.2-1.el7
'stable': docker-ce-26.1.2-1.el7
'edge': docker-ce-26.1.2-1.el7
docker_cli_versioned_pkg: docker_cli_versioned_pkg:
'latest': docker-ce-cli 'latest': docker-ce-cli
@@ -46,8 +50,10 @@ docker_cli_versioned_pkg:
'20.10': docker-ce-cli-20.10.20-3.el7 '20.10': docker-ce-cli-20.10.20-3.el7
'23.0': docker-ce-cli-23.0.6-1.el7 '23.0': docker-ce-cli-23.0.6-1.el7
'24.0': docker-ce-cli-24.0.9-1.el7 '24.0': docker-ce-cli-24.0.9-1.el7
'stable': docker-ce-cli-24.0.9-1.el7 '26.0': docker-ce-cli-26.0.2-1.el7
'edge': docker-ce-cli-24.0.9-1.el7 '26.1': docker-ce-cli-26.1.2-1.el7
'stable': docker-ce-cli-26.1.2-1.el7
'edge': docker-ce-cli-26.1.2-1.el7
docker_package_info: docker_package_info:
enablerepo: "docker-ce" enablerepo: "docker-ce"

18
kubespray/project/roles/container-engine/docker/vars/redhat.yml
View File

@@ -23,8 +23,10 @@ containerd_versioned_pkg:
'1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_distribution_major_version }}" '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_distribution_major_version }}"
'1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_distribution_major_version }}" '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_distribution_major_version }}"
'1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}" '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
'stable': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}" '1.6.31': "{{ containerd_package }}-1.6.31-3.1.el{{ ansible_distribution_major_version }}"
'edge': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}" '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
'stable': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
'edge': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
# https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package # https://docs.docker.com/engine/installation/linux/centos/#install-from-a-package
# https://download.docker.com/linux/centos/<centos_version>>/x86_64/stable/Packages/ # https://download.docker.com/linux/centos/<centos_version>>/x86_64/stable/Packages/
@@ -36,8 +38,10 @@ docker_versioned_pkg:
'20.10': docker-ce-3:20.10.20-3.el{{ ansible_distribution_major_version }} '20.10': docker-ce-3:20.10.20-3.el{{ ansible_distribution_major_version }}
'23.0': docker-ce-3:23.0.6-1.el{{ ansible_distribution_major_version }} '23.0': docker-ce-3:23.0.6-1.el{{ ansible_distribution_major_version }}
'24.0': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }} '24.0': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }}
'stable': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }} '26.0': docker-ce-3:26.0.2-1.el{{ ansible_distribution_major_version }}
'edge': docker-ce-3:24.0.9-1.el{{ ansible_distribution_major_version }} '26.1': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }}
'stable': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }}
'edge': docker-ce-3:26.1.2-1.el{{ ansible_distribution_major_version }}
docker_cli_versioned_pkg: docker_cli_versioned_pkg:
'latest': docker-ce-cli 'latest': docker-ce-cli
@@ -46,8 +50,10 @@ docker_cli_versioned_pkg:
'20.10': docker-ce-cli-1:20.10.20-3.el{{ ansible_distribution_major_version }} '20.10': docker-ce-cli-1:20.10.20-3.el{{ ansible_distribution_major_version }}
'23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_distribution_major_version }} '23.0': docker-ce-cli-1:23.0.6-1.el{{ ansible_distribution_major_version }}
'24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }} '24.0': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }}
'stable': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }} '26.0': docker-ce-cli-1:26.0.2-1.el{{ ansible_distribution_major_version }}
'edge': docker-ce-cli-1:24.0.9-1.el{{ ansible_distribution_major_version }} '26.1': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }}
'stable': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }}
'edge': docker-ce-cli-1:26.1.2-1.el{{ ansible_distribution_major_version }}
docker_package_info: docker_package_info:
enablerepo: "docker-ce" enablerepo: "docker-ce"

20
kubespray/project/roles/container-engine/docker/vars/ubuntu.yml
View File

@@ -22,9 +22,11 @@ containerd_versioned_pkg:
'1.6.15': "{{ containerd_package }}=1.6.15-1" '1.6.15': "{{ containerd_package }}=1.6.15-1"
'1.6.16': "{{ containerd_package }}=1.6.16-1" '1.6.16': "{{ containerd_package }}=1.6.16-1"
'1.6.18': "{{ containerd_package }}=1.6.18-1" '1.6.18': "{{ containerd_package }}=1.6.18-1"
'1.6.28': "{{ containerd_package }}=1.6.28-1" '1.6.28': "{{ containerd_package }}=1.6.28-2"
'stable': "{{ containerd_package }}=1.6.28-1" '1.6.31': "{{ containerd_package }}=1.6.31-1"
'edge': "{{ containerd_package }}=1.6.28-1" '1.6.32': "{{ containerd_package }}=1.6.32-1"
'stable': "{{ containerd_package }}=1.6.32-1"
'edge': "{{ containerd_package }}=1.6.32-1"
# https://download.docker.com/linux/ubuntu/ # https://download.docker.com/linux/ubuntu/
docker_versioned_pkg: docker_versioned_pkg:
@@ -34,8 +36,10 @@ docker_versioned_pkg:
'20.10': docker-ce=5:20.10.20~3-0~ubuntu-{{ ansible_distribution_release | lower }} '20.10': docker-ce=5:20.10.20~3-0~ubuntu-{{ ansible_distribution_release | lower }}
'23.0': docker-ce=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} '23.0': docker-ce=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
'24.0': docker-ce=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} '24.0': docker-ce=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
'stable': docker-ce=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} '26.0': docker-ce=5:26.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
'edge': docker-ce=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} '26.1': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
'stable': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
'edge': docker-ce=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
docker_cli_versioned_pkg: docker_cli_versioned_pkg:
'latest': docker-ce-cli 'latest': docker-ce-cli
@@ -44,8 +48,10 @@ docker_cli_versioned_pkg:
'20.10': docker-ce-cli=5:20.10.20~3-0~ubuntu-{{ ansible_distribution_release | lower }} '20.10': docker-ce-cli=5:20.10.20~3-0~ubuntu-{{ ansible_distribution_release | lower }}
'23.0': docker-ce-cli=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} '23.0': docker-ce-cli=5:23.0.6-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
'24.0': docker-ce-cli=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} '24.0': docker-ce-cli=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
'stable': docker-ce-cli=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} '26.0': docker-ce-cli=5:26.0.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
'edge': docker-ce-cli=5:24.0.9-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }} '26.1': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
'stable': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
'edge': docker-ce-cli=5:26.1.2-1~ubuntu.{{ ansible_distribution_version }}~{{ ansible_distribution_release | lower }}
docker_package_info: docker_package_info:
pkgs: pkgs:

5
kubespray/project/roles/container-engine/docker/vars/uniontech.yml
View File

@@ -21,8 +21,9 @@ containerd_versioned_pkg:
'1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_distribution_major_version }}" '1.6.16': "{{ containerd_package }}-1.6.16-3.1.el{{ ansible_distribution_major_version }}"
'1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_distribution_major_version }}" '1.6.18': "{{ containerd_package }}-1.6.18-3.1.el{{ ansible_distribution_major_version }}"
'1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}" '1.6.28': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}"
'stable': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}" '1.6.32': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
'edge': "{{ containerd_package }}-1.6.28-3.1.el{{ ansible_distribution_major_version }}" 'stable': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
'edge': "{{ containerd_package }}-1.6.32-3.1.el{{ ansible_distribution_major_version }}"
docker_version: 19.03 docker_version: 19.03
docker_cli_version: 19.03 docker_cli_version: 19.03

6
kubespray/project/roles/container-engine/gvisor/molecule/default/prepare.yml
View File

@@ -29,7 +29,7 @@
src: "{{ item }}" src: "{{ item }}"
dest: "/tmp/{{ item }}" dest: "/tmp/{{ item }}"
owner: root owner: root
mode: 0644 mode: "0644"
with_items: with_items:
- container.json - container.json
- sandbox.json - sandbox.json
@@ -38,12 +38,12 @@
path: /etc/cni/net.d path: /etc/cni/net.d
state: directory state: directory
owner: root owner: root
mode: 0755 mode: "0755"
- name: Setup CNI - name: Setup CNI
copy: copy:
src: "{{ item }}" src: "{{ item }}"
dest: "/etc/cni/net.d/{{ item }}" dest: "/etc/cni/net.d/{{ item }}"
owner: root owner: root
mode: 0644 mode: "0644"
with_items: with_items:
- 10-mynet.conf - 10-mynet.conf

4
kubespray/project/roles/container-engine/gvisor/tasks/main.yml
View File

@@ -13,8 +13,8 @@
copy: copy:
src: "{{ item.src }}" src: "{{ item.src }}"
dest: "{{ bin_dir }}/{{ item.dest }}" dest: "{{ bin_dir }}/{{ item.dest }}"
mode: 0755 mode: "0755"
remote_src: yes remote_src: true
with_items: with_items:
- { src: "{{ downloads.gvisor_runsc.dest }}", dest: "runsc" } - { src: "{{ downloads.gvisor_runsc.dest }}", dest: "runsc" }
- { src: "{{ downloads.gvisor_containerd_shim.dest }}", dest: "containerd-shim-runsc-v1" } - { src: "{{ downloads.gvisor_containerd_shim.dest }}", dest: "containerd-shim-runsc-v1" }

6
kubespray/project/roles/container-engine/kata-containers/molecule/default/prepare.yml
View File

@@ -29,7 +29,7 @@
src: "{{ item }}" src: "{{ item }}"
dest: "/tmp/{{ item }}" dest: "/tmp/{{ item }}"
owner: root owner: root
mode: 0644 mode: "0644"
with_items: with_items:
- container.json - container.json
- sandbox.json - sandbox.json
@@ -38,12 +38,12 @@
path: /etc/cni/net.d path: /etc/cni/net.d
state: directory state: directory
owner: "{{ kube_owner }}" owner: "{{ kube_owner }}"
mode: 0755 mode: "0755"
- name: Setup CNI - name: Setup CNI
copy: copy:
src: "{{ item }}" src: "{{ item }}"
dest: "/etc/cni/net.d/{{ item }}" dest: "/etc/cni/net.d/{{ item }}"
owner: root owner: root
mode: 0644 mode: "0644"
with_items: with_items:
- 10-mynet.conf - 10-mynet.conf

12
kubespray/project/roles/container-engine/kata-containers/tasks/main.yml
View File

@@ -8,22 +8,22 @@
unarchive: unarchive:
src: "{{ downloads.kata_containers.dest }}" src: "{{ downloads.kata_containers.dest }}"
dest: "/" dest: "/"
mode: 0755 mode: "0755"
owner: root owner: root
group: root group: root
remote_src: yes remote_src: true
- name: Kata-containers | Create config directory - name: Kata-containers | Create config directory
file: file:
path: "{{ kata_containers_config_dir }}" path: "{{ kata_containers_config_dir }}"
state: directory state: directory
mode: 0755 mode: "0755"
- name: Kata-containers | Set configuration - name: Kata-containers | Set configuration
template: template:
src: "{{ item }}.j2" src: "{{ item }}.j2"
dest: "{{ kata_containers_config_dir }}/{{ item }}" dest: "{{ kata_containers_config_dir }}/{{ item }}"
mode: 0644 mode: "0644"
with_items: with_items:
- configuration-qemu.toml - configuration-qemu.toml
@@ -33,7 +33,7 @@
template: template:
dest: "{{ kata_containers_containerd_bin_dir }}/containerd-shim-kata-{{ item }}-v2" dest: "{{ kata_containers_containerd_bin_dir }}/containerd-shim-kata-{{ item }}-v2"
src: containerd-shim-kata-v2.j2 src: containerd-shim-kata-v2.j2
mode: 0755 mode: "0755"
with_items: with_items:
- qemu - qemu
@@ -48,7 +48,7 @@
- name: Kata-containers | Persist vhost kernel modules - name: Kata-containers | Persist vhost kernel modules
copy: copy:
dest: /etc/modules-load.d/kubespray-kata-containers.conf dest: /etc/modules-load.d/kubespray-kata-containers.conf
mode: 0644 mode: "0644"
content: | content: |
vhost_vsock vhost_vsock
vhost_net vhost_net

4
kubespray/project/roles/container-engine/nerdctl/handlers/main.yml
View File

@@ -1,7 +1,7 @@
--- ---
- name: Get nerdctl completion - name: Get nerdctl completion
command: "{{ bin_dir }}/nerdctl completion bash" command: "{{ bin_dir }}/nerdctl completion bash"
changed_when: False changed_when: false
register: nerdctl_completion register: nerdctl_completion
check_mode: false check_mode: false
@@ -9,4 +9,4 @@
copy: copy:
dest: /etc/bash_completion.d/nerdctl dest: /etc/bash_completion.d/nerdctl
content: "{{ nerdctl_completion.stdout }}" content: "{{ nerdctl_completion.stdout }}"
mode: 0644 mode: "0644"

6
kubespray/project/roles/container-engine/nerdctl/tasks/main.yml
View File

@@ -8,7 +8,7 @@
copy: copy:
src: "{{ local_release_dir }}/nerdctl" src: "{{ local_release_dir }}/nerdctl"
dest: "{{ bin_dir }}/nerdctl" dest: "{{ bin_dir }}/nerdctl"
mode: 0755 mode: "0755"
remote_src: true remote_src: true
owner: root owner: root
group: root group: root
@@ -21,7 +21,7 @@
file: file:
path: /etc/nerdctl path: /etc/nerdctl
state: directory state: directory
mode: 0755 mode: "0755"
owner: root owner: root
group: root group: root
become: true become: true
@@ -30,7 +30,7 @@
template: template:
src: nerdctl.toml.j2 src: nerdctl.toml.j2
dest: /etc/nerdctl/nerdctl.toml dest: /etc/nerdctl/nerdctl.toml
mode: 0644 mode: "0644"
owner: root owner: root
group: root group: root
become: true become: true

8
kubespray/project/roles/container-engine/runc/tasks/main.yml
View File

@@ -2,9 +2,9 @@
- name: Runc | check if fedora coreos - name: Runc | check if fedora coreos
stat: stat:
path: /run/ostree-booted path: /run/ostree-booted
get_attributes: no get_attributes: false
get_checksum: no get_checksum: false
get_mime: no get_mime: false
register: ostree register: ostree
- name: Runc | set is_ostree - name: Runc | set is_ostree
@@ -27,7 +27,7 @@
copy: copy:
src: "{{ downloads.runc.dest }}" src: "{{ downloads.runc.dest }}"
dest: "{{ runc_bin_dir }}/runc" dest: "{{ runc_bin_dir }}/runc"
mode: 0755 mode: "0755"
remote_src: true remote_src: true
- name: Runc | Remove orphaned binary - name: Runc | Remove orphaned binary

8
kubespray/project/roles/container-engine/skopeo/tasks/main.yml
View File

@@ -2,9 +2,9 @@
- name: Skopeo | check if fedora coreos - name: Skopeo | check if fedora coreos
stat: stat:
path: /run/ostree-booted path: /run/ostree-booted
get_attributes: no get_attributes: false
get_checksum: no get_checksum: false
get_mime: no get_mime: false
register: ostree register: ostree
- name: Skopeo | set is_ostree - name: Skopeo | set is_ostree
@@ -28,5 +28,5 @@
copy: copy:
src: "{{ downloads.skopeo.dest }}" src: "{{ downloads.skopeo.dest }}"
dest: "{{ bin_dir }}/skopeo" dest: "{{ bin_dir }}/skopeo"
mode: 0755 mode: "0755"
remote_src: true remote_src: true

18
kubespray/project/roles/container-engine/validate-container-engine/tasks/main.yml
View File

@@ -2,9 +2,9 @@
- name: Validate-container-engine | check if fedora coreos - name: Validate-container-engine | check if fedora coreos
stat: stat:
path: /run/ostree-booted path: /run/ostree-booted
get_attributes: no get_attributes: false
get_checksum: no get_checksum: false
get_mime: no get_mime: false
register: ostree register: ostree
tags: tags:
- facts - facts
@@ -30,8 +30,8 @@
- name: Check if containerd is installed - name: Check if containerd is installed
find: find:
file_type: file file_type: file
recurse: yes recurse: true
use_regex: yes use_regex: true
patterns: patterns:
- containerd.service$ - containerd.service$
paths: paths:
@@ -45,8 +45,8 @@
- name: Check if docker is installed - name: Check if docker is installed
find: find:
file_type: file file_type: file
recurse: yes recurse: true
use_regex: yes use_regex: true
patterns: patterns:
- docker.service$ - docker.service$
paths: paths:
@@ -60,8 +60,8 @@
- name: Check if crio is installed - name: Check if crio is installed
find: find:
file_type: file file_type: file
recurse: yes recurse: true
use_regex: yes use_regex: true
patterns: patterns:
- crio.service$ - crio.service$
paths: paths:

6
kubespray/project/roles/container-engine/youki/molecule/default/prepare.yml
View File

@@ -29,7 +29,7 @@
src: "{{ item }}" src: "{{ item }}"
dest: "/tmp/{{ item }}" dest: "/tmp/{{ item }}"
owner: root owner: root
mode: 0644 mode: "0644"
with_items: with_items:
- container.json - container.json
- sandbox.json - sandbox.json
@@ -38,12 +38,12 @@
path: /etc/cni/net.d path: /etc/cni/net.d
state: directory state: directory
owner: root owner: root
mode: 0755 mode: "0755"
- name: Setup CNI - name: Setup CNI
copy: copy:
src: "{{ item }}" src: "{{ item }}"
dest: "/etc/cni/net.d/{{ item }}" dest: "/etc/cni/net.d/{{ item }}"
owner: root owner: root
mode: 0644 mode: "0644"
with_items: with_items:
- 10-mynet.conf - 10-mynet.conf

2
kubespray/project/roles/container-engine/youki/tasks/main.yml
View File

@@ -8,5 +8,5 @@
copy: copy:
src: "{{ local_release_dir }}/youki_{{ youki_version | regex_replace('\\.', '_') }}_linux/youki-{{ youki_version }}/youki" src: "{{ local_release_dir }}/youki_{{ youki_version | regex_replace('\\.', '_') }}_linux/youki-{{ youki_version }}/youki"
dest: "{{ youki_bin_dir }}/youki" dest: "{{ youki_bin_dir }}/youki"
mode: 0755 mode: "0755"
remote_src: true remote_src: true

2
kubespray/project/roles/download/tasks/check_pull_required.yml
View File

@@ -5,7 +5,7 @@
shell: "{{ image_info_command }}" shell: "{{ image_info_command }}"
register: docker_images register: docker_images
changed_when: false changed_when: false
check_mode: no check_mode: false
when: not download_always_pull when: not download_always_pull
- name: Check_pull_required | Set pull_required if the desired image is not yet loaded - name: Check_pull_required | Set pull_required if the desired image is not yet loaded

14
kubespray/project/roles/download/tasks/download_container.yml
View File

@@ -26,12 +26,12 @@
- name: Download_container | Determine if image is in cache - name: Download_container | Determine if image is in cache
stat: stat:
path: "{{ image_path_cached }}" path: "{{ image_path_cached }}"
get_attributes: no get_attributes: false
get_checksum: no get_checksum: false
get_mime: no get_mime: false
delegate_to: localhost delegate_to: localhost
connection: local connection: local
delegate_facts: no delegate_facts: false
register: cache_image register: cache_image
changed_when: false changed_when: false
become: false become: false
@@ -57,7 +57,7 @@
- name: Download_container | Download image if required - name: Download_container | Download image if required
command: "{{ image_pull_command_on_localhost if download_localhost else image_pull_command }} {{ image_reponame }}" command: "{{ image_pull_command_on_localhost if download_localhost else image_pull_command }} {{ image_reponame }}"
delegate_to: "{{ download_delegate if download_run_once else inventory_hostname }}" delegate_to: "{{ download_delegate if download_run_once else inventory_hostname }}"
delegate_facts: yes delegate_facts: true
run_once: "{{ download_run_once }}" run_once: "{{ download_run_once }}"
register: pull_task_result register: pull_task_result
until: pull_task_result is succeeded until: pull_task_result is succeeded
@@ -72,7 +72,7 @@
- name: Download_container | Save and compress image - name: Download_container | Save and compress image
shell: "{{ image_save_command_on_localhost if download_localhost else image_save_command }}" # noqa command-instead-of-shell - image_save_command_on_localhost contains a pipe, therefore requires shell shell: "{{ image_save_command_on_localhost if download_localhost else image_save_command }}" # noqa command-instead-of-shell - image_save_command_on_localhost contains a pipe, therefore requires shell
delegate_to: "{{ download_delegate }}" delegate_to: "{{ download_delegate }}"
delegate_facts: no delegate_facts: false
register: container_save_status register: container_save_status
failed_when: container_save_status.stderr failed_when: container_save_status.stderr
run_once: true run_once: true
@@ -99,7 +99,7 @@
dest: "{{ image_path_final }}" dest: "{{ image_path_final }}"
use_ssh_args: true use_ssh_args: true
mode: push mode: push
delegate_facts: no delegate_facts: false
register: upload_image register: upload_image
failed_when: not upload_image failed_when: not upload_image
until: upload_image is succeeded until: upload_image is succeeded

8
kubespray/project/roles/download/tasks/download_file.yml
View File

@@ -22,15 +22,15 @@
file: file:
path: "{{ download.dest | dirname }}" path: "{{ download.dest | dirname }}"
owner: "{{ download.owner | default(omit) }}" owner: "{{ download.owner | default(omit) }}"
mode: 0755 mode: "0755"
state: directory state: directory
recurse: yes recurse: true
- name: Download_file | Create local cache directory - name: Download_file | Create local cache directory
file: file:
path: "{{ file_path_cached | dirname }}" path: "{{ file_path_cached | dirname }}"
state: directory state: directory
recurse: yes recurse: true
delegate_to: localhost delegate_to: localhost
connection: local connection: local
delegate_facts: false delegate_facts: false
@@ -45,7 +45,7 @@
file: file:
path: "{{ file_path_cached | dirname }}" path: "{{ file_path_cached | dirname }}"
state: directory state: directory
recurse: yes recurse: true
delegate_to: "{{ download_delegate }}" delegate_to: "{{ download_delegate }}"
delegate_facts: false delegate_facts: false
run_once: true run_once: true

2
kubespray/project/roles/download/tasks/extract_file.yml
View File

@@ -5,7 +5,7 @@
dest: "{{ download.dest | dirname }}" dest: "{{ download.dest | dirname }}"
owner: "{{ download.owner | default(omit) }}" owner: "{{ download.owner | default(omit) }}"
mode: "{{ download.mode | default(omit) }}" mode: "{{ download.mode | default(omit) }}"
copy: no copy: false
extra_opts: "{{ download.unarchive_extra_opts | default(omit) }}" extra_opts: "{{ download.unarchive_extra_opts | default(omit) }}"
when: when:
- download.unarchive | default(false) - download.unarchive | default(false)

8
kubespray/project/roles/download/tasks/prep_download.yml
View File

@@ -62,14 +62,14 @@
register: docker_images register: docker_images
failed_when: false failed_when: false
changed_when: false changed_when: false
check_mode: no check_mode: false
when: download_container when: download_container
- name: Prep_download | Create staging directory on remote node - name: Prep_download | Create staging directory on remote node
file: file:
path: "{{ local_release_dir }}/images" path: "{{ local_release_dir }}/images"
state: directory state: directory
mode: 0755 mode: "0755"
owner: "{{ ansible_ssh_user | default(ansible_user_id) }}" owner: "{{ ansible_ssh_user | default(ansible_user_id) }}"
when: when:
- ansible_os_family not in ["Flatcar", "Flatcar Container Linux by Kinvolk"] - ansible_os_family not in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
@@ -78,10 +78,10 @@
file: file:
path: "{{ download_cache_dir }}/images" path: "{{ download_cache_dir }}/images"
state: directory state: directory
mode: 0755 mode: "0755"
delegate_to: localhost delegate_to: localhost
connection: local connection: local
delegate_facts: no delegate_facts: false
run_once: true run_once: true
become: false become: false
when: when:

11
kubespray/project/roles/download/tasks/prep_kubeadm_images.yml
View File

@@ -1,11 +1,4 @@
--- ---
- name: Prep_kubeadm_images | Check kubeadm version matches kubernetes version
fail:
msg: "Kubeadm version {{ kubeadm_version }} do not matches kubernetes {{ kube_version }}"
when:
- not skip_downloads | default(false)
- not kubeadm_version == downloads.kubeadm.version
- name: Prep_kubeadm_images | Download kubeadm binary - name: Prep_kubeadm_images | Download kubeadm binary
include_tasks: "download_file.yml" include_tasks: "download_file.yml"
vars: vars:
@@ -18,7 +11,7 @@
template: template:
src: "kubeadm-images.yaml.j2" src: "kubeadm-images.yaml.j2"
dest: "{{ kube_config_dir }}/kubeadm-images.yaml" dest: "{{ kube_config_dir }}/kubeadm-images.yaml"
mode: 0644 mode: "0644"
when: when:
- not skip_kubeadm_images | default(false) - not skip_kubeadm_images | default(false)
@@ -26,7 +19,7 @@
copy: copy:
src: "{{ downloads.kubeadm.dest }}" src: "{{ downloads.kubeadm.dest }}"
dest: "{{ bin_dir }}/kubeadm" dest: "{{ bin_dir }}/kubeadm"
mode: 0755 mode: "0755"
remote_src: true remote_src: true
- name: Prep_kubeadm_images | Set kubeadm binary permissions - name: Prep_kubeadm_images | Set kubeadm binary permissions

3
kubespray/project/roles/etcd/defaults/main.yml
View File

@@ -125,3 +125,6 @@ etcd_experimental_enable_distributed_tracing: false
etcd_experimental_distributed_tracing_sample_rate: 100 etcd_experimental_distributed_tracing_sample_rate: 100
etcd_experimental_distributed_tracing_address: "localhost:4317" etcd_experimental_distributed_tracing_address: "localhost:4317"
etcd_experimental_distributed_tracing_service_name: etcd etcd_experimental_distributed_tracing_service_name: etcd
# The interval for etcd watch progress notify events
etcd_experimental_watch_progress_notify_interval: 5s

8
kubespray/project/roles/etcd/handlers/backup.yml
View File

@@ -16,16 +16,16 @@
state: directory state: directory
owner: root owner: root
group: root group: root
mode: 0600 mode: "0600"
listen: Restart etcd listen: Restart etcd
when: etcd_cluster_is_healthy.rc == 0 when: etcd_cluster_is_healthy.rc == 0
- name: Stat etcd v2 data directory - name: Stat etcd v2 data directory
stat: stat:
path: "{{ etcd_data_dir }}/member" path: "{{ etcd_data_dir }}/member"
get_attributes: no get_attributes: false
get_checksum: no get_checksum: false
get_mime: no get_mime: false
register: etcd_data_dir_member register: etcd_data_dir_member
listen: Restart etcd listen: Restart etcd
when: etcd_cluster_is_healthy.rc == 0 when: etcd_cluster_is_healthy.rc == 0

6
kubespray/project/roles/etcd/handlers/main.yml
View File

@@ -3,7 +3,7 @@
import_tasks: backup.yml import_tasks: backup.yml
- name: Etcd | reload systemd - name: Etcd | reload systemd
systemd: systemd_service:
daemon_reload: true daemon_reload: true
listen: listen:
- Restart etcd - Restart etcd
@@ -26,7 +26,7 @@
- name: Wait for etcd up - name: Wait for etcd up
uri: uri:
url: "https://{% if is_etcd_master %}{{ etcd_address }}{% else %}127.0.0.1{% endif %}:2379/health" url: "https://{% if is_etcd_master %}{{ etcd_address }}{% else %}127.0.0.1{% endif %}:2379/health"
validate_certs: no validate_certs: false
client_cert: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}.pem" client_cert: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}.pem"
client_key: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}-key.pem" client_key: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}-key.pem"
register: result register: result
@@ -41,7 +41,7 @@
- name: Wait for etcd-events up - name: Wait for etcd-events up
uri: uri:
url: "https://{% if is_etcd_master %}{{ etcd_address }}{% else %}127.0.0.1{% endif %}:2383/health" url: "https://{% if is_etcd_master %}{{ etcd_address }}{% else %}127.0.0.1{% endif %}:2383/health"
validate_certs: no validate_certs: false
client_cert: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}.pem" client_cert: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}.pem"
client_key: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}-key.pem" client_key: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}-key.pem"
register: result register: result

6
kubespray/project/roles/etcd/tasks/check_certs.yml
View File

@@ -17,9 +17,9 @@
- name: "Check certs | Register ca and etcd admin/member certs on etcd hosts" - name: "Check certs | Register ca and etcd admin/member certs on etcd hosts"
stat: stat:
path: "{{ etcd_cert_dir }}/{{ item }}" path: "{{ etcd_cert_dir }}/{{ item }}"
get_attributes: no get_attributes: false
get_checksum: yes get_checksum: true
get_mime: no get_mime: false
register: etcd_member_certs register: etcd_member_certs
when: inventory_hostname in groups['etcd'] when: inventory_hostname in groups['etcd']
with_items: with_items:

Some files were not shown because too many files have changed in this diff Show More