actualized for kubespray version 2.28.0
This commit is contained in:
@@ -1,15 +1,16 @@
|
||||
---
|
||||
# advertised host IP for kubelet. This affects network plugin config. Take caution
|
||||
kubelet_address: "{{ ip | default(fallback_ips[inventory_hostname]) }}{{ (',' + ip6) if enable_dual_stack_networks and ip6 is defined else '' }}"
|
||||
# add ipv6 manual for dualstack mode because ipv4 priority in main_ip for dualstack
|
||||
kubelet_address: "{{ main_ips | join(',') }}"
|
||||
|
||||
# bind address for kubelet. Set to 0.0.0.0 to listen on all interfaces
|
||||
kubelet_bind_address: "{{ ip | default('0.0.0.0') }}"
|
||||
# bind address for kubelet. Set to :: to listen on all interfaces
|
||||
kubelet_bind_address: "{{ main_ip | default('::') }}"
|
||||
|
||||
# resolv.conf to base dns config
|
||||
kube_resolv_conf: "/etc/resolv.conf"
|
||||
|
||||
# Set to empty to avoid cgroup creation
|
||||
kubelet_enforce_node_allocatable: '""'
|
||||
kubelet_enforce_node_allocatable: "\"\""
|
||||
|
||||
# Set runtime and kubelet cgroups when using systemd as cgroup driver (default)
|
||||
kube_service_cgroups: "{% if kube_reserved %}{{ kube_reserved_cgroups_for_service_slice }}{% else %}system.slice{% endif %}"
|
||||
@@ -27,39 +28,30 @@ kubelet_systemd_hardening: false
|
||||
kubelet_systemd_wants_dependencies: []
|
||||
|
||||
# List of secure IPs for kubelet
|
||||
# don't forget ipv6 addresses for dualstack(because "main_ip" prioritizes ipv4)
|
||||
kube_node_addresses: >-
|
||||
{%- for host in (groups['kube_control_plane'] + groups['kube_node'] + groups['etcd']) | unique -%}
|
||||
{{ hostvars[host]['ip'] | default(fallback_ips[host]) }}{{ ' ' if not loop.last else '' }}
|
||||
{%- for host in (groups['k8s_cluster'] | union(groups['etcd'])) -%}
|
||||
{{ hostvars[host]['main_ips'] | join(' ') }}{{ ' ' if not loop.last else '' }}
|
||||
{%- endfor -%}
|
||||
kubelet_secure_addresses: "localhost link-local {{ kube_pods_subnet }} {{ kube_node_addresses }}"
|
||||
kubelet_secure_addresses: "localhost link-local {{ kube_pods_subnets | regex_replace(',', ' ') }} {{ kube_node_addresses }}"
|
||||
|
||||
# Reserve this space for kube resources
|
||||
# Whether to run kubelet and container-engine daemons in a dedicated cgroup. (Not required for resource reservations).
|
||||
kube_reserved: false
|
||||
kube_reserved_cgroups_for_service_slice: kube.slice
|
||||
kube_reserved_cgroups: "/{{ kube_reserved_cgroups_for_service_slice }}"
|
||||
kube_memory_reserved: 256Mi
|
||||
kube_cpu_reserved: 100m
|
||||
# kube_ephemeral_storage_reserved: 2Gi
|
||||
# kube_pid_reserved: "1000"
|
||||
# Reservation for master hosts
|
||||
kube_master_memory_reserved: 512Mi
|
||||
kube_master_cpu_reserved: 200m
|
||||
# kube_master_ephemeral_storage_reserved: 2Gi
|
||||
# kube_master_pid_reserved: "1000"
|
||||
kube_memory_reserved: "256Mi"
|
||||
kube_cpu_reserved: "100m"
|
||||
kube_ephemeral_storage_reserved: "500Mi"
|
||||
kube_pid_reserved: "1000"
|
||||
|
||||
# Set to true to reserve resources for system daemons
|
||||
system_reserved: false
|
||||
system_reserved_cgroups_for_service_slice: system.slice
|
||||
system_reserved_cgroups: "/{{ system_reserved_cgroups_for_service_slice }}"
|
||||
system_memory_reserved: 512Mi
|
||||
system_cpu_reserved: 500m
|
||||
# system_ephemeral_storage_reserved: 2Gi
|
||||
# system_pid_reserved: "1000"
|
||||
# Reservation for master hosts
|
||||
system_master_memory_reserved: 256Mi
|
||||
system_master_cpu_reserved: 250m
|
||||
# system_master_ephemeral_storage_reserved: 2Gi
|
||||
# system_master_pid_reserved: "1000"
|
||||
system_memory_reserved: "512Mi"
|
||||
system_cpu_reserved: "500m"
|
||||
system_ephemeral_storage_reserved: "500Mi"
|
||||
system_pid_reserved: 1000
|
||||
|
||||
## Eviction Thresholds to avoid system OOMs
|
||||
# https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#eviction-thresholds
|
||||
@@ -69,7 +61,7 @@ eviction_hard_control_plane: {}
|
||||
kubelet_status_update_frequency: 10s
|
||||
|
||||
# kube-vip
|
||||
kube_vip_version: v0.8.0
|
||||
kube_vip_version: 0.8.0
|
||||
|
||||
kube_vip_arp_enabled: false
|
||||
kube_vip_interface:
|
||||
@@ -91,7 +83,6 @@ kube_vip_bgppeers:
|
||||
kube_vip_address:
|
||||
kube_vip_enableServicesElection: false
|
||||
kube_vip_lb_enable: false
|
||||
kube_vip_lb_fwdmethod: local
|
||||
kube_vip_leasename: plndr-cp-lock
|
||||
kube_vip_svc_leasename: plndr-svcs-lock
|
||||
kube_vip_leaseduration: 5
|
||||
@@ -135,9 +126,6 @@ kubelet_config_extra_args_cgroupfs:
|
||||
systemCgroups: /system.slice
|
||||
cgroupRoot: /
|
||||
|
||||
## Support parameters to be passed to kubelet via kubelet-config.yaml only on nodes, not masters
|
||||
kubelet_node_config_extra_args: {}
|
||||
|
||||
# Maximum number of container log files that can be present for a container.
|
||||
kubelet_logfiles_max_nr: 5
|
||||
|
||||
@@ -147,16 +135,6 @@ kubelet_logfiles_max_size: 10Mi
|
||||
## Support custom flags to be passed to kubelet
|
||||
kubelet_custom_flags: []
|
||||
|
||||
## Support custom flags to be passed to kubelet only on nodes, not masters
|
||||
kubelet_node_custom_flags: []
|
||||
|
||||
# If non-empty, will use this string as identification instead of the actual hostname
|
||||
kube_override_hostname: >-
|
||||
{%- if cloud_provider is defined and cloud_provider in ['aws'] -%}
|
||||
{%- else -%}
|
||||
{{ inventory_hostname }}
|
||||
{%- endif -%}
|
||||
|
||||
# The read-only port for the Kubelet to serve on with no authentication/authorization.
|
||||
kube_read_only_port: 0
|
||||
|
||||
@@ -169,61 +147,6 @@ kubelet_healthz_bind_address: 127.0.0.1
|
||||
# sysctl_file_path to add sysctl conf to
|
||||
sysctl_file_path: "/etc/sysctl.d/99-sysctl.conf"
|
||||
|
||||
# For the openstack integration kubelet will need credentials to access
|
||||
# openstack apis like nova and cinder. Per default this values will be
|
||||
# read from the environment.
|
||||
openstack_auth_url: "{{ lookup('env', 'OS_AUTH_URL') }}"
|
||||
openstack_username: "{{ lookup('env', 'OS_USERNAME') }}"
|
||||
openstack_password: "{{ lookup('env', 'OS_PASSWORD') }}"
|
||||
openstack_region: "{{ lookup('env', 'OS_REGION_NAME') }}"
|
||||
openstack_tenant_id: "{{ lookup('env', 'OS_TENANT_ID') | default(lookup('env', 'OS_PROJECT_ID') | default(lookup('env', 'OS_PROJECT_NAME'), true), true) }}"
|
||||
openstack_tenant_name: "{{ lookup('env', 'OS_TENANT_NAME') }}"
|
||||
openstack_domain_name: "{{ lookup('env', 'OS_USER_DOMAIN_NAME') }}"
|
||||
openstack_domain_id: "{{ lookup('env', 'OS_USER_DOMAIN_ID') }}"
|
||||
|
||||
# For the vsphere integration, kubelet will need credentials to access
|
||||
# vsphere apis
|
||||
# Documentation regarding these values can be found
|
||||
# https://github.com/kubernetes/kubernetes/blob/master/pkg/cloudprovider/providers/vsphere/vsphere.go#L105
|
||||
vsphere_vcenter_ip: "{{ lookup('env', 'VSPHERE_VCENTER') }}"
|
||||
vsphere_vcenter_port: "{{ lookup('env', 'VSPHERE_VCENTER_PORT') }}"
|
||||
vsphere_user: "{{ lookup('env', 'VSPHERE_USER') }}"
|
||||
vsphere_password: "{{ lookup('env', 'VSPHERE_PASSWORD') }}"
|
||||
vsphere_datacenter: "{{ lookup('env', 'VSPHERE_DATACENTER') }}"
|
||||
vsphere_datastore: "{{ lookup('env', 'VSPHERE_DATASTORE') }}"
|
||||
vsphere_working_dir: "{{ lookup('env', 'VSPHERE_WORKING_DIR') }}"
|
||||
vsphere_insecure: "{{ lookup('env', 'VSPHERE_INSECURE') }}"
|
||||
vsphere_resource_pool: "{{ lookup('env', 'VSPHERE_RESOURCE_POOL') }}"
|
||||
|
||||
vsphere_scsi_controller_type: pvscsi
|
||||
# vsphere_public_network is name of the network the VMs are joined to
|
||||
vsphere_public_network: "{{ lookup('env', 'VSPHERE_PUBLIC_NETWORK') | default('') }}"
|
||||
|
||||
## When azure is used, you need to also set the following variables.
|
||||
## see docs/azure.md for details on how to get these values
|
||||
# azure_tenant_id:
|
||||
# azure_subscription_id:
|
||||
# azure_aad_client_id:
|
||||
# azure_aad_client_secret:
|
||||
# azure_resource_group:
|
||||
# azure_location:
|
||||
# azure_subnet_name:
|
||||
# azure_security_group_name:
|
||||
# azure_vnet_name:
|
||||
# azure_route_table_name:
|
||||
# supported values are 'standard' or 'vmss'
|
||||
# azure_vmtype: standard
|
||||
# Sku of Load Balancer and Public IP. Candidate values are: basic and standard.
|
||||
azure_loadbalancer_sku: basic
|
||||
# excludes master nodes from standard load balancer.
|
||||
azure_exclude_master_from_standard_lb: true
|
||||
# disables the outbound SNAT for public load balancer rules
|
||||
azure_disable_outbound_snat: false
|
||||
# use instance metadata service where possible
|
||||
azure_use_instance_metadata: true
|
||||
# use specific Azure API endpoints
|
||||
azure_cloud: AzurePublicCloud
|
||||
|
||||
## Support tls min version, Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
|
||||
# tls_min_version: ""
|
||||
|
||||
@@ -265,9 +188,10 @@ conntrack_modules:
|
||||
- nf_conntrack
|
||||
- nf_conntrack_ipv4
|
||||
|
||||
|
||||
## Enable distributed tracing for kubelet
|
||||
kubelet_tracing: false
|
||||
kubelet_tracing_endpoint: 0.0.0.0:4317
|
||||
kubelet_tracing_endpoint: "[::]:4317"
|
||||
kubelet_tracing_sampling_rate_per_million: 100
|
||||
|
||||
# The maximum number of image pulls in parallel. Set it to a integer great than 1 to enable image pulling in parallel.
|
||||
|
||||
@@ -1,82 +0,0 @@
|
||||
---
|
||||
- name: Check azure_tenant_id value
|
||||
fail:
|
||||
msg: "azure_tenant_id is missing"
|
||||
when: azure_tenant_id is not defined or not azure_tenant_id
|
||||
|
||||
- name: Check azure_subscription_id value
|
||||
fail:
|
||||
msg: "azure_subscription_id is missing"
|
||||
when: azure_subscription_id is not defined or not azure_subscription_id
|
||||
|
||||
- name: Check azure_aad_client_id value
|
||||
fail:
|
||||
msg: "azure_aad_client_id is missing"
|
||||
when: azure_aad_client_id is not defined or not azure_aad_client_id
|
||||
|
||||
- name: Check azure_aad_client_secret value
|
||||
fail:
|
||||
msg: "azure_aad_client_secret is missing"
|
||||
when: azure_aad_client_secret is not defined or not azure_aad_client_secret
|
||||
|
||||
- name: Check azure_resource_group value
|
||||
fail:
|
||||
msg: "azure_resource_group is missing"
|
||||
when: azure_resource_group is not defined or not azure_resource_group
|
||||
|
||||
- name: Check azure_location value
|
||||
fail:
|
||||
msg: "azure_location is missing"
|
||||
when: azure_location is not defined or not azure_location
|
||||
|
||||
- name: Check azure_subnet_name value
|
||||
fail:
|
||||
msg: "azure_subnet_name is missing"
|
||||
when: azure_subnet_name is not defined or not azure_subnet_name
|
||||
|
||||
- name: Check azure_security_group_name value
|
||||
fail:
|
||||
msg: "azure_security_group_name is missing"
|
||||
when: azure_security_group_name is not defined or not azure_security_group_name
|
||||
|
||||
- name: Check azure_vnet_name value
|
||||
fail:
|
||||
msg: "azure_vnet_name is missing"
|
||||
when: azure_vnet_name is not defined or not azure_vnet_name
|
||||
|
||||
- name: Check azure_vnet_resource_group value
|
||||
fail:
|
||||
msg: "azure_vnet_resource_group is missing"
|
||||
when: azure_vnet_resource_group is not defined or not azure_vnet_resource_group
|
||||
|
||||
- name: Check azure_route_table_name value
|
||||
fail:
|
||||
msg: "azure_route_table_name is missing"
|
||||
when: azure_route_table_name is not defined or not azure_route_table_name
|
||||
|
||||
- name: Check azure_loadbalancer_sku value
|
||||
fail:
|
||||
msg: "azure_loadbalancer_sku has an invalid value '{{ azure_loadbalancer_sku }}'. Supported values are 'basic', 'standard'"
|
||||
when: azure_loadbalancer_sku not in ["basic", "standard"]
|
||||
|
||||
- name: "Check azure_exclude_master_from_standard_lb is a bool"
|
||||
assert:
|
||||
that: azure_exclude_master_from_standard_lb | type_debug == 'bool'
|
||||
|
||||
- name: "Check azure_disable_outbound_snat is a bool"
|
||||
assert:
|
||||
that: azure_disable_outbound_snat | type_debug == 'bool'
|
||||
|
||||
- name: "Check azure_use_instance_metadata is a bool"
|
||||
assert:
|
||||
that: azure_use_instance_metadata | type_debug == 'bool'
|
||||
|
||||
- name: Check azure_vmtype value
|
||||
fail:
|
||||
msg: "azure_vmtype is missing. Supported values are 'standard' or 'vmss'"
|
||||
when: azure_vmtype is not defined or not azure_vmtype
|
||||
|
||||
- name: Check azure_cloud value
|
||||
fail:
|
||||
msg: "azure_cloud has an invalid value '{{ azure_cloud }}'. Supported values are 'AzureChinaCloud', 'AzureGermanCloud', 'AzurePublicCloud', 'AzureUSGovernmentCloud'."
|
||||
when: azure_cloud not in ["AzureChinaCloud", "AzureGermanCloud", "AzurePublicCloud", "AzureUSGovernmentCloud"]
|
||||
@@ -1,34 +0,0 @@
|
||||
---
|
||||
- name: Check openstack_auth_url value
|
||||
fail:
|
||||
msg: "openstack_auth_url is missing"
|
||||
when: openstack_auth_url is not defined or not openstack_auth_url
|
||||
|
||||
- name: Check openstack_username value
|
||||
fail:
|
||||
msg: "openstack_username is missing"
|
||||
when: openstack_username is not defined or not openstack_username
|
||||
|
||||
- name: Check openstack_password value
|
||||
fail:
|
||||
msg: "openstack_password is missing"
|
||||
when: openstack_password is not defined or not openstack_password
|
||||
|
||||
- name: Check openstack_region value
|
||||
fail:
|
||||
msg: "openstack_region is missing"
|
||||
when: openstack_region is not defined or not openstack_region
|
||||
|
||||
- name: Check openstack_tenant_id value
|
||||
fail:
|
||||
msg: "one of openstack_tenant_id or openstack_trust_id must be specified"
|
||||
when:
|
||||
- openstack_tenant_id is not defined or not openstack_tenant_id
|
||||
- openstack_trust_id is not defined
|
||||
|
||||
- name: Check openstack_trust_id value
|
||||
fail:
|
||||
msg: "one of openstack_tenant_id or openstack_trust_id must be specified"
|
||||
when:
|
||||
- openstack_trust_id is not defined or not openstack_trust_id
|
||||
- openstack_tenant_id is not defined
|
||||
@@ -1,22 +0,0 @@
|
||||
---
|
||||
- name: Check vsphere environment variables
|
||||
fail:
|
||||
msg: "{{ item.name }} is missing"
|
||||
when: item.value is not defined or not item.value
|
||||
with_items:
|
||||
- name: vsphere_vcenter_ip
|
||||
value: "{{ vsphere_vcenter_ip }}"
|
||||
- name: vsphere_vcenter_port
|
||||
value: "{{ vsphere_vcenter_port }}"
|
||||
- name: vsphere_user
|
||||
value: "{{ vsphere_user }}"
|
||||
- name: vsphere_password
|
||||
value: "{{ vsphere_password }}"
|
||||
- name: vsphere_datacenter
|
||||
value: "{{ vsphere_datacenter }}"
|
||||
- name: vsphere_datastore
|
||||
value: "{{ vsphere_datastore }}"
|
||||
- name: vsphere_working_dir
|
||||
value: "{{ vsphere_working_dir }}"
|
||||
- name: vsphere_insecure
|
||||
value: "{{ vsphere_insecure }}"
|
||||
@@ -8,7 +8,7 @@
|
||||
tags:
|
||||
- kubeadm
|
||||
when:
|
||||
- not inventory_hostname in groups['kube_control_plane']
|
||||
- not ('kube_control_plane' in group_names)
|
||||
|
||||
- name: Install | Copy kubelet binary from download dir
|
||||
copy:
|
||||
|
||||
@@ -5,11 +5,6 @@
|
||||
- facts
|
||||
- kubelet
|
||||
|
||||
- name: Pre-upgrade kubelet
|
||||
import_tasks: pre_upgrade.yml
|
||||
tags:
|
||||
- kubelet
|
||||
|
||||
- name: Ensure /var/lib/cni exists
|
||||
file:
|
||||
path: /var/lib/cni
|
||||
@@ -24,7 +19,7 @@
|
||||
- name: Install kube-vip
|
||||
import_tasks: loadbalancer/kube-vip.yml
|
||||
when:
|
||||
- is_kube_master
|
||||
- ('kube_control_plane' in group_names)
|
||||
- kube_vip_enabled
|
||||
tags:
|
||||
- kube-vip
|
||||
@@ -32,7 +27,7 @@
|
||||
- name: Install nginx-proxy
|
||||
import_tasks: loadbalancer/nginx-proxy.yml
|
||||
when:
|
||||
- not is_kube_master or kube_apiserver_bind_address != '0.0.0.0'
|
||||
- ('kube_control_plane' not in group_names) or (kube_apiserver_bind_address != '::')
|
||||
- loadbalancer_apiserver_localhost
|
||||
- loadbalancer_apiserver_type == 'nginx'
|
||||
tags:
|
||||
@@ -41,7 +36,7 @@
|
||||
- name: Install haproxy
|
||||
import_tasks: loadbalancer/haproxy.yml
|
||||
when:
|
||||
- not is_kube_master or kube_apiserver_bind_address != '0.0.0.0'
|
||||
- ('kube_control_plane' not in group_names) or (kube_apiserver_bind_address != '::')
|
||||
- loadbalancer_apiserver_localhost
|
||||
- loadbalancer_apiserver_type == 'haproxy'
|
||||
tags:
|
||||
@@ -137,52 +132,14 @@
|
||||
tags:
|
||||
- kube-proxy
|
||||
|
||||
- name: Check cloud provider credentials
|
||||
include_tasks: "cloud-credentials/{{ cloud_provider }}-credential-check.yml"
|
||||
when:
|
||||
- cloud_provider is defined
|
||||
- cloud_provider in [ 'openstack', 'azure', 'vsphere' ]
|
||||
- name: Modprobe Kernel Module for nftables
|
||||
community.general.modprobe:
|
||||
name: "nf_tables"
|
||||
state: present
|
||||
persistent: present
|
||||
when: kube_proxy_mode == 'nftables'
|
||||
tags:
|
||||
- cloud-provider
|
||||
- facts
|
||||
|
||||
- name: Test if openstack_cacert is a base64 string
|
||||
set_fact:
|
||||
openstack_cacert_is_base64: "{% if openstack_cacert is search('^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{3}= | [A-Za-z0-9+/]{2}==)?$') %}true{% else %}false{% endif %}"
|
||||
when:
|
||||
- cloud_provider is defined
|
||||
- cloud_provider == 'openstack'
|
||||
- openstack_cacert is defined
|
||||
- openstack_cacert | length > 0
|
||||
|
||||
|
||||
- name: Write cacert file
|
||||
copy:
|
||||
src: "{{ openstack_cacert if not openstack_cacert_is_base64 else omit }}"
|
||||
content: "{{ openstack_cacert | b64decode if openstack_cacert_is_base64 else omit }}"
|
||||
dest: "{{ kube_config_dir }}/openstack-cacert.pem"
|
||||
group: "{{ kube_cert_group }}"
|
||||
mode: "0640"
|
||||
when:
|
||||
- cloud_provider is defined
|
||||
- cloud_provider == 'openstack'
|
||||
- openstack_cacert is defined
|
||||
- openstack_cacert | length > 0
|
||||
tags:
|
||||
- cloud-provider
|
||||
|
||||
- name: Write cloud-config
|
||||
template:
|
||||
src: "cloud-configs/{{ cloud_provider }}-cloud-config.j2"
|
||||
dest: "{{ kube_config_dir }}/cloud_config"
|
||||
group: "{{ kube_cert_group }}"
|
||||
mode: "0640"
|
||||
when:
|
||||
- cloud_provider is defined
|
||||
- cloud_provider in [ 'openstack', 'azure', 'vsphere', 'aws', 'gce' ]
|
||||
notify: Node | restart kubelet
|
||||
tags:
|
||||
- cloud-provider
|
||||
- kube-proxy
|
||||
|
||||
- name: Install kubelet
|
||||
import_tasks: kubelet.yml
|
||||
|
||||
@@ -1,48 +0,0 @@
|
||||
---
|
||||
- name: "Pre-upgrade | check if kubelet container exists"
|
||||
shell: >-
|
||||
set -o pipefail &&
|
||||
{% if container_manager in ['crio', 'docker'] %}
|
||||
{{ docker_bin_dir }}/docker ps -af name=kubelet | grep kubelet
|
||||
{% elif container_manager == 'containerd' %}
|
||||
{{ bin_dir }}/crictl ps --all --name kubelet | grep kubelet
|
||||
{% endif %}
|
||||
args:
|
||||
executable: /bin/bash
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
check_mode: false
|
||||
register: kubelet_container_check
|
||||
|
||||
- name: "Pre-upgrade | copy /var/lib/cni from kubelet"
|
||||
command: >-
|
||||
{% if container_manager in ['crio', 'docker'] %}
|
||||
docker cp kubelet:/var/lib/cni /var/lib/cni
|
||||
{% elif container_manager == 'containerd' %}
|
||||
ctr run --rm --mount type=bind,src=/var/lib/cni,dst=/cnilibdir,options=rbind:rw kubelet kubelet-tmp sh -c 'cp /var/lib/cni/* /cnilibdir/'
|
||||
{% endif %}
|
||||
args:
|
||||
creates: "/var/lib/cni"
|
||||
failed_when: false
|
||||
when: kubelet_container_check.rc == 0
|
||||
|
||||
- name: "Pre-upgrade | ensure kubelet container service is stopped if using host deployment"
|
||||
service:
|
||||
name: kubelet
|
||||
state: stopped
|
||||
when: kubelet_container_check.rc == 0
|
||||
|
||||
- name: "Pre-upgrade | ensure kubelet container is removed if using host deployment"
|
||||
shell: >-
|
||||
{% if container_manager in ['crio', 'docker'] %}
|
||||
{{ docker_bin_dir }}/docker rm -fv kubelet
|
||||
{% elif container_manager == 'containerd' %}
|
||||
{{ bin_dir }}/crictl stop kubelet && {{ bin_dir }}/crictl rm kubelet
|
||||
{% endif %}
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
register: remove_kubelet_container
|
||||
retries: 4
|
||||
until: remove_kubelet_container.rc == 0
|
||||
delay: 5
|
||||
when: kubelet_container_check.rc == 0
|
||||
@@ -1,11 +0,0 @@
|
||||
[Global]
|
||||
zone={{ aws_zone|default("") }}
|
||||
vpc={{ aws_vpc|default("") }}
|
||||
subnetId={{ aws_subnet_id|default("") }}
|
||||
routeTableId={{ aws_route_table_id|default("") }}
|
||||
roleArn={{ aws_role_arn|default("") }}
|
||||
kubernetesClusterTag={{ aws_kubernetes_cluster_tag|default("") }}
|
||||
kubernetesClusterId={{ aws_kubernetes_cluster_id|default("") }}
|
||||
disableSecurityGroupIngress={{ "true" if aws_disable_security_group_ingress|default(False) else "false" }}
|
||||
disableStrictZoneCheck={{ "true" if aws_disable_strict_zone_check|default(False) else "false" }}
|
||||
elbSecurityGroup={{ aws_elb_security_group|default("") }}
|
||||
@@ -1,26 +0,0 @@
|
||||
{
|
||||
"cloud": "{{ azure_cloud }}",
|
||||
"tenantId": "{{ azure_tenant_id }}",
|
||||
"subscriptionId": "{{ azure_subscription_id }}",
|
||||
"aadClientId": "{{ azure_aad_client_id }}",
|
||||
"aadClientSecret": "{{ azure_aad_client_secret }}",
|
||||
"resourceGroup": "{{ azure_resource_group }}",
|
||||
"location": "{{ azure_location }}",
|
||||
"subnetName": "{{ azure_subnet_name }}",
|
||||
"securityGroupName": "{{ azure_security_group_name }}",
|
||||
"securityGroupResourceGroup": "{{ azure_security_group_resource_group | default(azure_vnet_resource_group) }}",
|
||||
"vnetName": "{{ azure_vnet_name }}",
|
||||
"vnetResourceGroup": "{{ azure_vnet_resource_group }}",
|
||||
"routeTableName": "{{ azure_route_table_name }}",
|
||||
"routeTableResourceGroup": "{{ azure_route_table_resource_group | default(azure_vnet_resource_group) }}",
|
||||
"vmType": "{{ azure_vmtype }}",
|
||||
{% if azure_primary_availability_set_name is defined %}
|
||||
"primaryAvailabilitySetName": "{{ azure_primary_availability_set_name }}",
|
||||
{%endif%}
|
||||
"useInstanceMetadata": {{azure_use_instance_metadata | lower }},
|
||||
{% if azure_loadbalancer_sku == "standard" %}
|
||||
"excludeMasterFromStandardLB": {{ azure_exclude_master_from_standard_lb | lower }},
|
||||
"disableOutboundSNAT": {{ azure_disable_outbound_snat | lower }},
|
||||
{% endif%}
|
||||
"loadBalancerSku": "{{ azure_loadbalancer_sku }}"
|
||||
}
|
||||
@@ -1,2 +0,0 @@
|
||||
[global]
|
||||
node-tags = {{ gce_node_tags }}
|
||||
@@ -1,54 +0,0 @@
|
||||
[Global]
|
||||
auth-url="{{ openstack_auth_url }}"
|
||||
username="{{ openstack_username }}"
|
||||
password="{{ openstack_password }}"
|
||||
region="{{ openstack_region }}"
|
||||
{% if openstack_trust_id is defined and openstack_trust_id != "" %}
|
||||
trust-id="{{ openstack_trust_id }}"
|
||||
{% else %}
|
||||
tenant-id="{{ openstack_tenant_id }}"
|
||||
{% endif %}
|
||||
{% if openstack_tenant_name is defined and openstack_tenant_name != "" %}
|
||||
tenant-name="{{ openstack_tenant_name }}"
|
||||
{% endif %}
|
||||
{% if openstack_domain_name is defined and openstack_domain_name != "" %}
|
||||
domain-name="{{ openstack_domain_name }}"
|
||||
{% elif openstack_domain_id is defined and openstack_domain_id != "" %}
|
||||
domain-id ="{{ openstack_domain_id }}"
|
||||
{% endif %}
|
||||
{% if openstack_cacert is defined and openstack_cacert != "" %}
|
||||
ca-file="{{ kube_config_dir }}/openstack-cacert.pem"
|
||||
{% endif %}
|
||||
|
||||
[BlockStorage]
|
||||
{% if openstack_blockstorage_version is defined %}
|
||||
bs-version={{ openstack_blockstorage_version }}
|
||||
{% endif %}
|
||||
{% if openstack_blockstorage_ignore_volume_az is defined and openstack_blockstorage_ignore_volume_az|bool %}
|
||||
ignore-volume-az={{ openstack_blockstorage_ignore_volume_az }}
|
||||
{% endif %}
|
||||
{% if node_volume_attach_limit is defined and node_volume_attach_limit != "" %}
|
||||
node-volume-attach-limit="{{ node_volume_attach_limit }}"
|
||||
{% endif %}
|
||||
|
||||
{% if openstack_lbaas_enabled and openstack_lbaas_subnet_id is defined %}
|
||||
[LoadBalancer]
|
||||
subnet-id={{ openstack_lbaas_subnet_id }}
|
||||
{% if openstack_lbaas_floating_network_id is defined %}
|
||||
floating-network-id={{ openstack_lbaas_floating_network_id }}
|
||||
{% endif %}
|
||||
{% if openstack_lbaas_use_octavia is defined %}
|
||||
use-octavia={{ openstack_lbaas_use_octavia }}
|
||||
{% endif %}
|
||||
{% if openstack_lbaas_method is defined %}
|
||||
lb-method={{ openstack_lbaas_method }}
|
||||
{% endif %}
|
||||
{% if openstack_lbaas_provider is defined %}
|
||||
lb-provider={{ openstack_lbaas_provider }}
|
||||
{% endif %}
|
||||
|
||||
create-monitor={{ openstack_lbaas_create_monitor }}
|
||||
monitor-delay={{ openstack_lbaas_monitor_delay }}
|
||||
monitor-timeout={{ openstack_lbaas_monitor_timeout }}
|
||||
monitor-max-retries={{ openstack_lbaas_monitor_max_retries }}
|
||||
{% endif %}
|
||||
@@ -1,36 +0,0 @@
|
||||
[Global]
|
||||
user = "{{ vsphere_user }}"
|
||||
password = "{{ vsphere_password }}"
|
||||
port = {{ vsphere_vcenter_port }}
|
||||
insecure-flag = {{ vsphere_insecure }}
|
||||
|
||||
datacenters = "{{ vsphere_datacenter }}"
|
||||
|
||||
[VirtualCenter "{{ vsphere_vcenter_ip }}"]
|
||||
|
||||
|
||||
[Workspace]
|
||||
server = "{{ vsphere_vcenter_ip }}"
|
||||
datacenter = "{{ vsphere_datacenter }}"
|
||||
folder = "{{ vsphere_working_dir }}"
|
||||
default-datastore = "{{ vsphere_datastore }}"
|
||||
{% if vsphere_resource_pool is defined and vsphere_resource_pool != "" %}
|
||||
resourcepool-path = "{{ vsphere_resource_pool }}"
|
||||
{% endif %}
|
||||
|
||||
|
||||
[Disk]
|
||||
scsicontrollertype = {{ vsphere_scsi_controller_type }}
|
||||
|
||||
{% if vsphere_public_network is defined and vsphere_public_network != "" %}
|
||||
[Network]
|
||||
public-network = {{ vsphere_public_network }}
|
||||
{% endif %}
|
||||
|
||||
[Labels]
|
||||
{% if vsphere_zone_category is defined and vsphere_zone_category != "" %}
|
||||
zone = {{ vsphere_zone_category }}
|
||||
{% endif %}
|
||||
{% if vsphere_region_category is defined and vsphere_region_category != "" %}
|
||||
region = {{ vsphere_region_category }}
|
||||
{% endif %}
|
||||
@@ -26,12 +26,13 @@ staticPodPath: {{ kube_manifest_dir }}
|
||||
cgroupDriver: {{ kubelet_cgroup_driver | default('systemd') }}
|
||||
containerLogMaxFiles: {{ kubelet_logfiles_max_nr }}
|
||||
containerLogMaxSize: {{ kubelet_logfiles_max_size }}
|
||||
containerRuntimeEndpoint : {{ cri_socket }}
|
||||
maxPods: {{ kubelet_max_pods }}
|
||||
podPidsLimit: {{ kubelet_pod_pids_limit }}
|
||||
address: {{ kubelet_bind_address }}
|
||||
address: "{{ kubelet_bind_address }}"
|
||||
readOnlyPort: {{ kube_read_only_port }}
|
||||
healthzPort: {{ kubelet_healthz_port }}
|
||||
healthzBindAddress: {{ kubelet_healthz_bind_address }}
|
||||
healthzBindAddress: "{{ kubelet_healthz_bind_address }}"
|
||||
kubeletCgroups: {{ kubelet_kubelet_cgroups }}
|
||||
clusterDomain: {{ dns_domain }}
|
||||
{% if kubelet_protect_kernel_defaults | bool %}
|
||||
@@ -60,56 +61,16 @@ clusterDNS:
|
||||
- {{ dns_address }}
|
||||
{% endfor %}
|
||||
{# Node reserved CPU/memory #}
|
||||
{% if kube_reserved | bool %}
|
||||
kubeReservedCgroup: {{ kube_reserved_cgroups }}
|
||||
{% for scope in "kube", "system" %}
|
||||
{% if lookup('ansible.builtin.vars', scope + "_reserved") | bool %}
|
||||
{{ scope }}ReservedCgroup: {{ lookup('ansible.builtin.vars', scope + '_reserved_cgroups') }}
|
||||
{% endif %}
|
||||
kubeReserved:
|
||||
{% if is_kube_master | bool %}
|
||||
cpu: "{{ kube_master_cpu_reserved }}"
|
||||
memory: {{ kube_master_memory_reserved }}
|
||||
{% if kube_master_ephemeral_storage_reserved is defined %}
|
||||
ephemeral-storage: {{ kube_master_ephemeral_storage_reserved }}
|
||||
{% endif %}
|
||||
{% if kube_master_pid_reserved is defined %}
|
||||
pid: "{{ kube_master_pid_reserved }}"
|
||||
{% endif %}
|
||||
{% else %}
|
||||
cpu: "{{ kube_cpu_reserved }}"
|
||||
memory: {{ kube_memory_reserved }}
|
||||
{% if kube_ephemeral_storage_reserved is defined %}
|
||||
ephemeral-storage: {{ kube_ephemeral_storage_reserved }}
|
||||
{% endif %}
|
||||
{% if kube_pid_reserved is defined %}
|
||||
pid: "{{ kube_pid_reserved }}"
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% if system_reserved | bool %}
|
||||
systemReservedCgroup: {{ system_reserved_cgroups }}
|
||||
systemReserved:
|
||||
{% if is_kube_master | bool %}
|
||||
cpu: "{{ system_master_cpu_reserved }}"
|
||||
memory: {{ system_master_memory_reserved }}
|
||||
{% if system_master_ephemeral_storage_reserved is defined %}
|
||||
ephemeral-storage: {{ system_master_ephemeral_storage_reserved }}
|
||||
{% endif %}
|
||||
{% if system_master_pid_reserved is defined %}
|
||||
pid: "{{ system_master_pid_reserved }}"
|
||||
{% endif %}
|
||||
{% else %}
|
||||
cpu: "{{ system_cpu_reserved }}"
|
||||
memory: {{ system_memory_reserved }}
|
||||
{% if system_ephemeral_storage_reserved is defined %}
|
||||
ephemeral-storage: {{ system_ephemeral_storage_reserved }}
|
||||
{% endif %}
|
||||
{% if system_pid_reserved is defined %}
|
||||
pid: "{{ system_pid_reserved }}"
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% if is_kube_master | bool and eviction_hard_control_plane is defined and eviction_hard_control_plane %}
|
||||
evictionHard:
|
||||
{{ eviction_hard_control_plane | to_nice_yaml(indent=2) | indent(2) }}
|
||||
{% elif not is_kube_master | bool and eviction_hard is defined and eviction_hard %}
|
||||
{{ scope }}Reserved:
|
||||
{% for resource in "cpu", "memory", "ephemeral-storage", "pid" %}
|
||||
{{ resource }}: "{{ lookup('ansible.builtin.vars', scope + '_' ~ (resource | replace('-', '_')) + '_reserved') }}"
|
||||
{% endfor %}
|
||||
{% endfor %}
|
||||
{% if eviction_hard is defined and eviction_hard %}
|
||||
evictionHard:
|
||||
{{ eviction_hard | to_nice_yaml(indent=2) | indent(2) }}
|
||||
{% endif %}
|
||||
@@ -117,9 +78,6 @@ resolvConf: "{{ kube_resolv_conf }}"
|
||||
{% if kubelet_config_extra_args %}
|
||||
{{ kubelet_config_extra_args | to_nice_yaml(indent=2) }}
|
||||
{% endif %}
|
||||
{% if inventory_hostname in groups['kube_node'] and kubelet_node_config_extra_args %}
|
||||
{{ kubelet_node_config_extra_args | to_nice_yaml(indent=2) }}
|
||||
{% endif %}
|
||||
{% if kubelet_feature_gates or kube_feature_gates %}
|
||||
featureGates:
|
||||
{% for feature in (kubelet_feature_gates | default(kube_feature_gates, true)) %}
|
||||
@@ -162,7 +120,7 @@ cpuManagerPolicy: {{ kubelet_cpu_manager_policy }}
|
||||
{% endif %}
|
||||
{% if kubelet_cpu_manager_policy_options is defined %}
|
||||
cpuManagerPolicyOptions:
|
||||
{{ kubelet_cpu_manager_policy_options | to_nice_yaml(indent=2) }}
|
||||
{{ kubelet_cpu_manager_policy_options | to_nice_yaml(indent=2) | indent(width=2) }}
|
||||
{% endif %}
|
||||
{% if kubelet_topology_manager_policy is defined %}
|
||||
topologyManagerPolicy: {{ kubelet_topology_manager_policy }}
|
||||
@@ -172,7 +130,7 @@ topologyManagerScope: {{ kubelet_topology_manager_scope }}
|
||||
{% endif %}
|
||||
{% if kubelet_tracing %}
|
||||
tracing:
|
||||
endpoint: {{ kubelet_tracing_endpoint }}
|
||||
endpoint: "{{ kubelet_tracing_endpoint }}"
|
||||
samplingRatePerMillion: {{ kubelet_tracing_sampling_rate_per_million }}
|
||||
{% endif %}
|
||||
maxParallelImagePulls: {{ kubelet_max_parallel_image_pulls }}
|
||||
|
||||
@@ -11,20 +11,17 @@ KUBELET_HOSTNAME="--hostname-override={{ kube_override_hostname }}"
|
||||
--config={{ kube_config_dir }}/kubelet-config.yaml \
|
||||
--kubeconfig={{ kube_config_dir }}/kubelet.conf \
|
||||
{# end kubeadm specific settings #}
|
||||
--container-runtime-endpoint={{ cri_socket }} \
|
||||
--runtime-cgroups={{ kubelet_runtime_cgroups }} \
|
||||
{% endset %}
|
||||
|
||||
KUBELET_ARGS="{{ kubelet_args_base }} {% if kubelet_custom_flags is string %} {{kubelet_custom_flags}} {% else %}{% for flag in kubelet_custom_flags %} {{flag}} {% endfor %}{% endif %}{% if inventory_hostname in groups['kube_node'] %}{% if kubelet_node_custom_flags is string %} {{kubelet_node_custom_flags}} {% else %}{% for flag in kubelet_node_custom_flags %} {{flag}} {% endfor %}{% endif %}{% endif %}"
|
||||
KUBELET_ARGS="{{ kubelet_args_base }} {{ kubelet_custom_flags | join(' ') }}"
|
||||
{% if kubelet_flexvolumes_plugins_dir is defined %}
|
||||
KUBELET_VOLUME_PLUGIN="--volume-plugin-dir={{ kubelet_flexvolumes_plugins_dir }}"
|
||||
{% endif %}
|
||||
{% if kube_network_plugin is defined and kube_network_plugin == "cloud" %}
|
||||
KUBELET_NETWORK_PLUGIN="--hairpin-mode=promiscuous-bridge --network-plugin=kubenet"
|
||||
{% endif %}
|
||||
{% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "gce"] %}
|
||||
KUBELET_CLOUDPROVIDER="--cloud-provider={{ cloud_provider }} --cloud-config={{ kube_config_dir }}/cloud_config"
|
||||
{% elif cloud_provider is defined and cloud_provider in ["external"] %}
|
||||
{% if cloud_provider == "external" %}
|
||||
KUBELET_CLOUDPROVIDER="--cloud-provider={{ cloud_provider }}"
|
||||
{% else %}
|
||||
KUBELET_CLOUDPROVIDER=""
|
||||
|
||||
@@ -22,7 +22,7 @@ defaults
|
||||
{% if loadbalancer_apiserver_healthcheck_port is defined -%}
|
||||
frontend healthz
|
||||
bind 0.0.0.0:{{ loadbalancer_apiserver_healthcheck_port }}
|
||||
{% if enable_dual_stack_networks -%}
|
||||
{% if ipv6_stack -%}
|
||||
bind :::{{ loadbalancer_apiserver_healthcheck_port }}
|
||||
{% endif -%}
|
||||
mode http
|
||||
@@ -31,7 +31,7 @@ frontend healthz
|
||||
|
||||
frontend kube_api_frontend
|
||||
bind 127.0.0.1:{{ loadbalancer_apiserver_port|default(kube_apiserver_port) }}
|
||||
{% if enable_dual_stack_networks -%}
|
||||
{% if ipv6_stack -%}
|
||||
bind [::1]:{{ loadbalancer_apiserver_port|default(kube_apiserver_port) }};
|
||||
{% endif -%}
|
||||
mode tcp
|
||||
@@ -45,5 +45,5 @@ backend kube_api_backend
|
||||
option httpchk GET /healthz
|
||||
http-check expect status 200
|
||||
{% for host in groups['kube_control_plane'] -%}
|
||||
server {{ host }} {{ hostvars[host]['access_ip'] | default(hostvars[host]['ip'] | default(fallback_ips[host])) }}:{{ kube_apiserver_port }} check check-ssl verify none
|
||||
server {{ host }} {{ hostvars[host]['main_access_ip'] | ansible.utils.ipwrap }}:{{ kube_apiserver_port }} check check-ssl verify none
|
||||
{% endfor -%}
|
||||
|
||||
@@ -14,13 +14,13 @@ stream {
|
||||
upstream kube_apiserver {
|
||||
least_conn;
|
||||
{% for host in groups['kube_control_plane'] -%}
|
||||
server {{ hostvars[host]['access_ip'] | default(hostvars[host]['ip'] | default(fallback_ips[host])) }}:{{ kube_apiserver_port }};
|
||||
server {{ hostvars[host]['main_access_ip'] | ansible.utils.ipwrap }}:{{ kube_apiserver_port }};
|
||||
{% endfor -%}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 127.0.0.1:{{ loadbalancer_apiserver_port|default(kube_apiserver_port) }};
|
||||
{% if enable_dual_stack_networks -%}
|
||||
{% if ipv6_stack -%}
|
||||
listen [::1]:{{ loadbalancer_apiserver_port|default(kube_apiserver_port) }};
|
||||
{% endif -%}
|
||||
proxy_pass kube_apiserver;
|
||||
@@ -44,7 +44,7 @@ http {
|
||||
{% if loadbalancer_apiserver_healthcheck_port is defined -%}
|
||||
server {
|
||||
listen {{ loadbalancer_apiserver_healthcheck_port }};
|
||||
{% if enable_dual_stack_networks -%}
|
||||
{% if ipv6_stack -%}
|
||||
listen [::]:{{ loadbalancer_apiserver_healthcheck_port }};
|
||||
{% endif -%}
|
||||
location /healthz {
|
||||
|
||||
@@ -104,11 +104,16 @@ spec:
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
name: kube-vip
|
||||
resources: {}
|
||||
{% if kube_vip_lb_fwdmethod == "masquerade" %}
|
||||
securityContext:
|
||||
privileged: true
|
||||
{% else %}
|
||||
securityContext:
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
{% endif %}
|
||||
volumeMounts:
|
||||
- mountPath: /etc/kubernetes/admin.conf
|
||||
name: kubeconfig
|
||||
|
||||
@@ -5,7 +5,7 @@ clusters:
|
||||
- name: local
|
||||
cluster:
|
||||
certificate-authority: {{ kube_cert_dir }}/ca.pem
|
||||
server: {{ kube_apiserver_endpoint }}
|
||||
server: "{{ kube_apiserver_endpoint }}"
|
||||
users:
|
||||
- name: kubelet
|
||||
user:
|
||||
|
||||
Reference in New Issue
Block a user