diff --git a/internal/config/orchestrator.go b/internal/config/orchestrator.go index 07e499f..5d7272d 100644 --- a/internal/config/orchestrator.go +++ b/internal/config/orchestrator.go @@ -35,6 +35,16 @@ type Orchestrator struct { Plugin string `yaml:"plugin" env-default:"calico"` ServiceAddresses string `yaml:"service_addresses" env-default:"10.233.0.0/18"` PodsSubnet string `yaml:"pods_subnet" env-default:"10.233.64.0/18"` + Calico struct { + EnableBpf bool `yaml:"enable_bpf"` + } `yaml:"calico"` + Cilium struct { + EnableBpf bool `yaml:"enable_bpf"` + Hubble struct { + Install bool `yaml:"install"` + EnableMetrics bool `yaml:"enable_metrics"` + } `yaml:"hubble"` + } `yaml:"cilium"` } `yaml:"network"` RegistryMirrors []RegistryMirror `yaml:"registry_mirrors"` } diff --git a/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml.tmpl b/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml.tmpl new file mode 100644 index 0000000..fdb5d4b --- /dev/null +++ b/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml.tmpl @@ -0,0 +1,131 @@ +--- +# see roles/network_plugin/calico/defaults/main.yml + +# the default value of name +calico_cni_name: k8s-pod-network + +## With calico it is possible to distributed routes with border routers of the datacenter. +## Warning : enabling router peering will disable calico's default behavior ('node mesh'). +## The subnets of each nodes will be distributed by the datacenter router +# peer_with_router: false + +# Enables Internet connectivity from containers +# nat_outgoing: true + +# Enables Calico CNI "host-local" IPAM plugin +# calico_ipam_host_local: true + +# add default ippool name +# calico_pool_name: "default-pool" + +# add default ippool blockSize (defaults kube_network_node_prefix) +calico_pool_blocksize: 26 + +# add default ippool CIDR (must be inside kube_pods_subnet, defaults to kube_pods_subnet otherwise) +# calico_pool_cidr: 1.2.3.4/5 + +# add default ippool CIDR to CNI config +# calico_cni_pool: true + +# Add default IPV6 IPPool CIDR. Must be inside kube_pods_subnet_ipv6. Defaults to kube_pods_subnet_ipv6 if not set. +# calico_pool_cidr_ipv6: fd85:ee78:d8a6:8607::1:0000/112 + +# Add default IPV6 IPPool CIDR to CNI config +# calico_cni_pool_ipv6: true + +# Global as_num (/calico/bgp/v1/global/as_num) +# global_as_num: "64512" + +# If doing peering with node-assigned asn where the globas does not match your nodes, you want this +# to be true. All other cases, false. +# calico_no_global_as_num: false + +# You can set MTU value here. If left undefined or empty, it will +# not be specified in calico CNI config, so Calico will use built-in +# defaults. The value should be a number, not a string. +# calico_mtu: 1500 + +# Configure the MTU to use for workload interfaces and tunnels. +# - If Wireguard is enabled, subtract 60 from your network MTU (i.e 1500-60=1440) +# - Otherwise, if VXLAN or BPF mode is enabled, subtract 50 from your network MTU (i.e. 1500-50=1450) +# - Otherwise, if IPIP is enabled, subtract 20 from your network MTU (i.e. 1500-20=1480) +# - Otherwise, if not using any encapsulation, set to your network MTU (i.e. 1500) +# calico_veth_mtu: 1440 + +# Advertise Cluster IPs +# calico_advertise_cluster_ips: true + +# Advertise Service External IPs +# calico_advertise_service_external_ips: +# - x.x.x.x/24 +# - y.y.y.y/32 + +# Advertise Service LoadBalancer IPs +# calico_advertise_service_loadbalancer_ips: +# - x.x.x.x/24 +# - y.y.y.y/16 + +# Choose data store type for calico: "etcd" or "kdd" (kubernetes datastore) +# calico_datastore: "kdd" + +# Choose Calico iptables backend: "Legacy", "Auto" or "NFT" +# calico_iptables_backend: "Auto" + +# Use typha (only with kdd) +# typha_enabled: false + +# Generate TLS certs for secure typha<->calico-node communication +# typha_secure: false + +# Scaling typha: 1 replica per 100 nodes is adequate +# Number of typha replicas +# typha_replicas: 1 + +# Set max typha connections +# typha_max_connections_lower_limit: 300 + +# Set calico network backend: "bird", "vxlan" or "none" +# bird enable BGP routing, required for ipip and no encapsulation modes +# calico_network_backend: vxlan + +# IP in IP and VXLAN is mutualy exclusive modes. +# set IP in IP encapsulation mode: "Always", "CrossSubnet", "Never" +# calico_ipip_mode: 'Never' + +# set VXLAN encapsulation mode: "Always", "CrossSubnet", "Never" +# calico_vxlan_mode: 'Always' + +# set VXLAN port and VNI +# calico_vxlan_vni: 4096 +# calico_vxlan_port: 4789 + +# Enable eBPF mode +calico_bpf_enabled: {{ .Orchestrator.Network.Calico.EnableBpf }} + +# If you want to use non default IP_AUTODETECTION_METHOD, IP6_AUTODETECTION_METHOD for calico node set this option to one of: +# * can-reach=DESTINATION +# * interface=INTERFACE-REGEX +# see https://docs.projectcalico.org/reference/node/configuration +# calico_ip_auto_method: "interface=eth.*" +# calico_ip6_auto_method: "interface=eth.*" + +# Set FELIX_MTUIFACEPATTERN, Pattern used to discover the host’s interface for MTU auto-detection. +# see https://projectcalico.docs.tigera.io/reference/felix/configuration +# calico_felix_mtu_iface_pattern: "^((en|wl|ww|sl|ib)[opsx].*|(eth|wlan|wwan).*)" + +# Choose the iptables insert mode for Calico: "Insert" or "Append". +# calico_felix_chaininsertmode: Insert + +# If you want use the default route interface when you use multiple interface with dynamique route (iproute2) +# see https://docs.projectcalico.org/reference/node/configuration : FELIX_DEVICEROUTESOURCEADDRESS +# calico_use_default_route_src_ipaddr: false + +# Enable calico traffic encryption with wireguard +# calico_wireguard_enabled: false + +# Under certain situations liveness and readiness probes may need tunning +# calico_node_livenessprobe_timeout: 10 +# calico_node_readinessprobe_timeout: 10 + +# Calico apiserver (only with kdd) +# calico_apiserver_enabled: false diff --git a/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml.tmpl b/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml.tmpl new file mode 100644 index 0000000..23d0b1c --- /dev/null +++ b/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml.tmpl @@ -0,0 +1,245 @@ +--- +# cilium_version: "v1.12.1" + +# Log-level +# cilium_debug: false + +# cilium_mtu: "" +# cilium_enable_ipv4: true +# cilium_enable_ipv6: false + +# Cilium agent health port +# cilium_agent_health_port: "9879" + +# Identity allocation mode selects how identities are shared between cilium +# nodes by setting how they are stored. The options are "crd" or "kvstore". +# - "crd" stores identities in kubernetes as CRDs (custom resource definition). +# These can be queried with: +# `kubectl get ciliumid` +# - "kvstore" stores identities in an etcd kvstore. +# - In order to support External Workloads, "crd" is required +# - Ref: https://docs.cilium.io/en/stable/gettingstarted/external-workloads/#setting-up-support-for-external-workloads-beta +# - KVStore operations are only required when cilium-operator is running with any of the below options: +# - --synchronize-k8s-services +# - --synchronize-k8s-nodes +# - --identity-allocation-mode=kvstore +# - Ref: https://docs.cilium.io/en/stable/internals/cilium_operator/#kvstore-operations +# cilium_identity_allocation_mode: kvstore + +# Etcd SSL dirs +# cilium_cert_dir: /etc/cilium/certs +# kube_etcd_cacert_file: ca.pem +# kube_etcd_cert_file: cert.pem +# kube_etcd_key_file: cert-key.pem + +# Limits for apps +# cilium_memory_limit: 500M +# cilium_cpu_limit: 500m +# cilium_memory_requests: 64M +# cilium_cpu_requests: 100m + +# Overlay Network Mode +# cilium_tunnel_mode: vxlan +# Optional features +# cilium_enable_prometheus: false +# Enable if you want to make use of hostPort mappings +# cilium_enable_portmap: false +# Monitor aggregation level (none/low/medium/maximum) +# cilium_monitor_aggregation: medium +# The monitor aggregation flags determine which TCP flags which, upon the +# first observation, cause monitor notifications to be generated. +# +# Only effective when monitor aggregation is set to "medium" or higher. +# cilium_monitor_aggregation_flags: "all" +# Kube Proxy Replacement mode (strict/partial) +# cilium_kube_proxy_replacement: partial + +# If upgrading from Cilium < 1.5, you may want to override some of these options +# to prevent service disruptions. See also: +# http://docs.cilium.io/en/stable/install/upgrade/#changes-that-may-require-action +# cilium_preallocate_bpf_maps: false + +# `cilium_tofqdns_enable_poller` is deprecated in 1.8, removed in 1.9 +# cilium_tofqdns_enable_poller: false + +# `cilium_enable_legacy_services` is deprecated in 1.6, removed in 1.9 +# cilium_enable_legacy_services: false + +# Unique ID of the cluster. Must be unique across all conneted clusters and +# in the range of 1 and 255. Only relevant when building a mesh of clusters. +# This value is not defined by default +# cilium_cluster_id: + +# Deploy cilium even if kube_network_plugin is not cilium. +# This enables to deploy cilium alongside another CNI to replace kube-proxy. +# cilium_deploy_additionally: false + +# Auto direct nodes routes can be used to advertise pods routes in your cluster +# without any tunelling (with `cilium_tunnel_mode` sets to `disabled`). +# This works only if you have a L2 connectivity between all your nodes. +# You wil also have to specify the variable `cilium_native_routing_cidr` to +# make this work. Please refer to the cilium documentation for more +# information about this kind of setups. +# cilium_auto_direct_node_routes: false + +# Allows to explicitly specify the IPv4 CIDR for native routing. +# When specified, Cilium assumes networking for this CIDR is preconfigured and +# hands traffic destined for that range to the Linux network stack without +# applying any SNAT. +# Generally speaking, specifying a native routing CIDR implies that Cilium can +# depend on the underlying networking stack to route packets to their +# destination. To offer a concrete example, if Cilium is configured to use +# direct routing and the Kubernetes CIDR is included in the native routing CIDR, +# the user must configure the routes to reach pods, either manually or by +# setting the auto-direct-node-routes flag. +# cilium_native_routing_cidr: "" + +# Allows to explicitly specify the IPv6 CIDR for native routing. +# cilium_native_routing_cidr_ipv6: "" + +# Enable transparent network encryption. +# cilium_encryption_enabled: false + +# Encryption method. Can be either ipsec or wireguard. +# Only effective when `cilium_encryption_enabled` is set to true. +# cilium_encryption_type: "ipsec" + +# Enable encryption for pure node to node traffic. +# This option is only effective when `cilium_encryption_type` is set to `ipsec`. +# cilium_ipsec_node_encryption: false + +# If your kernel or distribution does not support WireGuard, Cilium agent can be configured to fall back on the user-space implementation. +# When this flag is enabled and Cilium detects that the kernel has no native support for WireGuard, +# it will fallback on the wireguard-go user-space implementation of WireGuard. +# This option is only effective when `cilium_encryption_type` is set to `wireguard`. +# cilium_wireguard_userspace_fallback: false + +# IP Masquerade Agent +# https://docs.cilium.io/en/stable/concepts/networking/masquerading/ +# By default, all packets from a pod destined to an IP address outside of the cilium_native_routing_cidr range are masqueraded +# cilium_ip_masq_agent_enable: false + +### A packet sent from a pod to a destination which belongs to any CIDR from the nonMasqueradeCIDRs is not going to be masqueraded +# cilium_non_masquerade_cidrs: +# - 10.0.0.0/8 +# - 172.16.0.0/12 +# - 192.168.0.0/16 +# - 100.64.0.0/10 +# - 192.0.0.0/24 +# - 192.0.2.0/24 +# - 192.88.99.0/24 +# - 198.18.0.0/15 +# - 198.51.100.0/24 +# - 203.0.113.0/24 +# - 240.0.0.0/4 +### Indicates whether to masquerade traffic to the link local prefix. +### If the masqLinkLocal is not set or set to false, then 169.254.0.0/16 is appended to the non-masquerade CIDRs list. +# cilium_masq_link_local: false +### A time interval at which the agent attempts to reload config from disk +# cilium_ip_masq_resync_interval: 60s + +# Hubble +### Enable Hubble without install +# cilium_enable_hubble: false +### Enable Hubble Metrics +cilium_enable_hubble_metrics: {{ .Orchestrator.Network.Cilium.Hubble.EnableMetrics }} +### if cilium_enable_hubble_metrics: true +# cilium_hubble_metrics: +# - dns +# - drop +# - tcp +# - flow +# - icmp +# - http +### Enable Hubble install +cilium_hubble_install: {{ .Orchestrator.Network.Cilium.Hubble.Install }} +### Enable auto generate certs if cilium_hubble_install: true +cilium_hubble_tls_generate: true + +# IP address management mode for v1.9+. +# https://docs.cilium.io/en/v1.9/concepts/networking/ipam/ +# cilium_ipam_mode: kubernetes + +# Extra arguments for the Cilium agent +# cilium_agent_custom_args: [] + +# For adding and mounting extra volumes to the cilium agent +# cilium_agent_extra_volumes: [] +# cilium_agent_extra_volume_mounts: [] + +# cilium_agent_extra_env_vars: [] + +# cilium_operator_replicas: 2 + +# The address at which the cillium operator bind health check api +# cilium_operator_api_serve_addr: "127.0.0.1:9234" + +## A dictionary of extra config variables to add to cilium-config, formatted like: +## cilium_config_extra_vars: +## var1: "value1" +## var2: "value2" +# cilium_config_extra_vars: {} + +# For adding and mounting extra volumes to the cilium operator +# cilium_operator_extra_volumes: [] +# cilium_operator_extra_volume_mounts: [] + +# Extra arguments for the Cilium Operator +# cilium_operator_custom_args: [] + +# Name of the cluster. Only relevant when building a mesh of clusters. +# cilium_cluster_name: default + +# Make Cilium take ownership over the `/etc/cni/net.d` directory on the node, renaming all non-Cilium CNI configurations to `*.cilium_bak`. +# This ensures no Pods can be scheduled using other CNI plugins during Cilium agent downtime. +# Available for Cilium v1.10 and up. +# cilium_cni_exclusive: true + +# Configure the log file for CNI logging with retention policy of 7 days. +# Disable CNI file logging by setting this field to empty explicitly. +# Available for Cilium v1.12 and up. +# cilium_cni_log_file: "/var/run/cilium/cilium-cni.log" + +# -- Configure cgroup related configuration +# -- Enable auto mount of cgroup2 filesystem. +# When `cilium_cgroup_auto_mount` is enabled, cgroup2 filesystem is mounted at +# `cilium_cgroup_host_root` path on the underlying host and inside the cilium agent pod. +# If users disable `cilium_cgroup_auto_mount`, it's expected that users have mounted +# cgroup2 filesystem at the specified `cilium_cgroup_auto_mount` volume, and then the +# volume will be mounted inside the cilium agent pod at the same path. +# Available for Cilium v1.11 and up +# cilium_cgroup_auto_mount: true +# -- Configure cgroup root where cgroup2 filesystem is mounted on the host +# cilium_cgroup_host_root: "/run/cilium/cgroupv2" + +# Specifies the ratio (0.0-1.0) of total system memory to use for dynamic +# sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps. +# cilium_bpf_map_dynamic_size_ratio: "0.0" + +# -- Enables masquerading of IPv4 traffic leaving the node from endpoints. +# Available for Cilium v1.10 and up +# cilium_enable_ipv4_masquerade: true +# -- Enables masquerading of IPv6 traffic leaving the node from endpoints. +# Available for Cilium v1.10 and up +# cilium_enable_ipv6_masquerade: true + +# -- Enable native IP masquerade support in eBPF +cilium_enable_bpf_masquerade: {{ .Orchestrator.Network.Cilium.EnableBpf }} + +# -- Configure whether direct routing mode should route traffic via +# host stack (true) or directly and more efficiently out of BPF (false) if +# the kernel supports it. The latter has the implication that it will also +# bypass netfilter in the host namespace. +# cilium_enable_host_legacy_routing: true + +# -- Enable use of the remote node identity. +# ref: https://docs.cilium.io/en/v1.7/install/upgrade/#configmap-remote-node-identity +# cilium_enable_remote_node_identity: true + +# -- Enable the use of well-known identities. +# cilium_enable_well_known_identities: false + +# cilium_enable_bpf_clock_probe: true + +# -- Whether to enable CNP status updates. +# cilium_disable_cnp_status_updates: true diff --git a/internal/templates/kubespray.go b/internal/templates/kubespray.go index f7464f4..0904afb 100644 --- a/internal/templates/kubespray.go +++ b/internal/templates/kubespray.go @@ -5,6 +5,8 @@ var K8S_TEMPLATES = [...][2]string{ {"templates/kubespray/inventory/group_vars/all.yml.tmpl", "kubespray/inventory/group_vars/all.yml"}, {"templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/addons.yml"}, {"templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml"}, + {"templates/kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml"}, + {"templates/kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml"}, {"templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl", "kubespray/inventory/group_vars/all/containerd.yml"}, } diff --git a/kubespray/inventory/group_vars/all.yml b/kubespray/inventory/group_vars/all.yml index 6162050..34998b0 100644 --- a/kubespray/inventory/group_vars/all.yml +++ b/kubespray/inventory/group_vars/all.yml @@ -130,4 +130,4 @@ unsafe_show_logs: false allow_unsupported_distribution_setup: false ## Kubelet additional settings -kubelet_custom_flags: "--root-dir=/var/lib/kubelet" +kubelet_custom_flags: "--root-dir=/app/k8s/kubelet" diff --git a/kubespray/inventory/group_vars/all/containerd.yml b/kubespray/inventory/group_vars/all/containerd.yml index 1d3f5c3..dce8fae 100644 --- a/kubespray/inventory/group_vars/all/containerd.yml +++ b/kubespray/inventory/group_vars/all/containerd.yml @@ -1,8 +1,8 @@ --- # Please see roles/container-engine/containerd/defaults/main.yml for more configuration options -containerd_storage_dir: /var/lib/containerd -containerd_state_dir: /run/containerd +containerd_storage_dir: /app/containerd +containerd_state_dir: /app/containerd-state # containerd_oom_score: 0 diff --git a/kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml b/kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml index cc0499d..542c617 100644 --- a/kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml +++ b/kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml @@ -100,7 +100,7 @@ calico_pool_blocksize: 26 # calico_vxlan_port: 4789 # Enable eBPF mode -# calico_bpf_enabled: false +calico_bpf_enabled: false # If you want to use non default IP_AUTODETECTION_METHOD, IP6_AUTODETECTION_METHOD for calico node set this option to one of: # * can-reach=DESTINATION diff --git a/kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml b/kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml index 9023e09..fc3cf51 100644 --- a/kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml +++ b/kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml @@ -142,19 +142,19 @@ ### Enable Hubble without install # cilium_enable_hubble: false ### Enable Hubble Metrics -# cilium_enable_hubble_metrics: false +cilium_enable_hubble_metrics: false ### if cilium_enable_hubble_metrics: true -# cilium_hubble_metrics: {} -# - dns -# - drop -# - tcp -# - flow -# - icmp -# - http +# cilium_hubble_metrics: +# - dns +# - drop +# - tcp +# - flow +# - icmp +# - http ### Enable Hubble install -# cilium_hubble_install: false +cilium_hubble_install: false ### Enable auto generate certs if cilium_hubble_install: true -# cilium_hubble_tls_generate: false +cilium_hubble_tls_generate: true # IP address management mode for v1.9+. # https://docs.cilium.io/en/v1.9/concepts/networking/ipam/ @@ -224,7 +224,7 @@ # cilium_enable_ipv6_masquerade: true # -- Enable native IP masquerade support in eBPF -# cilium_enable_bpf_masquerade: false +cilium_enable_bpf_masquerade: false # -- Configure whether direct routing mode should route traffic via # host stack (true) or directly and more efficiently out of BPF (false) if diff --git a/kubespray/inventory/hosts b/kubespray/inventory/hosts index 041622a..236f44b 100644 --- a/kubespray/inventory/hosts +++ b/kubespray/inventory/hosts @@ -1,17 +1,31 @@ -t1-disk-lt-k8s-test-master-01 ansible_host=10.100.20.49 ip=10.100.20.49 -t1-disk-lt-k8s-test-slave-01 ansible_host=10.100.20.48 ip=10.100.20.48 -t1-disk-lt-k8s-test-slave-02 ansible_host=10.100.20.47 ip=10.100.20.47 +t1-disk-lt-k8s-master-01 ansible_host=10.100.20.43 ip=10.100.20.43 +t1-disk-lt-k8s-master-02 ansible_host=10.100.20.38 ip=10.100.20.38 +t1-disk-lt-k8s-master-03 ansible_host=10.100.20.42 ip=10.100.20.42 +t1-disk-lt-k8s-slave-01 ansible_host=10.100.20.40 ip=10.100.20.40 +t1-disk-lt-k8s-slave-02 ansible_host=10.100.20.41 ip=10.100.20.41 +t1-disk-lt-k8s-slave-03 ansible_host=10.100.20.39 ip=10.100.20.39 +t1-disk-lt-k8s-slave-04 ansible_host=10.100.20.45 ip=10.100.20.45 +t1-disk-lt-k8s-slave-05 ansible_host=10.100.20.44 ip=10.100.20.44 +t1-disk-lt-k8s-slave-06 ansible_host=10.100.20.50 ip=10.100.20.50 [kube_control_plane] -t1-disk-lt-k8s-test-master-01 +t1-disk-lt-k8s-master-01 +t1-disk-lt-k8s-master-02 +t1-disk-lt-k8s-master-03 [etcd] -t1-disk-lt-k8s-test-master-01 +t1-disk-lt-k8s-master-01 +t1-disk-lt-k8s-master-02 +t1-disk-lt-k8s-master-03 [kube_node] -t1-disk-lt-k8s-test-slave-01 -t1-disk-lt-k8s-test-slave-02 +t1-disk-lt-k8s-slave-01 +t1-disk-lt-k8s-slave-02 +t1-disk-lt-k8s-slave-03 +t1-disk-lt-k8s-slave-04 +t1-disk-lt-k8s-slave-05 +t1-disk-lt-k8s-slave-06 [k8s_cluster:children] kube_control_plane diff --git a/kubespray/project/roles/download/tasks/main.yml b/kubespray/project/roles/download/tasks/main.yml index fe83e6c..3309ab8 100644 --- a/kubespray/project/roles/download/tasks/main.yml +++ b/kubespray/project/roles/download/tasks/main.yml @@ -2,7 +2,7 @@ - name: Download | Prepare working directories and variables import_tasks: prep_download.yml when: - - not skip_downloads + - not skip_downloads | default(false) tags: - download - upload @@ -10,7 +10,7 @@ - name: Download | Get kubeadm binary and list of required images include_tasks: prep_kubeadm_images.yml when: - - not skip_downloads + - not skip_downloads | default(false) - inventory_hostname in groups['kube_control_plane'] tags: - download @@ -22,44 +22,8 @@ vars: download: "{{ download_defaults | combine(item.value) }}" include_file: "download_{% if download.container %}container{% else %}file{% endif %}.yml" - kubeadm_images: "{{ skip_kubeadm_images | ternary({}, _kubeadm_images) }}" - # The trick (converting list of tuples to list of dicts) below come from - # https://docs.ansible.com/ansible/latest/collections/community/general/dict_filter.html#examples - _kubeadm_images: "{{ dict(names | map('regex_replace', '^(.*)', 'kubeadm_\\1') | - zip( repos | zip(_tags, _groups) | - map('zip', keys) | map('map', 'reverse') | map('community.general.dict') | - map('combine', defaults))) | - dict2items | rejectattr('key', 'in', excluded) | items2dict }}" - keys: - - repo - - tag - - groups - images: "{{ kubeadm_images_raw.stdout_lines | map('split', ':') }}" - _tags: "{{ images | map(attribute=1) }}" - repos: "{{ images | map(attribute=0) }}" - names: "{{ repos | map('split', '/') | map(attribute=-1) }}" - _groups: "{{ names | map('extract', images_groups) }}" - defaults: - enabled: true - container: true - excluded: - - kubeadm_coredns - - kubeadm_pause - images_groups: - coredns: [] - pause: [] - kube-proxy: - - k8s_cluster - etcd: - - etcd - kube-scheduler: - - kube_control_plane - kube-controller-manager: - - kube_control_plane - kube-apiserver: - - kube_control_plane when: - - not skip_downloads + - not skip_downloads | default(false) - download.enabled - item.value.enabled - (not (item.value.container | default(false))) or (item.value.container and download_container) diff --git a/kubespray/project/roles/download/tasks/prep_kubeadm_images.yml b/kubespray/project/roles/download/tasks/prep_kubeadm_images.yml index 67ac2f7..fdfed1d 100644 --- a/kubespray/project/roles/download/tasks/prep_kubeadm_images.yml +++ b/kubespray/project/roles/download/tasks/prep_kubeadm_images.yml @@ -20,7 +20,7 @@ dest: "{{ kube_config_dir }}/kubeadm-images.yaml" mode: 0644 when: - - not skip_kubeadm_images + - not skip_kubeadm_images | default(false) - name: Prep_kubeadm_images | Copy kubeadm binary from download dir to system path copy: @@ -36,9 +36,36 @@ state: file - name: Prep_kubeadm_images | Generate list of required images - command: "{{ bin_dir }}/kubeadm config images list --config={{ kube_config_dir }}/kubeadm-images.yaml" + shell: "set -o pipefail && {{ bin_dir }}/kubeadm config images list --config={{ kube_config_dir }}/kubeadm-images.yaml | grep -Ev 'coredns|pause'" + args: + executable: /bin/bash register: kubeadm_images_raw run_once: true changed_when: false when: - - not skip_kubeadm_images + - not skip_kubeadm_images | default(false) + +- name: Prep_kubeadm_images | Parse list of images + vars: + kubeadm_images_list: "{{ kubeadm_images_raw.stdout_lines }}" + set_fact: + kubeadm_image: + key: "kubeadm_{{ (item | regex_replace('^(?:.*\\/)*', '')).split(':')[0] }}" + value: + enabled: true + container: true + repo: "{{ item | regex_replace('^(.*):.*$', '\\1') }}" + tag: "{{ item | regex_replace('^.*:(.*)$', '\\1') }}" + groups: k8s_cluster + loop: "{{ kubeadm_images_list | flatten(levels=1) }}" + register: kubeadm_images_cooked + run_once: true + when: + - not skip_kubeadm_images | default(false) + +- name: Prep_kubeadm_images | Convert list of images to dict for later use + set_fact: + kubeadm_images: "{{ kubeadm_images_cooked.results | map(attribute='ansible_facts.kubeadm_image') | list | items2dict }}" + run_once: true + when: + - not skip_kubeadm_images | default(false)