first version
This commit is contained in:
5
.gitignore
vendored
Normal file
5
.gitignore
vendored
Normal file
@@ -0,0 +1,5 @@
|
|||||||
|
*.DS_Store
|
||||||
|
*.vscode
|
||||||
|
*.env
|
||||||
|
*artifacts*
|
||||||
|
*k8s-admin*
|
||||||
45
cmd/main/main.go
Normal file
45
cmd/main/main.go
Normal file
@@ -0,0 +1,45 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"flag"
|
||||||
|
"kube-forge/pkg/config"
|
||||||
|
"kube-forge/pkg/kubespray"
|
||||||
|
"kube-forge/pkg/templates"
|
||||||
|
"os"
|
||||||
|
)
|
||||||
|
|
||||||
|
func parseArgs() (string, string, string, string) {
|
||||||
|
var password string
|
||||||
|
var configPath string
|
||||||
|
var dataDir string
|
||||||
|
var tags string
|
||||||
|
flag.StringVar(&password, "p", "", "Password to access hosts")
|
||||||
|
flag.StringVar(&configPath, "c", "/etc/kube-forge/config.yaml", "Path to config file")
|
||||||
|
flag.StringVar(&dataDir, "d", "/var/lib/kube-forge", "Path to data dir")
|
||||||
|
flag.StringVar(&tags, "t", "", "List of tags to apply (ex: ingress,dns)")
|
||||||
|
flag.Parse()
|
||||||
|
return password, configPath, dataDir, tags
|
||||||
|
}
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
password, configPath, dataDir, tags := parseArgs()
|
||||||
|
config := config.CreateConfig(configPath, dataDir, password)
|
||||||
|
|
||||||
|
repositories, releases := templates.GetHelmAppsConfigData()
|
||||||
|
config.Repositories = repositories
|
||||||
|
config.Releases = releases
|
||||||
|
|
||||||
|
templates.ApplyTemplates()
|
||||||
|
|
||||||
|
for _, cmd := range os.Args {
|
||||||
|
switch cmd {
|
||||||
|
case "apply":
|
||||||
|
kubespray.InstallCluster(tags)
|
||||||
|
kubespray.CopyK8SAdminConfig("k8s-admin.conf")
|
||||||
|
case "reset":
|
||||||
|
kubespray.ResetCluster()
|
||||||
|
case "upgrade":
|
||||||
|
kubespray.UpgradeCluster(tags)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
277
config.yaml
Normal file
277
config.yaml
Normal file
@@ -0,0 +1,277 @@
|
|||||||
|
credentials:
|
||||||
|
user: sre-admin
|
||||||
|
ask_sudo_password: false
|
||||||
|
private_key_file: /home/sre-admin/.ssh/id_rsa
|
||||||
|
|
||||||
|
hosts:
|
||||||
|
- hostname: vbox-prod-k8s-master-01
|
||||||
|
ip: "10.250.50.22"
|
||||||
|
roles: [control_plane, etcd]
|
||||||
|
|
||||||
|
# # Optional creds for each host
|
||||||
|
# user: user
|
||||||
|
# password: nF5S8nuKi87Dh42Jnjik
|
||||||
|
|
||||||
|
- hostname: vbox-prod-k8s-slave-01
|
||||||
|
ip: "10.250.50.23"
|
||||||
|
roles: [node]
|
||||||
|
|
||||||
|
- hostname: vbox-prod-k8s-slave-02
|
||||||
|
ip: "10.250.50.21"
|
||||||
|
roles: [node]
|
||||||
|
|
||||||
|
default_registry: ""
|
||||||
|
|
||||||
|
orchestrator:
|
||||||
|
version: v1.29.0
|
||||||
|
cluster_name: k8s-cluster.local
|
||||||
|
# bin_dir: /usr/local/bin
|
||||||
|
# sysctl_file_path: /etc/sysctl.d/99-sysctl.conf
|
||||||
|
loadbalancer_apiserver_port: 6443
|
||||||
|
dns:
|
||||||
|
servers:
|
||||||
|
- 8.8.8.8
|
||||||
|
- 8.8.4.4
|
||||||
|
disable_host_nameservers: false
|
||||||
|
# cloud_provider: "" # 'gce', 'aws', 'azure', 'openstack', 'vsphere', 'oci', or 'external'
|
||||||
|
# external_cloud_provider: "" # 'openstack', 'vsphere' and 'hcloud'
|
||||||
|
|
||||||
|
container_engine:
|
||||||
|
type: containerd # docker, crio and containerd
|
||||||
|
install: true
|
||||||
|
|
||||||
|
ping_access_ip: true
|
||||||
|
auto_renew_certificates: true
|
||||||
|
event_ttl: "1h0m0s"
|
||||||
|
pod_security_policy_enabled: true
|
||||||
|
|
||||||
|
network:
|
||||||
|
plugin: calico # cilium, calico, kube-ovn, weave or flannel
|
||||||
|
# service_addresses: 10.233.0.0/18
|
||||||
|
# pods_subnet: 10.233.64.0/18
|
||||||
|
|
||||||
|
modules:
|
||||||
|
admin_password: changeit
|
||||||
|
|
||||||
|
# additional_repositories:
|
||||||
|
# - name: argo-helm
|
||||||
|
# url: "https://argoproj.github.io/argo-helm"
|
||||||
|
|
||||||
|
observability:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
logging:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
loki:
|
||||||
|
persistence:
|
||||||
|
storage_size: 10Gi
|
||||||
|
retention: 168h
|
||||||
|
|
||||||
|
events:
|
||||||
|
enabled: true
|
||||||
|
cron:
|
||||||
|
schedule: "*/2 * * * *"
|
||||||
|
|
||||||
|
tracing:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
tempo:
|
||||||
|
retention: 24h
|
||||||
|
listen_port: 3100
|
||||||
|
|
||||||
|
persistence:
|
||||||
|
storage_size: 10Gi
|
||||||
|
|
||||||
|
tempo_query:
|
||||||
|
listen_port: 16686
|
||||||
|
|
||||||
|
monitoring:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
prometheus:
|
||||||
|
scrape_interval: 15s
|
||||||
|
persistence:
|
||||||
|
storage_size: 3Gi
|
||||||
|
retention: 7d
|
||||||
|
|
||||||
|
alert_manager:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
# route:
|
||||||
|
# receiver: kvazaric_notifications
|
||||||
|
# group_wait: 1s
|
||||||
|
# repeat_interval: 180m
|
||||||
|
|
||||||
|
# routes:
|
||||||
|
# - receiver: "kvazaric_notifications"
|
||||||
|
# group_by: ["alertname"]
|
||||||
|
# group_wait: 1s
|
||||||
|
# repeat_interval: 8737h
|
||||||
|
# matchers:
|
||||||
|
# - fireOnce=true
|
||||||
|
# receivers:
|
||||||
|
# - name: kvazaric_notifications
|
||||||
|
# telegram_configs:
|
||||||
|
# - send_resolved: true
|
||||||
|
# api_url: https://api.telegram.org
|
||||||
|
# bot_token: 6364937365:AAHcJKc-McN11gBWuQqoM87zr18eK0VKX9I
|
||||||
|
# chat_id: -968770779
|
||||||
|
# parse_mode: HTML
|
||||||
|
# message: '{{ template "telegram-message" . }}'
|
||||||
|
# http_config:
|
||||||
|
# follow_redirects: true
|
||||||
|
# enable_http2: false
|
||||||
|
blackbox:
|
||||||
|
enabled: true
|
||||||
|
additional_modules: |
|
||||||
|
|
||||||
|
kube_state:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
node:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
visualization:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
grafana:
|
||||||
|
enabled: true
|
||||||
|
expose:
|
||||||
|
type: ingress
|
||||||
|
|
||||||
|
domain: grafana.disk.lt.t1.cloud
|
||||||
|
|
||||||
|
tls:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
persistence:
|
||||||
|
storage_size: 2Gi
|
||||||
|
|
||||||
|
cicd:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
argo_cd:
|
||||||
|
expose:
|
||||||
|
type: ingress
|
||||||
|
domain: argocd.disk.lt.t1.cloud
|
||||||
|
|
||||||
|
tls:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
repositories:
|
||||||
|
{}
|
||||||
|
# harbor-helm:
|
||||||
|
# enableOCI: "true"
|
||||||
|
# type: helm
|
||||||
|
# name: helm-mountbit
|
||||||
|
# url: harbor.disk.t1.cloud/mountbit-helm
|
||||||
|
# username: username
|
||||||
|
# password: password
|
||||||
|
rbac:
|
||||||
|
additional_policies: |
|
||||||
|
p, developer, applications, *, */*, allow
|
||||||
|
|
||||||
|
p, developer, applications, *, */*logging*, deny
|
||||||
|
p, developer, repositories, get, *, allow
|
||||||
|
p, developer, projects, get, *, allow
|
||||||
|
|
||||||
|
p, developer, logs, get, *, allow
|
||||||
|
|
||||||
|
p, guest, applications, get, */*, allow
|
||||||
|
p, guest, projects, get, *, allow
|
||||||
|
|
||||||
|
ha:
|
||||||
|
enabled: false
|
||||||
|
autoscaling: false
|
||||||
|
|
||||||
|
rollouts:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
updates_operator:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
secrets_storage:
|
||||||
|
enabled: true
|
||||||
|
expose:
|
||||||
|
type: ingress # NodePort
|
||||||
|
domain: vault.disk.lt.t1.cloud
|
||||||
|
node_port: 30004
|
||||||
|
|
||||||
|
tls:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
# requires secrets_store_csi_driver in additional modules
|
||||||
|
csi_integration:
|
||||||
|
enabled: true
|
||||||
|
image: hashicorp/vault-csi-provider
|
||||||
|
version: 1.4.1
|
||||||
|
agent:
|
||||||
|
image: hashicorp/vault
|
||||||
|
version: 1.15.6
|
||||||
|
injector:
|
||||||
|
image: hashicorp/vault-k8s
|
||||||
|
version: 1.3.1
|
||||||
|
server:
|
||||||
|
image: "hashicorp/vault"
|
||||||
|
version: 1.15.6
|
||||||
|
persistence:
|
||||||
|
size: 10Gi
|
||||||
|
|
||||||
|
registry:
|
||||||
|
enabled: true
|
||||||
|
expose:
|
||||||
|
type: ingress # ingress or NodePort
|
||||||
|
# if expose_type is "ingress"
|
||||||
|
domain: harbor.disk.lt.t1.cloud
|
||||||
|
|
||||||
|
# if expose_type is "NodePort"
|
||||||
|
node_port_http: 30002
|
||||||
|
node_port_https: 30003
|
||||||
|
tls:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
persistence:
|
||||||
|
registry_size: 10Gi
|
||||||
|
jobservice_size: 1Gi
|
||||||
|
database_size: 2Gi
|
||||||
|
redis_size: 1Gi
|
||||||
|
trivy_size: 5Gi
|
||||||
|
|
||||||
|
defaultProjects:
|
||||||
|
- name: harbor-helm
|
||||||
|
public: false
|
||||||
|
enabled_scanner: true
|
||||||
|
|
||||||
|
additional:
|
||||||
|
cert_manager:
|
||||||
|
install: true
|
||||||
|
dns_servers:
|
||||||
|
- "1.1.1.1"
|
||||||
|
- "8.8.8.8"
|
||||||
|
account_email: reversstorm@gmail.com
|
||||||
|
|
||||||
|
ingress:
|
||||||
|
type: nginx # nginx
|
||||||
|
install: true
|
||||||
|
insecure_port: 80
|
||||||
|
secure_port: 443
|
||||||
|
ingress_class_name: nginx
|
||||||
|
host_network: true
|
||||||
|
|
||||||
|
# load_balancer:
|
||||||
|
# type: metallb
|
||||||
|
# install: true
|
||||||
|
|
||||||
|
storage:
|
||||||
|
local_path_provisioner:
|
||||||
|
storage_class_name: local-path
|
||||||
|
reclaim_policy: Delete
|
||||||
|
|
||||||
|
longhorn:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
secrets_store_csi_driver:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
## TODO: ceph
|
||||||
43
go.mod
Normal file
43
go.mod
Normal file
@@ -0,0 +1,43 @@
|
|||||||
|
module kube-forge
|
||||||
|
|
||||||
|
go 1.22
|
||||||
|
|
||||||
|
toolchain go1.22.2
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/BurntSushi/toml v1.2.1
|
||||||
|
github.com/Masterminds/sprig/v3 v3.2.3
|
||||||
|
github.com/apenella/go-ansible v1.3.0
|
||||||
|
github.com/ilyakaznacheev/cleanenv v1.5.0
|
||||||
|
golang.org/x/crypto v0.22.0
|
||||||
|
sigs.k8s.io/yaml v1.4.0
|
||||||
|
)
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/Masterminds/goutils v1.1.1 // indirect
|
||||||
|
github.com/Masterminds/semver/v3 v3.2.0 // indirect
|
||||||
|
github.com/apenella/go-ansible/v2 v2.0.0 // indirect
|
||||||
|
github.com/apenella/go-common-utils/data v0.0.0-20220913191136-86daaa87e7df // indirect
|
||||||
|
github.com/apenella/go-common-utils/error v0.0.0-20220913191136-86daaa87e7df // indirect
|
||||||
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
||||||
|
github.com/fatih/color v1.16.0 // indirect
|
||||||
|
github.com/google/uuid v1.1.1 // indirect
|
||||||
|
github.com/huandu/xstrings v1.3.3 // indirect
|
||||||
|
github.com/imdario/mergo v0.3.11 // indirect
|
||||||
|
github.com/joho/godotenv v1.5.1 // indirect
|
||||||
|
github.com/kr/pretty v0.2.1 // indirect
|
||||||
|
github.com/mattn/go-colorable v0.1.13 // indirect
|
||||||
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
||||||
|
github.com/mitchellh/copystructure v1.0.0 // indirect
|
||||||
|
github.com/mitchellh/reflectwalk v1.0.0 // indirect
|
||||||
|
github.com/pkg/errors v0.9.1 // indirect
|
||||||
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
||||||
|
github.com/shopspring/decimal v1.2.0 // indirect
|
||||||
|
github.com/spf13/cast v1.3.1 // indirect
|
||||||
|
github.com/stretchr/objx v0.5.2 // indirect
|
||||||
|
github.com/stretchr/testify v1.9.0 // indirect
|
||||||
|
golang.org/x/sys v0.19.0 // indirect
|
||||||
|
gopkg.in/yaml.v2 v2.4.0 // indirect
|
||||||
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
||||||
|
olympos.io/encoding/edn v0.0.0-20201019073823-d3554ca0b0a3 // indirect
|
||||||
|
)
|
||||||
119
go.sum
Normal file
119
go.sum
Normal file
@@ -0,0 +1,119 @@
|
|||||||
|
github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak=
|
||||||
|
github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
|
||||||
|
github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
|
||||||
|
github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
|
||||||
|
github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
|
||||||
|
github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
|
||||||
|
github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
|
||||||
|
github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
|
||||||
|
github.com/apenella/go-ansible v1.3.0 h1:INNaVzrgQMNIO9Yvnly6lA5KfN/pY3m1Z37gpmlUzPM=
|
||||||
|
github.com/apenella/go-ansible v1.3.0/go.mod h1:qiLWolQqLkCoqFlPvdsKhxk7O0qjIBCPNhUKpH/vjaU=
|
||||||
|
github.com/apenella/go-ansible/v2 v2.0.0 h1:9aZkU8dQ2fVITYX5V1CiQ3VX4PnNPBTgv31wJFd2Ito=
|
||||||
|
github.com/apenella/go-ansible/v2 v2.0.0/go.mod h1:ifhiX4d0bpynb8yhdzLTmGl/38HqTYr/26PfjB1enXQ=
|
||||||
|
github.com/apenella/go-common-utils/data v0.0.0-20220913191136-86daaa87e7df h1:sEikY2P+NZK/7VZUwIsnXIGElhsuFDSxh1bZYwHxdcI=
|
||||||
|
github.com/apenella/go-common-utils/data v0.0.0-20220913191136-86daaa87e7df/go.mod h1:cLVL6GjUiKG/WyBzX+KD6h/XRV/HnNZIZbMNNiBgQ9o=
|
||||||
|
github.com/apenella/go-common-utils/error v0.0.0-20220913191136-86daaa87e7df h1:SvlYbjlsSQDS7hbVT1h012/zdgvcwWJ+Yd9XRiiY/8s=
|
||||||
|
github.com/apenella/go-common-utils/error v0.0.0-20220913191136-86daaa87e7df/go.mod h1:+3dyIlHX350xJIUIffwMLswZXU+N2FwDE05VuKqxYdw=
|
||||||
|
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||||
|
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||||
|
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||||
|
github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
|
||||||
|
github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
|
||||||
|
github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
|
||||||
|
github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
|
||||||
|
github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
|
||||||
|
github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
|
||||||
|
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
|
||||||
|
github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
|
||||||
|
github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||||
|
github.com/huandu/xstrings v1.3.3 h1:/Gcsuc1x8JVbJ9/rlye4xZnVAbEkGauT8lbebqcQws4=
|
||||||
|
github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
|
||||||
|
github.com/ilyakaznacheev/cleanenv v1.5.0 h1:0VNZXggJE2OYdXE87bfSSwGxeiGt9moSR2lOrsHHvr4=
|
||||||
|
github.com/ilyakaznacheev/cleanenv v1.5.0/go.mod h1:a5aDzaJrLCQZsazHol1w8InnDcOX0OColm64SlIi6gk=
|
||||||
|
github.com/imdario/mergo v0.3.11 h1:3tnifQM4i+fbajXKBHXWEH+KvNHqojZ778UH75j3bGA=
|
||||||
|
github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
|
||||||
|
github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
|
||||||
|
github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
|
||||||
|
github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
|
||||||
|
github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
|
||||||
|
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
|
||||||
|
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
|
||||||
|
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
|
||||||
|
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
|
||||||
|
github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
|
||||||
|
github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
|
||||||
|
github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
|
||||||
|
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
|
||||||
|
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
|
||||||
|
github.com/mitchellh/copystructure v1.0.0 h1:Laisrj+bAB6b/yJwB5Bt3ITZhGJdqmxquMKeZ+mmkFQ=
|
||||||
|
github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
|
||||||
|
github.com/mitchellh/reflectwalk v1.0.0 h1:9D+8oIskB4VJBN5SFlmc27fSlIBZaov1Wpk/IfikLNY=
|
||||||
|
github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
|
||||||
|
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
|
||||||
|
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||||
|
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||||
|
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||||
|
github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
|
||||||
|
github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
|
||||||
|
github.com/sosedoff/ansible-vault-go v0.2.0 h1:XqkBdqbXgTuFQ++NdrZvSdUTNozeb6S3V5x7FVs17vg=
|
||||||
|
github.com/sosedoff/ansible-vault-go v0.2.0/go.mod h1:wMU54HNJfY0n0KIgbpA9m15NBfaUDlJrAsaZp0FwzkI=
|
||||||
|
github.com/spf13/cast v1.3.1 h1:nFm6S0SMdyzrzcmThSipiEubIDy8WEXKNZ0UOgiRpng=
|
||||||
|
github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
|
||||||
|
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||||
|
github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
|
||||||
|
github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
|
||||||
|
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
|
||||||
|
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
|
||||||
|
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
|
||||||
|
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
|
||||||
|
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
|
||||||
|
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
||||||
|
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
|
||||||
|
golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
|
||||||
|
golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
|
||||||
|
golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
|
||||||
|
golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
|
||||||
|
golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
|
||||||
|
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
|
||||||
|
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||||
|
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
|
||||||
|
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
|
||||||
|
golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
|
||||||
|
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||||
|
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
|
||||||
|
golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||||
|
golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
|
||||||
|
golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||||
|
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||||
|
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||||
|
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
|
||||||
|
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||||
|
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||||
|
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
|
||||||
|
golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||||
|
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||||
|
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||||
|
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
|
||||||
|
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||||
|
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||||
|
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
|
||||||
|
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
|
||||||
|
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||||
|
gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||||
|
gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
|
||||||
|
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
|
||||||
|
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||||
|
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||||
|
olympos.io/encoding/edn v0.0.0-20201019073823-d3554ca0b0a3 h1:slmdOY3vp8a7KQbHkL+FLbvbkgMqmXojpFUO/jENuqQ=
|
||||||
|
olympos.io/encoding/edn v0.0.0-20201019073823-d3554ca0b0a3/go.mod h1:oVgVk4OWVDi43qWBEyGhXgYxt7+ED4iYNpTngSLX2Iw=
|
||||||
|
sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
|
||||||
|
sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
|
||||||
1
kubespray/env/cmdline
vendored
Normal file
1
kubespray/env/cmdline
vendored
Normal file
@@ -0,0 +1 @@
|
|||||||
|
-b -v --become
|
||||||
2
kubespray/env/extravars
vendored
Normal file
2
kubespray/env/extravars
vendored
Normal file
@@ -0,0 +1,2 @@
|
|||||||
|
---
|
||||||
|
ansible_sudo_pass: nF5S8nuKi87Dh42Jnjik
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
4EE863bb8CdA1331D43B4CBcB274dd2267fDCdaA97Dcfa5E7E6BBc31b10E9695
|
||||||
129
kubespray/inventory/group_vars/all.yml
Normal file
129
kubespray/inventory/group_vars/all.yml
Normal file
@@ -0,0 +1,129 @@
|
|||||||
|
---
|
||||||
|
bin_dir: /usr/local/bin
|
||||||
|
|
||||||
|
## The access_ip variable is used to define how other nodes should access
|
||||||
|
## the node. This is used in flannel to allow other flannel nodes to see
|
||||||
|
## this node for example. The access_ip is really useful AWS and Google
|
||||||
|
## environments where the nodes are accessed remotely by the "public" ip,
|
||||||
|
## but don't know about that address themselves.
|
||||||
|
# access_ip: 1.1.1.1
|
||||||
|
|
||||||
|
|
||||||
|
## External LB example config
|
||||||
|
## apiserver_loadbalancer_domain_name: "elb.some.domain"
|
||||||
|
# loadbalancer_apiserver:
|
||||||
|
# address: 1.2.3.4
|
||||||
|
# port: 1234
|
||||||
|
|
||||||
|
## Internal loadbalancers for apiservers
|
||||||
|
# loadbalancer_apiserver_localhost: true
|
||||||
|
# valid options are "nginx" or "haproxy"
|
||||||
|
# loadbalancer_apiserver_type: nginx # valid values "nginx" or "haproxy"
|
||||||
|
|
||||||
|
## Local loadbalancer should use this port
|
||||||
|
## And must be set port 6443
|
||||||
|
loadbalancer_apiserver_port: 6443
|
||||||
|
|
||||||
|
## If loadbalancer_apiserver_healthcheck_port variable defined, enables proxy liveness check for nginx.
|
||||||
|
loadbalancer_apiserver_healthcheck_port: 8081
|
||||||
|
|
||||||
|
disable_host_nameservers: false
|
||||||
|
|
||||||
|
upstream_dns_servers:
|
||||||
|
- 8.8.8.8
|
||||||
|
- 8.8.4.4
|
||||||
|
|
||||||
|
## There are some changes specific to the cloud providers
|
||||||
|
## for instance we need to encapsulate packets with some network plugins
|
||||||
|
## If set the possible values are either 'gce', 'aws', 'azure', 'openstack', 'vsphere', 'oci', or 'external'
|
||||||
|
## When openstack is used make sure to source in the openstack credentials
|
||||||
|
## like you would do when using openstack-client before starting the playbook.
|
||||||
|
|
||||||
|
## When cloud_provider is set to 'external', you can set the cloud controller to deploy
|
||||||
|
## Supported cloud controllers are: 'openstack', 'vsphere' and 'hcloud'
|
||||||
|
## When openstack or vsphere are used make sure to source in the required fields
|
||||||
|
|
||||||
|
## Set these proxy values in order to update package manager and docker daemon to use proxies
|
||||||
|
# http_proxy: ""
|
||||||
|
# https_proxy: ""
|
||||||
|
|
||||||
|
## Refer to roles/kubespray-defaults/defaults/main.yml before modifying no_proxy
|
||||||
|
# no_proxy: ""
|
||||||
|
|
||||||
|
## Some problems may occur when downloading files over https proxy due to ansible bug
|
||||||
|
## https://github.com/ansible/ansible/issues/32750. Set this variable to False to disable
|
||||||
|
## SSL validation of get_url module. Note that kubespray will still be performing checksum validation.
|
||||||
|
# download_validate_certs: False
|
||||||
|
|
||||||
|
## If you need exclude all cluster nodes from proxy and other resources, add other resources here.
|
||||||
|
# additional_no_proxy: ""
|
||||||
|
|
||||||
|
## If you need to disable proxying of os package repositories but are still behind an http_proxy set
|
||||||
|
## skip_http_proxy_on_os_packages to true
|
||||||
|
## This will cause kubespray not to set proxy environment in /etc/yum.conf for centos and in /etc/apt/apt.conf for debian/ubuntu
|
||||||
|
## Special information for debian/ubuntu - you have to set the no_proxy variable, then apt package will install from your source of wish
|
||||||
|
# skip_http_proxy_on_os_packages: false
|
||||||
|
|
||||||
|
## Since workers are included in the no_proxy variable by default, docker engine will be restarted on all nodes (all
|
||||||
|
## pods will restart) when adding or removing workers. To override this behaviour by only including master nodes in the
|
||||||
|
## no_proxy variable, set below to true:
|
||||||
|
no_proxy_exclude_workers: false
|
||||||
|
|
||||||
|
## Certificate Management
|
||||||
|
## This setting determines whether certs are generated via scripts.
|
||||||
|
## Chose 'none' if you provide your own certificates.
|
||||||
|
## Option is "script", "none"
|
||||||
|
# cert_management: script
|
||||||
|
|
||||||
|
## Set to true to allow pre-checks to fail and continue deployment
|
||||||
|
# ignore_assert_errors: false
|
||||||
|
|
||||||
|
## The read-only port for the Kubelet to serve on with no authentication/authorization. Uncomment to enable.
|
||||||
|
# kube_read_only_port: 10255
|
||||||
|
|
||||||
|
## Set true to download and cache container
|
||||||
|
# download_container: true
|
||||||
|
|
||||||
|
## Deploy container engine
|
||||||
|
# Set false if you want to deploy container engine manually.
|
||||||
|
deploy_container_engine: true
|
||||||
|
|
||||||
|
## Red Hat Enterprise Linux subscription registration
|
||||||
|
## Add either RHEL subscription Username/Password or Organization ID/Activation Key combination
|
||||||
|
## Update RHEL subscription purpose usage, role and SLA if necessary
|
||||||
|
# rh_subscription_username: ""
|
||||||
|
# rh_subscription_password: ""
|
||||||
|
# rh_subscription_org_id: ""
|
||||||
|
# rh_subscription_activation_key: ""
|
||||||
|
# rh_subscription_usage: "Development"
|
||||||
|
# rh_subscription_role: "Red Hat Enterprise Server"
|
||||||
|
# rh_subscription_sla: "Self-Support"
|
||||||
|
|
||||||
|
## Check if access_ip responds to ping. Set false if your firewall blocks ICMP.
|
||||||
|
ping_access_ip: true
|
||||||
|
|
||||||
|
# sysctl_file_path to add sysctl conf to
|
||||||
|
sysctl_file_path: /etc/sysctl.d/99-sysctl.conf
|
||||||
|
|
||||||
|
## Variables for webhook token auth https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
|
||||||
|
kube_webhook_token_auth: false
|
||||||
|
kube_webhook_token_auth_url_skip_tls_verify: false
|
||||||
|
# kube_webhook_token_auth_url: https://...
|
||||||
|
## base64-encoded string of the webhook's CA certificate
|
||||||
|
# kube_webhook_token_auth_ca_data: "LS0t..."
|
||||||
|
|
||||||
|
## NTP Settings
|
||||||
|
# Start the ntpd or chrony service and enable it at system boot.
|
||||||
|
ntp_enabled: false
|
||||||
|
ntp_manage_config: false
|
||||||
|
ntp_servers:
|
||||||
|
- "0.pool.ntp.org iburst"
|
||||||
|
- "1.pool.ntp.org iburst"
|
||||||
|
- "2.pool.ntp.org iburst"
|
||||||
|
- "3.pool.ntp.org iburst"
|
||||||
|
|
||||||
|
## Used to control no_log attribute
|
||||||
|
unsafe_show_logs: false
|
||||||
|
|
||||||
|
## If enabled it will allow kubespray to attempt setup even if the distribution is not supported. For unsupported distributions this can lead to unexpected failures in some cases.
|
||||||
|
allow_unsupported_distribution_setup: false
|
||||||
3318
kubespray/inventory/group_vars/k8s_cluster/addons.yml
Normal file
3318
kubespray/inventory/group_vars/k8s_cluster/addons.yml
Normal file
File diff suppressed because it is too large
Load Diff
380
kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml
Normal file
380
kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml
Normal file
@@ -0,0 +1,380 @@
|
|||||||
|
---
|
||||||
|
# Kubernetes configuration dirs and system namespace.
|
||||||
|
# Those are where all the additional config stuff goes
|
||||||
|
# the kubernetes normally puts in /srv/kubernetes.
|
||||||
|
# This puts them in a sane location and namespace.
|
||||||
|
# Editing those values will almost surely break something.
|
||||||
|
kube_config_dir: /etc/kubernetes
|
||||||
|
kube_script_dir: "{{ bin_dir }}/kubernetes-scripts"
|
||||||
|
kube_manifest_dir: "{{ kube_config_dir }}/manifests"
|
||||||
|
|
||||||
|
# This is where all the cert scripts and certs will be located
|
||||||
|
kube_cert_dir: "{{ kube_config_dir }}/ssl"
|
||||||
|
|
||||||
|
# This is where all of the bearer tokens will be stored
|
||||||
|
kube_token_dir: "{{ kube_config_dir }}/tokens"
|
||||||
|
|
||||||
|
kube_api_anonymous_auth: true
|
||||||
|
|
||||||
|
## Change this to use another Kubernetes version, e.g. a current beta release
|
||||||
|
kube_version: v1.29.0
|
||||||
|
|
||||||
|
# Where the binaries will be downloaded.
|
||||||
|
# Note: ensure that you've enough disk space (about 1G)
|
||||||
|
local_release_dir: "/tmp/releases"
|
||||||
|
# Random shifts for retrying failed ops like pushing/downloading
|
||||||
|
retry_stagger: 5
|
||||||
|
|
||||||
|
# This is the user that owns tha cluster installation.
|
||||||
|
kube_owner: kube
|
||||||
|
|
||||||
|
# This is the group that the cert creation scripts chgrp the
|
||||||
|
# cert files to. Not really changeable...
|
||||||
|
kube_cert_group: kube-cert
|
||||||
|
|
||||||
|
# Cluster Loglevel configuration
|
||||||
|
kube_log_level: 2
|
||||||
|
|
||||||
|
# Directory where credentials will be stored
|
||||||
|
credentials_dir: "{{ inventory_dir }}/credentials"
|
||||||
|
|
||||||
|
## It is possible to activate / deactivate selected authentication methods (oidc, static token auth)
|
||||||
|
# kube_oidc_auth: false
|
||||||
|
# kube_token_auth: false
|
||||||
|
|
||||||
|
|
||||||
|
## Variables for OpenID Connect Configuration https://kubernetes.io/docs/admin/authentication/
|
||||||
|
## To use OpenID you have to deploy additional an OpenID Provider (e.g Dex, Keycloak, ...)
|
||||||
|
|
||||||
|
# kube_oidc_url: https:// ...
|
||||||
|
# kube_oidc_client_id: kubernetes
|
||||||
|
## Optional settings for OIDC
|
||||||
|
# kube_oidc_ca_file: "{{ kube_cert_dir }}/ca.pem"
|
||||||
|
# kube_oidc_username_claim: sub
|
||||||
|
# kube_oidc_username_prefix: 'oidc:'
|
||||||
|
# kube_oidc_groups_claim: groups
|
||||||
|
# kube_oidc_groups_prefix: 'oidc:'
|
||||||
|
|
||||||
|
## Variables to control webhook authn/authz
|
||||||
|
# kube_webhook_token_auth: false
|
||||||
|
# kube_webhook_token_auth_url: https://...
|
||||||
|
# kube_webhook_token_auth_url_skip_tls_verify: false
|
||||||
|
|
||||||
|
## For webhook authorization, authorization_modes must include Webhook
|
||||||
|
# kube_webhook_authorization: false
|
||||||
|
# kube_webhook_authorization_url: https://...
|
||||||
|
# kube_webhook_authorization_url_skip_tls_verify: false
|
||||||
|
|
||||||
|
# Choose network plugin (cilium, calico, kube-ovn, weave or flannel. Use cni for generic cni plugin)
|
||||||
|
# Can also be set to 'cloud', which lets the cloud provider setup appropriate routing
|
||||||
|
kube_network_plugin: calico
|
||||||
|
|
||||||
|
# Setting multi_networking to true will install Multus: https://github.com/k8snetworkplumbingwg/multus-cni
|
||||||
|
kube_network_plugin_multus: false
|
||||||
|
|
||||||
|
# Kubernetes internal network for services, unused block of space.
|
||||||
|
kube_service_addresses: 10.233.0.0/18
|
||||||
|
|
||||||
|
# internal network. When used, it will assign IP
|
||||||
|
# addresses from this range to individual pods.
|
||||||
|
# This network must be unused in your network infrastructure!
|
||||||
|
kube_pods_subnet: 10.233.64.0/18
|
||||||
|
|
||||||
|
# internal network node size allocation (optional). This is the size allocated
|
||||||
|
# to each node for pod IP address allocation. Note that the number of pods per node is
|
||||||
|
# also limited by the kubelet_max_pods variable which defaults to 110.
|
||||||
|
#
|
||||||
|
# Example:
|
||||||
|
# Up to 64 nodes and up to 254 or kubelet_max_pods (the lowest of the two) pods per node:
|
||||||
|
# - kube_pods_subnet: 10.233.64.0/18
|
||||||
|
# - kube_network_node_prefix: 24
|
||||||
|
# - kubelet_max_pods: 110
|
||||||
|
#
|
||||||
|
# Example:
|
||||||
|
# Up to 128 nodes and up to 126 or kubelet_max_pods (the lowest of the two) pods per node:
|
||||||
|
# - kube_pods_subnet: 10.233.64.0/18
|
||||||
|
# - kube_network_node_prefix: 25
|
||||||
|
# - kubelet_max_pods: 110
|
||||||
|
kube_network_node_prefix: 24
|
||||||
|
|
||||||
|
# Configure Dual Stack networking (i.e. both IPv4 and IPv6)
|
||||||
|
enable_dual_stack_networks: false
|
||||||
|
|
||||||
|
# Kubernetes internal network for IPv6 services, unused block of space.
|
||||||
|
# This is only used if enable_dual_stack_networks is set to true
|
||||||
|
# This provides 4096 IPv6 IPs
|
||||||
|
kube_service_addresses_ipv6: fd85:ee78:d8a6:8607::1000/116
|
||||||
|
|
||||||
|
# Internal network. When used, it will assign IPv6 addresses from this range to individual pods.
|
||||||
|
# This network must not already be in your network infrastructure!
|
||||||
|
# This is only used if enable_dual_stack_networks is set to true.
|
||||||
|
# This provides room for 256 nodes with 254 pods per node.
|
||||||
|
kube_pods_subnet_ipv6: fd85:ee78:d8a6:8607::1:0000/112
|
||||||
|
|
||||||
|
# IPv6 subnet size allocated to each for pods.
|
||||||
|
# This is only used if enable_dual_stack_networks is set to true
|
||||||
|
# This provides room for 254 pods per node.
|
||||||
|
kube_network_node_prefix_ipv6: 120
|
||||||
|
|
||||||
|
# The port the API Server will be listening on.
|
||||||
|
kube_apiserver_ip: "{{ kube_service_addresses|ipaddr('net')|ipaddr(1)|ipaddr('address') }}"
|
||||||
|
kube_apiserver_port: 6443 # (https)
|
||||||
|
|
||||||
|
# Kube-proxy proxyMode configuration.
|
||||||
|
# Can be ipvs, iptables
|
||||||
|
kube_proxy_mode: ipvs
|
||||||
|
|
||||||
|
# configure arp_ignore and arp_announce to avoid answering ARP queries from kube-ipvs0 interface
|
||||||
|
# must be set to true for MetalLB, kube-vip(ARP enabled) to work
|
||||||
|
kube_proxy_strict_arp: false
|
||||||
|
|
||||||
|
# A string slice of values which specify the addresses to use for NodePorts.
|
||||||
|
# Values may be valid IP blocks (e.g. 1.2.3.0/24, 1.2.3.4/32).
|
||||||
|
# The default empty string slice ([]) means to use all local addresses.
|
||||||
|
# kube_proxy_nodeport_addresses_cidr is retained for legacy config
|
||||||
|
kube_proxy_nodeport_addresses: >-
|
||||||
|
{%- if kube_proxy_nodeport_addresses_cidr is defined -%}
|
||||||
|
[{{ kube_proxy_nodeport_addresses_cidr }}]
|
||||||
|
{%- else -%}
|
||||||
|
[]
|
||||||
|
{%- endif -%}
|
||||||
|
|
||||||
|
# If non-empty, will use this string as identification instead of the actual hostname
|
||||||
|
# kube_override_hostname: >-
|
||||||
|
# {%- if cloud_provider is defined and cloud_provider in [ 'aws' ] -%}
|
||||||
|
# {%- else -%}
|
||||||
|
# {{ inventory_hostname }}
|
||||||
|
# {%- endif -%}
|
||||||
|
|
||||||
|
## Encrypting Secret Data at Rest
|
||||||
|
kube_encrypt_secret_data: false
|
||||||
|
|
||||||
|
# Graceful Node Shutdown (Kubernetes >= 1.21.0), see https://kubernetes.io/blog/2021/04/21/graceful-node-shutdown-beta/
|
||||||
|
# kubelet_shutdown_grace_period had to be greater than kubelet_shutdown_grace_period_critical_pods to allow
|
||||||
|
# non-critical podsa to also terminate gracefully
|
||||||
|
# kubelet_shutdown_grace_period: 60s
|
||||||
|
# kubelet_shutdown_grace_period_critical_pods: 20s
|
||||||
|
|
||||||
|
# DNS configuration.
|
||||||
|
# Kubernetes cluster name, also will be used as DNS domain
|
||||||
|
cluster_name: k8s-cluster.local
|
||||||
|
# Subdomains of DNS domain to be resolved via /etc/resolv.conf for hostnet pods
|
||||||
|
ndots: 2
|
||||||
|
# dns_timeout: 2
|
||||||
|
# dns_attempts: 2
|
||||||
|
# Custom search domains to be added in addition to the default cluster search domains
|
||||||
|
# searchdomains:
|
||||||
|
# - "svc.{{ cluster_name }}"
|
||||||
|
# - "default.svc.{{ cluster_name }}"
|
||||||
|
# remove_default_searchdomains: false
|
||||||
|
# Can be coredns, coredns_dual, manual or none
|
||||||
|
dns_mode: coredns
|
||||||
|
# Set manual server if using a custom cluster DNS server
|
||||||
|
# manual_dns_server: 10.x.x.x
|
||||||
|
# Enable nodelocal dns cache
|
||||||
|
enable_nodelocaldns: true
|
||||||
|
enable_nodelocaldns_secondary: false
|
||||||
|
nodelocaldns_ip: 169.254.25.10
|
||||||
|
nodelocaldns_health_port: 9254
|
||||||
|
nodelocaldns_second_health_port: 9256
|
||||||
|
nodelocaldns_bind_metrics_host_ip: false
|
||||||
|
nodelocaldns_secondary_skew_seconds: 5
|
||||||
|
# nodelocaldns_external_zones:
|
||||||
|
# - zones:
|
||||||
|
# - example.com
|
||||||
|
# - example.io:1053
|
||||||
|
# nameservers:
|
||||||
|
# - 1.1.1.1
|
||||||
|
# - 2.2.2.2
|
||||||
|
# cache: 5
|
||||||
|
# - zones:
|
||||||
|
# - https://mycompany.local:4453
|
||||||
|
# nameservers:
|
||||||
|
# - 192.168.0.53
|
||||||
|
# cache: 0
|
||||||
|
# - zones:
|
||||||
|
# - mydomain.tld
|
||||||
|
# nameservers:
|
||||||
|
# - 10.233.0.3
|
||||||
|
# cache: 5
|
||||||
|
# rewrite:
|
||||||
|
# - name website.tld website.namespace.svc.cluster.local
|
||||||
|
# Enable k8s_external plugin for CoreDNS
|
||||||
|
enable_coredns_k8s_external: false
|
||||||
|
coredns_k8s_external_zone: k8s_external.local
|
||||||
|
# Enable endpoint_pod_names option for kubernetes plugin
|
||||||
|
enable_coredns_k8s_endpoint_pod_names: false
|
||||||
|
# Set forward options for upstream DNS servers in coredns (and nodelocaldns) config
|
||||||
|
# dns_upstream_forward_extra_opts:
|
||||||
|
# policy: sequential
|
||||||
|
# Apply extra options to coredns kubernetes plugin
|
||||||
|
# coredns_kubernetes_extra_opts:
|
||||||
|
# - 'fallthrough example.local'
|
||||||
|
# Forward extra domains to the coredns kubernetes plugin
|
||||||
|
# coredns_kubernetes_extra_domains: ''
|
||||||
|
|
||||||
|
# Can be docker_dns, host_resolvconf or none
|
||||||
|
resolvconf_mode: host_resolvconf
|
||||||
|
# Deploy netchecker app to verify DNS resolve as an HTTP service
|
||||||
|
deploy_netchecker: false
|
||||||
|
# Ip address of the kubernetes skydns service
|
||||||
|
skydns_server: "{{ kube_service_addresses|ipaddr('net')|ipaddr(3)|ipaddr('address') }}"
|
||||||
|
skydns_server_secondary: "{{ kube_service_addresses|ipaddr('net')|ipaddr(4)|ipaddr('address') }}"
|
||||||
|
dns_domain: "{{ cluster_name }}"
|
||||||
|
|
||||||
|
## Container runtime
|
||||||
|
## docker for docker, crio for cri-o and containerd for containerd.
|
||||||
|
## Default: containerd
|
||||||
|
container_manager: containerd
|
||||||
|
|
||||||
|
# Additional container runtimes
|
||||||
|
kata_containers_enabled: false
|
||||||
|
|
||||||
|
kubeadm_certificate_key: "{{ lookup('password', credentials_dir + '/kubeadm_certificate_key.creds length=64 chars=hexdigits') | lower }}"
|
||||||
|
|
||||||
|
# K8s image pull policy (imagePullPolicy)
|
||||||
|
k8s_image_pull_policy: IfNotPresent
|
||||||
|
|
||||||
|
# audit log for kubernetes
|
||||||
|
kubernetes_audit: false
|
||||||
|
|
||||||
|
# define kubelet config dir for dynamic kubelet
|
||||||
|
# kubelet_config_dir:
|
||||||
|
default_kubelet_config_dir: "{{ kube_config_dir }}/dynamic_kubelet_dir"
|
||||||
|
|
||||||
|
# pod security policy (RBAC must be enabled either by having 'RBAC' in authorization_modes or kubeadm enabled)
|
||||||
|
podsecuritypolicy_enabled: true
|
||||||
|
|
||||||
|
# Custom PodSecurityPolicySpec for restricted policy
|
||||||
|
# podsecuritypolicy_restricted_spec: {}
|
||||||
|
|
||||||
|
# Custom PodSecurityPolicySpec for privileged policy
|
||||||
|
# podsecuritypolicy_privileged_spec: {}
|
||||||
|
|
||||||
|
# Make a copy of kubeconfig on the host that runs Ansible in {{ inventory_dir }}/artifacts
|
||||||
|
kubeconfig_localhost: true
|
||||||
|
# Use ansible_host as external api ip when copying over kubeconfig.
|
||||||
|
kubeconfig_localhost_ansible_host: true
|
||||||
|
# kubectl_localhost: false
|
||||||
|
|
||||||
|
# A comma separated list of levels of node allocatable enforcement to be enforced by kubelet.
|
||||||
|
# Acceptable options are 'pods', 'system-reserved', 'kube-reserved' and ''. Default is "".
|
||||||
|
# kubelet_enforce_node_allocatable: pods
|
||||||
|
|
||||||
|
## Set runtime and kubelet cgroups when using systemd as cgroup driver (default)
|
||||||
|
# kubelet_runtime_cgroups: "/{{ kube_service_cgroups }}/{{ container_manager }}.service"
|
||||||
|
# kubelet_kubelet_cgroups: "/{{ kube_service_cgroups }}/kubelet.service"
|
||||||
|
|
||||||
|
## Set runtime and kubelet cgroups when using cgroupfs as cgroup driver
|
||||||
|
# kubelet_runtime_cgroups_cgroupfs: "/system.slice/{{ container_manager }}.service"
|
||||||
|
# kubelet_kubelet_cgroups_cgroupfs: "/system.slice/kubelet.service"
|
||||||
|
|
||||||
|
# Optionally reserve this space for kube daemons.
|
||||||
|
# kube_reserved: false
|
||||||
|
## Uncomment to override default values
|
||||||
|
## The following two items need to be set when kube_reserved is true
|
||||||
|
# kube_reserved_cgroups_for_service_slice: kube.slice
|
||||||
|
# kube_reserved_cgroups: "/{{ kube_reserved_cgroups_for_service_slice }}"
|
||||||
|
# kube_memory_reserved: 256Mi
|
||||||
|
# kube_cpu_reserved: 100m
|
||||||
|
# kube_ephemeral_storage_reserved: 2Gi
|
||||||
|
# kube_pid_reserved: "1000"
|
||||||
|
# Reservation for master hosts
|
||||||
|
# kube_master_memory_reserved: 512Mi
|
||||||
|
# kube_master_cpu_reserved: 200m
|
||||||
|
# kube_master_ephemeral_storage_reserved: 2Gi
|
||||||
|
# kube_master_pid_reserved: "1000"
|
||||||
|
|
||||||
|
## Optionally reserve resources for OS system daemons.
|
||||||
|
# system_reserved: true
|
||||||
|
## Uncomment to override default values
|
||||||
|
## The following two items need to be set when system_reserved is true
|
||||||
|
# system_reserved_cgroups_for_service_slice: system.slice
|
||||||
|
# system_reserved_cgroups: "/{{ system_reserved_cgroups_for_service_slice }}"
|
||||||
|
# system_memory_reserved: 512Mi
|
||||||
|
# system_cpu_reserved: 500m
|
||||||
|
# system_ephemeral_storage_reserved: 2Gi
|
||||||
|
## Reservation for master hosts
|
||||||
|
# system_master_memory_reserved: 256Mi
|
||||||
|
# system_master_cpu_reserved: 250m
|
||||||
|
# system_master_ephemeral_storage_reserved: 2Gi
|
||||||
|
|
||||||
|
## Eviction Thresholds to avoid system OOMs
|
||||||
|
# https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#eviction-thresholds
|
||||||
|
# eviction_hard: {}
|
||||||
|
# eviction_hard_control_plane: {}
|
||||||
|
|
||||||
|
# An alternative flexvolume plugin directory
|
||||||
|
# kubelet_flexvolumes_plugins_dir: /usr/libexec/kubernetes/kubelet-plugins/volume/exec
|
||||||
|
|
||||||
|
## Supplementary addresses that can be added in kubernetes ssl keys.
|
||||||
|
## That can be useful for example to setup a keepalived virtual IP
|
||||||
|
# supplementary_addresses_in_ssl_keys: [10.0.0.1, 10.0.0.2, 10.0.0.3]
|
||||||
|
|
||||||
|
## Running on top of openstack vms with cinder enabled may lead to unschedulable pods due to NoVolumeZoneConflict restriction in kube-scheduler.
|
||||||
|
## See https://github.com/kubernetes-sigs/kubespray/issues/2141
|
||||||
|
## Set this variable to true to get rid of this issue
|
||||||
|
volume_cross_zone_attachment: false
|
||||||
|
## Add Persistent Volumes Storage Class for corresponding cloud provider (supported: in-tree OpenStack, Cinder CSI,
|
||||||
|
## AWS EBS CSI, Azure Disk CSI, GCP Persistent Disk CSI)
|
||||||
|
persistent_volumes_enabled: false
|
||||||
|
|
||||||
|
## Container Engine Acceleration
|
||||||
|
## Enable container acceleration feature, for example use gpu acceleration in containers
|
||||||
|
# nvidia_accelerator_enabled: true
|
||||||
|
## Nvidia GPU driver install. Install will by done by a (init) pod running as a daemonset.
|
||||||
|
## Important: if you use Ubuntu then you should set in all.yml 'docker_storage_options: -s overlay2'
|
||||||
|
## Array with nvida_gpu_nodes, leave empty or comment if you don't want to install drivers.
|
||||||
|
## Labels and taints won't be set to nodes if they are not in the array.
|
||||||
|
# nvidia_gpu_nodes:
|
||||||
|
# - kube-gpu-001
|
||||||
|
# nvidia_driver_version: "384.111"
|
||||||
|
## flavor can be tesla or gtx
|
||||||
|
# nvidia_gpu_flavor: gtx
|
||||||
|
## NVIDIA driver installer images. Change them if you have trouble accessing gcr.io.
|
||||||
|
# nvidia_driver_install_centos_container: atzedevries/nvidia-centos-driver-installer:2
|
||||||
|
# nvidia_driver_install_ubuntu_container: gcr.io/google-containers/ubuntu-nvidia-driver-installer@sha256:7df76a0f0a17294e86f691c81de6bbb7c04a1b4b3d4ea4e7e2cccdc42e1f6d63
|
||||||
|
## NVIDIA GPU device plugin image.
|
||||||
|
# nvidia_gpu_device_plugin_container: "registry.k8s.io/nvidia-gpu-device-plugin@sha256:0842734032018be107fa2490c98156992911e3e1f2a21e059ff0105b07dd8e9e"
|
||||||
|
|
||||||
|
## Support tls min version, Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
|
||||||
|
# tls_min_version: ""
|
||||||
|
|
||||||
|
## Support tls cipher suites.
|
||||||
|
# tls_cipher_suites: {}
|
||||||
|
# - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
|
||||||
|
# - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
|
||||||
|
# - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||||||
|
# - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
|
||||||
|
# - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
||||||
|
# - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
|
||||||
|
# - TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
|
||||||
|
# - TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
|
||||||
|
# - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
# - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
# - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
# - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
# - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
# - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
|
||||||
|
# - TLS_ECDHE_RSA_WITH_RC4_128_SHA
|
||||||
|
# - TLS_RSA_WITH_3DES_EDE_CBC_SHA
|
||||||
|
# - TLS_RSA_WITH_AES_128_CBC_SHA
|
||||||
|
# - TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||||
|
# - TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||||
|
# - TLS_RSA_WITH_AES_256_CBC_SHA
|
||||||
|
# - TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
# - TLS_RSA_WITH_RC4_128_SHA
|
||||||
|
|
||||||
|
## Amount of time to retain events. (default 1h0m0s)
|
||||||
|
event_ttl_duration: "1h0m0s"
|
||||||
|
|
||||||
|
## Automatically renew K8S control plane certificates on first Monday of each month
|
||||||
|
auto_renew_certificates: true
|
||||||
|
# First Monday of each month
|
||||||
|
# auto_renew_certificates_systemd_calendar: "Mon *-*-1,2,3,4,5,6,7 03:{{ groups['kube_control_plane'].index(inventory_hostname) }}0:00"
|
||||||
|
|
||||||
|
# kubeadm patches path
|
||||||
|
kubeadm_patches:
|
||||||
|
enabled: false
|
||||||
|
source_dir: "{{ inventory_dir }}/patches"
|
||||||
|
dest_dir: "{{ kube_config_dir }}/patches"
|
||||||
131
kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml
Normal file
131
kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml
Normal file
@@ -0,0 +1,131 @@
|
|||||||
|
---
|
||||||
|
# see roles/network_plugin/calico/defaults/main.yml
|
||||||
|
|
||||||
|
# the default value of name
|
||||||
|
calico_cni_name: k8s-pod-network
|
||||||
|
|
||||||
|
## With calico it is possible to distributed routes with border routers of the datacenter.
|
||||||
|
## Warning : enabling router peering will disable calico's default behavior ('node mesh').
|
||||||
|
## The subnets of each nodes will be distributed by the datacenter router
|
||||||
|
# peer_with_router: false
|
||||||
|
|
||||||
|
# Enables Internet connectivity from containers
|
||||||
|
# nat_outgoing: true
|
||||||
|
|
||||||
|
# Enables Calico CNI "host-local" IPAM plugin
|
||||||
|
# calico_ipam_host_local: true
|
||||||
|
|
||||||
|
# add default ippool name
|
||||||
|
# calico_pool_name: "default-pool"
|
||||||
|
|
||||||
|
# add default ippool blockSize (defaults kube_network_node_prefix)
|
||||||
|
calico_pool_blocksize: 26
|
||||||
|
|
||||||
|
# add default ippool CIDR (must be inside kube_pods_subnet, defaults to kube_pods_subnet otherwise)
|
||||||
|
# calico_pool_cidr: 1.2.3.4/5
|
||||||
|
|
||||||
|
# add default ippool CIDR to CNI config
|
||||||
|
# calico_cni_pool: true
|
||||||
|
|
||||||
|
# Add default IPV6 IPPool CIDR. Must be inside kube_pods_subnet_ipv6. Defaults to kube_pods_subnet_ipv6 if not set.
|
||||||
|
# calico_pool_cidr_ipv6: fd85:ee78:d8a6:8607::1:0000/112
|
||||||
|
|
||||||
|
# Add default IPV6 IPPool CIDR to CNI config
|
||||||
|
# calico_cni_pool_ipv6: true
|
||||||
|
|
||||||
|
# Global as_num (/calico/bgp/v1/global/as_num)
|
||||||
|
# global_as_num: "64512"
|
||||||
|
|
||||||
|
# If doing peering with node-assigned asn where the globas does not match your nodes, you want this
|
||||||
|
# to be true. All other cases, false.
|
||||||
|
# calico_no_global_as_num: false
|
||||||
|
|
||||||
|
# You can set MTU value here. If left undefined or empty, it will
|
||||||
|
# not be specified in calico CNI config, so Calico will use built-in
|
||||||
|
# defaults. The value should be a number, not a string.
|
||||||
|
# calico_mtu: 1500
|
||||||
|
|
||||||
|
# Configure the MTU to use for workload interfaces and tunnels.
|
||||||
|
# - If Wireguard is enabled, subtract 60 from your network MTU (i.e 1500-60=1440)
|
||||||
|
# - Otherwise, if VXLAN or BPF mode is enabled, subtract 50 from your network MTU (i.e. 1500-50=1450)
|
||||||
|
# - Otherwise, if IPIP is enabled, subtract 20 from your network MTU (i.e. 1500-20=1480)
|
||||||
|
# - Otherwise, if not using any encapsulation, set to your network MTU (i.e. 1500)
|
||||||
|
# calico_veth_mtu: 1440
|
||||||
|
|
||||||
|
# Advertise Cluster IPs
|
||||||
|
# calico_advertise_cluster_ips: true
|
||||||
|
|
||||||
|
# Advertise Service External IPs
|
||||||
|
# calico_advertise_service_external_ips:
|
||||||
|
# - x.x.x.x/24
|
||||||
|
# - y.y.y.y/32
|
||||||
|
|
||||||
|
# Advertise Service LoadBalancer IPs
|
||||||
|
# calico_advertise_service_loadbalancer_ips:
|
||||||
|
# - x.x.x.x/24
|
||||||
|
# - y.y.y.y/16
|
||||||
|
|
||||||
|
# Choose data store type for calico: "etcd" or "kdd" (kubernetes datastore)
|
||||||
|
# calico_datastore: "kdd"
|
||||||
|
|
||||||
|
# Choose Calico iptables backend: "Legacy", "Auto" or "NFT"
|
||||||
|
# calico_iptables_backend: "Auto"
|
||||||
|
|
||||||
|
# Use typha (only with kdd)
|
||||||
|
# typha_enabled: false
|
||||||
|
|
||||||
|
# Generate TLS certs for secure typha<->calico-node communication
|
||||||
|
# typha_secure: false
|
||||||
|
|
||||||
|
# Scaling typha: 1 replica per 100 nodes is adequate
|
||||||
|
# Number of typha replicas
|
||||||
|
# typha_replicas: 1
|
||||||
|
|
||||||
|
# Set max typha connections
|
||||||
|
# typha_max_connections_lower_limit: 300
|
||||||
|
|
||||||
|
# Set calico network backend: "bird", "vxlan" or "none"
|
||||||
|
# bird enable BGP routing, required for ipip and no encapsulation modes
|
||||||
|
# calico_network_backend: vxlan
|
||||||
|
|
||||||
|
# IP in IP and VXLAN is mutualy exclusive modes.
|
||||||
|
# set IP in IP encapsulation mode: "Always", "CrossSubnet", "Never"
|
||||||
|
# calico_ipip_mode: 'Never'
|
||||||
|
|
||||||
|
# set VXLAN encapsulation mode: "Always", "CrossSubnet", "Never"
|
||||||
|
# calico_vxlan_mode: 'Always'
|
||||||
|
|
||||||
|
# set VXLAN port and VNI
|
||||||
|
# calico_vxlan_vni: 4096
|
||||||
|
# calico_vxlan_port: 4789
|
||||||
|
|
||||||
|
# Enable eBPF mode
|
||||||
|
# calico_bpf_enabled: false
|
||||||
|
|
||||||
|
# If you want to use non default IP_AUTODETECTION_METHOD, IP6_AUTODETECTION_METHOD for calico node set this option to one of:
|
||||||
|
# * can-reach=DESTINATION
|
||||||
|
# * interface=INTERFACE-REGEX
|
||||||
|
# see https://docs.projectcalico.org/reference/node/configuration
|
||||||
|
# calico_ip_auto_method: "interface=eth.*"
|
||||||
|
# calico_ip6_auto_method: "interface=eth.*"
|
||||||
|
|
||||||
|
# Set FELIX_MTUIFACEPATTERN, Pattern used to discover the host’s interface for MTU auto-detection.
|
||||||
|
# see https://projectcalico.docs.tigera.io/reference/felix/configuration
|
||||||
|
# calico_felix_mtu_iface_pattern: "^((en|wl|ww|sl|ib)[opsx].*|(eth|wlan|wwan).*)"
|
||||||
|
|
||||||
|
# Choose the iptables insert mode for Calico: "Insert" or "Append".
|
||||||
|
# calico_felix_chaininsertmode: Insert
|
||||||
|
|
||||||
|
# If you want use the default route interface when you use multiple interface with dynamique route (iproute2)
|
||||||
|
# see https://docs.projectcalico.org/reference/node/configuration : FELIX_DEVICEROUTESOURCEADDRESS
|
||||||
|
# calico_use_default_route_src_ipaddr: false
|
||||||
|
|
||||||
|
# Enable calico traffic encryption with wireguard
|
||||||
|
# calico_wireguard_enabled: false
|
||||||
|
|
||||||
|
# Under certain situations liveness and readiness probes may need tunning
|
||||||
|
# calico_node_livenessprobe_timeout: 10
|
||||||
|
# calico_node_readinessprobe_timeout: 10
|
||||||
|
|
||||||
|
# Calico apiserver (only with kdd)
|
||||||
|
# calico_apiserver_enabled: false
|
||||||
245
kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml
Normal file
245
kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml
Normal file
@@ -0,0 +1,245 @@
|
|||||||
|
---
|
||||||
|
# cilium_version: "v1.12.1"
|
||||||
|
|
||||||
|
# Log-level
|
||||||
|
# cilium_debug: false
|
||||||
|
|
||||||
|
# cilium_mtu: ""
|
||||||
|
# cilium_enable_ipv4: true
|
||||||
|
# cilium_enable_ipv6: false
|
||||||
|
|
||||||
|
# Cilium agent health port
|
||||||
|
# cilium_agent_health_port: "9879"
|
||||||
|
|
||||||
|
# Identity allocation mode selects how identities are shared between cilium
|
||||||
|
# nodes by setting how they are stored. The options are "crd" or "kvstore".
|
||||||
|
# - "crd" stores identities in kubernetes as CRDs (custom resource definition).
|
||||||
|
# These can be queried with:
|
||||||
|
# `kubectl get ciliumid`
|
||||||
|
# - "kvstore" stores identities in an etcd kvstore.
|
||||||
|
# - In order to support External Workloads, "crd" is required
|
||||||
|
# - Ref: https://docs.cilium.io/en/stable/gettingstarted/external-workloads/#setting-up-support-for-external-workloads-beta
|
||||||
|
# - KVStore operations are only required when cilium-operator is running with any of the below options:
|
||||||
|
# - --synchronize-k8s-services
|
||||||
|
# - --synchronize-k8s-nodes
|
||||||
|
# - --identity-allocation-mode=kvstore
|
||||||
|
# - Ref: https://docs.cilium.io/en/stable/internals/cilium_operator/#kvstore-operations
|
||||||
|
# cilium_identity_allocation_mode: kvstore
|
||||||
|
|
||||||
|
# Etcd SSL dirs
|
||||||
|
# cilium_cert_dir: /etc/cilium/certs
|
||||||
|
# kube_etcd_cacert_file: ca.pem
|
||||||
|
# kube_etcd_cert_file: cert.pem
|
||||||
|
# kube_etcd_key_file: cert-key.pem
|
||||||
|
|
||||||
|
# Limits for apps
|
||||||
|
# cilium_memory_limit: 500M
|
||||||
|
# cilium_cpu_limit: 500m
|
||||||
|
# cilium_memory_requests: 64M
|
||||||
|
# cilium_cpu_requests: 100m
|
||||||
|
|
||||||
|
# Overlay Network Mode
|
||||||
|
# cilium_tunnel_mode: vxlan
|
||||||
|
# Optional features
|
||||||
|
# cilium_enable_prometheus: false
|
||||||
|
# Enable if you want to make use of hostPort mappings
|
||||||
|
# cilium_enable_portmap: false
|
||||||
|
# Monitor aggregation level (none/low/medium/maximum)
|
||||||
|
# cilium_monitor_aggregation: medium
|
||||||
|
# The monitor aggregation flags determine which TCP flags which, upon the
|
||||||
|
# first observation, cause monitor notifications to be generated.
|
||||||
|
#
|
||||||
|
# Only effective when monitor aggregation is set to "medium" or higher.
|
||||||
|
# cilium_monitor_aggregation_flags: "all"
|
||||||
|
# Kube Proxy Replacement mode (strict/partial)
|
||||||
|
# cilium_kube_proxy_replacement: partial
|
||||||
|
|
||||||
|
# If upgrading from Cilium < 1.5, you may want to override some of these options
|
||||||
|
# to prevent service disruptions. See also:
|
||||||
|
# http://docs.cilium.io/en/stable/install/upgrade/#changes-that-may-require-action
|
||||||
|
# cilium_preallocate_bpf_maps: false
|
||||||
|
|
||||||
|
# `cilium_tofqdns_enable_poller` is deprecated in 1.8, removed in 1.9
|
||||||
|
# cilium_tofqdns_enable_poller: false
|
||||||
|
|
||||||
|
# `cilium_enable_legacy_services` is deprecated in 1.6, removed in 1.9
|
||||||
|
# cilium_enable_legacy_services: false
|
||||||
|
|
||||||
|
# Unique ID of the cluster. Must be unique across all conneted clusters and
|
||||||
|
# in the range of 1 and 255. Only relevant when building a mesh of clusters.
|
||||||
|
# This value is not defined by default
|
||||||
|
# cilium_cluster_id:
|
||||||
|
|
||||||
|
# Deploy cilium even if kube_network_plugin is not cilium.
|
||||||
|
# This enables to deploy cilium alongside another CNI to replace kube-proxy.
|
||||||
|
# cilium_deploy_additionally: false
|
||||||
|
|
||||||
|
# Auto direct nodes routes can be used to advertise pods routes in your cluster
|
||||||
|
# without any tunelling (with `cilium_tunnel_mode` sets to `disabled`).
|
||||||
|
# This works only if you have a L2 connectivity between all your nodes.
|
||||||
|
# You wil also have to specify the variable `cilium_native_routing_cidr` to
|
||||||
|
# make this work. Please refer to the cilium documentation for more
|
||||||
|
# information about this kind of setups.
|
||||||
|
# cilium_auto_direct_node_routes: false
|
||||||
|
|
||||||
|
# Allows to explicitly specify the IPv4 CIDR for native routing.
|
||||||
|
# When specified, Cilium assumes networking for this CIDR is preconfigured and
|
||||||
|
# hands traffic destined for that range to the Linux network stack without
|
||||||
|
# applying any SNAT.
|
||||||
|
# Generally speaking, specifying a native routing CIDR implies that Cilium can
|
||||||
|
# depend on the underlying networking stack to route packets to their
|
||||||
|
# destination. To offer a concrete example, if Cilium is configured to use
|
||||||
|
# direct routing and the Kubernetes CIDR is included in the native routing CIDR,
|
||||||
|
# the user must configure the routes to reach pods, either manually or by
|
||||||
|
# setting the auto-direct-node-routes flag.
|
||||||
|
# cilium_native_routing_cidr: ""
|
||||||
|
|
||||||
|
# Allows to explicitly specify the IPv6 CIDR for native routing.
|
||||||
|
# cilium_native_routing_cidr_ipv6: ""
|
||||||
|
|
||||||
|
# Enable transparent network encryption.
|
||||||
|
# cilium_encryption_enabled: false
|
||||||
|
|
||||||
|
# Encryption method. Can be either ipsec or wireguard.
|
||||||
|
# Only effective when `cilium_encryption_enabled` is set to true.
|
||||||
|
# cilium_encryption_type: "ipsec"
|
||||||
|
|
||||||
|
# Enable encryption for pure node to node traffic.
|
||||||
|
# This option is only effective when `cilium_encryption_type` is set to `ipsec`.
|
||||||
|
# cilium_ipsec_node_encryption: false
|
||||||
|
|
||||||
|
# If your kernel or distribution does not support WireGuard, Cilium agent can be configured to fall back on the user-space implementation.
|
||||||
|
# When this flag is enabled and Cilium detects that the kernel has no native support for WireGuard,
|
||||||
|
# it will fallback on the wireguard-go user-space implementation of WireGuard.
|
||||||
|
# This option is only effective when `cilium_encryption_type` is set to `wireguard`.
|
||||||
|
# cilium_wireguard_userspace_fallback: false
|
||||||
|
|
||||||
|
# IP Masquerade Agent
|
||||||
|
# https://docs.cilium.io/en/stable/concepts/networking/masquerading/
|
||||||
|
# By default, all packets from a pod destined to an IP address outside of the cilium_native_routing_cidr range are masqueraded
|
||||||
|
# cilium_ip_masq_agent_enable: false
|
||||||
|
|
||||||
|
### A packet sent from a pod to a destination which belongs to any CIDR from the nonMasqueradeCIDRs is not going to be masqueraded
|
||||||
|
# cilium_non_masquerade_cidrs:
|
||||||
|
# - 10.0.0.0/8
|
||||||
|
# - 172.16.0.0/12
|
||||||
|
# - 192.168.0.0/16
|
||||||
|
# - 100.64.0.0/10
|
||||||
|
# - 192.0.0.0/24
|
||||||
|
# - 192.0.2.0/24
|
||||||
|
# - 192.88.99.0/24
|
||||||
|
# - 198.18.0.0/15
|
||||||
|
# - 198.51.100.0/24
|
||||||
|
# - 203.0.113.0/24
|
||||||
|
# - 240.0.0.0/4
|
||||||
|
### Indicates whether to masquerade traffic to the link local prefix.
|
||||||
|
### If the masqLinkLocal is not set or set to false, then 169.254.0.0/16 is appended to the non-masquerade CIDRs list.
|
||||||
|
# cilium_masq_link_local: false
|
||||||
|
### A time interval at which the agent attempts to reload config from disk
|
||||||
|
# cilium_ip_masq_resync_interval: 60s
|
||||||
|
|
||||||
|
# Hubble
|
||||||
|
### Enable Hubble without install
|
||||||
|
# cilium_enable_hubble: false
|
||||||
|
### Enable Hubble Metrics
|
||||||
|
# cilium_enable_hubble_metrics: false
|
||||||
|
### if cilium_enable_hubble_metrics: true
|
||||||
|
# cilium_hubble_metrics: {}
|
||||||
|
# - dns
|
||||||
|
# - drop
|
||||||
|
# - tcp
|
||||||
|
# - flow
|
||||||
|
# - icmp
|
||||||
|
# - http
|
||||||
|
### Enable Hubble install
|
||||||
|
# cilium_hubble_install: false
|
||||||
|
### Enable auto generate certs if cilium_hubble_install: true
|
||||||
|
# cilium_hubble_tls_generate: false
|
||||||
|
|
||||||
|
# IP address management mode for v1.9+.
|
||||||
|
# https://docs.cilium.io/en/v1.9/concepts/networking/ipam/
|
||||||
|
# cilium_ipam_mode: kubernetes
|
||||||
|
|
||||||
|
# Extra arguments for the Cilium agent
|
||||||
|
# cilium_agent_custom_args: []
|
||||||
|
|
||||||
|
# For adding and mounting extra volumes to the cilium agent
|
||||||
|
# cilium_agent_extra_volumes: []
|
||||||
|
# cilium_agent_extra_volume_mounts: []
|
||||||
|
|
||||||
|
# cilium_agent_extra_env_vars: []
|
||||||
|
|
||||||
|
# cilium_operator_replicas: 2
|
||||||
|
|
||||||
|
# The address at which the cillium operator bind health check api
|
||||||
|
# cilium_operator_api_serve_addr: "127.0.0.1:9234"
|
||||||
|
|
||||||
|
## A dictionary of extra config variables to add to cilium-config, formatted like:
|
||||||
|
## cilium_config_extra_vars:
|
||||||
|
## var1: "value1"
|
||||||
|
## var2: "value2"
|
||||||
|
# cilium_config_extra_vars: {}
|
||||||
|
|
||||||
|
# For adding and mounting extra volumes to the cilium operator
|
||||||
|
# cilium_operator_extra_volumes: []
|
||||||
|
# cilium_operator_extra_volume_mounts: []
|
||||||
|
|
||||||
|
# Extra arguments for the Cilium Operator
|
||||||
|
# cilium_operator_custom_args: []
|
||||||
|
|
||||||
|
# Name of the cluster. Only relevant when building a mesh of clusters.
|
||||||
|
# cilium_cluster_name: default
|
||||||
|
|
||||||
|
# Make Cilium take ownership over the `/etc/cni/net.d` directory on the node, renaming all non-Cilium CNI configurations to `*.cilium_bak`.
|
||||||
|
# This ensures no Pods can be scheduled using other CNI plugins during Cilium agent downtime.
|
||||||
|
# Available for Cilium v1.10 and up.
|
||||||
|
# cilium_cni_exclusive: true
|
||||||
|
|
||||||
|
# Configure the log file for CNI logging with retention policy of 7 days.
|
||||||
|
# Disable CNI file logging by setting this field to empty explicitly.
|
||||||
|
# Available for Cilium v1.12 and up.
|
||||||
|
# cilium_cni_log_file: "/var/run/cilium/cilium-cni.log"
|
||||||
|
|
||||||
|
# -- Configure cgroup related configuration
|
||||||
|
# -- Enable auto mount of cgroup2 filesystem.
|
||||||
|
# When `cilium_cgroup_auto_mount` is enabled, cgroup2 filesystem is mounted at
|
||||||
|
# `cilium_cgroup_host_root` path on the underlying host and inside the cilium agent pod.
|
||||||
|
# If users disable `cilium_cgroup_auto_mount`, it's expected that users have mounted
|
||||||
|
# cgroup2 filesystem at the specified `cilium_cgroup_auto_mount` volume, and then the
|
||||||
|
# volume will be mounted inside the cilium agent pod at the same path.
|
||||||
|
# Available for Cilium v1.11 and up
|
||||||
|
# cilium_cgroup_auto_mount: true
|
||||||
|
# -- Configure cgroup root where cgroup2 filesystem is mounted on the host
|
||||||
|
# cilium_cgroup_host_root: "/run/cilium/cgroupv2"
|
||||||
|
|
||||||
|
# Specifies the ratio (0.0-1.0) of total system memory to use for dynamic
|
||||||
|
# sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
|
||||||
|
# cilium_bpf_map_dynamic_size_ratio: "0.0"
|
||||||
|
|
||||||
|
# -- Enables masquerading of IPv4 traffic leaving the node from endpoints.
|
||||||
|
# Available for Cilium v1.10 and up
|
||||||
|
# cilium_enable_ipv4_masquerade: true
|
||||||
|
# -- Enables masquerading of IPv6 traffic leaving the node from endpoints.
|
||||||
|
# Available for Cilium v1.10 and up
|
||||||
|
# cilium_enable_ipv6_masquerade: true
|
||||||
|
|
||||||
|
# -- Enable native IP masquerade support in eBPF
|
||||||
|
# cilium_enable_bpf_masquerade: false
|
||||||
|
|
||||||
|
# -- Configure whether direct routing mode should route traffic via
|
||||||
|
# host stack (true) or directly and more efficiently out of BPF (false) if
|
||||||
|
# the kernel supports it. The latter has the implication that it will also
|
||||||
|
# bypass netfilter in the host namespace.
|
||||||
|
# cilium_enable_host_legacy_routing: true
|
||||||
|
|
||||||
|
# -- Enable use of the remote node identity.
|
||||||
|
# ref: https://docs.cilium.io/en/v1.7/install/upgrade/#configmap-remote-node-identity
|
||||||
|
# cilium_enable_remote_node_identity: true
|
||||||
|
|
||||||
|
# -- Enable the use of well-known identities.
|
||||||
|
# cilium_enable_well_known_identities: false
|
||||||
|
|
||||||
|
# cilium_enable_bpf_clock_probe: true
|
||||||
|
|
||||||
|
# -- Whether to enable CNP status updates.
|
||||||
|
# cilium_disable_cnp_status_updates: true
|
||||||
@@ -0,0 +1,18 @@
|
|||||||
|
# see roles/network_plugin/flannel/defaults/main.yml
|
||||||
|
|
||||||
|
## interface that should be used for flannel operations
|
||||||
|
## This is actually an inventory cluster-level item
|
||||||
|
# flannel_interface:
|
||||||
|
|
||||||
|
## Select interface that should be used for flannel operations by regexp on Name or IP
|
||||||
|
## This is actually an inventory cluster-level item
|
||||||
|
## example: select interface with ip from net 10.0.0.0/23
|
||||||
|
## single quote and escape backslashes
|
||||||
|
# flannel_interface_regexp: '10\\.0\\.[0-2]\\.\\d{1,3}'
|
||||||
|
|
||||||
|
# You can choose what type of flannel backend to use: 'vxlan', 'host-gw' or 'wireguard'
|
||||||
|
# please refer to flannel's docs : https://github.com/coreos/flannel/blob/master/README.md
|
||||||
|
# flannel_backend_type: "vxlan"
|
||||||
|
# flannel_vxlan_vni: 1
|
||||||
|
# flannel_vxlan_port: 8472
|
||||||
|
# flannel_vxlan_direct_routing: false
|
||||||
@@ -0,0 +1,63 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
# geneve or vlan
|
||||||
|
kube_ovn_network_type: geneve
|
||||||
|
|
||||||
|
# geneve, vxlan or stt. ATTENTION: some networkpolicy cannot take effect when using vxlan and stt need custom compile ovs kernel module
|
||||||
|
kube_ovn_tunnel_type: geneve
|
||||||
|
|
||||||
|
## The nic to support container network can be a nic name or a group of regex separated by comma e.g: 'enp6s0f0,eth.*', if empty will use the nic that the default route use.
|
||||||
|
# kube_ovn_iface: eth1
|
||||||
|
## The MTU used by pod iface in overlay networks (default iface MTU - 100)
|
||||||
|
# kube_ovn_mtu: 1333
|
||||||
|
|
||||||
|
## Enable hw-offload, disable traffic mirror and set the iface to the physical port. Make sure that there is an IP address bind to the physical port.
|
||||||
|
kube_ovn_hw_offload: false
|
||||||
|
# traffic mirror
|
||||||
|
kube_ovn_traffic_mirror: false
|
||||||
|
|
||||||
|
# kube_ovn_pool_cidr_ipv6: fd85:ee78:d8a6:8607::1:0000/112
|
||||||
|
# kube_ovn_default_interface_name: eth0
|
||||||
|
|
||||||
|
kube_ovn_external_address: 8.8.8.8
|
||||||
|
kube_ovn_external_address_ipv6: 2400:3200::1
|
||||||
|
kube_ovn_external_dns: alauda.cn
|
||||||
|
|
||||||
|
# kube_ovn_default_gateway: 10.233.64.1,fd85:ee78:d8a6:8607::1:0
|
||||||
|
kube_ovn_default_gateway_check: true
|
||||||
|
kube_ovn_default_logical_gateway: false
|
||||||
|
# kube_ovn_default_exclude_ips: 10.16.0.1
|
||||||
|
kube_ovn_node_switch_cidr: 100.64.0.0/16
|
||||||
|
kube_ovn_node_switch_cidr_ipv6: fd00:100:64::/64
|
||||||
|
|
||||||
|
## vlan config, set default interface name and vlan id
|
||||||
|
# kube_ovn_default_interface_name: eth0
|
||||||
|
kube_ovn_default_vlan_id: 100
|
||||||
|
kube_ovn_vlan_name: product
|
||||||
|
|
||||||
|
## pod nic type, support: veth-pair or internal-port
|
||||||
|
kube_ovn_pod_nic_type: veth_pair
|
||||||
|
|
||||||
|
## Enable load balancer
|
||||||
|
kube_ovn_enable_lb: true
|
||||||
|
|
||||||
|
## Enable network policy support
|
||||||
|
kube_ovn_enable_np: true
|
||||||
|
|
||||||
|
## Enable external vpc support
|
||||||
|
kube_ovn_enable_external_vpc: true
|
||||||
|
|
||||||
|
## Enable checksum
|
||||||
|
kube_ovn_encap_checksum: true
|
||||||
|
|
||||||
|
## enable ssl
|
||||||
|
kube_ovn_enable_ssl: false
|
||||||
|
|
||||||
|
## dpdk
|
||||||
|
kube_ovn_dpdk_enabled: false
|
||||||
|
|
||||||
|
## enable interconnection to an existing IC database server.
|
||||||
|
kube_ovn_ic_enable: false
|
||||||
|
kube_ovn_ic_autoroute: true
|
||||||
|
kube_ovn_ic_dbhost: "127.0.0.1"
|
||||||
|
kube_ovn_ic_zone: "kubernetes"
|
||||||
@@ -0,0 +1,64 @@
|
|||||||
|
# See roles/network_plugin/kube-router//defaults/main.yml
|
||||||
|
|
||||||
|
# Enables Pod Networking -- Advertises and learns the routes to Pods via iBGP
|
||||||
|
# kube_router_run_router: true
|
||||||
|
|
||||||
|
# Enables Network Policy -- sets up iptables to provide ingress firewall for pods
|
||||||
|
# kube_router_run_firewall: true
|
||||||
|
|
||||||
|
# Enables Service Proxy -- sets up IPVS for Kubernetes Services
|
||||||
|
# see docs/kube-router.md "Caveats" section
|
||||||
|
# kube_router_run_service_proxy: false
|
||||||
|
|
||||||
|
# Add Cluster IP of the service to the RIB so that it gets advertises to the BGP peers.
|
||||||
|
# kube_router_advertise_cluster_ip: false
|
||||||
|
|
||||||
|
# Add External IP of service to the RIB so that it gets advertised to the BGP peers.
|
||||||
|
# kube_router_advertise_external_ip: false
|
||||||
|
|
||||||
|
# Add LoadBalancer IP of service status as set by the LB provider to the RIB so that it gets advertised to the BGP peers.
|
||||||
|
# kube_router_advertise_loadbalancer_ip: false
|
||||||
|
|
||||||
|
# Adjust manifest of kube-router daemonset template with DSR needed changes
|
||||||
|
# kube_router_enable_dsr: false
|
||||||
|
|
||||||
|
# Array of arbitrary extra arguments to kube-router, see
|
||||||
|
# https://github.com/cloudnativelabs/kube-router/blob/master/docs/user-guide.md
|
||||||
|
# kube_router_extra_args: []
|
||||||
|
|
||||||
|
# ASN number of the cluster, used when communicating with external BGP routers
|
||||||
|
# kube_router_cluster_asn: ~
|
||||||
|
|
||||||
|
# ASN numbers of the BGP peer to which cluster nodes will advertise cluster ip and node's pod cidr.
|
||||||
|
# kube_router_peer_router_asns: ~
|
||||||
|
|
||||||
|
# The ip address of the external router to which all nodes will peer and advertise the cluster ip and pod cidr's.
|
||||||
|
# kube_router_peer_router_ips: ~
|
||||||
|
|
||||||
|
# The remote port of the external BGP to which all nodes will peer. If not set, default BGP port (179) will be used.
|
||||||
|
# kube_router_peer_router_ports: ~
|
||||||
|
|
||||||
|
# Setups node CNI to allow hairpin mode, requires node reboots, see
|
||||||
|
# https://github.com/cloudnativelabs/kube-router/blob/master/docs/user-guide.md#hairpin-mode
|
||||||
|
# kube_router_support_hairpin_mode: false
|
||||||
|
|
||||||
|
# Select DNS Policy ClusterFirstWithHostNet, ClusterFirst, etc.
|
||||||
|
# kube_router_dns_policy: ClusterFirstWithHostNet
|
||||||
|
|
||||||
|
# Array of annotations for master
|
||||||
|
# kube_router_annotations_master: []
|
||||||
|
|
||||||
|
# Array of annotations for every node
|
||||||
|
# kube_router_annotations_node: []
|
||||||
|
|
||||||
|
# Array of common annotations for every node
|
||||||
|
# kube_router_annotations_all: []
|
||||||
|
|
||||||
|
# Enables scraping kube-router metrics with Prometheus
|
||||||
|
# kube_router_enable_metrics: false
|
||||||
|
|
||||||
|
# Path to serve Prometheus metrics on
|
||||||
|
# kube_router_metrics_path: /metrics
|
||||||
|
|
||||||
|
# Prometheus metrics port to use
|
||||||
|
# kube_router_metrics_port: 9255
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
# private interface, on a l2-network
|
||||||
|
macvlan_interface: "eth1"
|
||||||
|
|
||||||
|
# Enable nat in default gateway network interface
|
||||||
|
enable_nat_default_gateway: true
|
||||||
64
kubespray/inventory/group_vars/k8s_cluster/k8s-net-weave.yml
Normal file
64
kubespray/inventory/group_vars/k8s_cluster/k8s-net-weave.yml
Normal file
@@ -0,0 +1,64 @@
|
|||||||
|
# see roles/network_plugin/weave/defaults/main.yml
|
||||||
|
|
||||||
|
# Weave's network password for encryption, if null then no network encryption.
|
||||||
|
# weave_password: ~
|
||||||
|
|
||||||
|
# If set to 1, disable checking for new Weave Net versions (default is blank,
|
||||||
|
# i.e. check is enabled)
|
||||||
|
# weave_checkpoint_disable: false
|
||||||
|
|
||||||
|
# Soft limit on the number of connections between peers. Defaults to 100.
|
||||||
|
# weave_conn_limit: 100
|
||||||
|
|
||||||
|
# Weave Net defaults to enabling hairpin on the bridge side of the veth pair
|
||||||
|
# for containers attached. If you need to disable hairpin, e.g. your kernel is
|
||||||
|
# one of those that can panic if hairpin is enabled, then you can disable it by
|
||||||
|
# setting `HAIRPIN_MODE=false`.
|
||||||
|
# weave_hairpin_mode: true
|
||||||
|
|
||||||
|
# The range of IP addresses used by Weave Net and the subnet they are placed in
|
||||||
|
# (CIDR format; default 10.32.0.0/12)
|
||||||
|
# weave_ipalloc_range: "{{ kube_pods_subnet }}"
|
||||||
|
|
||||||
|
# Set to 0 to disable Network Policy Controller (default is on)
|
||||||
|
# weave_expect_npc: "{{ enable_network_policy }}"
|
||||||
|
|
||||||
|
# List of addresses of peers in the Kubernetes cluster (default is to fetch the
|
||||||
|
# list from the api-server)
|
||||||
|
# weave_kube_peers: ~
|
||||||
|
|
||||||
|
# Set the initialization mode of the IP Address Manager (defaults to consensus
|
||||||
|
# amongst the KUBE_PEERS)
|
||||||
|
# weave_ipalloc_init: ~
|
||||||
|
|
||||||
|
# Set the IP address used as a gateway from the Weave network to the host
|
||||||
|
# network - this is useful if you are configuring the addon as a static pod.
|
||||||
|
# weave_expose_ip: ~
|
||||||
|
|
||||||
|
# Address and port that the Weave Net daemon will serve Prometheus-style
|
||||||
|
# metrics on (defaults to 0.0.0.0:6782)
|
||||||
|
# weave_metrics_addr: ~
|
||||||
|
|
||||||
|
# Address and port that the Weave Net daemon will serve status requests on
|
||||||
|
# (defaults to disabled)
|
||||||
|
# weave_status_addr: ~
|
||||||
|
|
||||||
|
# Weave Net defaults to 1376 bytes, but you can set a smaller size if your
|
||||||
|
# underlying network has a tighter limit, or set a larger size for better
|
||||||
|
# performance if your network supports jumbo frames (e.g. 8916)
|
||||||
|
# weave_mtu: 1376
|
||||||
|
|
||||||
|
# Set to 1 to preserve the client source IP address when accessing Service
|
||||||
|
# annotated with `service.spec.externalTrafficPolicy=Local`. The feature works
|
||||||
|
# only with Weave IPAM (default).
|
||||||
|
# weave_no_masq_local: true
|
||||||
|
|
||||||
|
# set to nft to use nftables backend for iptables (default is iptables)
|
||||||
|
# weave_iptables_backend: iptables
|
||||||
|
|
||||||
|
# Extra variables that passing to launch.sh, useful for enabling seed mode, see
|
||||||
|
# https://www.weave.works/docs/net/latest/tasks/ipam/ipam/
|
||||||
|
# weave_extra_args: ~
|
||||||
|
|
||||||
|
# Extra variables for weave_npc that passing to launch.sh, useful for change log level, ex --log-level=error
|
||||||
|
# weave_npc_extra_args: ~
|
||||||
23
kubespray/inventory/hosts
Normal file
23
kubespray/inventory/hosts
Normal file
@@ -0,0 +1,23 @@
|
|||||||
|
|
||||||
|
vbox-prod-k8s-master-01 ansible_host=10.250.50.22 ip=10.250.50.22
|
||||||
|
vbox-prod-k8s-slave-01 ansible_host=10.250.50.23 ip=10.250.50.23
|
||||||
|
vbox-prod-k8s-slave-02 ansible_host=10.250.50.21 ip=10.250.50.21
|
||||||
|
|
||||||
|
[kube_control_plane]
|
||||||
|
vbox-prod-k8s-master-01
|
||||||
|
|
||||||
|
[etcd]
|
||||||
|
vbox-prod-k8s-master-01
|
||||||
|
|
||||||
|
[kube_node]
|
||||||
|
vbox-prod-k8s-slave-01
|
||||||
|
vbox-prod-k8s-slave-02
|
||||||
|
|
||||||
|
[k8s_cluster:children]
|
||||||
|
kube_control_plane
|
||||||
|
kube_node
|
||||||
|
|
||||||
|
[all:vars]
|
||||||
|
ansible_connection=ssh
|
||||||
|
ansible_user=sre-admin
|
||||||
|
ansible_ssh_private_key_file=/home/sre-admin/.ssh/id_rsa
|
||||||
34
kubespray/project/ansible_version.yml
Normal file
34
kubespray/project/ansible_version.yml
Normal file
@@ -0,0 +1,34 @@
|
|||||||
|
---
|
||||||
|
- name: Check Ansible version
|
||||||
|
hosts: all
|
||||||
|
gather_facts: false
|
||||||
|
become: no
|
||||||
|
run_once: true
|
||||||
|
vars:
|
||||||
|
minimal_ansible_version: 2.15.5 # 2.15 versions before 2.15.5 are known to be buggy for kubespray
|
||||||
|
maximal_ansible_version: 2.17.0
|
||||||
|
tags: always
|
||||||
|
tasks:
|
||||||
|
- name: "Check {{ minimal_ansible_version }} <= Ansible version < {{ maximal_ansible_version }}"
|
||||||
|
assert:
|
||||||
|
msg: "Ansible must be between {{ minimal_ansible_version }} and {{ maximal_ansible_version }} exclusive - you have {{ ansible_version.string }}"
|
||||||
|
that:
|
||||||
|
- ansible_version.string is version(minimal_ansible_version, ">=")
|
||||||
|
- ansible_version.string is version(maximal_ansible_version, "<")
|
||||||
|
tags:
|
||||||
|
- check
|
||||||
|
|
||||||
|
- name: "Check that python netaddr is installed"
|
||||||
|
assert:
|
||||||
|
msg: "Python netaddr is not present"
|
||||||
|
that: "'127.0.0.1' | ansible.utils.ipaddr"
|
||||||
|
tags:
|
||||||
|
- check
|
||||||
|
|
||||||
|
# CentOS 7 provides too old jinja version
|
||||||
|
- name: "Check that jinja is not too old (install via pip)"
|
||||||
|
assert:
|
||||||
|
msg: "Your Jinja version is too old, install via pip"
|
||||||
|
that: "{% set test %}It works{% endset %}{{ test == 'It works' }}"
|
||||||
|
tags:
|
||||||
|
- check
|
||||||
58
kubespray/project/boilerplate.yml
Normal file
58
kubespray/project/boilerplate.yml
Normal file
@@ -0,0 +1,58 @@
|
|||||||
|
---
|
||||||
|
- name: Check ansible version
|
||||||
|
import_playbook: ansible_version.yml
|
||||||
|
|
||||||
|
# These are inventory compatibility tasks to ensure we keep compatibility with old style group names
|
||||||
|
|
||||||
|
- name: Add kube-master nodes to kube_control_plane
|
||||||
|
hosts: kube-master
|
||||||
|
gather_facts: false
|
||||||
|
tags: always
|
||||||
|
tasks:
|
||||||
|
- name: Add nodes to kube_control_plane group
|
||||||
|
group_by:
|
||||||
|
key: 'kube_control_plane'
|
||||||
|
|
||||||
|
- name: Add kube-node nodes to kube_node
|
||||||
|
hosts: kube-node
|
||||||
|
gather_facts: false
|
||||||
|
tags: always
|
||||||
|
tasks:
|
||||||
|
- name: Add nodes to kube_node group
|
||||||
|
group_by:
|
||||||
|
key: 'kube_node'
|
||||||
|
|
||||||
|
- name: Add k8s-cluster nodes to k8s_cluster
|
||||||
|
hosts: k8s-cluster
|
||||||
|
gather_facts: false
|
||||||
|
tags: always
|
||||||
|
tasks:
|
||||||
|
- name: Add nodes to k8s_cluster group
|
||||||
|
group_by:
|
||||||
|
key: 'k8s_cluster'
|
||||||
|
|
||||||
|
- name: Add calico-rr nodes to calico_rr
|
||||||
|
hosts: calico-rr
|
||||||
|
gather_facts: false
|
||||||
|
tags: always
|
||||||
|
tasks:
|
||||||
|
- name: Add nodes to calico_rr group
|
||||||
|
group_by:
|
||||||
|
key: 'calico_rr'
|
||||||
|
|
||||||
|
- name: Add no-floating nodes to no_floating
|
||||||
|
hosts: no-floating
|
||||||
|
gather_facts: false
|
||||||
|
tags: always
|
||||||
|
tasks:
|
||||||
|
- name: Add nodes to no-floating group
|
||||||
|
group_by:
|
||||||
|
key: 'no_floating'
|
||||||
|
|
||||||
|
- name: Install bastion ssh config
|
||||||
|
hosts: bastion[0]
|
||||||
|
gather_facts: False
|
||||||
|
environment: "{{ proxy_disable_env }}"
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults }
|
||||||
|
- { role: bastion-ssh-config, tags: ["localhost", "bastion"] }
|
||||||
111
kubespray/project/cluster.yml
Normal file
111
kubespray/project/cluster.yml
Normal file
@@ -0,0 +1,111 @@
|
|||||||
|
---
|
||||||
|
- name: Common tasks for every playbooks
|
||||||
|
import_playbook: boilerplate.yml
|
||||||
|
|
||||||
|
- name: Gather facts
|
||||||
|
import_playbook: facts.yml
|
||||||
|
|
||||||
|
- name: Prepare for etcd install
|
||||||
|
hosts: k8s_cluster:etcd
|
||||||
|
gather_facts: False
|
||||||
|
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
|
||||||
|
environment: "{{ proxy_disable_env }}"
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults }
|
||||||
|
- { role: kubernetes/preinstall, tags: preinstall }
|
||||||
|
- {
|
||||||
|
role: "container-engine",
|
||||||
|
tags: "container-engine",
|
||||||
|
when: deploy_container_engine,
|
||||||
|
}
|
||||||
|
- { role: download, tags: download, when: "not skip_downloads" }
|
||||||
|
|
||||||
|
- name: Install etcd
|
||||||
|
import_playbook: install_etcd.yml
|
||||||
|
|
||||||
|
- name: Install Kubernetes nodes
|
||||||
|
hosts: k8s_cluster
|
||||||
|
gather_facts: False
|
||||||
|
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
|
||||||
|
environment: "{{ proxy_disable_env }}"
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults }
|
||||||
|
- { role: kubernetes/node, tags: node }
|
||||||
|
|
||||||
|
- name: Install the control plane
|
||||||
|
hosts: kube_control_plane
|
||||||
|
gather_facts: False
|
||||||
|
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
|
||||||
|
environment: "{{ proxy_disable_env }}"
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults }
|
||||||
|
- { role: kubernetes/control-plane, tags: master }
|
||||||
|
- { role: kubernetes/client, tags: client }
|
||||||
|
- { role: kubernetes-apps/cluster_roles, tags: cluster-roles }
|
||||||
|
|
||||||
|
- name: Invoke kubeadm and install a CNI
|
||||||
|
hosts: k8s_cluster
|
||||||
|
gather_facts: False
|
||||||
|
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
|
||||||
|
environment: "{{ proxy_disable_env }}"
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults }
|
||||||
|
- { role: kubernetes/kubeadm, tags: kubeadm }
|
||||||
|
- { role: kubernetes/node-label, tags: node-label }
|
||||||
|
- { role: kubernetes/node-taint, tags: node-taint }
|
||||||
|
- { role: network_plugin, tags: network }
|
||||||
|
- { role: kubernetes-apps/kubelet-csr-approver, tags: kubelet-csr-approver }
|
||||||
|
|
||||||
|
- name: Install Calico Route Reflector
|
||||||
|
hosts: calico_rr
|
||||||
|
gather_facts: False
|
||||||
|
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
|
||||||
|
environment: "{{ proxy_disable_env }}"
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults }
|
||||||
|
- { role: network_plugin/calico/rr, tags: ["network", "calico_rr"] }
|
||||||
|
|
||||||
|
- name: Patch Kubernetes for Windows
|
||||||
|
hosts: kube_control_plane[0]
|
||||||
|
gather_facts: False
|
||||||
|
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
|
||||||
|
environment: "{{ proxy_disable_env }}"
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults }
|
||||||
|
- { role: win_nodes/kubernetes_patch, tags: ["master", "win_nodes"] }
|
||||||
|
|
||||||
|
- name: Install Kubernetes and Helm apps
|
||||||
|
hosts: kube_control_plane
|
||||||
|
gather_facts: False
|
||||||
|
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
|
||||||
|
environment: "{{ proxy_disable_env }}"
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults }
|
||||||
|
- {
|
||||||
|
role: kubernetes-apps/external_cloud_controller,
|
||||||
|
tags: external-cloud-controller,
|
||||||
|
}
|
||||||
|
- { role: kubernetes-apps/network_plugin, tags: network }
|
||||||
|
- { role: kubernetes-apps/policy_controller, tags: policy-controller }
|
||||||
|
- { role: kubernetes-apps/ingress_controller, tags: ingress-controller }
|
||||||
|
- { role: kubernetes-apps/external_provisioner, tags: external-provisioner }
|
||||||
|
- { role: kubernetes-apps, tags: apps }
|
||||||
|
- {
|
||||||
|
role: helm-apps,
|
||||||
|
when: "releases is defined and repositories is defined",
|
||||||
|
tags: helm-apps,
|
||||||
|
}
|
||||||
|
|
||||||
|
- name: Apply resolv.conf changes now that cluster DNS is up
|
||||||
|
hosts: k8s_cluster
|
||||||
|
gather_facts: False
|
||||||
|
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
|
||||||
|
environment: "{{ proxy_disable_env }}"
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults }
|
||||||
|
- {
|
||||||
|
role: kubernetes/preinstall,
|
||||||
|
when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'",
|
||||||
|
tags: resolvconf,
|
||||||
|
dns_late: true,
|
||||||
|
}
|
||||||
41
kubespray/project/facts.yml
Normal file
41
kubespray/project/facts.yml
Normal file
@@ -0,0 +1,41 @@
|
|||||||
|
---
|
||||||
|
- name: Bootstrap hosts for Ansible
|
||||||
|
hosts: k8s_cluster:etcd:calico_rr
|
||||||
|
strategy: linear
|
||||||
|
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
|
||||||
|
gather_facts: false
|
||||||
|
environment: "{{ proxy_disable_env }}"
|
||||||
|
vars:
|
||||||
|
# Need to disable pipelining for bootstrap-os as some systems have requiretty in sudoers set, which makes pipelining
|
||||||
|
# fail. bootstrap-os fixes this on these systems, so in later plays it can be enabled.
|
||||||
|
ansible_ssh_pipelining: false
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults }
|
||||||
|
- { role: bootstrap-os, tags: bootstrap-os}
|
||||||
|
|
||||||
|
- name: Gather facts
|
||||||
|
hosts: k8s_cluster:etcd:calico_rr
|
||||||
|
gather_facts: False
|
||||||
|
tags: always
|
||||||
|
tasks:
|
||||||
|
- name: Gather minimal facts
|
||||||
|
setup:
|
||||||
|
gather_subset: '!all'
|
||||||
|
|
||||||
|
# filter match the following variables:
|
||||||
|
# ansible_default_ipv4
|
||||||
|
# ansible_default_ipv6
|
||||||
|
# ansible_all_ipv4_addresses
|
||||||
|
# ansible_all_ipv6_addresses
|
||||||
|
- name: Gather necessary facts (network)
|
||||||
|
setup:
|
||||||
|
gather_subset: '!all,!min,network'
|
||||||
|
filter: "ansible_*_ipv[46]*"
|
||||||
|
|
||||||
|
# filter match the following variables:
|
||||||
|
# ansible_memtotal_mb
|
||||||
|
# ansible_swaptotal_mb
|
||||||
|
- name: Gather necessary facts (hardware)
|
||||||
|
setup:
|
||||||
|
gather_subset: '!all,!min,hardware'
|
||||||
|
filter: "ansible_*total_mb"
|
||||||
29
kubespray/project/install_etcd.yml
Normal file
29
kubespray/project/install_etcd.yml
Normal file
@@ -0,0 +1,29 @@
|
|||||||
|
---
|
||||||
|
- name: Add worker nodes to the etcd play if needed
|
||||||
|
hosts: kube_node
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults }
|
||||||
|
tasks:
|
||||||
|
- name: Check if nodes needs etcd client certs (depends on network_plugin)
|
||||||
|
group_by:
|
||||||
|
key: "_kubespray_needs_etcd"
|
||||||
|
when:
|
||||||
|
- kube_network_plugin in ["flannel", "canal", "cilium"] or
|
||||||
|
(cilium_deploy_additionally | default(false)) or
|
||||||
|
(kube_network_plugin == "calico" and calico_datastore == "etcd")
|
||||||
|
- etcd_deployment_type != "kubeadm"
|
||||||
|
tags: etcd
|
||||||
|
|
||||||
|
- name: Install etcd
|
||||||
|
hosts: etcd:kube_control_plane:_kubespray_needs_etcd
|
||||||
|
gather_facts: False
|
||||||
|
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
|
||||||
|
environment: "{{ proxy_disable_env }}"
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults }
|
||||||
|
- role: etcd
|
||||||
|
tags: etcd
|
||||||
|
vars:
|
||||||
|
etcd_cluster_setup: true
|
||||||
|
etcd_events_cluster_setup: "{{ etcd_events_cluster_enabled }}"
|
||||||
|
when: etcd_deployment_type != "kubeadm"
|
||||||
BIN
kubespray/project/library/__pycache__/kube.cpython-312.pyc
Normal file
BIN
kubespray/project/library/__pycache__/kube.cpython-312.pyc
Normal file
Binary file not shown.
366
kubespray/project/library/kube.py
Normal file
366
kubespray/project/library/kube.py
Normal file
@@ -0,0 +1,366 @@
|
|||||||
|
#!/usr/bin/python
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
|
||||||
|
DOCUMENTATION = """
|
||||||
|
---
|
||||||
|
module: kube
|
||||||
|
short_description: Manage Kubernetes Cluster
|
||||||
|
description:
|
||||||
|
- Create, replace, remove, and stop resources within a Kubernetes Cluster
|
||||||
|
version_added: "2.0"
|
||||||
|
options:
|
||||||
|
name:
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
description:
|
||||||
|
- The name associated with resource
|
||||||
|
filename:
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
description:
|
||||||
|
- The path and filename of the resource(s) definition file(s).
|
||||||
|
- To operate on several files this can accept a comma separated list of files or a list of files.
|
||||||
|
aliases: [ 'files', 'file', 'filenames' ]
|
||||||
|
kubectl:
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
description:
|
||||||
|
- The path to the kubectl bin
|
||||||
|
namespace:
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
description:
|
||||||
|
- The namespace associated with the resource(s)
|
||||||
|
resource:
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
description:
|
||||||
|
- The resource to perform an action on. pods (po), replicationControllers (rc), services (svc)
|
||||||
|
label:
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
description:
|
||||||
|
- The labels used to filter specific resources.
|
||||||
|
server:
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
description:
|
||||||
|
- The url for the API server that commands are executed against.
|
||||||
|
kubeconfig:
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
description:
|
||||||
|
- The path to the kubeconfig.
|
||||||
|
force:
|
||||||
|
required: false
|
||||||
|
default: false
|
||||||
|
description:
|
||||||
|
- A flag to indicate to force delete, replace, or stop.
|
||||||
|
wait:
|
||||||
|
required: false
|
||||||
|
default: false
|
||||||
|
description:
|
||||||
|
- A flag to indicate to wait for resources to be created before continuing to the next step
|
||||||
|
all:
|
||||||
|
required: false
|
||||||
|
default: false
|
||||||
|
description:
|
||||||
|
- A flag to indicate delete all, stop all, or all namespaces when checking exists.
|
||||||
|
log_level:
|
||||||
|
required: false
|
||||||
|
default: 0
|
||||||
|
description:
|
||||||
|
- Indicates the level of verbosity of logging by kubectl.
|
||||||
|
state:
|
||||||
|
required: false
|
||||||
|
choices: ['present', 'absent', 'latest', 'reloaded', 'stopped']
|
||||||
|
default: present
|
||||||
|
description:
|
||||||
|
- present handles checking existence or creating if definition file provided,
|
||||||
|
absent handles deleting resource(s) based on other options,
|
||||||
|
latest handles creating or updating based on existence,
|
||||||
|
reloaded handles updating resource(s) definition using definition file,
|
||||||
|
stopped handles stopping resource(s) based on other options.
|
||||||
|
recursive:
|
||||||
|
required: false
|
||||||
|
default: false
|
||||||
|
description:
|
||||||
|
- Process the directory used in -f, --filename recursively.
|
||||||
|
Useful when you want to manage related manifests organized
|
||||||
|
within the same directory.
|
||||||
|
requirements:
|
||||||
|
- kubectl
|
||||||
|
author: "Kenny Jones (@kenjones-cisco)"
|
||||||
|
"""
|
||||||
|
|
||||||
|
EXAMPLES = """
|
||||||
|
- name: test nginx is present
|
||||||
|
kube: name=nginx resource=rc state=present
|
||||||
|
|
||||||
|
- name: test nginx is stopped
|
||||||
|
kube: name=nginx resource=rc state=stopped
|
||||||
|
|
||||||
|
- name: test nginx is absent
|
||||||
|
kube: name=nginx resource=rc state=absent
|
||||||
|
|
||||||
|
- name: test nginx is present
|
||||||
|
kube: filename=/tmp/nginx.yml
|
||||||
|
|
||||||
|
- name: test nginx and postgresql are present
|
||||||
|
kube: files=/tmp/nginx.yml,/tmp/postgresql.yml
|
||||||
|
|
||||||
|
- name: test nginx and postgresql are present
|
||||||
|
kube:
|
||||||
|
files:
|
||||||
|
- /tmp/nginx.yml
|
||||||
|
- /tmp/postgresql.yml
|
||||||
|
"""
|
||||||
|
|
||||||
|
|
||||||
|
class KubeManager(object):
|
||||||
|
|
||||||
|
def __init__(self, module):
|
||||||
|
|
||||||
|
self.module = module
|
||||||
|
|
||||||
|
self.kubectl = module.params.get('kubectl')
|
||||||
|
if self.kubectl is None:
|
||||||
|
self.kubectl = module.get_bin_path('kubectl', True)
|
||||||
|
self.base_cmd = [self.kubectl]
|
||||||
|
|
||||||
|
if module.params.get('server'):
|
||||||
|
self.base_cmd.append('--server=' + module.params.get('server'))
|
||||||
|
|
||||||
|
if module.params.get('kubeconfig'):
|
||||||
|
self.base_cmd.append('--kubeconfig=' + module.params.get('kubeconfig'))
|
||||||
|
|
||||||
|
if module.params.get('log_level'):
|
||||||
|
self.base_cmd.append('--v=' + str(module.params.get('log_level')))
|
||||||
|
|
||||||
|
if module.params.get('namespace'):
|
||||||
|
self.base_cmd.append('--namespace=' + module.params.get('namespace'))
|
||||||
|
|
||||||
|
|
||||||
|
self.all = module.params.get('all')
|
||||||
|
self.force = module.params.get('force')
|
||||||
|
self.wait = module.params.get('wait')
|
||||||
|
self.name = module.params.get('name')
|
||||||
|
self.filename = [f.strip() for f in module.params.get('filename') or []]
|
||||||
|
self.resource = module.params.get('resource')
|
||||||
|
self.label = module.params.get('label')
|
||||||
|
self.recursive = module.params.get('recursive')
|
||||||
|
|
||||||
|
def _execute(self, cmd):
|
||||||
|
args = self.base_cmd + cmd
|
||||||
|
try:
|
||||||
|
rc, out, err = self.module.run_command(args)
|
||||||
|
if rc != 0:
|
||||||
|
self.module.fail_json(
|
||||||
|
msg='error running kubectl (%s) command (rc=%d), out=\'%s\', err=\'%s\'' % (' '.join(args), rc, out, err))
|
||||||
|
except Exception as exc:
|
||||||
|
self.module.fail_json(
|
||||||
|
msg='error running kubectl (%s) command: %s' % (' '.join(args), str(exc)))
|
||||||
|
return out.splitlines()
|
||||||
|
|
||||||
|
def _execute_nofail(self, cmd):
|
||||||
|
args = self.base_cmd + cmd
|
||||||
|
rc, out, err = self.module.run_command(args)
|
||||||
|
if rc != 0:
|
||||||
|
return None
|
||||||
|
return out.splitlines()
|
||||||
|
|
||||||
|
def create(self, check=True, force=True):
|
||||||
|
if check and self.exists():
|
||||||
|
return []
|
||||||
|
|
||||||
|
cmd = ['apply']
|
||||||
|
|
||||||
|
if force:
|
||||||
|
cmd.append('--force')
|
||||||
|
|
||||||
|
if self.wait:
|
||||||
|
cmd.append('--wait')
|
||||||
|
|
||||||
|
if self.recursive:
|
||||||
|
cmd.append('--recursive={}'.format(self.recursive))
|
||||||
|
|
||||||
|
if not self.filename:
|
||||||
|
self.module.fail_json(msg='filename required to create')
|
||||||
|
|
||||||
|
cmd.append('--filename=' + ','.join(self.filename))
|
||||||
|
|
||||||
|
return self._execute(cmd)
|
||||||
|
|
||||||
|
def replace(self, force=True):
|
||||||
|
|
||||||
|
cmd = ['apply']
|
||||||
|
|
||||||
|
if force:
|
||||||
|
cmd.append('--force')
|
||||||
|
|
||||||
|
if self.wait:
|
||||||
|
cmd.append('--wait')
|
||||||
|
|
||||||
|
if self.recursive:
|
||||||
|
cmd.append('--recursive={}'.format(self.recursive))
|
||||||
|
|
||||||
|
if not self.filename:
|
||||||
|
self.module.fail_json(msg='filename required to reload')
|
||||||
|
|
||||||
|
cmd.append('--filename=' + ','.join(self.filename))
|
||||||
|
|
||||||
|
return self._execute(cmd)
|
||||||
|
|
||||||
|
def delete(self):
|
||||||
|
|
||||||
|
if not self.force and not self.exists():
|
||||||
|
return []
|
||||||
|
|
||||||
|
cmd = ['delete']
|
||||||
|
|
||||||
|
if self.filename:
|
||||||
|
cmd.append('--filename=' + ','.join(self.filename))
|
||||||
|
if self.recursive:
|
||||||
|
cmd.append('--recursive={}'.format(self.recursive))
|
||||||
|
else:
|
||||||
|
if not self.resource:
|
||||||
|
self.module.fail_json(msg='resource required to delete without filename')
|
||||||
|
|
||||||
|
cmd.append(self.resource)
|
||||||
|
|
||||||
|
if self.name:
|
||||||
|
cmd.append(self.name)
|
||||||
|
|
||||||
|
if self.label:
|
||||||
|
cmd.append('--selector=' + self.label)
|
||||||
|
|
||||||
|
if self.all:
|
||||||
|
cmd.append('--all')
|
||||||
|
|
||||||
|
if self.force:
|
||||||
|
cmd.append('--ignore-not-found')
|
||||||
|
|
||||||
|
if self.recursive:
|
||||||
|
cmd.append('--recursive={}'.format(self.recursive))
|
||||||
|
|
||||||
|
return self._execute(cmd)
|
||||||
|
|
||||||
|
def exists(self):
|
||||||
|
cmd = ['get']
|
||||||
|
|
||||||
|
if self.filename:
|
||||||
|
cmd.append('--filename=' + ','.join(self.filename))
|
||||||
|
if self.recursive:
|
||||||
|
cmd.append('--recursive={}'.format(self.recursive))
|
||||||
|
else:
|
||||||
|
if not self.resource:
|
||||||
|
self.module.fail_json(msg='resource required without filename')
|
||||||
|
|
||||||
|
cmd.append(self.resource)
|
||||||
|
|
||||||
|
if self.name:
|
||||||
|
cmd.append(self.name)
|
||||||
|
|
||||||
|
if self.label:
|
||||||
|
cmd.append('--selector=' + self.label)
|
||||||
|
|
||||||
|
if self.all:
|
||||||
|
cmd.append('--all-namespaces')
|
||||||
|
|
||||||
|
cmd.append('--no-headers')
|
||||||
|
|
||||||
|
result = self._execute_nofail(cmd)
|
||||||
|
if not result:
|
||||||
|
return False
|
||||||
|
return True
|
||||||
|
|
||||||
|
# TODO: This is currently unused, perhaps convert to 'scale' with a replicas param?
|
||||||
|
def stop(self):
|
||||||
|
|
||||||
|
if not self.force and not self.exists():
|
||||||
|
return []
|
||||||
|
|
||||||
|
cmd = ['stop']
|
||||||
|
|
||||||
|
if self.filename:
|
||||||
|
cmd.append('--filename=' + ','.join(self.filename))
|
||||||
|
if self.recursive:
|
||||||
|
cmd.append('--recursive={}'.format(self.recursive))
|
||||||
|
else:
|
||||||
|
if not self.resource:
|
||||||
|
self.module.fail_json(msg='resource required to stop without filename')
|
||||||
|
|
||||||
|
cmd.append(self.resource)
|
||||||
|
|
||||||
|
if self.name:
|
||||||
|
cmd.append(self.name)
|
||||||
|
|
||||||
|
if self.label:
|
||||||
|
cmd.append('--selector=' + self.label)
|
||||||
|
|
||||||
|
if self.all:
|
||||||
|
cmd.append('--all')
|
||||||
|
|
||||||
|
if self.force:
|
||||||
|
cmd.append('--ignore-not-found')
|
||||||
|
|
||||||
|
return self._execute(cmd)
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
|
||||||
|
module = AnsibleModule(
|
||||||
|
argument_spec=dict(
|
||||||
|
name=dict(),
|
||||||
|
filename=dict(type='list', aliases=['files', 'file', 'filenames']),
|
||||||
|
namespace=dict(),
|
||||||
|
resource=dict(),
|
||||||
|
label=dict(),
|
||||||
|
server=dict(),
|
||||||
|
kubeconfig=dict(),
|
||||||
|
kubectl=dict(),
|
||||||
|
force=dict(default=False, type='bool'),
|
||||||
|
wait=dict(default=False, type='bool'),
|
||||||
|
all=dict(default=False, type='bool'),
|
||||||
|
log_level=dict(default=0, type='int'),
|
||||||
|
state=dict(default='present', choices=['present', 'absent', 'latest', 'reloaded', 'stopped', 'exists']),
|
||||||
|
recursive=dict(default=False, type='bool'),
|
||||||
|
),
|
||||||
|
mutually_exclusive=[['filename', 'list']]
|
||||||
|
)
|
||||||
|
|
||||||
|
changed = False
|
||||||
|
|
||||||
|
manager = KubeManager(module)
|
||||||
|
state = module.params.get('state')
|
||||||
|
if state == 'present':
|
||||||
|
result = manager.create(check=False)
|
||||||
|
|
||||||
|
elif state == 'absent':
|
||||||
|
result = manager.delete()
|
||||||
|
|
||||||
|
elif state == 'reloaded':
|
||||||
|
result = manager.replace()
|
||||||
|
|
||||||
|
elif state == 'stopped':
|
||||||
|
result = manager.stop()
|
||||||
|
|
||||||
|
elif state == 'latest':
|
||||||
|
result = manager.replace()
|
||||||
|
|
||||||
|
elif state == 'exists':
|
||||||
|
result = manager.exists()
|
||||||
|
module.exit_json(changed=changed,
|
||||||
|
msg='%s' % result)
|
||||||
|
|
||||||
|
else:
|
||||||
|
module.fail_json(msg='Unrecognized state %s.' % state)
|
||||||
|
|
||||||
|
module.exit_json(changed=changed,
|
||||||
|
msg='success: %s' % (' '.join(result))
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
from ansible.module_utils.basic import * # noqa
|
||||||
|
if __name__ == '__main__':
|
||||||
|
main()
|
||||||
366
kubespray/project/modules/kube.py
Normal file
366
kubespray/project/modules/kube.py
Normal file
@@ -0,0 +1,366 @@
|
|||||||
|
#!/usr/bin/python
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
|
||||||
|
DOCUMENTATION = """
|
||||||
|
---
|
||||||
|
module: kube
|
||||||
|
short_description: Manage Kubernetes Cluster
|
||||||
|
description:
|
||||||
|
- Create, replace, remove, and stop resources within a Kubernetes Cluster
|
||||||
|
version_added: "2.0"
|
||||||
|
options:
|
||||||
|
name:
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
description:
|
||||||
|
- The name associated with resource
|
||||||
|
filename:
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
description:
|
||||||
|
- The path and filename of the resource(s) definition file(s).
|
||||||
|
- To operate on several files this can accept a comma separated list of files or a list of files.
|
||||||
|
aliases: [ 'files', 'file', 'filenames' ]
|
||||||
|
kubectl:
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
description:
|
||||||
|
- The path to the kubectl bin
|
||||||
|
namespace:
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
description:
|
||||||
|
- The namespace associated with the resource(s)
|
||||||
|
resource:
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
description:
|
||||||
|
- The resource to perform an action on. pods (po), replicationControllers (rc), services (svc)
|
||||||
|
label:
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
description:
|
||||||
|
- The labels used to filter specific resources.
|
||||||
|
server:
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
description:
|
||||||
|
- The url for the API server that commands are executed against.
|
||||||
|
kubeconfig:
|
||||||
|
required: false
|
||||||
|
default: null
|
||||||
|
description:
|
||||||
|
- The path to the kubeconfig.
|
||||||
|
force:
|
||||||
|
required: false
|
||||||
|
default: false
|
||||||
|
description:
|
||||||
|
- A flag to indicate to force delete, replace, or stop.
|
||||||
|
wait:
|
||||||
|
required: false
|
||||||
|
default: false
|
||||||
|
description:
|
||||||
|
- A flag to indicate to wait for resources to be created before continuing to the next step
|
||||||
|
all:
|
||||||
|
required: false
|
||||||
|
default: false
|
||||||
|
description:
|
||||||
|
- A flag to indicate delete all, stop all, or all namespaces when checking exists.
|
||||||
|
log_level:
|
||||||
|
required: false
|
||||||
|
default: 0
|
||||||
|
description:
|
||||||
|
- Indicates the level of verbosity of logging by kubectl.
|
||||||
|
state:
|
||||||
|
required: false
|
||||||
|
choices: ['present', 'absent', 'latest', 'reloaded', 'stopped']
|
||||||
|
default: present
|
||||||
|
description:
|
||||||
|
- present handles checking existence or creating if definition file provided,
|
||||||
|
absent handles deleting resource(s) based on other options,
|
||||||
|
latest handles creating or updating based on existence,
|
||||||
|
reloaded handles updating resource(s) definition using definition file,
|
||||||
|
stopped handles stopping resource(s) based on other options.
|
||||||
|
recursive:
|
||||||
|
required: false
|
||||||
|
default: false
|
||||||
|
description:
|
||||||
|
- Process the directory used in -f, --filename recursively.
|
||||||
|
Useful when you want to manage related manifests organized
|
||||||
|
within the same directory.
|
||||||
|
requirements:
|
||||||
|
- kubectl
|
||||||
|
author: "Kenny Jones (@kenjones-cisco)"
|
||||||
|
"""
|
||||||
|
|
||||||
|
EXAMPLES = """
|
||||||
|
- name: test nginx is present
|
||||||
|
kube: name=nginx resource=rc state=present
|
||||||
|
|
||||||
|
- name: test nginx is stopped
|
||||||
|
kube: name=nginx resource=rc state=stopped
|
||||||
|
|
||||||
|
- name: test nginx is absent
|
||||||
|
kube: name=nginx resource=rc state=absent
|
||||||
|
|
||||||
|
- name: test nginx is present
|
||||||
|
kube: filename=/tmp/nginx.yml
|
||||||
|
|
||||||
|
- name: test nginx and postgresql are present
|
||||||
|
kube: files=/tmp/nginx.yml,/tmp/postgresql.yml
|
||||||
|
|
||||||
|
- name: test nginx and postgresql are present
|
||||||
|
kube:
|
||||||
|
files:
|
||||||
|
- /tmp/nginx.yml
|
||||||
|
- /tmp/postgresql.yml
|
||||||
|
"""
|
||||||
|
|
||||||
|
|
||||||
|
class KubeManager(object):
|
||||||
|
|
||||||
|
def __init__(self, module):
|
||||||
|
|
||||||
|
self.module = module
|
||||||
|
|
||||||
|
self.kubectl = module.params.get('kubectl')
|
||||||
|
if self.kubectl is None:
|
||||||
|
self.kubectl = module.get_bin_path('kubectl', True)
|
||||||
|
self.base_cmd = [self.kubectl]
|
||||||
|
|
||||||
|
if module.params.get('server'):
|
||||||
|
self.base_cmd.append('--server=' + module.params.get('server'))
|
||||||
|
|
||||||
|
if module.params.get('kubeconfig'):
|
||||||
|
self.base_cmd.append('--kubeconfig=' + module.params.get('kubeconfig'))
|
||||||
|
|
||||||
|
if module.params.get('log_level'):
|
||||||
|
self.base_cmd.append('--v=' + str(module.params.get('log_level')))
|
||||||
|
|
||||||
|
if module.params.get('namespace'):
|
||||||
|
self.base_cmd.append('--namespace=' + module.params.get('namespace'))
|
||||||
|
|
||||||
|
|
||||||
|
self.all = module.params.get('all')
|
||||||
|
self.force = module.params.get('force')
|
||||||
|
self.wait = module.params.get('wait')
|
||||||
|
self.name = module.params.get('name')
|
||||||
|
self.filename = [f.strip() for f in module.params.get('filename') or []]
|
||||||
|
self.resource = module.params.get('resource')
|
||||||
|
self.label = module.params.get('label')
|
||||||
|
self.recursive = module.params.get('recursive')
|
||||||
|
|
||||||
|
def _execute(self, cmd):
|
||||||
|
args = self.base_cmd + cmd
|
||||||
|
try:
|
||||||
|
rc, out, err = self.module.run_command(args)
|
||||||
|
if rc != 0:
|
||||||
|
self.module.fail_json(
|
||||||
|
msg='error running kubectl (%s) command (rc=%d), out=\'%s\', err=\'%s\'' % (' '.join(args), rc, out, err))
|
||||||
|
except Exception as exc:
|
||||||
|
self.module.fail_json(
|
||||||
|
msg='error running kubectl (%s) command: %s' % (' '.join(args), str(exc)))
|
||||||
|
return out.splitlines()
|
||||||
|
|
||||||
|
def _execute_nofail(self, cmd):
|
||||||
|
args = self.base_cmd + cmd
|
||||||
|
rc, out, err = self.module.run_command(args)
|
||||||
|
if rc != 0:
|
||||||
|
return None
|
||||||
|
return out.splitlines()
|
||||||
|
|
||||||
|
def create(self, check=True, force=True):
|
||||||
|
if check and self.exists():
|
||||||
|
return []
|
||||||
|
|
||||||
|
cmd = ['apply']
|
||||||
|
|
||||||
|
if force:
|
||||||
|
cmd.append('--force')
|
||||||
|
|
||||||
|
if self.wait:
|
||||||
|
cmd.append('--wait')
|
||||||
|
|
||||||
|
if self.recursive:
|
||||||
|
cmd.append('--recursive={}'.format(self.recursive))
|
||||||
|
|
||||||
|
if not self.filename:
|
||||||
|
self.module.fail_json(msg='filename required to create')
|
||||||
|
|
||||||
|
cmd.append('--filename=' + ','.join(self.filename))
|
||||||
|
|
||||||
|
return self._execute(cmd)
|
||||||
|
|
||||||
|
def replace(self, force=True):
|
||||||
|
|
||||||
|
cmd = ['apply']
|
||||||
|
|
||||||
|
if force:
|
||||||
|
cmd.append('--force')
|
||||||
|
|
||||||
|
if self.wait:
|
||||||
|
cmd.append('--wait')
|
||||||
|
|
||||||
|
if self.recursive:
|
||||||
|
cmd.append('--recursive={}'.format(self.recursive))
|
||||||
|
|
||||||
|
if not self.filename:
|
||||||
|
self.module.fail_json(msg='filename required to reload')
|
||||||
|
|
||||||
|
cmd.append('--filename=' + ','.join(self.filename))
|
||||||
|
|
||||||
|
return self._execute(cmd)
|
||||||
|
|
||||||
|
def delete(self):
|
||||||
|
|
||||||
|
if not self.force and not self.exists():
|
||||||
|
return []
|
||||||
|
|
||||||
|
cmd = ['delete']
|
||||||
|
|
||||||
|
if self.filename:
|
||||||
|
cmd.append('--filename=' + ','.join(self.filename))
|
||||||
|
if self.recursive:
|
||||||
|
cmd.append('--recursive={}'.format(self.recursive))
|
||||||
|
else:
|
||||||
|
if not self.resource:
|
||||||
|
self.module.fail_json(msg='resource required to delete without filename')
|
||||||
|
|
||||||
|
cmd.append(self.resource)
|
||||||
|
|
||||||
|
if self.name:
|
||||||
|
cmd.append(self.name)
|
||||||
|
|
||||||
|
if self.label:
|
||||||
|
cmd.append('--selector=' + self.label)
|
||||||
|
|
||||||
|
if self.all:
|
||||||
|
cmd.append('--all')
|
||||||
|
|
||||||
|
if self.force:
|
||||||
|
cmd.append('--ignore-not-found')
|
||||||
|
|
||||||
|
if self.recursive:
|
||||||
|
cmd.append('--recursive={}'.format(self.recursive))
|
||||||
|
|
||||||
|
return self._execute(cmd)
|
||||||
|
|
||||||
|
def exists(self):
|
||||||
|
cmd = ['get']
|
||||||
|
|
||||||
|
if self.filename:
|
||||||
|
cmd.append('--filename=' + ','.join(self.filename))
|
||||||
|
if self.recursive:
|
||||||
|
cmd.append('--recursive={}'.format(self.recursive))
|
||||||
|
else:
|
||||||
|
if not self.resource:
|
||||||
|
self.module.fail_json(msg='resource required without filename')
|
||||||
|
|
||||||
|
cmd.append(self.resource)
|
||||||
|
|
||||||
|
if self.name:
|
||||||
|
cmd.append(self.name)
|
||||||
|
|
||||||
|
if self.label:
|
||||||
|
cmd.append('--selector=' + self.label)
|
||||||
|
|
||||||
|
if self.all:
|
||||||
|
cmd.append('--all-namespaces')
|
||||||
|
|
||||||
|
cmd.append('--no-headers')
|
||||||
|
|
||||||
|
result = self._execute_nofail(cmd)
|
||||||
|
if not result:
|
||||||
|
return False
|
||||||
|
return True
|
||||||
|
|
||||||
|
# TODO: This is currently unused, perhaps convert to 'scale' with a replicas param?
|
||||||
|
def stop(self):
|
||||||
|
|
||||||
|
if not self.force and not self.exists():
|
||||||
|
return []
|
||||||
|
|
||||||
|
cmd = ['stop']
|
||||||
|
|
||||||
|
if self.filename:
|
||||||
|
cmd.append('--filename=' + ','.join(self.filename))
|
||||||
|
if self.recursive:
|
||||||
|
cmd.append('--recursive={}'.format(self.recursive))
|
||||||
|
else:
|
||||||
|
if not self.resource:
|
||||||
|
self.module.fail_json(msg='resource required to stop without filename')
|
||||||
|
|
||||||
|
cmd.append(self.resource)
|
||||||
|
|
||||||
|
if self.name:
|
||||||
|
cmd.append(self.name)
|
||||||
|
|
||||||
|
if self.label:
|
||||||
|
cmd.append('--selector=' + self.label)
|
||||||
|
|
||||||
|
if self.all:
|
||||||
|
cmd.append('--all')
|
||||||
|
|
||||||
|
if self.force:
|
||||||
|
cmd.append('--ignore-not-found')
|
||||||
|
|
||||||
|
return self._execute(cmd)
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
|
||||||
|
module = AnsibleModule(
|
||||||
|
argument_spec=dict(
|
||||||
|
name=dict(),
|
||||||
|
filename=dict(type='list', aliases=['files', 'file', 'filenames']),
|
||||||
|
namespace=dict(),
|
||||||
|
resource=dict(),
|
||||||
|
label=dict(),
|
||||||
|
server=dict(),
|
||||||
|
kubeconfig=dict(),
|
||||||
|
kubectl=dict(),
|
||||||
|
force=dict(default=False, type='bool'),
|
||||||
|
wait=dict(default=False, type='bool'),
|
||||||
|
all=dict(default=False, type='bool'),
|
||||||
|
log_level=dict(default=0, type='int'),
|
||||||
|
state=dict(default='present', choices=['present', 'absent', 'latest', 'reloaded', 'stopped', 'exists']),
|
||||||
|
recursive=dict(default=False, type='bool'),
|
||||||
|
),
|
||||||
|
mutually_exclusive=[['filename', 'list']]
|
||||||
|
)
|
||||||
|
|
||||||
|
changed = False
|
||||||
|
|
||||||
|
manager = KubeManager(module)
|
||||||
|
state = module.params.get('state')
|
||||||
|
if state == 'present':
|
||||||
|
result = manager.create(check=False)
|
||||||
|
|
||||||
|
elif state == 'absent':
|
||||||
|
result = manager.delete()
|
||||||
|
|
||||||
|
elif state == 'reloaded':
|
||||||
|
result = manager.replace()
|
||||||
|
|
||||||
|
elif state == 'stopped':
|
||||||
|
result = manager.stop()
|
||||||
|
|
||||||
|
elif state == 'latest':
|
||||||
|
result = manager.replace()
|
||||||
|
|
||||||
|
elif state == 'exists':
|
||||||
|
result = manager.exists()
|
||||||
|
module.exit_json(changed=changed,
|
||||||
|
msg='%s' % result)
|
||||||
|
|
||||||
|
else:
|
||||||
|
module.fail_json(msg='Unrecognized state %s.' % state)
|
||||||
|
|
||||||
|
module.exit_json(changed=changed,
|
||||||
|
msg='success: %s' % (' '.join(result))
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
from ansible.module_utils.basic import * # noqa
|
||||||
|
if __name__ == '__main__':
|
||||||
|
main()
|
||||||
28
kubespray/project/recover_control_plane.yml
Normal file
28
kubespray/project/recover_control_plane.yml
Normal file
@@ -0,0 +1,28 @@
|
|||||||
|
---
|
||||||
|
- name: Common tasks for every playbooks
|
||||||
|
import_playbook: boilerplate.yml
|
||||||
|
|
||||||
|
- name: Recover etcd
|
||||||
|
hosts: etcd[0]
|
||||||
|
environment: "{{ proxy_disable_env }}"
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults}
|
||||||
|
- role: recover_control_plane/etcd
|
||||||
|
when: etcd_deployment_type != "kubeadm"
|
||||||
|
|
||||||
|
- name: Recover control plane
|
||||||
|
hosts: kube_control_plane[0]
|
||||||
|
environment: "{{ proxy_disable_env }}"
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults}
|
||||||
|
- { role: recover_control_plane/control-plane }
|
||||||
|
|
||||||
|
- name: Apply whole cluster install
|
||||||
|
import_playbook: cluster.yml
|
||||||
|
|
||||||
|
- name: Perform post recover tasks
|
||||||
|
hosts: kube_control_plane
|
||||||
|
environment: "{{ proxy_disable_env }}"
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults}
|
||||||
|
- { role: recover_control_plane/post-recover }
|
||||||
43
kubespray/project/remove_node.yml
Normal file
43
kubespray/project/remove_node.yml
Normal file
@@ -0,0 +1,43 @@
|
|||||||
|
---
|
||||||
|
- name: Common tasks for every playbooks
|
||||||
|
import_playbook: boilerplate.yml
|
||||||
|
|
||||||
|
- name: Confirm node removal
|
||||||
|
hosts: "{{ node | default('etcd:k8s_cluster:calico_rr') }}"
|
||||||
|
gather_facts: no
|
||||||
|
tasks:
|
||||||
|
- name: Confirm Execution
|
||||||
|
pause:
|
||||||
|
prompt: "Are you sure you want to delete nodes state? Type 'yes' to delete nodes."
|
||||||
|
register: pause_result
|
||||||
|
run_once: True
|
||||||
|
when:
|
||||||
|
- not (skip_confirmation | default(false) | bool)
|
||||||
|
|
||||||
|
- name: Fail if user does not confirm deletion
|
||||||
|
fail:
|
||||||
|
msg: "Delete nodes confirmation failed"
|
||||||
|
when: pause_result.user_input | default('yes') != 'yes'
|
||||||
|
|
||||||
|
- name: Gather facts
|
||||||
|
import_playbook: facts.yml
|
||||||
|
when: reset_nodes | default(True) | bool
|
||||||
|
|
||||||
|
- name: Reset node
|
||||||
|
hosts: "{{ node | default('kube_node') }}"
|
||||||
|
gather_facts: no
|
||||||
|
environment: "{{ proxy_disable_env }}"
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults, when: reset_nodes | default(True) | bool }
|
||||||
|
- { role: remove-node/pre-remove, tags: pre-remove }
|
||||||
|
- { role: remove-node/remove-etcd-node }
|
||||||
|
- { role: reset, tags: reset, when: reset_nodes | default(True) | bool }
|
||||||
|
|
||||||
|
# Currently cannot remove first master or etcd
|
||||||
|
- name: Post node removal
|
||||||
|
hosts: "{{ node | default('kube_control_plane[1:]:etcd[1:]') }}"
|
||||||
|
gather_facts: no
|
||||||
|
environment: "{{ proxy_disable_env }}"
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults, when: reset_nodes | default(True) | bool }
|
||||||
|
- { role: remove-node/post-remove, tags: post-remove }
|
||||||
35
kubespray/project/reset.yml
Normal file
35
kubespray/project/reset.yml
Normal file
@@ -0,0 +1,35 @@
|
|||||||
|
---
|
||||||
|
- name: Common tasks for every playbooks
|
||||||
|
import_playbook: boilerplate.yml
|
||||||
|
|
||||||
|
- name: Gather facts
|
||||||
|
import_playbook: facts.yml
|
||||||
|
|
||||||
|
- name: Reset cluster
|
||||||
|
hosts: etcd:k8s_cluster:calico_rr
|
||||||
|
gather_facts: False
|
||||||
|
pre_tasks:
|
||||||
|
- name: Reset Confirmation
|
||||||
|
pause:
|
||||||
|
prompt: "Are you sure you want to reset cluster state? Type 'yes' to reset your cluster."
|
||||||
|
register: reset_confirmation_prompt
|
||||||
|
run_once: True
|
||||||
|
when:
|
||||||
|
- not (skip_confirmation | default(false) | bool)
|
||||||
|
- reset_confirmation is not defined
|
||||||
|
|
||||||
|
- name: Check confirmation
|
||||||
|
fail:
|
||||||
|
msg: "Reset confirmation failed"
|
||||||
|
when:
|
||||||
|
- not reset_confirmation | default(false) | bool
|
||||||
|
- not reset_confirmation_prompt.user_input | default("") == "yes"
|
||||||
|
|
||||||
|
- name: Gather information about installed services
|
||||||
|
service_facts:
|
||||||
|
|
||||||
|
environment: "{{ proxy_disable_env }}"
|
||||||
|
roles:
|
||||||
|
- { role: kubespray-defaults}
|
||||||
|
- { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_early: true }
|
||||||
|
- { role: reset, tags: reset }
|
||||||
27
kubespray/project/roles/adduser/defaults/main.yml
Normal file
27
kubespray/project/roles/adduser/defaults/main.yml
Normal file
@@ -0,0 +1,27 @@
|
|||||||
|
---
|
||||||
|
kube_owner: kube
|
||||||
|
kube_cert_group: kube-cert
|
||||||
|
etcd_data_dir: "/var/lib/etcd"
|
||||||
|
|
||||||
|
addusers:
|
||||||
|
etcd:
|
||||||
|
name: etcd
|
||||||
|
comment: "Etcd user"
|
||||||
|
create_home: no
|
||||||
|
system: yes
|
||||||
|
shell: /sbin/nologin
|
||||||
|
kube:
|
||||||
|
name: kube
|
||||||
|
comment: "Kubernetes user"
|
||||||
|
create_home: no
|
||||||
|
system: yes
|
||||||
|
shell: /sbin/nologin
|
||||||
|
group: "{{ kube_cert_group }}"
|
||||||
|
|
||||||
|
adduser:
|
||||||
|
name: "{{ user.name }}"
|
||||||
|
group: "{{ user.name | default(None) }}"
|
||||||
|
comment: "{{ user.comment | default(None) }}"
|
||||||
|
shell: "{{ user.shell | default(None) }}"
|
||||||
|
system: "{{ user.system | default(None) }}"
|
||||||
|
create_home: "{{ user.create_home | default(None) }}"
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
---
|
||||||
|
- name: Converge
|
||||||
|
hosts: all
|
||||||
|
become: true
|
||||||
|
gather_facts: false
|
||||||
|
roles:
|
||||||
|
- role: adduser
|
||||||
|
vars:
|
||||||
|
user:
|
||||||
|
name: foo
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
---
|
||||||
|
role_name_check: 1
|
||||||
|
dependency:
|
||||||
|
name: galaxy
|
||||||
|
driver:
|
||||||
|
name: vagrant
|
||||||
|
provider:
|
||||||
|
name: libvirt
|
||||||
|
platforms:
|
||||||
|
- name: adduser-01
|
||||||
|
box: generic/ubuntu2004
|
||||||
|
cpus: 1
|
||||||
|
memory: 512
|
||||||
|
provider_options:
|
||||||
|
driver: kvm
|
||||||
|
provisioner:
|
||||||
|
name: ansible
|
||||||
|
config_options:
|
||||||
|
defaults:
|
||||||
|
callbacks_enabled: profile_tasks
|
||||||
|
timeout: 120
|
||||||
|
verifier:
|
||||||
|
name: testinfra
|
||||||
16
kubespray/project/roles/adduser/tasks/main.yml
Normal file
16
kubespray/project/roles/adduser/tasks/main.yml
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
---
|
||||||
|
- name: User | Create User Group
|
||||||
|
group:
|
||||||
|
name: "{{ user.group | default(user.name) }}"
|
||||||
|
system: "{{ user.system | default(omit) }}"
|
||||||
|
|
||||||
|
- name: User | Create User
|
||||||
|
user:
|
||||||
|
comment: "{{ user.comment | default(omit) }}"
|
||||||
|
create_home: "{{ user.create_home | default(omit) }}"
|
||||||
|
group: "{{ user.group | default(user.name) }}"
|
||||||
|
home: "{{ user.home | default(omit) }}"
|
||||||
|
shell: "{{ user.shell | default(omit) }}"
|
||||||
|
name: "{{ user.name }}"
|
||||||
|
system: "{{ user.system | default(omit) }}"
|
||||||
|
when: user.name != "root"
|
||||||
8
kubespray/project/roles/adduser/vars/coreos.yml
Normal file
8
kubespray/project/roles/adduser/vars/coreos.yml
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
---
|
||||||
|
addusers:
|
||||||
|
- name: kube
|
||||||
|
comment: "Kubernetes user"
|
||||||
|
shell: /sbin/nologin
|
||||||
|
system: yes
|
||||||
|
group: "{{ kube_cert_group }}"
|
||||||
|
create_home: no
|
||||||
15
kubespray/project/roles/adduser/vars/debian.yml
Normal file
15
kubespray/project/roles/adduser/vars/debian.yml
Normal file
@@ -0,0 +1,15 @@
|
|||||||
|
---
|
||||||
|
addusers:
|
||||||
|
- name: etcd
|
||||||
|
comment: "Etcd user"
|
||||||
|
create_home: yes
|
||||||
|
home: "{{ etcd_data_dir }}"
|
||||||
|
system: yes
|
||||||
|
shell: /sbin/nologin
|
||||||
|
|
||||||
|
- name: kube
|
||||||
|
comment: "Kubernetes user"
|
||||||
|
create_home: no
|
||||||
|
system: yes
|
||||||
|
shell: /sbin/nologin
|
||||||
|
group: "{{ kube_cert_group }}"
|
||||||
15
kubespray/project/roles/adduser/vars/redhat.yml
Normal file
15
kubespray/project/roles/adduser/vars/redhat.yml
Normal file
@@ -0,0 +1,15 @@
|
|||||||
|
---
|
||||||
|
addusers:
|
||||||
|
- name: etcd
|
||||||
|
comment: "Etcd user"
|
||||||
|
create_home: yes
|
||||||
|
home: "{{ etcd_data_dir }}"
|
||||||
|
system: yes
|
||||||
|
shell: /sbin/nologin
|
||||||
|
|
||||||
|
- name: kube
|
||||||
|
comment: "Kubernetes user"
|
||||||
|
create_home: no
|
||||||
|
system: yes
|
||||||
|
shell: /sbin/nologin
|
||||||
|
group: "{{ kube_cert_group }}"
|
||||||
@@ -0,0 +1,2 @@
|
|||||||
|
---
|
||||||
|
ssh_bastion_confing__name: ssh-bastion.conf
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
---
|
||||||
|
- name: Converge
|
||||||
|
hosts: all
|
||||||
|
become: true
|
||||||
|
gather_facts: false
|
||||||
|
roles:
|
||||||
|
- role: bastion-ssh-config
|
||||||
|
tasks:
|
||||||
|
- name: Copy config to remote host
|
||||||
|
copy:
|
||||||
|
src: "{{ playbook_dir }}/{{ ssh_bastion_confing__name }}"
|
||||||
|
dest: "{{ ssh_bastion_confing__name }}"
|
||||||
|
owner: "{{ ansible_user }}"
|
||||||
|
group: "{{ ansible_user }}"
|
||||||
|
mode: 0644
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
---
|
||||||
|
role_name_check: 1
|
||||||
|
dependency:
|
||||||
|
name: galaxy
|
||||||
|
driver:
|
||||||
|
name: vagrant
|
||||||
|
provider:
|
||||||
|
name: libvirt
|
||||||
|
platforms:
|
||||||
|
- name: bastion-01
|
||||||
|
box: generic/ubuntu2004
|
||||||
|
cpus: 1
|
||||||
|
memory: 512
|
||||||
|
provider_options:
|
||||||
|
driver: kvm
|
||||||
|
provisioner:
|
||||||
|
name: ansible
|
||||||
|
config_options:
|
||||||
|
defaults:
|
||||||
|
callbacks_enabled: profile_tasks
|
||||||
|
timeout: 120
|
||||||
|
inventory:
|
||||||
|
hosts:
|
||||||
|
all:
|
||||||
|
hosts:
|
||||||
|
children:
|
||||||
|
bastion:
|
||||||
|
hosts:
|
||||||
|
bastion-01:
|
||||||
|
verifier:
|
||||||
|
name: testinfra
|
||||||
22
kubespray/project/roles/bastion-ssh-config/tasks/main.yml
Normal file
22
kubespray/project/roles/bastion-ssh-config/tasks/main.yml
Normal file
@@ -0,0 +1,22 @@
|
|||||||
|
---
|
||||||
|
- name: Set bastion host IP and port
|
||||||
|
set_fact:
|
||||||
|
bastion_ip: "{{ hostvars[groups['bastion'][0]]['ansible_host'] | d(hostvars[groups['bastion'][0]]['ansible_ssh_host']) }}"
|
||||||
|
bastion_port: "{{ hostvars[groups['bastion'][0]]['ansible_port'] | d(hostvars[groups['bastion'][0]]['ansible_ssh_port']) | d(22) }}"
|
||||||
|
delegate_to: localhost
|
||||||
|
connection: local
|
||||||
|
|
||||||
|
# As we are actually running on localhost, the ansible_ssh_user is your local user when you try to use it directly
|
||||||
|
# To figure out the real ssh user, we delegate this task to the bastion and store the ansible_user in real_user
|
||||||
|
- name: Store the current ansible_user in the real_user fact
|
||||||
|
set_fact:
|
||||||
|
real_user: "{{ ansible_user }}"
|
||||||
|
|
||||||
|
- name: Create ssh bastion conf
|
||||||
|
become: false
|
||||||
|
delegate_to: localhost
|
||||||
|
connection: local
|
||||||
|
template:
|
||||||
|
src: "{{ ssh_bastion_confing__name }}.j2"
|
||||||
|
dest: "{{ playbook_dir }}/{{ ssh_bastion_confing__name }}"
|
||||||
|
mode: 0640
|
||||||
@@ -0,0 +1,18 @@
|
|||||||
|
{% set vars={'hosts': ''} %}
|
||||||
|
{% set user='' %}
|
||||||
|
|
||||||
|
{% for h in groups['all'] %}
|
||||||
|
{% if h not in groups['bastion'] %}
|
||||||
|
{% if vars.update({'hosts': vars['hosts'] + ' ' + (hostvars[h].get('ansible_ssh_host') or hostvars[h]['ansible_host'])}) %}{% endif %}
|
||||||
|
{% endif %}
|
||||||
|
{% endfor %}
|
||||||
|
|
||||||
|
Host {{ bastion_ip }}
|
||||||
|
Hostname {{ bastion_ip }}
|
||||||
|
StrictHostKeyChecking no
|
||||||
|
ControlMaster auto
|
||||||
|
ControlPath ~/.ssh/ansible-%r@%h:%p
|
||||||
|
ControlPersist 5m
|
||||||
|
|
||||||
|
Host {{ vars['hosts'] }}
|
||||||
|
ProxyCommand ssh -F /dev/null -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -W %h:%p -p {{ bastion_port }} {{ real_user }}@{{ bastion_ip }} {% if ansible_ssh_private_key_file is defined %}-i {{ ansible_ssh_private_key_file }}{% endif %}
|
||||||
32
kubespray/project/roles/bootstrap-os/defaults/main.yml
Normal file
32
kubespray/project/roles/bootstrap-os/defaults/main.yml
Normal file
@@ -0,0 +1,32 @@
|
|||||||
|
---
|
||||||
|
## CentOS/RHEL/AlmaLinux specific variables
|
||||||
|
# Use the fastestmirror yum plugin
|
||||||
|
centos_fastestmirror_enabled: false
|
||||||
|
|
||||||
|
## Flatcar Container Linux specific variables
|
||||||
|
# Disable locksmithd or leave it in its current state
|
||||||
|
coreos_locksmithd_disable: false
|
||||||
|
|
||||||
|
## Oracle Linux specific variables
|
||||||
|
# Install public repo on Oracle Linux
|
||||||
|
use_oracle_public_repo: true
|
||||||
|
|
||||||
|
fedora_coreos_packages:
|
||||||
|
- python
|
||||||
|
- python3-libselinux
|
||||||
|
- ethtool # required in kubeadm preflight phase for verifying the environment
|
||||||
|
- ipset # required in kubeadm preflight phase for verifying the environment
|
||||||
|
- conntrack-tools # required by kube-proxy
|
||||||
|
|
||||||
|
## General
|
||||||
|
# Set the hostname to inventory_hostname
|
||||||
|
override_system_hostname: true
|
||||||
|
|
||||||
|
is_fedora_coreos: false
|
||||||
|
|
||||||
|
skip_http_proxy_on_os_packages: false
|
||||||
|
|
||||||
|
# If this is true, debug information will be displayed but
|
||||||
|
# may contain some private data, so it is recommended to set it to false
|
||||||
|
# in the production environment.
|
||||||
|
unsafe_show_logs: false
|
||||||
46
kubespray/project/roles/bootstrap-os/files/bootstrap.sh
Executable file
46
kubespray/project/roles/bootstrap-os/files/bootstrap.sh
Executable file
@@ -0,0 +1,46 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
set -e
|
||||||
|
|
||||||
|
BINDIR="/opt/bin"
|
||||||
|
if [[ -e $BINDIR/.bootstrapped ]]; then
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
ARCH=$(uname -m)
|
||||||
|
case $ARCH in
|
||||||
|
"x86_64")
|
||||||
|
PYPY_ARCH=linux64
|
||||||
|
PYPI_HASH=46818cb3d74b96b34787548343d266e2562b531ddbaf330383ba930ff1930ed5
|
||||||
|
;;
|
||||||
|
"aarch64")
|
||||||
|
PYPY_ARCH=aarch64
|
||||||
|
PYPI_HASH=2e1ae193d98bc51439642a7618d521ea019f45b8fb226940f7e334c548d2b4b9
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Unsupported Architecture: ${ARCH}"
|
||||||
|
exit 1
|
||||||
|
esac
|
||||||
|
|
||||||
|
PYTHON_VERSION=3.9
|
||||||
|
PYPY_VERSION=7.3.9
|
||||||
|
PYPY_FILENAME="pypy${PYTHON_VERSION}-v${PYPY_VERSION}-${PYPY_ARCH}"
|
||||||
|
PYPI_URL="https://downloads.python.org/pypy/${PYPY_FILENAME}.tar.bz2"
|
||||||
|
|
||||||
|
mkdir -p $BINDIR
|
||||||
|
|
||||||
|
cd $BINDIR
|
||||||
|
|
||||||
|
TAR_FILE=pyp.tar.bz2
|
||||||
|
wget -O "${TAR_FILE}" "${PYPI_URL}"
|
||||||
|
echo "${PYPI_HASH} ${TAR_FILE}" | sha256sum -c -
|
||||||
|
tar -xjf "${TAR_FILE}" && rm "${TAR_FILE}"
|
||||||
|
mv -n "${PYPY_FILENAME}" pypy3
|
||||||
|
|
||||||
|
ln -s ./pypy3/bin/pypy3 python
|
||||||
|
$BINDIR/python --version
|
||||||
|
|
||||||
|
# install PyYAML
|
||||||
|
./python -m ensurepip
|
||||||
|
./python -m pip install pyyaml
|
||||||
|
|
||||||
|
touch $BINDIR/.bootstrapped
|
||||||
4
kubespray/project/roles/bootstrap-os/handlers/main.yml
Normal file
4
kubespray/project/roles/bootstrap-os/handlers/main.yml
Normal file
@@ -0,0 +1,4 @@
|
|||||||
|
---
|
||||||
|
- name: RHEL auto-attach subscription
|
||||||
|
command: /sbin/subscription-manager attach --auto
|
||||||
|
become: true
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
- name: Converge
|
||||||
|
hosts: all
|
||||||
|
gather_facts: no
|
||||||
|
roles:
|
||||||
|
- role: bootstrap-os
|
||||||
@@ -0,0 +1,53 @@
|
|||||||
|
---
|
||||||
|
role_name_check: 1
|
||||||
|
dependency:
|
||||||
|
name: galaxy
|
||||||
|
driver:
|
||||||
|
name: vagrant
|
||||||
|
provider:
|
||||||
|
name: libvirt
|
||||||
|
platforms:
|
||||||
|
- name: ubuntu20
|
||||||
|
box: generic/ubuntu2004
|
||||||
|
cpus: 1
|
||||||
|
memory: 512
|
||||||
|
provider_options:
|
||||||
|
driver: kvm
|
||||||
|
- name: ubuntu22
|
||||||
|
box: generic/ubuntu2204
|
||||||
|
cpus: 1
|
||||||
|
memory: 1024
|
||||||
|
provider_options:
|
||||||
|
driver: kvm
|
||||||
|
- name: centos7
|
||||||
|
box: centos/7
|
||||||
|
cpus: 1
|
||||||
|
memory: 512
|
||||||
|
provider_options:
|
||||||
|
driver: kvm
|
||||||
|
- name: almalinux8
|
||||||
|
box: almalinux/8
|
||||||
|
cpus: 1
|
||||||
|
memory: 512
|
||||||
|
provider_options:
|
||||||
|
driver: kvm
|
||||||
|
- name: debian10
|
||||||
|
box: generic/debian10
|
||||||
|
cpus: 1
|
||||||
|
memory: 512
|
||||||
|
provider_options:
|
||||||
|
driver: kvm
|
||||||
|
provisioner:
|
||||||
|
name: ansible
|
||||||
|
config_options:
|
||||||
|
defaults:
|
||||||
|
callbacks_enabled: profile_tasks
|
||||||
|
timeout: 120
|
||||||
|
inventory:
|
||||||
|
group_vars:
|
||||||
|
all:
|
||||||
|
user:
|
||||||
|
name: foo
|
||||||
|
comment: My test comment
|
||||||
|
verifier:
|
||||||
|
name: testinfra
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
import os
|
||||||
|
|
||||||
|
import testinfra.utils.ansible_runner
|
||||||
|
|
||||||
|
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
|
||||||
|
os.environ['MOLECULE_INVENTORY_FILE']
|
||||||
|
).get_hosts('all')
|
||||||
|
|
||||||
|
|
||||||
|
def test_python(host):
|
||||||
|
assert host.exists('python3') or host.exists('python')
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
- name: Enable EPEL repo for Amazon Linux
|
||||||
|
yum_repository:
|
||||||
|
name: epel
|
||||||
|
file: epel
|
||||||
|
description: Extra Packages for Enterprise Linux 7 - $basearch
|
||||||
|
baseurl: http://download.fedoraproject.org/pub/epel/7/$basearch
|
||||||
|
gpgcheck: yes
|
||||||
|
gpgkey: http://download.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-7
|
||||||
|
skip_if_unavailable: yes
|
||||||
|
enabled: yes
|
||||||
|
repo_gpgcheck: no
|
||||||
|
when: epel_enabled
|
||||||
118
kubespray/project/roles/bootstrap-os/tasks/bootstrap-centos.yml
Normal file
118
kubespray/project/roles/bootstrap-os/tasks/bootstrap-centos.yml
Normal file
@@ -0,0 +1,118 @@
|
|||||||
|
---
|
||||||
|
- name: Gather host facts to get ansible_distribution_version ansible_distribution_major_version
|
||||||
|
setup:
|
||||||
|
gather_subset: '!all'
|
||||||
|
filter: ansible_distribution_*version
|
||||||
|
|
||||||
|
- name: Add proxy to yum.conf or dnf.conf if http_proxy is defined
|
||||||
|
community.general.ini_file:
|
||||||
|
path: "{{ ((ansible_distribution_major_version | int) < 8) | ternary('/etc/yum.conf', '/etc/dnf/dnf.conf') }}"
|
||||||
|
section: main
|
||||||
|
option: proxy
|
||||||
|
value: "{{ http_proxy | default(omit) }}"
|
||||||
|
state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
|
||||||
|
no_extra_spaces: true
|
||||||
|
mode: 0644
|
||||||
|
become: true
|
||||||
|
when: not skip_http_proxy_on_os_packages
|
||||||
|
|
||||||
|
# For Oracle Linux install public repo
|
||||||
|
- name: Download Oracle Linux public yum repo
|
||||||
|
get_url:
|
||||||
|
url: https://yum.oracle.com/public-yum-ol7.repo
|
||||||
|
dest: /etc/yum.repos.d/public-yum-ol7.repo
|
||||||
|
mode: 0644
|
||||||
|
when:
|
||||||
|
- use_oracle_public_repo | default(true)
|
||||||
|
- '''ID="ol"'' in os_release.stdout_lines'
|
||||||
|
- (ansible_distribution_version | float) < 7.6
|
||||||
|
environment: "{{ proxy_env }}"
|
||||||
|
|
||||||
|
- name: Enable Oracle Linux repo
|
||||||
|
community.general.ini_file:
|
||||||
|
dest: /etc/yum.repos.d/public-yum-ol7.repo
|
||||||
|
section: "{{ item }}"
|
||||||
|
option: enabled
|
||||||
|
value: "1"
|
||||||
|
mode: 0644
|
||||||
|
with_items:
|
||||||
|
- ol7_latest
|
||||||
|
- ol7_addons
|
||||||
|
- ol7_developer_EPEL
|
||||||
|
when:
|
||||||
|
- use_oracle_public_repo | default(true)
|
||||||
|
- '''ID="ol"'' in os_release.stdout_lines'
|
||||||
|
- (ansible_distribution_version | float) < 7.6
|
||||||
|
|
||||||
|
- name: Install EPEL for Oracle Linux repo package
|
||||||
|
package:
|
||||||
|
name: "oracle-epel-release-el{{ ansible_distribution_major_version }}"
|
||||||
|
state: present
|
||||||
|
when:
|
||||||
|
- use_oracle_public_repo | default(true)
|
||||||
|
- '''ID="ol"'' in os_release.stdout_lines'
|
||||||
|
- (ansible_distribution_version | float) >= 7.6
|
||||||
|
|
||||||
|
- name: Enable Oracle Linux repo
|
||||||
|
community.general.ini_file:
|
||||||
|
dest: "/etc/yum.repos.d/oracle-linux-ol{{ ansible_distribution_major_version }}.repo"
|
||||||
|
section: "ol{{ ansible_distribution_major_version }}_addons"
|
||||||
|
option: "{{ item.option }}"
|
||||||
|
value: "{{ item.value }}"
|
||||||
|
mode: 0644
|
||||||
|
with_items:
|
||||||
|
- { option: "name", value: "ol{{ ansible_distribution_major_version }}_addons" }
|
||||||
|
- { option: "enabled", value: "1" }
|
||||||
|
- { option: "baseurl", value: "http://yum.oracle.com/repo/OracleLinux/OL{{ ansible_distribution_major_version }}/addons/$basearch/" }
|
||||||
|
when:
|
||||||
|
- use_oracle_public_repo | default(true)
|
||||||
|
- '''ID="ol"'' in os_release.stdout_lines'
|
||||||
|
- (ansible_distribution_version | float) >= 7.6
|
||||||
|
|
||||||
|
- name: Enable Centos extra repo for Oracle Linux
|
||||||
|
community.general.ini_file:
|
||||||
|
dest: "/etc/yum.repos.d/centos-extras.repo"
|
||||||
|
section: "extras"
|
||||||
|
option: "{{ item.option }}"
|
||||||
|
value: "{{ item.value }}"
|
||||||
|
mode: 0644
|
||||||
|
with_items:
|
||||||
|
- { option: "name", value: "CentOS-{{ ansible_distribution_major_version }} - Extras" }
|
||||||
|
- { option: "enabled", value: "1" }
|
||||||
|
- { option: "gpgcheck", value: "0" }
|
||||||
|
- { option: "baseurl", value: "http://mirror.centos.org/{{ 'altarch' if (ansible_distribution_major_version | int) <= 7 and ansible_architecture == 'aarch64' else 'centos' }}/{{ ansible_distribution_major_version }}/extras/$basearch/{% if ansible_distribution_major_version | int > 7 %}os/{% endif %}" }
|
||||||
|
when:
|
||||||
|
- use_oracle_public_repo | default(true)
|
||||||
|
- '''ID="ol"'' in os_release.stdout_lines'
|
||||||
|
- (ansible_distribution_version | float) >= 7.6
|
||||||
|
- (ansible_distribution_version | float) < 9
|
||||||
|
|
||||||
|
# CentOS ships with python installed
|
||||||
|
|
||||||
|
- name: Check presence of fastestmirror.conf
|
||||||
|
stat:
|
||||||
|
path: /etc/yum/pluginconf.d/fastestmirror.conf
|
||||||
|
get_attributes: no
|
||||||
|
get_checksum: no
|
||||||
|
get_mime: no
|
||||||
|
register: fastestmirror
|
||||||
|
|
||||||
|
# the fastestmirror plugin can actually slow down Ansible deployments
|
||||||
|
- name: Disable fastestmirror plugin if requested
|
||||||
|
lineinfile:
|
||||||
|
dest: /etc/yum/pluginconf.d/fastestmirror.conf
|
||||||
|
regexp: "^enabled=.*"
|
||||||
|
line: "enabled=0"
|
||||||
|
state: present
|
||||||
|
become: true
|
||||||
|
when:
|
||||||
|
- fastestmirror.stat.exists
|
||||||
|
- not centos_fastestmirror_enabled
|
||||||
|
|
||||||
|
# libselinux-python is required on SELinux enabled hosts
|
||||||
|
# See https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#managed-node-requirements
|
||||||
|
- name: Install libselinux python package
|
||||||
|
package:
|
||||||
|
name: "{{ ((ansible_distribution_major_version | int) < 8) | ternary('libselinux-python', 'python3-libselinux') }}"
|
||||||
|
state: present
|
||||||
|
become: true
|
||||||
@@ -0,0 +1,16 @@
|
|||||||
|
---
|
||||||
|
# ClearLinux ships with Python installed
|
||||||
|
|
||||||
|
- name: Install basic package to run containers
|
||||||
|
package:
|
||||||
|
name: containers-basic
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Make sure docker service is enabled
|
||||||
|
systemd:
|
||||||
|
name: docker
|
||||||
|
masked: false
|
||||||
|
enabled: true
|
||||||
|
daemon_reload: true
|
||||||
|
state: started
|
||||||
|
become: true
|
||||||
@@ -0,0 +1,37 @@
|
|||||||
|
---
|
||||||
|
# CoreOS ships without Python installed
|
||||||
|
|
||||||
|
- name: Check if bootstrap is needed
|
||||||
|
raw: stat /opt/bin/.bootstrapped
|
||||||
|
register: need_bootstrap
|
||||||
|
failed_when: false
|
||||||
|
changed_when: false
|
||||||
|
tags:
|
||||||
|
- facts
|
||||||
|
|
||||||
|
- name: Force binaries directory for Container Linux by CoreOS and Flatcar
|
||||||
|
set_fact:
|
||||||
|
bin_dir: "/opt/bin"
|
||||||
|
tags:
|
||||||
|
- facts
|
||||||
|
|
||||||
|
- name: Run bootstrap.sh
|
||||||
|
script: bootstrap.sh
|
||||||
|
become: true
|
||||||
|
environment: "{{ proxy_env }}"
|
||||||
|
when:
|
||||||
|
- need_bootstrap.rc != 0
|
||||||
|
|
||||||
|
- name: Set the ansible_python_interpreter fact
|
||||||
|
set_fact:
|
||||||
|
ansible_python_interpreter: "{{ bin_dir }}/python"
|
||||||
|
tags:
|
||||||
|
- facts
|
||||||
|
|
||||||
|
- name: Disable auto-upgrade
|
||||||
|
systemd:
|
||||||
|
name: locksmithd.service
|
||||||
|
masked: true
|
||||||
|
state: stopped
|
||||||
|
when:
|
||||||
|
- coreos_locksmithd_disable
|
||||||
@@ -0,0 +1,76 @@
|
|||||||
|
---
|
||||||
|
# Some Debian based distros ship without Python installed
|
||||||
|
|
||||||
|
- name: Check if bootstrap is needed
|
||||||
|
raw: which python3
|
||||||
|
register: need_bootstrap
|
||||||
|
failed_when: false
|
||||||
|
changed_when: false
|
||||||
|
# This command should always run, even in check mode
|
||||||
|
check_mode: false
|
||||||
|
tags:
|
||||||
|
- facts
|
||||||
|
|
||||||
|
- name: Check http::proxy in apt configuration files
|
||||||
|
raw: apt-config dump | grep -qsi 'Acquire::http::proxy'
|
||||||
|
register: need_http_proxy
|
||||||
|
failed_when: false
|
||||||
|
changed_when: false
|
||||||
|
# This command should always run, even in check mode
|
||||||
|
check_mode: false
|
||||||
|
|
||||||
|
- name: Add http_proxy to /etc/apt/apt.conf if http_proxy is defined
|
||||||
|
raw: echo 'Acquire::http::proxy "{{ http_proxy }}";' >> /etc/apt/apt.conf
|
||||||
|
become: true
|
||||||
|
when:
|
||||||
|
- http_proxy is defined
|
||||||
|
- need_http_proxy.rc != 0
|
||||||
|
- not skip_http_proxy_on_os_packages
|
||||||
|
|
||||||
|
- name: Check https::proxy in apt configuration files
|
||||||
|
raw: apt-config dump | grep -qsi 'Acquire::https::proxy'
|
||||||
|
register: need_https_proxy
|
||||||
|
failed_when: false
|
||||||
|
changed_when: false
|
||||||
|
# This command should always run, even in check mode
|
||||||
|
check_mode: false
|
||||||
|
|
||||||
|
- name: Add https_proxy to /etc/apt/apt.conf if https_proxy is defined
|
||||||
|
raw: echo 'Acquire::https::proxy "{{ https_proxy }}";' >> /etc/apt/apt.conf
|
||||||
|
become: true
|
||||||
|
when:
|
||||||
|
- https_proxy is defined
|
||||||
|
- need_https_proxy.rc != 0
|
||||||
|
- not skip_http_proxy_on_os_packages
|
||||||
|
|
||||||
|
- name: Install python3
|
||||||
|
raw:
|
||||||
|
apt-get update && \
|
||||||
|
DEBIAN_FRONTEND=noninteractive apt-get install -y python3-minimal
|
||||||
|
become: true
|
||||||
|
when:
|
||||||
|
- need_bootstrap.rc != 0
|
||||||
|
|
||||||
|
- name: Update Apt cache
|
||||||
|
raw: apt-get update --allow-releaseinfo-change
|
||||||
|
become: true
|
||||||
|
when:
|
||||||
|
- '''ID=debian'' in os_release.stdout_lines'
|
||||||
|
- '''VERSION_ID="10"'' in os_release.stdout_lines or ''VERSION_ID="11"'' in os_release.stdout_lines'
|
||||||
|
register: bootstrap_update_apt_result
|
||||||
|
changed_when:
|
||||||
|
- '"changed its" in bootstrap_update_apt_result.stdout'
|
||||||
|
- '"value from" in bootstrap_update_apt_result.stdout'
|
||||||
|
ignore_errors: true
|
||||||
|
|
||||||
|
- name: Set the ansible_python_interpreter fact
|
||||||
|
set_fact:
|
||||||
|
ansible_python_interpreter: "/usr/bin/python3"
|
||||||
|
|
||||||
|
# Workaround for https://github.com/ansible/ansible/issues/25543
|
||||||
|
- name: Install dbus for the hostname module
|
||||||
|
package:
|
||||||
|
name: dbus
|
||||||
|
state: present
|
||||||
|
use: apt
|
||||||
|
become: true
|
||||||
@@ -0,0 +1,46 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
- name: Check if bootstrap is needed
|
||||||
|
raw: which python
|
||||||
|
register: need_bootstrap
|
||||||
|
failed_when: false
|
||||||
|
changed_when: false
|
||||||
|
tags:
|
||||||
|
- facts
|
||||||
|
|
||||||
|
- name: Remove podman network cni
|
||||||
|
raw: "podman network rm podman"
|
||||||
|
become: true
|
||||||
|
ignore_errors: true # noqa ignore-errors
|
||||||
|
when: need_bootstrap.rc != 0
|
||||||
|
|
||||||
|
- name: Clean up possible pending packages on fedora coreos
|
||||||
|
raw: "export http_proxy={{ http_proxy | default('') }};rpm-ostree cleanup -p }}"
|
||||||
|
become: true
|
||||||
|
when: need_bootstrap.rc != 0
|
||||||
|
|
||||||
|
- name: Install required packages on fedora coreos
|
||||||
|
raw: "export http_proxy={{ http_proxy | default('') }};rpm-ostree install --allow-inactive {{ fedora_coreos_packages | join(' ') }}"
|
||||||
|
become: true
|
||||||
|
when: need_bootstrap.rc != 0
|
||||||
|
|
||||||
|
- name: Reboot immediately for updated ostree
|
||||||
|
raw: "nohup bash -c 'sleep 5s && shutdown -r now'"
|
||||||
|
become: true
|
||||||
|
ignore_errors: true # noqa ignore-errors
|
||||||
|
ignore_unreachable: yes
|
||||||
|
when: need_bootstrap.rc != 0
|
||||||
|
|
||||||
|
- name: Wait for the reboot to complete
|
||||||
|
wait_for_connection:
|
||||||
|
timeout: 240
|
||||||
|
connect_timeout: 20
|
||||||
|
delay: 5
|
||||||
|
sleep: 5
|
||||||
|
when: need_bootstrap.rc != 0
|
||||||
|
|
||||||
|
- name: Store the fact if this is an fedora core os host
|
||||||
|
set_fact:
|
||||||
|
is_fedora_coreos: True
|
||||||
|
tags:
|
||||||
|
- facts
|
||||||
@@ -0,0 +1,36 @@
|
|||||||
|
---
|
||||||
|
# Some Fedora based distros ship without Python installed
|
||||||
|
|
||||||
|
- name: Check if bootstrap is needed
|
||||||
|
raw: which python
|
||||||
|
register: need_bootstrap
|
||||||
|
failed_when: false
|
||||||
|
changed_when: false
|
||||||
|
tags:
|
||||||
|
- facts
|
||||||
|
|
||||||
|
- name: Add proxy to dnf.conf if http_proxy is defined
|
||||||
|
community.general.ini_file:
|
||||||
|
path: "/etc/dnf/dnf.conf"
|
||||||
|
section: main
|
||||||
|
option: proxy
|
||||||
|
value: "{{ http_proxy | default(omit) }}"
|
||||||
|
state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
|
||||||
|
no_extra_spaces: true
|
||||||
|
mode: 0644
|
||||||
|
become: true
|
||||||
|
when: not skip_http_proxy_on_os_packages
|
||||||
|
|
||||||
|
- name: Install python3 on fedora
|
||||||
|
raw: "dnf install --assumeyes --quiet python3"
|
||||||
|
become: true
|
||||||
|
when:
|
||||||
|
- need_bootstrap.rc != 0
|
||||||
|
|
||||||
|
# libselinux-python3 is required on SELinux enabled hosts
|
||||||
|
# See https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#managed-node-requirements
|
||||||
|
- name: Install libselinux-python3
|
||||||
|
package:
|
||||||
|
name: libselinux-python3
|
||||||
|
state: present
|
||||||
|
become: true
|
||||||
@@ -0,0 +1,37 @@
|
|||||||
|
---
|
||||||
|
# Flatcar Container Linux ships without Python installed
|
||||||
|
|
||||||
|
- name: Check if bootstrap is needed
|
||||||
|
raw: stat /opt/bin/.bootstrapped
|
||||||
|
register: need_bootstrap
|
||||||
|
failed_when: false
|
||||||
|
changed_when: false
|
||||||
|
tags:
|
||||||
|
- facts
|
||||||
|
|
||||||
|
- name: Force binaries directory for Flatcar Container Linux by Kinvolk
|
||||||
|
set_fact:
|
||||||
|
bin_dir: "/opt/bin"
|
||||||
|
tags:
|
||||||
|
- facts
|
||||||
|
|
||||||
|
- name: Run bootstrap.sh
|
||||||
|
script: bootstrap.sh
|
||||||
|
become: true
|
||||||
|
environment: "{{ proxy_env }}"
|
||||||
|
when:
|
||||||
|
- need_bootstrap.rc != 0
|
||||||
|
|
||||||
|
- name: Set the ansible_python_interpreter fact
|
||||||
|
set_fact:
|
||||||
|
ansible_python_interpreter: "{{ bin_dir }}/python"
|
||||||
|
tags:
|
||||||
|
- facts
|
||||||
|
|
||||||
|
- name: Disable auto-upgrade
|
||||||
|
systemd:
|
||||||
|
name: locksmithd.service
|
||||||
|
masked: true
|
||||||
|
state: stopped
|
||||||
|
when:
|
||||||
|
- coreos_locksmithd_disable
|
||||||
@@ -0,0 +1,85 @@
|
|||||||
|
---
|
||||||
|
# OpenSUSE ships with Python installed
|
||||||
|
- name: Gather host facts to get ansible_distribution_version ansible_distribution_major_version
|
||||||
|
setup:
|
||||||
|
gather_subset: '!all'
|
||||||
|
filter: ansible_distribution_*version
|
||||||
|
|
||||||
|
- name: Check that /etc/sysconfig/proxy file exists
|
||||||
|
stat:
|
||||||
|
path: /etc/sysconfig/proxy
|
||||||
|
get_attributes: no
|
||||||
|
get_checksum: no
|
||||||
|
get_mime: no
|
||||||
|
register: stat_result
|
||||||
|
|
||||||
|
- name: Create the /etc/sysconfig/proxy empty file
|
||||||
|
file: # noqa risky-file-permissions
|
||||||
|
path: /etc/sysconfig/proxy
|
||||||
|
state: touch
|
||||||
|
when:
|
||||||
|
- http_proxy is defined or https_proxy is defined
|
||||||
|
- not stat_result.stat.exists
|
||||||
|
|
||||||
|
- name: Set the http_proxy in /etc/sysconfig/proxy
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/sysconfig/proxy
|
||||||
|
regexp: '^HTTP_PROXY='
|
||||||
|
line: 'HTTP_PROXY="{{ http_proxy }}"'
|
||||||
|
become: true
|
||||||
|
when:
|
||||||
|
- http_proxy is defined
|
||||||
|
|
||||||
|
- name: Set the https_proxy in /etc/sysconfig/proxy
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/sysconfig/proxy
|
||||||
|
regexp: '^HTTPS_PROXY='
|
||||||
|
line: 'HTTPS_PROXY="{{ https_proxy }}"'
|
||||||
|
become: true
|
||||||
|
when:
|
||||||
|
- https_proxy is defined
|
||||||
|
|
||||||
|
- name: Enable proxies
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/sysconfig/proxy
|
||||||
|
regexp: '^PROXY_ENABLED='
|
||||||
|
line: 'PROXY_ENABLED="yes"'
|
||||||
|
become: true
|
||||||
|
when:
|
||||||
|
- http_proxy is defined or https_proxy is defined
|
||||||
|
|
||||||
|
# Required for zypper module
|
||||||
|
- name: Install python-xml
|
||||||
|
shell: zypper refresh && zypper --non-interactive install python-xml
|
||||||
|
changed_when: false
|
||||||
|
become: true
|
||||||
|
tags:
|
||||||
|
- facts
|
||||||
|
|
||||||
|
# Without this package, the get_url module fails when trying to handle https
|
||||||
|
- name: Install python-cryptography
|
||||||
|
community.general.zypper:
|
||||||
|
name: python-cryptography
|
||||||
|
state: present
|
||||||
|
update_cache: true
|
||||||
|
become: true
|
||||||
|
when:
|
||||||
|
- ansible_distribution_version is version('15.4', '<')
|
||||||
|
|
||||||
|
- name: Install python3-cryptography
|
||||||
|
community.general.zypper:
|
||||||
|
name: python3-cryptography
|
||||||
|
state: present
|
||||||
|
update_cache: true
|
||||||
|
become: true
|
||||||
|
when:
|
||||||
|
- ansible_distribution_version is version('15.4', '>=')
|
||||||
|
|
||||||
|
# Nerdctl needs some basic packages to get an environment up
|
||||||
|
- name: Install basic dependencies
|
||||||
|
community.general.zypper:
|
||||||
|
name:
|
||||||
|
- iptables
|
||||||
|
- apparmor-parser
|
||||||
|
state: present
|
||||||
|
become: true
|
||||||
113
kubespray/project/roles/bootstrap-os/tasks/bootstrap-redhat.yml
Normal file
113
kubespray/project/roles/bootstrap-os/tasks/bootstrap-redhat.yml
Normal file
@@ -0,0 +1,113 @@
|
|||||||
|
---
|
||||||
|
- name: Gather host facts to get ansible_distribution_version ansible_distribution_major_version
|
||||||
|
setup:
|
||||||
|
gather_subset: '!all'
|
||||||
|
filter: ansible_distribution_*version
|
||||||
|
|
||||||
|
- name: Add proxy to yum.conf or dnf.conf if http_proxy is defined
|
||||||
|
community.general.ini_file:
|
||||||
|
path: "{{ ((ansible_distribution_major_version | int) < 8) | ternary('/etc/yum.conf', '/etc/dnf/dnf.conf') }}"
|
||||||
|
section: main
|
||||||
|
option: proxy
|
||||||
|
value: "{{ http_proxy | default(omit) }}"
|
||||||
|
state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
|
||||||
|
no_extra_spaces: true
|
||||||
|
mode: 0644
|
||||||
|
become: true
|
||||||
|
when: not skip_http_proxy_on_os_packages
|
||||||
|
|
||||||
|
- name: Add proxy to RHEL subscription-manager if http_proxy is defined
|
||||||
|
command: /sbin/subscription-manager config --server.proxy_hostname={{ http_proxy | regex_replace(':\d+$') | regex_replace('^.*://') }} --server.proxy_port={{ http_proxy | regex_replace('^.*:') }}
|
||||||
|
become: true
|
||||||
|
when:
|
||||||
|
- not skip_http_proxy_on_os_packages
|
||||||
|
- http_proxy is defined
|
||||||
|
|
||||||
|
- name: Check RHEL subscription-manager status
|
||||||
|
command: /sbin/subscription-manager status
|
||||||
|
register: rh_subscription_status
|
||||||
|
changed_when: "rh_subscription_status.rc != 0"
|
||||||
|
ignore_errors: true # noqa ignore-errors
|
||||||
|
become: true
|
||||||
|
|
||||||
|
- name: RHEL subscription Organization ID/Activation Key registration
|
||||||
|
community.general.redhat_subscription:
|
||||||
|
state: present
|
||||||
|
org_id: "{{ rh_subscription_org_id }}"
|
||||||
|
activationkey: "{{ rh_subscription_activation_key }}"
|
||||||
|
force_register: true
|
||||||
|
notify: RHEL auto-attach subscription
|
||||||
|
become: true
|
||||||
|
when:
|
||||||
|
- rh_subscription_org_id is defined
|
||||||
|
- rh_subscription_status.changed
|
||||||
|
|
||||||
|
# this task has no_log set to prevent logging security sensitive information such as subscription passwords
|
||||||
|
- name: RHEL subscription Username/Password registration
|
||||||
|
community.general.redhat_subscription:
|
||||||
|
state: present
|
||||||
|
username: "{{ rh_subscription_username }}"
|
||||||
|
password: "{{ rh_subscription_password }}"
|
||||||
|
auto_attach: true
|
||||||
|
force_register: true
|
||||||
|
syspurpose:
|
||||||
|
usage: "{{ rh_subscription_usage }}"
|
||||||
|
role: "{{ rh_subscription_role }}"
|
||||||
|
service_level_agreement: "{{ rh_subscription_sla }}"
|
||||||
|
sync: true
|
||||||
|
notify: RHEL auto-attach subscription
|
||||||
|
become: true
|
||||||
|
no_log: "{{ not (unsafe_show_logs | bool) }}"
|
||||||
|
when:
|
||||||
|
- rh_subscription_username is defined
|
||||||
|
- rh_subscription_status.changed
|
||||||
|
|
||||||
|
# container-selinux is in extras repo
|
||||||
|
- name: Enable RHEL 7 repos
|
||||||
|
community.general.rhsm_repository:
|
||||||
|
name:
|
||||||
|
- "rhel-7-server-rpms"
|
||||||
|
- "rhel-7-server-extras-rpms"
|
||||||
|
state: "{{ 'enabled' if (rhel_enable_repos | default(True) | bool) else 'disabled' }}"
|
||||||
|
when:
|
||||||
|
- ansible_distribution_major_version == "7"
|
||||||
|
- (not rh_subscription_status.changed) or (rh_subscription_username is defined) or (rh_subscription_org_id is defined)
|
||||||
|
|
||||||
|
# container-selinux is in appstream repo
|
||||||
|
- name: Enable RHEL 8 repos
|
||||||
|
community.general.rhsm_repository:
|
||||||
|
name:
|
||||||
|
- "rhel-8-for-*-baseos-rpms"
|
||||||
|
- "rhel-8-for-*-appstream-rpms"
|
||||||
|
state: "{{ 'enabled' if (rhel_enable_repos | default(True) | bool) else 'disabled' }}"
|
||||||
|
when:
|
||||||
|
- ansible_distribution_major_version == "8"
|
||||||
|
- (not rh_subscription_status.changed) or (rh_subscription_username is defined) or (rh_subscription_org_id is defined)
|
||||||
|
|
||||||
|
- name: Check presence of fastestmirror.conf
|
||||||
|
stat:
|
||||||
|
path: /etc/yum/pluginconf.d/fastestmirror.conf
|
||||||
|
get_attributes: no
|
||||||
|
get_checksum: no
|
||||||
|
get_mime: no
|
||||||
|
register: fastestmirror
|
||||||
|
|
||||||
|
# the fastestmirror plugin can actually slow down Ansible deployments
|
||||||
|
- name: Disable fastestmirror plugin if requested
|
||||||
|
lineinfile:
|
||||||
|
dest: /etc/yum/pluginconf.d/fastestmirror.conf
|
||||||
|
regexp: "^enabled=.*"
|
||||||
|
line: "enabled=0"
|
||||||
|
state: present
|
||||||
|
become: true
|
||||||
|
when:
|
||||||
|
- fastestmirror.stat.exists
|
||||||
|
- not centos_fastestmirror_enabled
|
||||||
|
|
||||||
|
# libselinux-python is required on SELinux enabled hosts
|
||||||
|
# See https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#managed-node-requirements
|
||||||
|
- name: Install libselinux python package
|
||||||
|
package:
|
||||||
|
name: "{{ ((ansible_distribution_major_version | int) < 8) | ternary('libselinux-python', 'python3-libselinux') }}"
|
||||||
|
state: present
|
||||||
|
become: true
|
||||||
109
kubespray/project/roles/bootstrap-os/tasks/main.yml
Normal file
109
kubespray/project/roles/bootstrap-os/tasks/main.yml
Normal file
@@ -0,0 +1,109 @@
|
|||||||
|
---
|
||||||
|
- name: Fetch /etc/os-release
|
||||||
|
raw: cat /etc/os-release
|
||||||
|
register: os_release
|
||||||
|
changed_when: false
|
||||||
|
# This command should always run, even in check mode
|
||||||
|
check_mode: false
|
||||||
|
|
||||||
|
- name: Bootstrap CentOS
|
||||||
|
include_tasks: bootstrap-centos.yml
|
||||||
|
when: '''ID="centos"'' in os_release.stdout_lines or ''ID="ol"'' in os_release.stdout_lines or ''ID="almalinux"'' in os_release.stdout_lines or ''ID="rocky"'' in os_release.stdout_lines or ''ID="kylin"'' in os_release.stdout_lines or ''ID="uos"'' in os_release.stdout_lines or ''ID="openEuler"'' in os_release.stdout_lines'
|
||||||
|
|
||||||
|
- name: Bootstrap Amazon
|
||||||
|
include_tasks: bootstrap-amazon.yml
|
||||||
|
when: '''ID="amzn"'' in os_release.stdout_lines'
|
||||||
|
|
||||||
|
- name: Bootstrap RedHat
|
||||||
|
include_tasks: bootstrap-redhat.yml
|
||||||
|
when: '''ID="rhel"'' in os_release.stdout_lines'
|
||||||
|
|
||||||
|
- name: Bootstrap Clear Linux
|
||||||
|
include_tasks: bootstrap-clearlinux.yml
|
||||||
|
when: '''ID=clear-linux-os'' in os_release.stdout_lines'
|
||||||
|
|
||||||
|
# Fedora CoreOS
|
||||||
|
- name: Bootstrap Fedora CoreOS
|
||||||
|
include_tasks: bootstrap-fedora-coreos.yml
|
||||||
|
when:
|
||||||
|
- '''ID=fedora'' in os_release.stdout_lines'
|
||||||
|
- '''VARIANT_ID=coreos'' in os_release.stdout_lines'
|
||||||
|
|
||||||
|
- name: Bootstrap Flatcar
|
||||||
|
include_tasks: bootstrap-flatcar.yml
|
||||||
|
when: '''ID=flatcar'' in os_release.stdout_lines'
|
||||||
|
|
||||||
|
- name: Bootstrap Debian
|
||||||
|
include_tasks: bootstrap-debian.yml
|
||||||
|
when: '''ID=debian'' in os_release.stdout_lines or ''ID=ubuntu'' in os_release.stdout_lines'
|
||||||
|
|
||||||
|
# Fedora "classic"
|
||||||
|
- name: Boostrap Fedora
|
||||||
|
include_tasks: bootstrap-fedora.yml
|
||||||
|
when:
|
||||||
|
- '''ID=fedora'' in os_release.stdout_lines'
|
||||||
|
- '''VARIANT_ID=coreos'' not in os_release.stdout_lines'
|
||||||
|
|
||||||
|
- name: Bootstrap OpenSUSE
|
||||||
|
include_tasks: bootstrap-opensuse.yml
|
||||||
|
when: '''ID="opensuse-leap"'' in os_release.stdout_lines or ''ID="opensuse-tumbleweed"'' in os_release.stdout_lines'
|
||||||
|
|
||||||
|
- name: Create remote_tmp for it is used by another module
|
||||||
|
file:
|
||||||
|
path: "{{ ansible_remote_tmp | default('~/.ansible/tmp') }}"
|
||||||
|
state: directory
|
||||||
|
mode: 0700
|
||||||
|
|
||||||
|
# Workaround for https://github.com/ansible/ansible/issues/42726
|
||||||
|
# (1/3)
|
||||||
|
- name: Gather host facts to get ansible_os_family
|
||||||
|
setup:
|
||||||
|
gather_subset: '!all'
|
||||||
|
filter: ansible_*
|
||||||
|
|
||||||
|
- name: Assign inventory name to unconfigured hostnames (non-CoreOS, non-Flatcar, Suse and ClearLinux, non-Fedora)
|
||||||
|
hostname:
|
||||||
|
name: "{{ inventory_hostname }}"
|
||||||
|
when:
|
||||||
|
- override_system_hostname
|
||||||
|
- ansible_os_family not in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
|
||||||
|
- not ansible_distribution == "Fedora"
|
||||||
|
- not is_fedora_coreos
|
||||||
|
|
||||||
|
# (2/3)
|
||||||
|
- name: Assign inventory name to unconfigured hostnames (CoreOS, Flatcar, Suse, ClearLinux and Fedora only)
|
||||||
|
command: "hostnamectl set-hostname {{ inventory_hostname }}"
|
||||||
|
register: hostname_changed
|
||||||
|
become: true
|
||||||
|
changed_when: false
|
||||||
|
when: >
|
||||||
|
override_system_hostname
|
||||||
|
and (ansible_os_family in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
|
||||||
|
or is_fedora_coreos
|
||||||
|
or ansible_distribution == "Fedora")
|
||||||
|
|
||||||
|
# (3/3)
|
||||||
|
- name: Update hostname fact (CoreOS, Flatcar, Suse, ClearLinux and Fedora only)
|
||||||
|
setup:
|
||||||
|
gather_subset: '!all'
|
||||||
|
filter: ansible_hostname
|
||||||
|
when: >
|
||||||
|
override_system_hostname
|
||||||
|
and (ansible_os_family in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
|
||||||
|
or is_fedora_coreos
|
||||||
|
or ansible_distribution == "Fedora")
|
||||||
|
|
||||||
|
- name: Install ceph-commmon package
|
||||||
|
package:
|
||||||
|
name:
|
||||||
|
- ceph-common
|
||||||
|
state: present
|
||||||
|
when: rbd_provisioner_enabled | default(false)
|
||||||
|
|
||||||
|
- name: Ensure bash_completion.d folder exists
|
||||||
|
file:
|
||||||
|
name: /etc/bash_completion.d/
|
||||||
|
state: directory
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: 0755
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
---
|
||||||
|
# We keep these variables around to allow migration from package
|
||||||
|
# manager controlled installs to direct download ones.
|
||||||
|
containerd_package: 'containerd.io'
|
||||||
|
yum_repo_dir: /etc/yum.repos.d
|
||||||
|
|
||||||
|
# Keep minimal repo information around for cleanup
|
||||||
|
containerd_repo_info:
|
||||||
|
repos:
|
||||||
|
|
||||||
|
# Ubuntu docker-ce repo
|
||||||
|
containerd_ubuntu_repo_base_url: "https://download.docker.com/linux/ubuntu"
|
||||||
|
containerd_ubuntu_repo_component: "stable"
|
||||||
|
|
||||||
|
# Debian docker-ce repo
|
||||||
|
containerd_debian_repo_base_url: "https://download.docker.com/linux/debian"
|
||||||
|
containerd_debian_repo_component: "stable"
|
||||||
@@ -0,0 +1,2 @@
|
|||||||
|
---
|
||||||
|
allow_duplicates: true
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
---
|
||||||
|
- name: Containerd-common | check if fedora coreos
|
||||||
|
stat:
|
||||||
|
path: /run/ostree-booted
|
||||||
|
get_attributes: no
|
||||||
|
get_checksum: no
|
||||||
|
get_mime: no
|
||||||
|
register: ostree
|
||||||
|
|
||||||
|
- name: Containerd-common | set is_ostree
|
||||||
|
set_fact:
|
||||||
|
is_ostree: "{{ ostree.stat.exists }}"
|
||||||
|
|
||||||
|
- name: Containerd-common | gather os specific variables
|
||||||
|
include_vars: "{{ item }}"
|
||||||
|
with_first_found:
|
||||||
|
- files:
|
||||||
|
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower | replace('/', '_') }}.yml"
|
||||||
|
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_release | lower }}-{{ host_architecture }}.yml"
|
||||||
|
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_release | lower }}.yml"
|
||||||
|
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower | replace('/', '_') }}.yml"
|
||||||
|
- "{{ ansible_distribution | lower }}-{{ host_architecture }}.yml"
|
||||||
|
- "{{ ansible_distribution | lower }}.yml"
|
||||||
|
- "{{ ansible_os_family | lower }}-{{ host_architecture }}.yml"
|
||||||
|
- "{{ ansible_os_family | lower }}.yml"
|
||||||
|
- defaults.yml
|
||||||
|
paths:
|
||||||
|
- ../vars
|
||||||
|
skip: true
|
||||||
|
tags:
|
||||||
|
- facts
|
||||||
@@ -0,0 +1,2 @@
|
|||||||
|
---
|
||||||
|
containerd_package: containerd
|
||||||
@@ -0,0 +1,2 @@
|
|||||||
|
---
|
||||||
|
containerd_package: containerd
|
||||||
@@ -0,0 +1,111 @@
|
|||||||
|
---
|
||||||
|
containerd_storage_dir: "/var/lib/containerd"
|
||||||
|
containerd_state_dir: "/run/containerd"
|
||||||
|
containerd_systemd_dir: "/etc/systemd/system/containerd.service.d"
|
||||||
|
# The default value is not -999 here because containerd's oom_score_adj has been
|
||||||
|
# set to the -999 even if containerd_oom_score is 0.
|
||||||
|
# Ref: https://github.com/kubernetes-sigs/kubespray/pull/9275#issuecomment-1246499242
|
||||||
|
containerd_oom_score: 0
|
||||||
|
|
||||||
|
containerd_default_runtime: "runc"
|
||||||
|
containerd_snapshotter: "overlayfs"
|
||||||
|
|
||||||
|
containerd_runc_runtime:
|
||||||
|
name: runc
|
||||||
|
type: "io.containerd.runc.v2"
|
||||||
|
engine: ""
|
||||||
|
root: ""
|
||||||
|
base_runtime_spec: cri-base.json
|
||||||
|
options:
|
||||||
|
systemdCgroup: "{{ containerd_use_systemd_cgroup | ternary('true', 'false') }}"
|
||||||
|
binaryName: "{{ bin_dir }}/runc"
|
||||||
|
|
||||||
|
containerd_additional_runtimes: []
|
||||||
|
# Example for Kata Containers as additional runtime:
|
||||||
|
# - name: kata
|
||||||
|
# type: "io.containerd.kata.v2"
|
||||||
|
# engine: ""
|
||||||
|
# root: ""
|
||||||
|
|
||||||
|
containerd_base_runtime_spec_rlimit_nofile: 65535
|
||||||
|
|
||||||
|
containerd_default_base_runtime_spec_patch:
|
||||||
|
process:
|
||||||
|
rlimits:
|
||||||
|
- type: RLIMIT_NOFILE
|
||||||
|
hard: "{{ containerd_base_runtime_spec_rlimit_nofile }}"
|
||||||
|
soft: "{{ containerd_base_runtime_spec_rlimit_nofile }}"
|
||||||
|
|
||||||
|
# Can help reduce disk usage
|
||||||
|
# https://github.com/containerd/containerd/discussions/6295
|
||||||
|
containerd_discard_unpacked_layers: true
|
||||||
|
|
||||||
|
containerd_base_runtime_specs:
|
||||||
|
cri-base.json: "{{ containerd_default_base_runtime_spec | combine(containerd_default_base_runtime_spec_patch, recursive=1) }}"
|
||||||
|
|
||||||
|
containerd_grpc_max_recv_message_size: 16777216
|
||||||
|
containerd_grpc_max_send_message_size: 16777216
|
||||||
|
|
||||||
|
containerd_debug_level: "info"
|
||||||
|
|
||||||
|
containerd_metrics_address: ""
|
||||||
|
|
||||||
|
containerd_metrics_grpc_histogram: false
|
||||||
|
|
||||||
|
containerd_registries_mirrors:
|
||||||
|
- prefix: docker.io
|
||||||
|
mirrors:
|
||||||
|
- host: https://registry-1.docker.io
|
||||||
|
capabilities: ["pull", "resolve"]
|
||||||
|
skip_verify: false
|
||||||
|
|
||||||
|
containerd_max_container_log_line_size: -1
|
||||||
|
|
||||||
|
# If enabled it will allow non root users to use port numbers <1024
|
||||||
|
containerd_enable_unprivileged_ports: false
|
||||||
|
# If enabled it will allow non root users to use icmp sockets
|
||||||
|
containerd_enable_unprivileged_icmp: false
|
||||||
|
|
||||||
|
containerd_cfg_dir: /etc/containerd
|
||||||
|
|
||||||
|
# Extra config to be put in {{ containerd_cfg_dir }}/config.toml literally
|
||||||
|
containerd_extra_args: ''
|
||||||
|
|
||||||
|
# Configure registry auth (if applicable to secure/insecure registries)
|
||||||
|
containerd_registry_auth: []
|
||||||
|
# - registry: 10.0.0.2:5000
|
||||||
|
# username: user
|
||||||
|
# password: pass
|
||||||
|
|
||||||
|
# Configure containerd service
|
||||||
|
containerd_limit_proc_num: "infinity"
|
||||||
|
containerd_limit_core: "infinity"
|
||||||
|
containerd_limit_open_file_num: "infinity"
|
||||||
|
containerd_limit_mem_lock: "infinity"
|
||||||
|
|
||||||
|
# If enabled it will use config_path and config to be put in {{ containerd_cfg_dir }}/certs.d/
|
||||||
|
containerd_use_config_path: false
|
||||||
|
|
||||||
|
# OS distributions that already support containerd
|
||||||
|
containerd_supported_distributions:
|
||||||
|
- "CentOS"
|
||||||
|
- "OracleLinux"
|
||||||
|
- "RedHat"
|
||||||
|
- "Ubuntu"
|
||||||
|
- "Debian"
|
||||||
|
- "Fedora"
|
||||||
|
- "AlmaLinux"
|
||||||
|
- "Rocky"
|
||||||
|
- "Amazon"
|
||||||
|
- "Flatcar"
|
||||||
|
- "Flatcar Container Linux by Kinvolk"
|
||||||
|
- "Suse"
|
||||||
|
- "openSUSE Leap"
|
||||||
|
- "openSUSE Tumbleweed"
|
||||||
|
- "Kylin Linux Advanced Server"
|
||||||
|
- "UnionTech"
|
||||||
|
- "UniontechOS"
|
||||||
|
- "openEuler"
|
||||||
|
|
||||||
|
# Enable container device interface
|
||||||
|
enable_cdi: false
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
---
|
||||||
|
- name: Containerd | restart containerd
|
||||||
|
systemd:
|
||||||
|
name: containerd
|
||||||
|
state: restarted
|
||||||
|
enabled: yes
|
||||||
|
daemon-reload: yes
|
||||||
|
masked: no
|
||||||
|
listen: Restart containerd
|
||||||
|
|
||||||
|
- name: Containerd | wait for containerd
|
||||||
|
command: "{{ containerd_bin_dir }}/ctr images ls -q"
|
||||||
|
register: containerd_ready
|
||||||
|
retries: 8
|
||||||
|
delay: 4
|
||||||
|
until: containerd_ready.rc == 0
|
||||||
|
listen: Restart containerd
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
---
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
dependencies:
|
||||||
|
- role: container-engine/containerd-common
|
||||||
|
- role: container-engine/runc
|
||||||
|
- role: container-engine/crictl
|
||||||
|
- role: container-engine/nerdctl
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
---
|
||||||
|
- name: Converge
|
||||||
|
hosts: all
|
||||||
|
become: true
|
||||||
|
vars:
|
||||||
|
container_manager: containerd
|
||||||
|
roles:
|
||||||
|
- role: kubespray-defaults
|
||||||
|
- role: container-engine/containerd
|
||||||
@@ -0,0 +1,47 @@
|
|||||||
|
---
|
||||||
|
role_name_check: 1
|
||||||
|
driver:
|
||||||
|
name: vagrant
|
||||||
|
provider:
|
||||||
|
name: libvirt
|
||||||
|
platforms:
|
||||||
|
- name: ubuntu20
|
||||||
|
box: generic/ubuntu2004
|
||||||
|
cpus: 1
|
||||||
|
memory: 1024
|
||||||
|
groups:
|
||||||
|
- kube_control_plane
|
||||||
|
- kube_node
|
||||||
|
- k8s_cluster
|
||||||
|
provider_options:
|
||||||
|
driver: kvm
|
||||||
|
- name: debian11
|
||||||
|
box: generic/debian11
|
||||||
|
cpus: 1
|
||||||
|
memory: 1024
|
||||||
|
groups:
|
||||||
|
- kube_control_plane
|
||||||
|
- kube_node
|
||||||
|
- k8s_cluster
|
||||||
|
provider_options:
|
||||||
|
driver: kvm
|
||||||
|
- name: almalinux8
|
||||||
|
box: almalinux/8
|
||||||
|
cpus: 1
|
||||||
|
memory: 1024
|
||||||
|
groups:
|
||||||
|
- kube_control_plane
|
||||||
|
- kube_node
|
||||||
|
- k8s_cluster
|
||||||
|
provider_options:
|
||||||
|
driver: kvm
|
||||||
|
provisioner:
|
||||||
|
name: ansible
|
||||||
|
env:
|
||||||
|
ANSIBLE_ROLES_PATH: ../../../../
|
||||||
|
config_options:
|
||||||
|
defaults:
|
||||||
|
callbacks_enabled: profile_tasks
|
||||||
|
timeout: 120
|
||||||
|
verifier:
|
||||||
|
name: testinfra
|
||||||
@@ -0,0 +1,29 @@
|
|||||||
|
---
|
||||||
|
- name: Prepare
|
||||||
|
hosts: all
|
||||||
|
gather_facts: False
|
||||||
|
become: true
|
||||||
|
vars:
|
||||||
|
ignore_assert_errors: true
|
||||||
|
roles:
|
||||||
|
- role: kubespray-defaults
|
||||||
|
- role: bootstrap-os
|
||||||
|
- role: kubernetes/preinstall
|
||||||
|
- role: adduser
|
||||||
|
user: "{{ addusers.kube }}"
|
||||||
|
tasks:
|
||||||
|
- name: Download CNI
|
||||||
|
include_tasks: "../../../../download/tasks/download_file.yml"
|
||||||
|
vars:
|
||||||
|
download: "{{ download_defaults | combine(downloads.cni) }}"
|
||||||
|
|
||||||
|
- name: Prepare CNI
|
||||||
|
hosts: all
|
||||||
|
gather_facts: False
|
||||||
|
become: true
|
||||||
|
vars:
|
||||||
|
ignore_assert_errors: true
|
||||||
|
kube_network_plugin: cni
|
||||||
|
roles:
|
||||||
|
- role: kubespray-defaults
|
||||||
|
- role: network_plugin/cni
|
||||||
@@ -0,0 +1,55 @@
|
|||||||
|
import os
|
||||||
|
import pytest
|
||||||
|
|
||||||
|
import testinfra.utils.ansible_runner
|
||||||
|
|
||||||
|
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
|
||||||
|
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
|
||||||
|
|
||||||
|
|
||||||
|
def test_service(host):
|
||||||
|
svc = host.service("containerd")
|
||||||
|
assert svc.is_running
|
||||||
|
assert svc.is_enabled
|
||||||
|
|
||||||
|
|
||||||
|
def test_version(host):
|
||||||
|
crictl = "/usr/local/bin/crictl"
|
||||||
|
path = "unix:///var/run/containerd/containerd.sock"
|
||||||
|
with host.sudo():
|
||||||
|
cmd = host.command(crictl + " --runtime-endpoint " + path + " version")
|
||||||
|
assert cmd.rc == 0
|
||||||
|
assert "RuntimeName: containerd" in cmd.stdout
|
||||||
|
|
||||||
|
|
||||||
|
@pytest.mark.parametrize('image, dest', [
|
||||||
|
('quay.io/kubespray/hello-world:latest', '/tmp/hello-world.tar')
|
||||||
|
])
|
||||||
|
def test_image_pull_save_load(host, image, dest):
|
||||||
|
nerdctl = "/usr/local/bin/nerdctl"
|
||||||
|
dest_file = host.file(dest)
|
||||||
|
|
||||||
|
with host.sudo():
|
||||||
|
pull_cmd = host.command(nerdctl + " pull " + image)
|
||||||
|
assert pull_cmd.rc ==0
|
||||||
|
|
||||||
|
with host.sudo():
|
||||||
|
save_cmd = host.command(nerdctl + " save -o " + dest + " " + image)
|
||||||
|
assert save_cmd.rc == 0
|
||||||
|
assert dest_file.exists
|
||||||
|
|
||||||
|
with host.sudo():
|
||||||
|
load_cmd = host.command(nerdctl + " load < " + dest)
|
||||||
|
assert load_cmd.rc == 0
|
||||||
|
|
||||||
|
|
||||||
|
@pytest.mark.parametrize('image', [
|
||||||
|
('quay.io/kubespray/hello-world:latest')
|
||||||
|
])
|
||||||
|
def test_run(host, image):
|
||||||
|
nerdctl = "/usr/local/bin/nerdctl"
|
||||||
|
|
||||||
|
with host.sudo():
|
||||||
|
cmd = host.command(nerdctl + " -n k8s.io run " + image)
|
||||||
|
assert cmd.rc == 0
|
||||||
|
assert "Hello from Docker" in cmd.stdout
|
||||||
@@ -0,0 +1,143 @@
|
|||||||
|
---
|
||||||
|
- name: Fail containerd setup if distribution is not supported
|
||||||
|
fail:
|
||||||
|
msg: "{{ ansible_distribution }} is not supported by containerd."
|
||||||
|
when:
|
||||||
|
- not (allow_unsupported_distribution_setup | default(false)) and (ansible_distribution not in containerd_supported_distributions)
|
||||||
|
|
||||||
|
- name: Containerd | Remove any package manager controlled containerd package
|
||||||
|
package:
|
||||||
|
name: "{{ containerd_package }}"
|
||||||
|
state: absent
|
||||||
|
when:
|
||||||
|
- not (is_ostree or (ansible_distribution == "Flatcar Container Linux by Kinvolk") or (ansible_distribution == "Flatcar"))
|
||||||
|
|
||||||
|
- name: Containerd | Remove containerd repository
|
||||||
|
file:
|
||||||
|
path: "{{ yum_repo_dir }}/containerd.repo"
|
||||||
|
state: absent
|
||||||
|
when:
|
||||||
|
- ansible_os_family in ['RedHat']
|
||||||
|
|
||||||
|
- name: Containerd | Remove containerd repository
|
||||||
|
apt_repository:
|
||||||
|
repo: "{{ item }}"
|
||||||
|
state: absent
|
||||||
|
with_items: "{{ containerd_repo_info.repos }}"
|
||||||
|
when: ansible_pkg_mgr == 'apt'
|
||||||
|
|
||||||
|
- name: Containerd | Download containerd
|
||||||
|
include_tasks: "../../../download/tasks/download_file.yml"
|
||||||
|
vars:
|
||||||
|
download: "{{ download_defaults | combine(downloads.containerd) }}"
|
||||||
|
|
||||||
|
- name: Containerd | Unpack containerd archive
|
||||||
|
unarchive:
|
||||||
|
src: "{{ downloads.containerd.dest }}"
|
||||||
|
dest: "{{ containerd_bin_dir }}"
|
||||||
|
mode: 0755
|
||||||
|
remote_src: yes
|
||||||
|
extra_opts:
|
||||||
|
- --strip-components=1
|
||||||
|
notify: Restart containerd
|
||||||
|
|
||||||
|
- name: Containerd | Remove orphaned binary
|
||||||
|
file:
|
||||||
|
path: "/usr/bin/{{ item }}"
|
||||||
|
state: absent
|
||||||
|
when:
|
||||||
|
- containerd_bin_dir != "/usr/bin"
|
||||||
|
- not (is_ostree or (ansible_distribution == "Flatcar Container Linux by Kinvolk") or (ansible_distribution == "Flatcar"))
|
||||||
|
ignore_errors: true # noqa ignore-errors
|
||||||
|
with_items:
|
||||||
|
- containerd
|
||||||
|
- containerd-shim
|
||||||
|
- containerd-shim-runc-v1
|
||||||
|
- containerd-shim-runc-v2
|
||||||
|
- ctr
|
||||||
|
|
||||||
|
- name: Containerd | Generate systemd service for containerd
|
||||||
|
template:
|
||||||
|
src: containerd.service.j2
|
||||||
|
dest: /etc/systemd/system/containerd.service
|
||||||
|
mode: 0644
|
||||||
|
validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:containerd.service'"
|
||||||
|
# FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
|
||||||
|
# Remove once we drop support for systemd < 250
|
||||||
|
notify: Restart containerd
|
||||||
|
|
||||||
|
- name: Containerd | Ensure containerd directories exist
|
||||||
|
file:
|
||||||
|
dest: "{{ item }}"
|
||||||
|
state: directory
|
||||||
|
mode: 0755
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
with_items:
|
||||||
|
- "{{ containerd_systemd_dir }}"
|
||||||
|
- "{{ containerd_cfg_dir }}"
|
||||||
|
- "{{ containerd_storage_dir }}"
|
||||||
|
- "{{ containerd_state_dir }}"
|
||||||
|
|
||||||
|
- name: Containerd | Write containerd proxy drop-in
|
||||||
|
template:
|
||||||
|
src: http-proxy.conf.j2
|
||||||
|
dest: "{{ containerd_systemd_dir }}/http-proxy.conf"
|
||||||
|
mode: 0644
|
||||||
|
notify: Restart containerd
|
||||||
|
when: http_proxy is defined or https_proxy is defined
|
||||||
|
|
||||||
|
- name: Containerd | Generate default base_runtime_spec
|
||||||
|
register: ctr_oci_spec
|
||||||
|
command: "{{ containerd_bin_dir }}/ctr oci spec"
|
||||||
|
check_mode: false
|
||||||
|
changed_when: false
|
||||||
|
|
||||||
|
- name: Containerd | Store generated default base_runtime_spec
|
||||||
|
set_fact:
|
||||||
|
containerd_default_base_runtime_spec: "{{ ctr_oci_spec.stdout | from_json }}"
|
||||||
|
|
||||||
|
- name: Containerd | Write base_runtime_specs
|
||||||
|
copy:
|
||||||
|
content: "{{ item.value }}"
|
||||||
|
dest: "{{ containerd_cfg_dir }}/{{ item.key }}"
|
||||||
|
owner: "root"
|
||||||
|
mode: 0644
|
||||||
|
with_dict: "{{ containerd_base_runtime_specs | default({}) }}"
|
||||||
|
notify: Restart containerd
|
||||||
|
|
||||||
|
- name: Containerd | Copy containerd config file
|
||||||
|
template:
|
||||||
|
src: config.toml.j2
|
||||||
|
dest: "{{ containerd_cfg_dir }}/config.toml"
|
||||||
|
owner: "root"
|
||||||
|
mode: 0640
|
||||||
|
notify: Restart containerd
|
||||||
|
|
||||||
|
- name: Containerd | Configure containerd registries
|
||||||
|
when: containerd_registries_mirrors is defined
|
||||||
|
block:
|
||||||
|
- name: Containerd | Create registry directories
|
||||||
|
file:
|
||||||
|
path: "{{ containerd_cfg_dir }}/certs.d/{{ item.prefix }}"
|
||||||
|
state: directory
|
||||||
|
mode: 0755
|
||||||
|
loop: "{{ containerd_registries_mirrors }}"
|
||||||
|
- name: Containerd | Write hosts.toml file
|
||||||
|
template:
|
||||||
|
src: hosts.toml.j2
|
||||||
|
dest: "{{ containerd_cfg_dir }}/certs.d/{{ item.prefix }}/hosts.toml"
|
||||||
|
mode: 0640
|
||||||
|
loop: "{{ containerd_registries_mirrors }}"
|
||||||
|
|
||||||
|
# you can sometimes end up in a state where everything is installed
|
||||||
|
# but containerd was not started / enabled
|
||||||
|
- name: Containerd | Flush handlers
|
||||||
|
meta: flush_handlers
|
||||||
|
|
||||||
|
- name: Containerd | Ensure containerd is started and enabled
|
||||||
|
systemd:
|
||||||
|
name: containerd
|
||||||
|
daemon_reload: yes
|
||||||
|
enabled: yes
|
||||||
|
state: started
|
||||||
@@ -0,0 +1,40 @@
|
|||||||
|
---
|
||||||
|
- name: Containerd | Remove containerd repository for RedHat os family
|
||||||
|
file:
|
||||||
|
path: "{{ yum_repo_dir }}/containerd.repo"
|
||||||
|
state: absent
|
||||||
|
when:
|
||||||
|
- ansible_os_family in ['RedHat']
|
||||||
|
tags:
|
||||||
|
- reset_containerd
|
||||||
|
|
||||||
|
- name: Containerd | Remove containerd repository for Debian os family
|
||||||
|
apt_repository:
|
||||||
|
repo: "{{ item }}"
|
||||||
|
state: absent
|
||||||
|
with_items: "{{ containerd_repo_info.repos }}"
|
||||||
|
when: ansible_pkg_mgr == 'apt'
|
||||||
|
tags:
|
||||||
|
- reset_containerd
|
||||||
|
|
||||||
|
- name: Containerd | Stop containerd service
|
||||||
|
service:
|
||||||
|
name: containerd
|
||||||
|
daemon_reload: true
|
||||||
|
enabled: false
|
||||||
|
state: stopped
|
||||||
|
tags:
|
||||||
|
- reset_containerd
|
||||||
|
|
||||||
|
- name: Containerd | Remove configuration files
|
||||||
|
file:
|
||||||
|
path: "{{ item }}"
|
||||||
|
state: absent
|
||||||
|
loop:
|
||||||
|
- /etc/systemd/system/containerd.service
|
||||||
|
- "{{ containerd_systemd_dir }}"
|
||||||
|
- "{{ containerd_cfg_dir }}"
|
||||||
|
- "{{ containerd_storage_dir }}"
|
||||||
|
- "{{ containerd_state_dir }}"
|
||||||
|
tags:
|
||||||
|
- reset_containerd
|
||||||
@@ -0,0 +1,97 @@
|
|||||||
|
version = 2
|
||||||
|
root = "{{ containerd_storage_dir }}"
|
||||||
|
state = "{{ containerd_state_dir }}"
|
||||||
|
oom_score = {{ containerd_oom_score }}
|
||||||
|
|
||||||
|
[grpc]
|
||||||
|
max_recv_message_size = {{ containerd_grpc_max_recv_message_size }}
|
||||||
|
max_send_message_size = {{ containerd_grpc_max_send_message_size }}
|
||||||
|
|
||||||
|
[debug]
|
||||||
|
level = "{{ containerd_debug_level }}"
|
||||||
|
|
||||||
|
[metrics]
|
||||||
|
address = "{{ containerd_metrics_address }}"
|
||||||
|
grpc_histogram = {{ containerd_metrics_grpc_histogram | lower }}
|
||||||
|
|
||||||
|
[plugins]
|
||||||
|
[plugins."io.containerd.grpc.v1.cri"]
|
||||||
|
sandbox_image = "{{ pod_infra_image_repo }}:{{ pod_infra_image_tag }}"
|
||||||
|
max_container_log_line_size = {{ containerd_max_container_log_line_size }}
|
||||||
|
enable_unprivileged_ports = {{ containerd_enable_unprivileged_ports | lower }}
|
||||||
|
enable_unprivileged_icmp = {{ containerd_enable_unprivileged_icmp | lower }}
|
||||||
|
{% if enable_cdi %}
|
||||||
|
enable_cdi = true
|
||||||
|
cdi_spec_dirs = ["/etc/cdi", "/var/run/cdi"]
|
||||||
|
{% endif %}
|
||||||
|
[plugins."io.containerd.grpc.v1.cri".containerd]
|
||||||
|
default_runtime_name = "{{ containerd_default_runtime }}"
|
||||||
|
snapshotter = "{{ containerd_snapshotter }}"
|
||||||
|
discard_unpacked_layers = {{ containerd_discard_unpacked_layers | lower }}
|
||||||
|
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
|
||||||
|
{% for runtime in [containerd_runc_runtime] + containerd_additional_runtimes %}
|
||||||
|
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.{{ runtime.name }}]
|
||||||
|
runtime_type = "{{ runtime.type }}"
|
||||||
|
runtime_engine = "{{ runtime.engine }}"
|
||||||
|
runtime_root = "{{ runtime.root }}"
|
||||||
|
{% if runtime.base_runtime_spec is defined %}
|
||||||
|
base_runtime_spec = "{{ containerd_cfg_dir }}/{{ runtime.base_runtime_spec }}"
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.{{ runtime.name }}.options]
|
||||||
|
{% for key, value in runtime.options.items() %}
|
||||||
|
{% if value | string != "true" and value | string != "false" %}
|
||||||
|
{{ key }} = "{{ value }}"
|
||||||
|
{% else %}
|
||||||
|
{{ key }} = {{ value }}
|
||||||
|
{% endif %}
|
||||||
|
{% endfor %}
|
||||||
|
{% endfor %}
|
||||||
|
{% if kata_containers_enabled %}
|
||||||
|
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-qemu]
|
||||||
|
runtime_type = "io.containerd.kata-qemu.v2"
|
||||||
|
{% endif %}
|
||||||
|
{% if gvisor_enabled %}
|
||||||
|
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc]
|
||||||
|
runtime_type = "io.containerd.runsc.v1"
|
||||||
|
{% endif %}
|
||||||
|
[plugins."io.containerd.grpc.v1.cri".registry]
|
||||||
|
{% if containerd_use_config_path is defined and containerd_use_config_path|bool %}
|
||||||
|
config_path = "{{ containerd_cfg_dir }}/certs.d"
|
||||||
|
{% else %}
|
||||||
|
[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
|
||||||
|
{% set insecure_registries_addr = [] %}
|
||||||
|
{% for registry in containerd_registries_mirrors %}
|
||||||
|
[plugins."io.containerd.grpc.v1.cri".registry.mirrors."{{ registry.prefix }}"]
|
||||||
|
{% set endpoint = [] %}
|
||||||
|
{% for mirror in registry.mirrors %}
|
||||||
|
{% if endpoint.append(mirror.host) %}{% endif %}
|
||||||
|
{% if mirror.skip_verify is defined and mirror.skip_verify|bool %}{% if insecure_registries_addr.append(mirror.host | urlsplit('netloc')) %}{% endif %}{% endif %}
|
||||||
|
{% endfor %}
|
||||||
|
endpoint = ["{{ ( endpoint | unique ) | join('","') }}"]
|
||||||
|
{% endfor %}
|
||||||
|
{% for addr in insecure_registries_addr | unique %}
|
||||||
|
[plugins."io.containerd.grpc.v1.cri".registry.configs."{{ addr }}".tls]
|
||||||
|
insecure_skip_verify = true
|
||||||
|
{% endfor %}
|
||||||
|
{% endif %}
|
||||||
|
{% for registry in containerd_registry_auth if registry['registry'] is defined %}
|
||||||
|
{% if (registry['username'] is defined and registry['password'] is defined) or registry['auth'] is defined %}
|
||||||
|
[plugins."io.containerd.grpc.v1.cri".registry.configs."{{ registry['registry'] }}".auth]
|
||||||
|
{% if registry['username'] is defined and registry['password'] is defined %}
|
||||||
|
password = "{{ registry['password'] }}"
|
||||||
|
username = "{{ registry['username'] }}"
|
||||||
|
{% else %}
|
||||||
|
auth = "{{ registry['auth'] }}"
|
||||||
|
{% endif %}
|
||||||
|
{% endif %}
|
||||||
|
{% endfor %}
|
||||||
|
|
||||||
|
{% if nri_enabled and containerd_version is version('1.7.0', '>=') %}
|
||||||
|
[plugins."io.containerd.nri.v1.nri"]
|
||||||
|
disable = false
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
{% if containerd_extra_args is defined %}
|
||||||
|
{{ containerd_extra_args }}
|
||||||
|
{% endif %}
|
||||||
@@ -0,0 +1,45 @@
|
|||||||
|
# Copyright The containerd Authors.
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
[Unit]
|
||||||
|
Description=containerd container runtime
|
||||||
|
Documentation=https://containerd.io
|
||||||
|
After=network.target local-fs.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
ExecStartPre=-/sbin/modprobe overlay
|
||||||
|
ExecStart={{ containerd_bin_dir }}/containerd
|
||||||
|
|
||||||
|
Type=notify
|
||||||
|
Delegate=yes
|
||||||
|
KillMode=process
|
||||||
|
Restart=always
|
||||||
|
RestartSec=5
|
||||||
|
# Having non-zero Limit*s causes performance problems due to accounting overhead
|
||||||
|
# in the kernel. We recommend using cgroups to do container-local accounting.
|
||||||
|
LimitNPROC={{ containerd_limit_proc_num }}
|
||||||
|
LimitCORE={{ containerd_limit_core }}
|
||||||
|
LimitNOFILE={{ containerd_limit_open_file_num }}
|
||||||
|
LimitMEMLOCK={{ containerd_limit_mem_lock }}
|
||||||
|
# Comment TasksMax if your systemd version does not supports it.
|
||||||
|
# Only systemd 226 and above support this version.
|
||||||
|
TasksMax=infinity
|
||||||
|
OOMScoreAdjust=-999
|
||||||
|
# Set the cgroup slice of the service so that kube reserved takes effect
|
||||||
|
{% if kube_reserved is defined and kube_reserved|bool %}
|
||||||
|
Slice={{ kube_reserved_cgroups_for_service_slice }}
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
server = "https://{{ item.prefix }}"
|
||||||
|
{% for mirror in item.mirrors %}
|
||||||
|
[host."{{ mirror.host }}"]
|
||||||
|
capabilities = ["{{ ([ mirror.capabilities ] | flatten ) | join('","') }}"]
|
||||||
|
skip_verify = {{ mirror.skip_verify | default('false') | string | lower }}
|
||||||
|
override_path = {{ mirror.override_path | default('false') | string | lower }}
|
||||||
|
{% endfor %}
|
||||||
@@ -0,0 +1,2 @@
|
|||||||
|
[Service]
|
||||||
|
Environment={% if http_proxy is defined %}"HTTP_PROXY={{ http_proxy }}"{% endif %} {% if https_proxy is defined %}"HTTPS_PROXY={{ https_proxy }}"{% endif %} {% if no_proxy is defined %}"NO_PROXY={{ no_proxy }}"{% endif %}
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
containerd_repo_info:
|
||||||
|
repos:
|
||||||
|
- >
|
||||||
|
deb {{ containerd_debian_repo_base_url }}
|
||||||
|
{{ ansible_distribution_release | lower }}
|
||||||
|
{{ containerd_debian_repo_component }}
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
containerd_repo_info:
|
||||||
|
repos:
|
||||||
|
- >
|
||||||
|
deb {{ containerd_ubuntu_repo_base_url }}
|
||||||
|
{{ ansible_distribution_release | lower }}
|
||||||
|
{{ containerd_ubuntu_repo_component }}
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
---
|
||||||
|
- name: Cri-dockerd | reload systemd
|
||||||
|
systemd:
|
||||||
|
name: cri-dockerd
|
||||||
|
daemon_reload: true
|
||||||
|
masked: no
|
||||||
|
listen: Restart and enable cri-dockerd
|
||||||
|
|
||||||
|
- name: Cri-dockerd | restart docker.service
|
||||||
|
service:
|
||||||
|
name: docker.service
|
||||||
|
state: restarted
|
||||||
|
listen: Restart and enable cri-dockerd
|
||||||
|
|
||||||
|
- name: Cri-dockerd | reload cri-dockerd.socket
|
||||||
|
service:
|
||||||
|
name: cri-dockerd.socket
|
||||||
|
state: restarted
|
||||||
|
listen: Restart and enable cri-dockerd
|
||||||
|
|
||||||
|
- name: Cri-dockerd | reload cri-dockerd.service
|
||||||
|
service:
|
||||||
|
name: cri-dockerd.service
|
||||||
|
state: restarted
|
||||||
|
listen: Restart and enable cri-dockerd
|
||||||
|
|
||||||
|
- name: Cri-dockerd | enable cri-dockerd service
|
||||||
|
service:
|
||||||
|
name: cri-dockerd.service
|
||||||
|
enabled: yes
|
||||||
|
listen: Restart and enable cri-dockerd
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
---
|
||||||
|
dependencies:
|
||||||
|
- role: container-engine/docker
|
||||||
|
- role: container-engine/crictl
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
---
|
||||||
|
- name: Converge
|
||||||
|
hosts: all
|
||||||
|
become: true
|
||||||
|
vars:
|
||||||
|
container_manager: docker
|
||||||
|
roles:
|
||||||
|
- role: kubespray-defaults
|
||||||
|
- role: container-engine/cri-dockerd
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
{
|
||||||
|
"cniVersion": "0.2.0",
|
||||||
|
"name": "mynet",
|
||||||
|
"type": "bridge",
|
||||||
|
"bridge": "cni0",
|
||||||
|
"isGateway": true,
|
||||||
|
"ipMasq": true,
|
||||||
|
"ipam": {
|
||||||
|
"type": "host-local",
|
||||||
|
"subnet": "172.19.0.0/24",
|
||||||
|
"routes": [
|
||||||
|
{
|
||||||
|
"dst": "0.0.0.0/0"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
{
|
||||||
|
"metadata": {
|
||||||
|
"name": "cri-dockerd1"
|
||||||
|
},
|
||||||
|
"image": {
|
||||||
|
"image": "quay.io/kubespray/hello-world:latest"
|
||||||
|
},
|
||||||
|
"log_path": "cri-dockerd1.0.log",
|
||||||
|
"linux": {}
|
||||||
|
}
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
{
|
||||||
|
"metadata": {
|
||||||
|
"name": "cri-dockerd1",
|
||||||
|
"namespace": "default",
|
||||||
|
"attempt": 1,
|
||||||
|
"uid": "hdishd83djaidwnduwk28bcsb"
|
||||||
|
},
|
||||||
|
"linux": {},
|
||||||
|
"log_directory": "/tmp"
|
||||||
|
}
|
||||||
@@ -0,0 +1,39 @@
|
|||||||
|
---
|
||||||
|
role_name_check: 1
|
||||||
|
driver:
|
||||||
|
name: vagrant
|
||||||
|
provider:
|
||||||
|
name: libvirt
|
||||||
|
platforms:
|
||||||
|
- name: almalinux8
|
||||||
|
box: almalinux/8
|
||||||
|
cpus: 1
|
||||||
|
memory: 1024
|
||||||
|
nested: true
|
||||||
|
groups:
|
||||||
|
- kube_control_plane
|
||||||
|
provider_options:
|
||||||
|
driver: kvm
|
||||||
|
- name: ubuntu20
|
||||||
|
box: generic/ubuntu2004
|
||||||
|
cpus: 1
|
||||||
|
memory: 1024
|
||||||
|
nested: true
|
||||||
|
groups:
|
||||||
|
- kube_control_plane
|
||||||
|
provider_options:
|
||||||
|
driver: kvm
|
||||||
|
provisioner:
|
||||||
|
name: ansible
|
||||||
|
env:
|
||||||
|
ANSIBLE_ROLES_PATH: ../../../../
|
||||||
|
config_options:
|
||||||
|
defaults:
|
||||||
|
callbacks_enabled: profile_tasks
|
||||||
|
timeout: 120
|
||||||
|
inventory:
|
||||||
|
group_vars:
|
||||||
|
all:
|
||||||
|
become: true
|
||||||
|
verifier:
|
||||||
|
name: testinfra
|
||||||
@@ -0,0 +1,48 @@
|
|||||||
|
---
|
||||||
|
- name: Prepare
|
||||||
|
hosts: all
|
||||||
|
become: true
|
||||||
|
roles:
|
||||||
|
- role: kubespray-defaults
|
||||||
|
- role: bootstrap-os
|
||||||
|
- role: adduser
|
||||||
|
user: "{{ addusers.kube }}"
|
||||||
|
tasks:
|
||||||
|
- name: Download CNI
|
||||||
|
include_tasks: "../../../../download/tasks/download_file.yml"
|
||||||
|
vars:
|
||||||
|
download: "{{ download_defaults | combine(downloads.cni) }}"
|
||||||
|
|
||||||
|
- name: Prepare container runtime
|
||||||
|
hosts: all
|
||||||
|
become: true
|
||||||
|
vars:
|
||||||
|
container_manager: containerd
|
||||||
|
kube_network_plugin: cni
|
||||||
|
roles:
|
||||||
|
- role: kubespray-defaults
|
||||||
|
- role: network_plugin/cni
|
||||||
|
tasks:
|
||||||
|
- name: Copy test container files
|
||||||
|
copy:
|
||||||
|
src: "{{ item }}"
|
||||||
|
dest: "/tmp/{{ item }}"
|
||||||
|
owner: root
|
||||||
|
mode: 0644
|
||||||
|
with_items:
|
||||||
|
- container.json
|
||||||
|
- sandbox.json
|
||||||
|
- name: Create /etc/cni/net.d directory
|
||||||
|
file:
|
||||||
|
path: /etc/cni/net.d
|
||||||
|
state: directory
|
||||||
|
owner: "{{ kube_owner }}"
|
||||||
|
mode: 0755
|
||||||
|
- name: Setup CNI
|
||||||
|
copy:
|
||||||
|
src: "{{ item }}"
|
||||||
|
dest: "/etc/cni/net.d/{{ item }}"
|
||||||
|
owner: root
|
||||||
|
mode: 0644
|
||||||
|
with_items:
|
||||||
|
- 10-mynet.conf
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
import os
|
||||||
|
|
||||||
|
import testinfra.utils.ansible_runner
|
||||||
|
|
||||||
|
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
|
||||||
|
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
|
||||||
|
|
||||||
|
|
||||||
|
def test_run_pod(host):
|
||||||
|
run_command = "/usr/local/bin/crictl run --with-pull /tmp/container.json /tmp/sandbox.json"
|
||||||
|
with host.sudo():
|
||||||
|
cmd = host.command(run_command)
|
||||||
|
assert cmd.rc == 0
|
||||||
|
|
||||||
|
with host.sudo():
|
||||||
|
log_f = host.file("/tmp/cri-dockerd1.0.log")
|
||||||
|
|
||||||
|
assert log_f.exists
|
||||||
|
assert b"Hello from Docker" in log_f.content
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
---
|
||||||
|
- name: Runc | Download cri-dockerd binary
|
||||||
|
include_tasks: "../../../download/tasks/download_file.yml"
|
||||||
|
vars:
|
||||||
|
download: "{{ download_defaults | combine(downloads.cri_dockerd) }}"
|
||||||
|
|
||||||
|
- name: Copy cri-dockerd binary from download dir
|
||||||
|
copy:
|
||||||
|
src: "{{ local_release_dir }}/cri-dockerd"
|
||||||
|
dest: "{{ bin_dir }}/cri-dockerd"
|
||||||
|
mode: 0755
|
||||||
|
remote_src: true
|
||||||
|
notify:
|
||||||
|
- Restart and enable cri-dockerd
|
||||||
|
|
||||||
|
- name: Generate cri-dockerd systemd unit files
|
||||||
|
template:
|
||||||
|
src: "{{ item }}.j2"
|
||||||
|
dest: "/etc/systemd/system/{{ item }}"
|
||||||
|
mode: 0644
|
||||||
|
validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:{{ item }}'"
|
||||||
|
# FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
|
||||||
|
# Remove once we drop support for systemd < 250
|
||||||
|
with_items:
|
||||||
|
- cri-dockerd.service
|
||||||
|
- cri-dockerd.socket
|
||||||
|
notify:
|
||||||
|
- Restart and enable cri-dockerd
|
||||||
|
|
||||||
|
- name: Flush handlers
|
||||||
|
meta: flush_handlers
|
||||||
@@ -0,0 +1,44 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=CRI Interface for Docker Application Container Engine
|
||||||
|
Documentation=https://docs.mirantis.com
|
||||||
|
After=network-online.target firewalld.service docker.service
|
||||||
|
Wants=network-online.target docker.service
|
||||||
|
Requires=cri-dockerd.socket
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=notify
|
||||||
|
ExecStart={{ bin_dir }}/cri-dockerd --container-runtime-endpoint {{ cri_socket }} --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin --network-plugin=cni --pod-cidr={{ kube_pods_subnet }} --pod-infra-container-image={{ pod_infra_image_repo }}:{{ pod_infra_version }} {% if enable_dual_stack_networks %}--ipv6-dual-stack=True{% endif %}
|
||||||
|
|
||||||
|
ExecReload=/bin/kill -s HUP $MAINPID
|
||||||
|
TimeoutSec=0
|
||||||
|
RestartSec=2
|
||||||
|
Restart=always
|
||||||
|
|
||||||
|
# Note that StartLimit* options were moved from "Service" to "Unit" in systemd 229.
|
||||||
|
# Both the old, and new location are accepted by systemd 229 and up, so using the old location
|
||||||
|
# to make them work for either version of systemd.
|
||||||
|
StartLimitBurst=3
|
||||||
|
|
||||||
|
# Note that StartLimitInterval was renamed to StartLimitIntervalSec in systemd 230.
|
||||||
|
# Both the old, and new name are accepted by systemd 230 and up, so using the old name to make
|
||||||
|
# this option work for either version of systemd.
|
||||||
|
StartLimitInterval=60s
|
||||||
|
|
||||||
|
# Having non-zero Limit*s causes performance problems due to accounting overhead
|
||||||
|
# in the kernel. We recommend using cgroups to do container-local accounting.
|
||||||
|
LimitNOFILE=infinity
|
||||||
|
LimitNPROC=infinity
|
||||||
|
LimitCORE=infinity
|
||||||
|
|
||||||
|
# Comment TasksMax if your systemd version does not support it.
|
||||||
|
# Only systemd 226 and above support this option.
|
||||||
|
TasksMax=infinity
|
||||||
|
Delegate=yes
|
||||||
|
KillMode=process
|
||||||
|
# Set the cgroup slice of the service so that kube reserved takes effect
|
||||||
|
{% if kube_reserved is defined and kube_reserved|bool %}
|
||||||
|
Slice={{ kube_reserved_cgroups_for_service_slice }}
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=CRI Docker Socket for the API
|
||||||
|
PartOf=cri-dockerd.service
|
||||||
|
|
||||||
|
[Socket]
|
||||||
|
ListenStream=%t/cri-dockerd.sock
|
||||||
|
SocketMode=0660
|
||||||
|
SocketUser=root
|
||||||
|
SocketGroup=docker
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=sockets.target
|
||||||
@@ -0,0 +1,91 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
crio_cgroup_manager: "{{ kubelet_cgroup_driver | default('systemd') }}"
|
||||||
|
crio_conmon: "{{ bin_dir }}/conmon"
|
||||||
|
crio_enable_metrics: false
|
||||||
|
crio_log_level: "info"
|
||||||
|
crio_metrics_port: "9090"
|
||||||
|
crio_pause_image: "{{ pod_infra_image_repo }}:{{ pod_infra_version }}"
|
||||||
|
|
||||||
|
# Registries defined within cri-o.
|
||||||
|
# By default unqualified images are not allowed for security reasons
|
||||||
|
crio_registries: []
|
||||||
|
# - prefix: docker.io
|
||||||
|
# insecure: false
|
||||||
|
# blocked: false
|
||||||
|
# location: registry-1.docker.io ## REQUIRED
|
||||||
|
# unqualified: false
|
||||||
|
# mirrors:
|
||||||
|
# - location: 172.20.100.52:5000
|
||||||
|
# insecure: true
|
||||||
|
# - location: mirror.gcr.io
|
||||||
|
# insecure: false
|
||||||
|
|
||||||
|
crio_registry_auth: []
|
||||||
|
# - registry: 10.0.0.2:5000
|
||||||
|
# username: user
|
||||||
|
# password: pass
|
||||||
|
|
||||||
|
crio_seccomp_profile: ""
|
||||||
|
crio_selinux: "{{ (preinstall_selinux_state == 'enforcing') | lower }}"
|
||||||
|
crio_signature_policy: "{% if ansible_os_family == 'ClearLinux' %}/usr/share/defaults/crio/policy.json{% endif %}"
|
||||||
|
|
||||||
|
# Override system default for storage driver
|
||||||
|
# crio_storage_driver: "overlay"
|
||||||
|
|
||||||
|
crio_stream_port: "10010"
|
||||||
|
|
||||||
|
crio_required_version: "{{ kube_version | regex_replace('^v(?P<major>\\d+).(?P<minor>\\d+).(?P<patch>\\d+)$', '\\g<major>.\\g<minor>') }}"
|
||||||
|
|
||||||
|
# The crio_runtimes variable defines a list of OCI compatible runtimes.
|
||||||
|
crio_runtimes:
|
||||||
|
- name: runc
|
||||||
|
path: "{{ bin_dir }}/runc"
|
||||||
|
type: oci
|
||||||
|
root: /run/runc
|
||||||
|
|
||||||
|
# Kata Containers is an OCI runtime, where containers are run inside lightweight
|
||||||
|
# VMs. Kata provides additional isolation towards the host, minimizing the host attack
|
||||||
|
# surface and mitigating the consequences of containers breakout.
|
||||||
|
kata_runtimes:
|
||||||
|
# Kata Containers with the default configured VMM
|
||||||
|
- name: kata-qemu
|
||||||
|
path: /usr/local/bin/containerd-shim-kata-qemu-v2
|
||||||
|
type: vm
|
||||||
|
root: /run/kata-containers
|
||||||
|
privileged_without_host_devices: true
|
||||||
|
|
||||||
|
# crun is a fast and low-memory footprint OCI Container Runtime fully written in C.
|
||||||
|
crun_runtime:
|
||||||
|
name: crun
|
||||||
|
path: "{{ bin_dir }}/crun"
|
||||||
|
type: oci
|
||||||
|
root: /run/crun
|
||||||
|
|
||||||
|
# youki is an implementation of the OCI runtime-spec in Rust, similar to runc.
|
||||||
|
youki_runtime:
|
||||||
|
name: youki
|
||||||
|
path: "{{ youki_bin_dir }}/youki"
|
||||||
|
type: oci
|
||||||
|
root: /run/youki
|
||||||
|
|
||||||
|
# Reserve 16M uids and gids for user namespaces (256 pods * 65536 uids/gids)
|
||||||
|
# at the end of the uid/gid space
|
||||||
|
crio_remap_enable: false
|
||||||
|
crio_remap_user: containers
|
||||||
|
crio_subuid_start: 2130706432
|
||||||
|
crio_subuid_length: 16777216
|
||||||
|
crio_subgid_start: 2130706432
|
||||||
|
crio_subgid_length: 16777216
|
||||||
|
|
||||||
|
# cri-o manual files
|
||||||
|
crio_man_files:
|
||||||
|
5:
|
||||||
|
- crio.conf
|
||||||
|
- crio.conf.d
|
||||||
|
8:
|
||||||
|
- crio
|
||||||
|
- crio-status
|
||||||
|
|
||||||
|
# If set to true, it will enable the CRIU support in cri-o
|
||||||
|
crio_criu_support_enabled: false
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
/usr/share/rhel/secrets:/run/secrets
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
---
|
||||||
|
- name: CRI-O | reload systemd
|
||||||
|
systemd:
|
||||||
|
daemon_reload: true
|
||||||
|
listen: Restart crio
|
||||||
|
|
||||||
|
- name: CRI-O | reload crio
|
||||||
|
service:
|
||||||
|
name: crio
|
||||||
|
state: restarted
|
||||||
|
enabled: yes
|
||||||
|
listen: Restart crio
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
---
|
||||||
|
dependencies:
|
||||||
|
- role: container-engine/runc
|
||||||
|
- role: container-engine/crictl
|
||||||
|
- role: container-engine/skopeo
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
---
|
||||||
|
- name: Converge
|
||||||
|
hosts: all
|
||||||
|
become: true
|
||||||
|
vars:
|
||||||
|
container_manager: crio
|
||||||
|
roles:
|
||||||
|
- role: kubespray-defaults
|
||||||
|
- role: container-engine/cri-o
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
{
|
||||||
|
"cniVersion": "0.2.0",
|
||||||
|
"name": "mynet",
|
||||||
|
"type": "bridge",
|
||||||
|
"bridge": "cni0",
|
||||||
|
"isGateway": true,
|
||||||
|
"ipMasq": true,
|
||||||
|
"ipam": {
|
||||||
|
"type": "host-local",
|
||||||
|
"subnet": "172.19.0.0/24",
|
||||||
|
"routes": [
|
||||||
|
{
|
||||||
|
"dst": "0.0.0.0/0"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
{
|
||||||
|
"metadata": {
|
||||||
|
"name": "runc1"
|
||||||
|
},
|
||||||
|
"image": {
|
||||||
|
"image": "quay.io/kubespray/hello-world:latest"
|
||||||
|
},
|
||||||
|
"log_path": "runc1.0.log",
|
||||||
|
"linux": {}
|
||||||
|
}
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
{
|
||||||
|
"metadata": {
|
||||||
|
"name": "runc1",
|
||||||
|
"namespace": "default",
|
||||||
|
"attempt": 1,
|
||||||
|
"uid": "hdishd83djaidwnduwk28bcsb"
|
||||||
|
},
|
||||||
|
"linux": {},
|
||||||
|
"log_directory": "/tmp"
|
||||||
|
}
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user