gstykalin/kube-forge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

actualized for kubespray version 2.28.0

Browse Source
This commit is contained in:
George Stykalin
2025-06-15 20:25:45 +03:00
parent c819d4f51f
commit c2df2abc78
366 changed files with 9939 additions and 40388 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
kubespray/project/roles/kubernetes-apps/ansible/defaults/main.yml
View File

@@ -20,7 +20,7 @@ coredns_default_zone_cache_block: |
coredns_pod_disruption_budget: false
# value for coredns pdb
coredns_pod_disruption_budget_max_unavailable: "30%"
deploy_coredns: true
# coredns_additional_configs adds any extra configuration to coredns
# coredns_additional_configs: |
# whoami
@@ -55,11 +55,17 @@ nodelocaldns_ds_nodeselector: "kubernetes.io/os: linux"
nodelocaldns_prometheus_port: 9253
nodelocaldns_secondary_prometheus_port: 9255
# nodelocaldns_additional_configs adds any extra configuration to coredns
# nodelocaldns_additional_configs: |
# whoami
# local
# Limits for dns-autoscaler
dns_autoscaler_cpu_requests: 20m
dns_autoscaler_memory_requests: 10Mi
dns_autoscaler_deployment_nodeselector: "kubernetes.io/os: linux"
# dns_autoscaler_extra_tolerations: [{effect: NoSchedule, operator: "Exists"}]
dns_autoscaler_affinity: {}
# etcd metrics
# etcd_metrics_service_labels:

50
kubespray/project/roles/kubernetes-apps/ansible/tasks/coredns.yml
View File

@@ -1,50 +0,0 @@
---
- name: Kubernetes Apps | Lay Down CoreDNS templates
template:
src: "{{ item.file }}.j2"
dest: "{{ kube_config_dir }}/{{ item.file }}"
mode: "0644"
loop:
- { name: coredns, file: coredns-clusterrole.yml, type: clusterrole }
- { name: coredns, file: coredns-clusterrolebinding.yml, type: clusterrolebinding }
- { name: coredns, file: coredns-config.yml, type: configmap }
- { name: coredns, file: coredns-deployment.yml, type: deployment }
- { name: coredns, file: coredns-sa.yml, type: sa }
- { name: coredns, file: coredns-svc.yml, type: svc }
- { name: dns-autoscaler, file: dns-autoscaler.yml, type: deployment }
- { name: dns-autoscaler, file: dns-autoscaler-clusterrole.yml, type: clusterrole }
- { name: dns-autoscaler, file: dns-autoscaler-clusterrolebinding.yml, type: clusterrolebinding }
- { name: coredns, file: coredns-poddisruptionbudget.yml, type: poddisruptionbudget, condition: coredns_pod_disruption_budget }
- { name: dns-autoscaler, file: dns-autoscaler-sa.yml, type: sa }
register: coredns_manifests
vars:
clusterIP: "{{ skydns_server }}"
when:
- dns_mode in ['coredns', 'coredns_dual']
- inventory_hostname == groups['kube_control_plane'][0]
- enable_dns_autoscaler or item.name != 'dns-autoscaler'
- item.condition | default(True)
tags:
- coredns
- name: Kubernetes Apps | Lay Down Secondary CoreDNS Template
template:
src: "{{ item.src }}.j2"
dest: "{{ kube_config_dir }}/{{ item.file }}"
mode: "0644"
with_items:
- { name: coredns, src: coredns-deployment.yml, file: coredns-deployment-secondary.yml, type: deployment }
- { name: coredns, src: coredns-svc.yml, file: coredns-svc-secondary.yml, type: svc }
- { name: dns-autoscaler, src: dns-autoscaler.yml, file: coredns-autoscaler-secondary.yml, type: deployment }
- { name: coredns, src: coredns-poddisruptionbudget.yml, file: coredns-poddisruptionbudget-secondary.yml, type: poddisruptionbudget, condition: coredns_pod_disruption_budget }
register: coredns_secondary_manifests
vars:
clusterIP: "{{ skydns_server_secondary }}"
coredns_ordinal_suffix: "-secondary"
when:
- dns_mode == 'coredns_dual'
- inventory_hostname == groups['kube_control_plane'][0]
- enable_dns_autoscaler or item.name != 'dns-autoscaler'
- item.condition | default(True)
tags:
- coredns

21
kubespray/project/roles/kubernetes-apps/ansible/tasks/dashboard.yml
View File

@@ -1,21 +0,0 @@
---
- name: Kubernetes Apps | Lay down dashboard template
template:
src: "{{ item.file }}.j2"
dest: "{{ kube_config_dir }}/{{ item.file }}"
mode: "0644"
with_items:
- { file: dashboard.yml, type: deploy, name: kubernetes-dashboard }
register: manifests
when: inventory_hostname == groups['kube_control_plane'][0]
- name: Kubernetes Apps | Start dashboard
kube:
name: "{{ item.item.name }}"
namespace: "{{ dashboard_namespace }}"
kubectl: "{{ bin_dir }}/kubectl"
resource: "{{ item.item.type }}"
filename: "{{ kube_config_dir }}/{{ item.item.file }}"
state: "latest"
with_items: "{{ manifests.results }}"
when: inventory_hostname == groups['kube_control_plane'][0]

22
kubespray/project/roles/kubernetes-apps/ansible/tasks/etcd_metrics.yml
View File

@@ -1,22 +0,0 @@
---
- name: Kubernetes Apps | Lay down etcd_metrics templates
template:
src: "{{ item.file }}.j2"
dest: "{{ kube_config_dir }}/{{ item.file }}"
mode: "0644"
with_items:
- { file: etcd_metrics-endpoints.yml, type: endpoints, name: etcd-metrics }
- { file: etcd_metrics-service.yml, type: service, name: etcd-metrics }
register: manifests
when: inventory_hostname == groups['kube_control_plane'][0]
- name: Kubernetes Apps | Start etcd_metrics
kube:
name: "{{ item.item.name }}"
namespace: kube-system
kubectl: "{{ bin_dir }}/kubectl"
resource: "{{ item.item.type }}"
filename: "{{ kube_config_dir }}/{{ item.item.file }}"
state: "latest"
with_items: "{{ manifests.results }}"
when: inventory_hostname == groups['kube_control_plane'][0]

116
kubespray/project/roles/kubernetes-apps/ansible/tasks/main.yml
View File

@@ -12,62 +12,112 @@
when: inventory_hostname == groups['kube_control_plane'][0]
- name: Kubernetes Apps | CoreDNS
import_tasks: "coredns.yml"
command:
cmd: "{{ kubectl_apply_stdin }}"
stdin: "{{ lookup('template', item) }}"
delegate_to: "{{ groups['kube_control_plane'][0] }}"
run_once: true
loop: "{{ coredns_manifests | flatten }}"
tags:
- coredns
vars:
clusterIP: "{{ skydns_server }}"
when:
- dns_mode in ['coredns', 'coredns_dual']
- inventory_hostname == groups['kube_control_plane'][0]
- deploy_coredns
- name: Kubernetes Apps | CoreDNS Secondary
command:
cmd: "{{ kubectl_apply_stdin }}"
stdin: "{{ lookup('template', item) }}"
delegate_to: "{{ groups['kube_control_plane'][0] }}"
run_once: true
loop: "{{ coredns_manifests | flatten }}"
tags:
- coredns
vars:
clusterIP: "{{ skydns_server_secondary }}"
coredns_ordinal_suffix: "-secondary"
when:
- dns_mode == 'coredns_dual'
- deploy_coredns
- name: Kubernetes Apps | nodelocalDNS
import_tasks: "nodelocaldns.yml"
command:
cmd: "{{ kubectl_apply_stdin }}"
stdin: "{{ lookup('template', item) }}"
delegate_to: "{{ groups['kube_control_plane'][0] }}"
run_once: true
loop: "{{ nodelocaldns_manifests | flatten }}"
when:
- enable_nodelocaldns
- inventory_hostname == groups['kube_control_plane'] | first
tags:
- nodelocaldns
- name: Kubernetes Apps | Start Resources
kube:
name: "{{ item.item.name }}"
namespace: "kube-system"
kubectl: "{{ bin_dir }}/kubectl"
resource: "{{ item.item.type }}"
filename: "{{ kube_config_dir }}/{{ item.item.file }}"
state: "latest"
with_items:
- "{{ coredns_manifests.results | default({}) }}"
- "{{ coredns_secondary_manifests.results | default({}) }}"
- "{{ nodelocaldns_manifests.results | default({}) }}"
- "{{ nodelocaldns_second_manifests.results | default({}) }}"
when:
- dns_mode != 'none'
- inventory_hostname == groups['kube_control_plane'][0]
- not item is skipped
register: resource_result
until: resource_result is succeeded
retries: 4
delay: 5
tags:
- coredns
- nodelocaldns
loop_control:
label: "{{ item.item.file }}"
vars:
primaryClusterIP: >-
{%- if dns_mode in ['coredns', 'coredns_dual'] -%}
{{ skydns_server }}
{%- elif dns_mode == 'manual' -%}
{{ manual_dns_server }}
{%- endif -%}
secondaryclusterIP: "{{ skydns_server_secondary }}"
forwardTarget: >-
{%- if secondaryclusterIP is defined and dns_mode == 'coredns_dual' -%}
{{ primaryClusterIP }} {{ secondaryclusterIP }}
{%- else -%}
{{ primaryClusterIP }}
{%- endif -%}
upstreamForwardTarget: >-
{%- if upstream_dns_servers | length > 0 -%}
{{ upstream_dns_servers | join(' ') }}
{%- else -%}
/etc/resolv.conf
{%- endif -%}
- name: Kubernetes Apps | Etcd metrics endpoints
import_tasks: etcd_metrics.yml
command:
cmd: "{{ kubectl_apply_stdin }}"
stdin: "{{ lookup('template', item) }}"
delegate_to: "{{ groups['kube_control_plane'][0] }}"
run_once: true
loop:
- etcd_metrics-endpoints.yml.j2
- etcd_metrics-service.yml.j2
when: etcd_metrics_port is defined and etcd_metrics_service_labels is defined
tags:
- etcd_metrics
- name: Kubernetes Apps | Netchecker
import_tasks: netchecker.yml
command:
cmd: "{{ kubectl_apply_stdin }}"
stdin: "{{ lookup('template', item) }}"
delegate_to: "{{ groups['kube_control_plane'][0] }}"
run_once: true
vars:
namespace: "{{ netcheck_namespace }}"
when: deploy_netchecker
tags:
- netchecker
loop:
- netchecker-ns.yml.j2
- netchecker-agent-sa.yml.j2
- netchecker-agent-ds.yml.j2
- netchecker-agent-hostnet-ds.yml.j2
- netchecker-server-sa.yml.j2
- netchecker-server-clusterrole.yml.j2
- netchecker-server-clusterrolebinding.yml.j2
- netchecker-server-deployment.yml.j2
- netchecker-server-svc.yml.j2
- name: Kubernetes Apps | Dashboard
import_tasks: dashboard.yml
command:
cmd: "{{ kubectl_apply_stdin }}"
stdin: "{{ lookup('template', 'dashboard.yml.j2') }}"
delegate_to: "{{ groups['kube_control_plane'][0] }}"
run_once: true
vars:
namespace: "{{ dashboard_namespace }}"
when: dashboard_enabled
tags:
- dashboard

47
kubespray/project/roles/kubernetes-apps/ansible/tasks/netchecker.yml
View File

@@ -1,47 +0,0 @@
---
- name: Kubernetes Apps | Check AppArmor status
command: which apparmor_parser
register: apparmor_status
when:
- inventory_hostname == groups['kube_control_plane'][0]
failed_when: false
- name: Kubernetes Apps | Set apparmor_enabled
set_fact:
apparmor_enabled: "{{ apparmor_status.rc == 0 }}"
when:
- inventory_hostname == groups['kube_control_plane'][0]
- name: Kubernetes Apps | Netchecker Templates list
set_fact:
netchecker_templates:
- {file: netchecker-ns.yml, type: ns, name: netchecker-namespace}
- {file: netchecker-agent-sa.yml, type: sa, name: netchecker-agent}
- {file: netchecker-agent-ds.yml, type: ds, name: netchecker-agent}
- {file: netchecker-agent-hostnet-ds.yml, type: ds, name: netchecker-agent-hostnet}
- {file: netchecker-server-sa.yml, type: sa, name: netchecker-server}
- {file: netchecker-server-clusterrole.yml, type: clusterrole, name: netchecker-server}
- {file: netchecker-server-clusterrolebinding.yml, type: clusterrolebinding, name: netchecker-server}
- {file: netchecker-server-deployment.yml, type: deployment, name: netchecker-server}
- {file: netchecker-server-svc.yml, type: svc, name: netchecker-service}
- name: Kubernetes Apps | Lay Down Netchecker Template
template:
src: "{{ item.file }}.j2"
dest: "{{ kube_config_dir }}/{{ item.file }}"
mode: "0644"
with_items: "{{ netchecker_templates }}"
register: manifests
when:
- inventory_hostname == groups['kube_control_plane'][0]
- name: Kubernetes Apps | Start Netchecker Resources
kube:
name: "{{ item.item.name }}"
namespace: "{{ netcheck_namespace }}"
kubectl: "{{ bin_dir }}/kubectl"
resource: "{{ item.item.type }}"
filename: "{{ kube_config_dir }}/{{ item.item.file }}"
state: "latest"
with_items: "{{ manifests.results }}"
when: inventory_hostname == groups['kube_control_plane'][0] and not item is skipped

79
kubespray/project/roles/kubernetes-apps/ansible/tasks/nodelocaldns.yml
View File

@@ -1,79 +0,0 @@
---
- name: Kubernetes Apps | set up necessary nodelocaldns parameters
set_fact:
# noqa: jinja[spacing]
primaryClusterIP: >-
{%- if dns_mode in ['coredns', 'coredns_dual'] -%}
{{ skydns_server }}
{%- elif dns_mode == 'manual' -%}
{{ manual_dns_server }}
{%- endif -%}
secondaryclusterIP: "{{ skydns_server_secondary }}"
when:
- enable_nodelocaldns
- inventory_hostname == groups['kube_control_plane'] | first
tags:
- nodelocaldns
- coredns
- name: Kubernetes Apps | Lay Down nodelocaldns Template
template:
src: "{{ item.file }}.j2"
dest: "{{ kube_config_dir }}/{{ item.file }}"
mode: "0644"
with_items:
- { name: nodelocaldns, file: nodelocaldns-config.yml, type: configmap }
- { name: nodelocaldns, file: nodelocaldns-sa.yml, type: sa }
- { name: nodelocaldns, file: nodelocaldns-daemonset.yml, type: daemonset }
register: nodelocaldns_manifests
vars:
# noqa: jinja[spacing]
forwardTarget: >-
{%- if secondaryclusterIP is defined and dns_mode == 'coredns_dual' -%}
{{ primaryClusterIP }} {{ secondaryclusterIP }}
{%- else -%}
{{ primaryClusterIP }}
{%- endif -%}
upstreamForwardTarget: >-
{%- if upstream_dns_servers is defined and upstream_dns_servers | length > 0 -%}
{{ upstream_dns_servers | join(' ') }}
{%- else -%}
/etc/resolv.conf
{%- endif -%}
when:
- enable_nodelocaldns
- inventory_hostname == groups['kube_control_plane'] | first
tags:
- nodelocaldns
- coredns
- name: Kubernetes Apps | Lay Down nodelocaldns-secondary Template
template:
src: "{{ item.file }}.j2"
dest: "{{ kube_config_dir }}/{{ item.file }}"
mode: "0644"
with_items:
- { name: nodelocaldns, file: nodelocaldns-second-daemonset.yml, type: daemonset }
register: nodelocaldns_second_manifests
vars:
# noqa: jinja[spacing]
forwardTarget: >-
{%- if secondaryclusterIP is defined and dns_mode == 'coredns_dual' -%}
{{ primaryClusterIP }} {{ secondaryclusterIP }}
{%- else -%}
{{ primaryClusterIP }}
{%- endif -%}
# noqa: jinja[spacing]
upstreamForwardTarget: >-
{%- if upstream_dns_servers is defined and upstream_dns_servers | length > 0 -%}
{{ upstream_dns_servers | join(' ') }}
{%- else -%}
/etc/resolv.conf
{%- endif -%}
when:
- enable_nodelocaldns
- enable_nodelocaldns_secondary
- inventory_hostname == groups['kube_control_plane'] | first
tags:
- nodelocaldns
- coredns

6
kubespray/project/roles/kubernetes-apps/ansible/templates/coredns-config.yml.j2
View File

@@ -68,12 +68,14 @@ data:
{% endif %}
}
prometheus :9153
forward . {{ upstream_dns_servers | join(' ') if upstream_dns_servers is defined and upstream_dns_servers | length > 0 else '/etc/resolv.conf' }} {
forward . {{ upstream_dns_servers | join(' ') if upstream_dns_servers | length > 0 else '/etc/resolv.conf' }} {
prefer_udp
max_concurrent 1000
{% if dns_upstream_forward_extra_opts is defined %}
{% for optname, optvalue in dns_upstream_forward_extra_opts.items() %}
{{ optname }} {{ optvalue }}
{{ (optname ~ ' ' ~ optvalue) | trim }}
{# do not add a trailing space when optvalue == ''
workaround for: https://github.com/kubernetes/kubernetes/issues/36222 #}
{% endfor %}
{% endif %}
}

24
kubespray/project/roles/kubernetes-apps/ansible/templates/dashboard.yml.j2
View File

@@ -17,16 +17,15 @@
#
# Example usage: kubectl create -f <this_file>
{% if dashboard_namespace != "kube-system" %}
{% if namespace != 'kube-system' %}
---
apiVersion: v1
kind: Namespace
metadata:
name: {{ dashboard_namespace }}
name: {{ namespace }}
labels:
name: {{ dashboard_namespace }}
name: {{ namespace }}
{% endif %}
---
# ------------------- Dashboard Secrets ------------------- #
apiVersion: v1
@@ -35,7 +34,6 @@ metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-certs
namespace: {{ dashboard_namespace }}
type: Opaque
---
@@ -45,7 +43,6 @@ metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-csrf
namespace: {{ dashboard_namespace }}
type: Opaque
data:
csrf: ""
@@ -57,7 +54,6 @@ metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-key-holder
namespace: {{ dashboard_namespace }}
type: Opaque
---
@@ -68,7 +64,6 @@ metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard-settings
namespace: {{ dashboard_namespace }}
---
# ------------------- Dashboard Service Account ------------------- #
@@ -79,7 +74,6 @@ metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: {{ dashboard_namespace }}
---
# ------------------- Dashboard Role & Role Binding ------------------- #
@@ -89,7 +83,6 @@ metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: {{ dashboard_namespace }}
rules:
# Allow Dashboard to get, update and delete Dashboard exclusive secrets.
- apiGroups: [""]
@@ -118,7 +111,6 @@ metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: {{ dashboard_namespace }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
@@ -126,7 +118,7 @@ roleRef:
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: {{ dashboard_namespace }}
namespace: {{ namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
@@ -140,7 +132,7 @@ roleRef:
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: {{ dashboard_namespace }}
namespace: {{ namespace }}
---
# ------------------- Dashboard Deployment ------------------- #
@@ -151,7 +143,6 @@ metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: {{ dashboard_namespace }}
spec:
replicas: {{ dashboard_replicas }}
revisionHistoryLimit: 10
@@ -182,7 +173,7 @@ spec:
- containerPort: 8443
protocol: TCP
args:
- --namespace={{ dashboard_namespace }}
- --namespace={{ namespace }}
{% if dashboard_use_custom_certs %}
- --tls-key-file={{ dashboard_tls_key_file }}
- --tls-cert-file={{ dashboard_tls_cert_file }}
@@ -238,7 +229,6 @@ metadata:
labels:
k8s-app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: {{ dashboard_namespace }}
spec:
ports:
- port: 443
@@ -270,7 +260,6 @@ metadata:
labels:
k8s-app: kubernetes-metrics-scraper
name: dashboard-metrics-scraper
namespace: {{ dashboard_namespace }}
spec:
ports:
- port: 8000
@@ -287,7 +276,6 @@ metadata:
labels:
k8s-app: kubernetes-metrics-scraper
name: kubernetes-metrics-scraper
namespace: {{ dashboard_namespace }}
spec:
replicas: 1
revisionHistoryLimit: 10

16
kubespray/project/roles/kubernetes-apps/ansible/templates/dns-autoscaler.yml.j2
View File

@@ -48,21 +48,7 @@ spec:
{{ dns_autoscaler_extra_tolerations | list | to_nice_yaml(indent=2) | indent(8) }}
{% endif %}
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- topologyKey: "kubernetes.io/hostname"
labelSelector:
matchLabels:
k8s-app: dns-autoscaler{{ coredns_ordinal_suffix }}
nodeAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
preference:
matchExpressions:
- key: node-role.kubernetes.io/control-plane
operator: In
values:
- ""
{{ dns_autoscaler_affinity | to_nice_yaml(indent=2) | indent(8) }}
containers:
- name: autoscaler
image: "{{ dnsautoscaler_image_repo }}:{{ dnsautoscaler_image_tag }}"

14
kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-config.yml.j2
View File

@@ -75,6 +75,9 @@ data:
prometheus {% if nodelocaldns_bind_metrics_host_ip %}{$MY_HOST_IP}{% endif %}:{{ nodelocaldns_prometheus_port }}
}
.:53 {
{% if nodelocaldns_additional_configs is defined %}
{{ nodelocaldns_additional_configs | indent(width=8, first=False) }}
{% endif %}
errors
cache 30
reload
@@ -82,7 +85,9 @@ data:
bind {{ nodelocaldns_ip }}
forward . {{ upstreamForwardTarget }}{% if dns_upstream_forward_extra_opts is defined %} {
{% for optname, optvalue in dns_upstream_forward_extra_opts.items() %}
{{ optname }} {{ optvalue }}
{{ (optname ~ ' ' ~ optvalue) | trim }}
{# do not add a trailing space when optvalue == ''
workaround for: https://github.com/kubernetes/kubernetes/issues/36222 #}
{% endfor %}
}{% endif %}
@@ -157,6 +162,9 @@ data:
prometheus {% if nodelocaldns_bind_metrics_host_ip %}{$MY_HOST_IP}{% endif %}:{{ nodelocaldns_secondary_prometheus_port }}
}
.:53 {
{% if nodelocaldns_additional_configs is defined %}
{{ nodelocaldns_additional_configs | indent(width=8, first=False) }}
{% endif %}
errors
cache 30
reload
@@ -164,7 +172,9 @@ data:
bind {{ nodelocaldns_ip }}
forward . {{ upstreamForwardTarget }}{% if dns_upstream_forward_extra_opts is defined %} {
{% for optname, optvalue in dns_upstream_forward_extra_opts.items() %}
{{ optname }} {{ optvalue }}
{{ (optname ~ ' ' ~ optvalue) | trim }}
{# do not add a trailing space when optvalue == ''
workaround for: https://github.com/kubernetes/kubernetes/issues/36222 #}
{% endfor %}
}{% endif %}

5
kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-daemonset.yml.j2
View File

@@ -47,7 +47,7 @@ spec:
- coredns
{% if enable_nodelocaldns_secondary %}
- -skipteardown
{% else %}
{% endif %}
ports:
- containerPort: 53
name: dns
@@ -55,10 +55,9 @@ spec:
- containerPort: 53
name: dns-tcp
protocol: TCP
- containerPort: 9253
- containerPort: {{ nodelocaldns_prometheus_port }}
name: metrics
protocol: TCP
{% endif %}
securityContext:
privileged: true
{% if nodelocaldns_bind_metrics_host_ip %}

4
kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-second-daemonset.yml.j2
View File

@@ -39,6 +39,10 @@ spec:
cpu: {{ nodelocaldns_cpu_requests }}
memory: {{ nodelocaldns_memory_requests }}
args: [ "-localip", "{{ nodelocaldns_ip }}", "-conf", "/etc/coredns/Corefile", "-upstreamsvc", "coredns", "-skipteardown" ]
ports:
- containerPort: {{ nodelocaldns_secondary_prometheus_port }}
name: metrics
protocol: TCP
securityContext:
privileged: true
{% if nodelocaldns_bind_metrics_host_ip %}

22
kubespray/project/roles/kubernetes-apps/ansible/vars/main.yml Normal file
View File

@@ -0,0 +1,22 @@
---
dns_autoscaler_manifests:
- dns-autoscaler-sa.yml.j2
- dns-autoscaler.yml.j2
- dns-autoscaler-clusterrole.yml.j2
- dns-autoscaler-clusterrolebinding.yml.j2
coredns_manifests:
- coredns-clusterrole.yml.j2
- coredns-clusterrolebinding.yml.j2
- coredns-config.yml.j2
- coredns-deployment.yml.j2
- coredns-sa.yml.j2
- coredns-svc.yml.j2
- "{{ dns_autoscaler_manifests if enable_dns_autoscaler else [] }}"
- "{{ 'coredns-poddisruptionbudget.yml.j2' if coredns_pod_disruption_budget else [] }}"
nodelocaldns_manifests:
- nodelocaldns-config.yml.j2
- nodelocaldns-daemonset.yml.j2
- nodelocaldns-sa.yml.j2
- "{{ 'nodelocaldns-second-daemonset.yml.j2' if enable_nodelocaldns_secondary else [] }}"

4
kubespray/project/roles/kubernetes-apps/argocd/defaults/main.yml
View File

@@ -1,6 +1,6 @@
---
argocd_enabled: false
argocd_version: v2.11.0
argocd_version: 2.14.5
argocd_namespace: argocd
# argocd_admin_password:
argocd_install_url: "https://raw.githubusercontent.com/argoproj/argo-cd/{{ argocd_version }}/manifests/install.yaml"
argocd_install_url: "https://raw.githubusercontent.com/argoproj/argo-cd/v{{ argocd_version }}/manifests/install.yaml"

6
kubespray/project/roles/kubernetes-apps/cloud_controller/oci/defaults/main.yml
View File

@@ -1,6 +0,0 @@
---
oci_security_list_management: All
oci_use_instance_principals: false
oci_cloud_controller_version: 0.7.0
oci_cloud_controller_pull_source: iad.ocir.io/oracle/cloud-provider-oci

67
kubespray/project/roles/kubernetes-apps/cloud_controller/oci/tasks/credentials-check.yml
View File

@@ -1,67 +0,0 @@
---
- name: "OCI Cloud Controller | Credentials Check | oci_private_key"
fail:
msg: "oci_private_key is missing"
when:
- not oci_use_instance_principals
- oci_private_key is not defined or not oci_private_key
- name: "OCI Cloud Controller | Credentials Check | oci_region_id"
fail:
msg: "oci_region_id is missing"
when:
- not oci_use_instance_principals
- oci_region_id is not defined or not oci_region_id
- name: "OCI Cloud Controller | Credentials Check | oci_tenancy_id"
fail:
msg: "oci_tenancy_id is missing"
when:
- not oci_use_instance_principals
- oci_tenancy_id is not defined or not oci_tenancy_id
- name: "OCI Cloud Controller | Credentials Check | oci_user_id"
fail:
msg: "oci_user_id is missing"
when:
- not oci_use_instance_principals
- oci_user_id is not defined or not oci_user_id
- name: "OCI Cloud Controller | Credentials Check | oci_user_fingerprint"
fail:
msg: "oci_user_fingerprint is missing"
when:
- not oci_use_instance_principals
- oci_user_fingerprint is not defined or not oci_user_fingerprint
- name: "OCI Cloud Controller | Credentials Check | oci_compartment_id"
fail:
msg: "oci_compartment_id is missing. This is the compartment in which the cluster resides"
when:
- oci_compartment_id is not defined or not oci_compartment_id
- name: "OCI Cloud Controller | Credentials Check | oci_vnc_id"
fail:
msg: "oci_vnc_id is missing. This is the Virtual Cloud Network in which the cluster resides"
when:
- oci_vnc_id is not defined or not oci_vnc_id
- name: "OCI Cloud Controller | Credentials Check | oci_subnet1_id"
fail:
msg: "oci_subnet1_id is missingg. This is the first subnet to which loadbalancers will be added"
when:
- oci_subnet1_id is not defined or not oci_subnet1_id
- name: "OCI Cloud Controller | Credentials Check | oci_subnet2_id"
fail:
msg: "oci_subnet2_id is missing. Two subnets are required for load balancer high availability"
when:
- oci_cloud_controller_version is version_compare('0.7.0', '<')
- oci_subnet2_id is not defined or not oci_subnet2_id
- name: "OCI Cloud Controller | Credentials Check | oci_security_list_management"
fail:
msg: "oci_security_list_management is missing, or not defined correctly. Valid options are (All, Frontend, None)."
when:
- oci_security_list_management is not defined or oci_security_list_management not in ["All", "Frontend", "None"]

35
kubespray/project/roles/kubernetes-apps/cloud_controller/oci/tasks/main.yml
View File

@@ -1,35 +0,0 @@
---
- name: OCI Cloud Controller | Check Oracle Cloud credentials
import_tasks: credentials-check.yml
- name: "OCI Cloud Controller | Generate Cloud Provider Configuration"
template:
src: controller-manager-config.yml.j2
dest: "{{ kube_config_dir }}/controller-manager-config.yml"
mode: "0644"
when: inventory_hostname == groups['kube_control_plane'][0]
- name: "OCI Cloud Controller | Slurp Configuration"
slurp:
src: "{{ kube_config_dir }}/controller-manager-config.yml"
register: controller_manager_config
- name: "OCI Cloud Controller | Encode Configuration"
set_fact:
controller_manager_config_base64: "{{ controller_manager_config.content }}"
when: inventory_hostname == groups['kube_control_plane'][0]
- name: "OCI Cloud Controller | Generate Manifests"
template:
src: oci-cloud-provider.yml.j2
dest: "{{ kube_config_dir }}/oci-cloud-provider.yml"
mode: "0644"
when: inventory_hostname == groups['kube_control_plane'][0]
- name: "OCI Cloud Controller | Apply Manifests"
kube:
kubectl: "{{ bin_dir }}/kubectl"
filename: "{{ kube_config_dir }}/oci-cloud-provider.yml"
state: latest
when: inventory_hostname == groups['kube_control_plane'][0]

89
kubespray/project/roles/kubernetes-apps/cloud_controller/oci/templates/controller-manager-config.yml.j2
View File

@@ -1,89 +0,0 @@
{% macro private_key() %}{{ oci_private_key }}{% endmacro %}
{% if oci_use_instance_principals %}
# (https://docs.us-phoenix-1.oraclecloud.com/Content/Identity/Tasks/callingservicesfrominstances.htm).
# Ensure you have setup the following OCI policies and your kubernetes nodes are running within them
# allow dynamic-group [your dynamic group name] to read instance-family in compartment [your compartment name]
# allow dynamic-group [your dynamic group name] to use virtual-network-family in compartment [your compartment name]
# allow dynamic-group [your dynamic group name] to manage load-balancers in compartment [your compartment name]
useInstancePrincipals: true
{% else %}
useInstancePrincipals: false
{% endif %}
auth:
{% if oci_use_instance_principals %}
# This key is put here too for backwards compatibility
useInstancePrincipals: true
{% else %}
useInstancePrincipals: false
region: {{ oci_region_id }}
tenancy: {{ oci_tenancy_id }}
user: {{ oci_user_id }}
key: |
{{ oci_private_key }}
{% if oci_private_key_passphrase is defined %}
passphrase: {{ oci_private_key_passphrase }}
{% endif %}
fingerprint: {{ oci_user_fingerprint }}
{% endif %}
# compartment configures Compartment within which the cluster resides.
compartment: {{ oci_compartment_id }}
# vcn configures the Virtual Cloud Network (VCN) within which the cluster resides.
vcn: {{ oci_vnc_id }}
loadBalancer:
# subnet1 configures one of two subnets to which load balancers will be added.
# OCI load balancers require two subnets to ensure high availability.
subnet1: {{ oci_subnet1_id }}
{% if oci_subnet2_id is defined %}
# subnet2 configures the second of two subnets to which load balancers will be
# added. OCI load balancers require two subnets to ensure high availability.
subnet2: {{ oci_subnet2_id }}
{% endif %}
# SecurityListManagementMode configures how security lists are managed by the CCM.
# "All" (default): Manage all required security list rules for load balancer services.
# "Frontend": Manage only security list rules for ingress to the load
# balancer. Requires that the user has setup a rule that
# allows inbound traffic to the appropriate ports for kube
# proxy health port, node port ranges, and health check port ranges.
# E.g. 10.82.0.0/16 30000-32000.
# "None": Disables all security list management. Requires that the
# user has setup a rule that allows inbound traffic to the
# appropriate ports for kube proxy health port, node port
# ranges, and health check port ranges. E.g. 10.82.0.0/16 30000-32000.
# Additionally requires the user to mange rules to allow
# inbound traffic to load balancers.
securityListManagementMode: {{ oci_security_list_management }}
{% if oci_security_lists is defined and oci_security_lists | length > 0 %}
# Optional specification of which security lists to modify per subnet. This does not apply if security list management is off.
securityLists:
{% for subnet_ocid, list_ocid in oci_security_lists.items() %}
{{ subnet_ocid }}: {{ list_ocid }}
{% endfor %}
{% endif %}
{% if oci_rate_limit is defined and oci_rate_limit | length > 0 %}
# Optional rate limit controls for accessing OCI API
rateLimiter:
{% if oci_rate_limit.rate_limit_qps_read %}
rateLimitQPSRead: {{ oci_rate_limit.rate_limit_qps_read }}
{% endif %}
{% if oci_rate_limit.rate_limit_qps_write %}
rateLimitQPSWrite: {{ oci_rate_limit.rate_limit_qps_write }}
{% endif %}
{% if oci_rate_limit.rate_limit_bucket_read %}
rateLimitBucketRead: {{ oci_rate_limit.rate_limit_bucket_read }}
{% endif %}
{% if oci_rate_limit.rate_limit_bucket_write %}
rateLimitBucketWrite: {{ oci_rate_limit.rate_limit_bucket_write }}
{% endif %}
{% endif %}

7
kubespray/project/roles/kubernetes-apps/cluster_roles/tasks/main.yml
View File

@@ -59,13 +59,6 @@
- inventory_hostname == groups['kube_control_plane'][0]
tags: node-webhook
- name: Configure Oracle Cloud provider
include_tasks: oci.yml
tags: oci
when:
- cloud_provider is defined
- cloud_provider == 'oci'
- name: PriorityClass | Copy k8s-cluster-critical-pc.yml file
copy:
src: k8s-cluster-critical-pc.yml

19
kubespray/project/roles/kubernetes-apps/cluster_roles/tasks/oci.yml
View File

@@ -1,19 +0,0 @@
---
- name: Copy OCI RBAC Manifest
copy:
src: "oci-rbac.yml"
dest: "{{ kube_config_dir }}/oci-rbac.yml"
mode: "0640"
when:
- cloud_provider is defined
- cloud_provider == 'oci'
- inventory_hostname == groups['kube_control_plane'][0]
- name: Apply OCI RBAC
kube:
kubectl: "{{ bin_dir }}/kubectl"
filename: "{{ kube_config_dir }}/oci-rbac.yml"
when:
- cloud_provider is defined
- cloud_provider == 'oci'
- inventory_hostname == groups['kube_control_plane'][0]

6
kubespray/project/roles/kubernetes-apps/csi_driver/OWNERS
View File

@@ -1,6 +0,0 @@
# See the OWNERS docs at https://go.k8s.io/owners
approvers:
reviewers:
- alijahnas
- luckySB

2
kubespray/project/roles/kubernetes-apps/csi_driver/cinder/tasks/main.yml
View File

@@ -9,7 +9,7 @@
loop_control:
loop_var: delegate_host_to_write_cacert
when:
- inventory_hostname in groups['k8s_cluster']
- ('k8s_cluster' in group_names)
- cinder_cacert is defined
- cinder_cacert | length > 0

2
kubespray/project/roles/kubernetes-apps/csi_driver/upcloud/templates/upcloud-csi-controller.yml.j2
View File

@@ -100,7 +100,7 @@ spec:
- name: socket-dir
mountPath: /var/lib/csi/sockets/pluginproxy/
imagePullSecrets:
- name: regcred
- name: upcloud
volumes:
- name: socket-dir
emptyDir: {}

2
kubespray/project/roles/kubernetes-apps/csi_driver/upcloud/templates/upcloud-csi-node.yml.j2
View File

@@ -77,7 +77,7 @@ spec:
- name: device-dir
mountPath: /dev
imagePullSecrets:
- name: regcred
- name: upcloud
volumes:
- name: registration-dir
hostPath:

6
kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/defaults/main.yml
View File

@@ -4,14 +4,14 @@ external_vsphere_insecure: "true"
external_vsphere_kubernetes_cluster_id: "kubernetes-cluster-id"
external_vsphere_version: "7.0u1"
vsphere_syncer_image_tag: "v3.1.0"
vsphere_syncer_image_tag: "v3.3.1"
vsphere_csi_attacher_image_tag: "v4.3.0"
vsphere_csi_controller: "v3.1.0"
vsphere_csi_controller: "v3.3.1"
vsphere_csi_liveness_probe_image_tag: "v2.10.0"
vsphere_csi_provisioner_image_tag: "v3.5.0"
vsphere_csi_snapshotter_image_tag: "v6.2.2"
vsphere_csi_node_driver_registrar_image_tag: "v2.8.0"
vsphere_csi_driver_image_tag: "v3.1.0"
vsphere_csi_driver_image_tag: "v3.3.1"
vsphere_csi_resizer_tag: "v1.8.0"
# Set to kube-system for backward compatibility, should be change to vmware-system-csi on the long run

2
kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-controller-config.yml.j2
View File

@@ -19,12 +19,10 @@ data:
"multi-vcenter-csi-topology": "true"
"csi-internal-generated-cluster-id": "true"
"listview-tasks": "true"
{% if vsphere_csi_controller is version('v2.7.0', '>=') %}
"improved-csi-idempotency": "true"
"improved-volume-topology": "true"
"use-csinode-id": "true"
"list-volumes": "false"
{% endif %}
kind: ConfigMap
metadata:
name: internal-feature-states.csi.vsphere.vmware.com

4
kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-controller-deployment.yml.j2
View File

@@ -99,7 +99,7 @@ spec:
name: socket-dir
{% endif %}
- name: vsphere-csi-controller
image: {{ gcr_image_repo }}/cloud-provider-vsphere/csi/release/driver:{{ vsphere_csi_controller }}
image: {{ kube_image_repo }}/csi-vsphere/driver:{{ vsphere_csi_controller }}
args:
- "--fss-name=internal-feature-states.csi.vsphere.vmware.com"
- "--fss-namespace={{ vsphere_csi_namespace }}"
@@ -168,7 +168,7 @@ spec:
- name: socket-dir
mountPath: {{ csi_endpoint }}
- name: vsphere-syncer
image: {{ gcr_image_repo }}/cloud-provider-vsphere/csi/release/syncer:{{ vsphere_syncer_image_tag }}
image: {{ kube_image_repo }}/csi-vsphere/syncer:{{ vsphere_syncer_image_tag }}
args:
- "--leader-election"
- "--leader-election-lease-duration=30s"

2
kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-controller-rbac.yml.j2
View File

@@ -33,11 +33,9 @@ rules:
- apiGroups: [""]
resources: ["events"]
verbs: ["get", "list", "watch", "create", "update", "patch"]
{% if vsphere_csi_controller is version('v2.0.0', '>=') %}
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch", "list", "delete", "update", "create"]
{% endif %}
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses","csinodes"]
verbs: ["get", "list", "watch"]

2
kubespray/project/roles/kubernetes-apps/csi_driver/vsphere/templates/vsphere-csi-node.yml.j2
View File

@@ -62,7 +62,7 @@ spec:
- --mode=kubelet-registration-probe
initialDelaySeconds: 3
- name: vsphere-csi-node
image: {{ gcr_image_repo }}/cloud-provider-vsphere/csi/release/driver:{{ vsphere_csi_driver_image_tag }}
image: {{ kube_image_repo }}/csi-vsphere/driver:{{ vsphere_csi_driver_image_tag }}
imagePullPolicy: {{ k8s_image_pull_policy }}
args:
- "--fss-name=internal-feature-states.csi.vsphere.vmware.com"

2
kubespray/project/roles/kubernetes-apps/defaults/main.yml Normal file
View File

@@ -0,0 +1,2 @@
---
namespace: kube-system

12
kubespray/project/roles/kubernetes-apps/external_cloud_controller/huaweicloud/defaults/main.yml
View File

@@ -2,12 +2,12 @@
# The external cloud controller will need credentials to access
# openstack apis. Per default these values will be
# read from the environment.
external_huaweicloud_auth_url: "{{ lookup('env','OS_AUTH_URL') }}"
external_huaweicloud_access_key: "{{ lookup('env','OS_ACCESS_KEY') }}"
external_huaweicloud_secret_key: "{{ lookup('env','OS_SECRET_KEY') }}"
external_huaweicloud_region: "{{ lookup('env','OS_REGION_NAME') }}"
external_huaweicloud_project_id: "{{ lookup('env','OS_TENANT_ID')| default(lookup('env','OS_PROJECT_ID'),true) }}"
external_huaweicloud_cloud: "{{ lookup('env','OS_CLOUD') }}"
external_huaweicloud_auth_url: "{{ lookup('env', 'OS_AUTH_URL') }}"
external_huaweicloud_access_key: "{{ lookup('env', 'OS_ACCESS_KEY') }}"
external_huaweicloud_secret_key: "{{ lookup('env', 'OS_SECRET_KEY') }}"
external_huaweicloud_region: "{{ lookup('env', 'OS_REGION_NAME') }}"
external_huaweicloud_project_id: "{{ lookup('env', 'OS_TENANT_ID') | default(lookup('env', 'OS_PROJECT_ID'), true) }}"
external_huaweicloud_cloud: "{{ lookup('env', 'OS_CLOUD') }}"
## A dictionary of extra arguments to add to the huawei cloud controller manager deployment
## Format:

16
kubespray/project/roles/kubernetes-apps/external_cloud_controller/meta/main.yml
View File

@@ -2,9 +2,7 @@
dependencies:
- role: kubernetes-apps/external_cloud_controller/openstack
when:
- cloud_provider is defined
- cloud_provider == "external"
- external_cloud_provider is defined
- external_cloud_provider == "openstack"
- inventory_hostname == groups['kube_control_plane'][0]
tags:
@@ -12,9 +10,7 @@ dependencies:
- external-openstack
- role: kubernetes-apps/external_cloud_controller/vsphere
when:
- cloud_provider is defined
- cloud_provider == "external"
- external_cloud_provider is defined
- external_cloud_provider == "vsphere"
- inventory_hostname == groups['kube_control_plane'][0]
tags:
@@ -22,9 +18,7 @@ dependencies:
- external-vsphere
- role: kubernetes-apps/external_cloud_controller/hcloud
when:
- cloud_provider is defined
- cloud_provider == "external"
- external_cloud_provider is defined
- external_cloud_provider == "hcloud"
- inventory_hostname == groups['kube_control_plane'][0]
tags:
@@ -32,11 +26,17 @@ dependencies:
- external-hcloud
- role: kubernetes-apps/external_cloud_controller/huaweicloud
when:
- cloud_provider is defined
- cloud_provider == "external"
- external_cloud_provider is defined
- external_cloud_provider == "huaweicloud"
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- external-cloud-controller
- external-huaweicloud
- role: kubernetes-apps/external_cloud_controller/oci
when:
- cloud_provider == "external"
- external_cloud_provider == "oci"
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- external-cloud-controller
- external-oci

25
kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/defaults/main.yml Normal file
View File

@@ -0,0 +1,25 @@
---
## External Oracle Cloud Controller Manager
## https://github.com/oracle/oci-cloud-controller-manager/blob/v1.29.0/manifests/provider-config-example.yaml
external_oracle_auth_region: ""
external_oracle_auth_tenancy: ""
external_oracle_auth_user: ""
external_oracle_auth_key: ""
external_oracle_auth_passphrase: ""
external_oracle_auth_fingerprint: ""
external_oracle_auth_use_instance_principals: false
external_oracle_compartment: ""
external_oracle_vcn: ""
external_oracle_load_balancer_subnet1: ""
external_oracle_load_balancer_subnet2: ""
external_oracle_load_balancer_security_list_management_mode: All
external_oracle_load_balancer_security_lists: {}
external_oracle_ratelimiter_qps_read: 20.0
external_oracle_ratelimiter_bucket_read: 5
external_oracle_ratelimiter_qps_write: 20.0
external_oracle_ratelimiter_bucket_write: 5
external_oracle_cloud_controller_image_repo: ghcr.io/oracle/cloud-provider-oci
external_oracle_cloud_controller_image_tag: "v1.29.0"

53
kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/tasks/main.yml Normal file
View File

@@ -0,0 +1,53 @@
---
- name: "External OCI Cloud Controller Manager | Check credentials"
ansible.builtin.assert:
that:
- external_oracle_auth_key | length > 0
- external_oracle_auth_region | length > 0
- external_oracle_auth_tenancy | length > 0
- external_oracle_auth_user | length > 0
- external_oracle_auth_fingerprint | length > 0
when: not external_oracle_auth_use_instance_principals
- name: "External OCI Cloud Controller Manager | Check settings"
ansible.builtin.assert:
that:
- external_oracle_compartment | length > 0
- external_oracle_vcn | length > 0
- external_oracle_load_balancer_subnet1 | length > 0
- external_oracle_load_balancer_subnet2 | length > 0
- external_oracle_load_balancer_security_list_management_mode in ["All", "Frontend", "None"]
- name: External OCI Cloud Controller Manager | Get base64 cloud-config
set_fact:
external_oracle_cloud_config_secret: "{{ lookup('template', 'external-oci-cloud-config.j2') | b64encode }}"
when: inventory_hostname == groups['kube_control_plane'][0]
tags: external-oci
- name: External OCI Cloud Controller Manager | Generate Manifests
template:
src: "{{ item.file }}.j2"
dest: "{{ kube_config_dir }}/{{ item.file }}"
group: "{{ kube_cert_group }}"
mode: "0640"
with_items:
- {name: external-oci-cloud-config-secret, file: external-oci-cloud-config-secret.yml}
- {name: external-oci-cloud-controller-manager-rbac, file: external-oci-cloud-controller-manager-rbac.yml}
- {name: external-oci-cloud-controller-manager, file: external-oci-cloud-controller-manager.yml}
register: external_oracle_manifests
when: inventory_hostname == groups['kube_control_plane'][0]
tags: external-oci
- name: External OCI Cloud Controller Manager | Apply Manifests
kube:
kubectl: "{{ bin_dir }}/kubectl"
filename: "{{ kube_config_dir }}/{{ item.item.file }}"
state: "latest"
with_items:
- "{{ external_oracle_manifests.results }}"
when:
- inventory_hostname == groups['kube_control_plane'][0]
- not item is skipped
loop_control:
label: "{{ item.item.file }}"
tags: external-oci

10
kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-config-secret.yml.j2 Normal file
View File

@@ -0,0 +1,10 @@
# This YAML file contains secret objects,
# which are necessary to run external oci cloud controller.
kind: Secret
apiVersion: v1
metadata:
name: oci-cloud-controller-manager
namespace: kube-system
data:
cloud-provider.yaml: {{ external_oracle_cloud_config_secret }}

45
kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-config.yml.j2 Normal file
View File

@@ -0,0 +1,45 @@
{% if external_oracle_auth_use_instance_principals %}
useInstancePrincipals: true
{% endif %}
auth:
{% if external_oracle_auth_use_instance_principals %}
useInstancePrincipals: true
{% else %}
useInstancePrincipals: false
region: {{ external_oracle_auth_region }}
tenancy: {{ external_oracle_auth_tenancy }}
user: {{ external_oracle_auth_user }}
key: |
{{ external_oracle_auth_key }}
{% if external_oracle_auth_passphrase is defined %}
# Omit if there is not a password for the key
passphrase: {{ external_oracle_auth_passphrase }}
{% endif %}
fingerprint: {{ external_oracle_auth_fingerprint }}
{% endif %}
compartment: {{ external_oracle_compartment }}
vcn: {{ external_oracle_vcn }}
loadBalancer:
subnet1: {{ external_oracle_load_balancer_subnet1 }}
subnet2: {{ external_oracle_load_balancer_subnet2 }}
securityListManagementMode: {{ external_oracle_load_balancer_security_list_management_mode }}
{% if external_oracle_security_lists is defined and external_oracle_security_lists | length > 0 %}
# Optional specification of which security lists to modify per subnet. This does not apply if security list management is off.
securityLists:
{% for subnet_ocid, list_ocid in external_oracle_load_balancer_security_lists.items() %}
{{ subnet_ocid }}: {{ list_ocid }}
{% endfor %}
{% endif %}
# Optional rate limit controls for accessing OCI API
rateLimiter:
rateLimitQPSRead: {{ external_oracle_ratelimiter_qps_read }}
rateLimitBucketRead: {{ external_oracle_ratelimiter_bucket_read }}
rateLimitQPSWrite: {{ external_oracle_ratelimiter_qps_write }}
rateLimitBucketWrite: {{ external_oracle_ratelimiter_bucket_write }}

42
kubespray/project/roles/kubernetes-apps/cluster_roles/files/oci-rbac.yml → kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-controller-manager-rbac.yml.j2
View File

@@ -9,6 +9,8 @@ apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: system:cloud-controller-manager
labels:
kubernetes.io/cluster-service: "true"
rules:
- apiGroups:
- ""
@@ -32,19 +34,33 @@ rules:
- list
- watch
- patch
- get
- apiGroups:
- ""
resources:
- services/status
verbs:
- patch
- get
- update
- apiGroups:
- ""
resources:
- configmaps
resourceNames:
- "extension-apiserver-authentication"
verbs:
- get
- apiGroups:
- ""
resources:
- events
verbs:
- list
- watch
- create
- patch
- update
@@ -76,6 +92,18 @@ rules:
verbs:
- create
- apiGroups:
- "coordination.k8s.io"
resources:
- leases
verbs:
- get
- create
- update
- delete
- patch
- watch
- apiGroups:
- ""
resources:
@@ -86,12 +114,26 @@ rules:
- get
- update
- apiGroups:
- ""
resources:
- configmaps
resourceNames:
- "extension-apiserver-authentication"
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- serviceaccounts
verbs:
- create
- list
- get
- watch
- apiGroups:
- ""
resources:

24
kubespray/project/roles/kubernetes-apps/cloud_controller/oci/templates/oci-cloud-provider.yml.j2 → kubespray/project/roles/kubernetes-apps/external_cloud_controller/oci/templates/external-oci-cloud-controller-manager.yml.j2
View File

@@ -1,12 +1,3 @@
apiVersion: v1
data:
cloud-provider.yaml: {{ controller_manager_config_base64 }}
kind: Secret
metadata:
name: oci-cloud-controller-manager
namespace: kube-system
type: Opaque
---
apiVersion: apps/v1
kind: DaemonSet
@@ -28,13 +19,8 @@ spec:
component: oci-cloud-controller-manager
tier: control-plane
spec:
{% if oci_cloud_controller_pull_secret is defined %}
imagePullSecrets:
- name: {{ oci_cloud_controller_pull_secret }}
{% endif %}
serviceAccountName: cloud-controller-manager
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
nodeSelector:
node-role.kubernetes.io/control-plane: ""
tolerations:
@@ -44,6 +30,9 @@ spec:
- key: node-role.kubernetes.io/control-plane
operator: Exists
effect: NoSchedule
- key: node-role.kubernetes.io/master
operator: Exists
effect: NoSchedule
volumes:
- name: cfg
secret:
@@ -53,13 +42,14 @@ spec:
path: /etc/kubernetes
containers:
- name: oci-cloud-controller-manager
image: {{ oci_cloud_controller_pull_source }}:{{ oci_cloud_controller_version }}
image: {{ external_oracle_cloud_controller_image_repo }}:{{ external_oracle_cloud_controller_image_tag }}
command: ["/usr/local/bin/oci-cloud-controller-manager"]
args:
- --cloud-config=/etc/oci/cloud-provider.yaml
- --cloud-provider=oci
- --leader-elect-resource-lock=configmaps
- -v=2
- --leader-elect-resource-lock=leases
- --concurrent-service-syncs=3
- --v=2
volumeMounts:
- name: cfg
mountPath: /etc/oci

6
kubespray/project/roles/kubernetes-apps/external_cloud_controller/openstack/OWNERS
View File

@@ -1,6 +0,0 @@
# See the OWNERS docs at https://go.k8s.io/owners
approvers:
reviewers:
- alijahnas
- luckySB

2
kubespray/project/roles/kubernetes-apps/external_cloud_controller/openstack/defaults/main.yml
View File

@@ -21,6 +21,6 @@ external_openstack_cacert: "{{ lookup('env', 'OS_CACERT') }}"
## arg1: "value1"
## arg2: "value2"
external_openstack_cloud_controller_extra_args: {}
external_openstack_cloud_controller_image_tag: "v1.30.0"
external_openstack_cloud_controller_image_tag: "v1.32.0"
external_openstack_cloud_controller_bind_address: 127.0.0.1
external_openstack_cloud_controller_dns_policy: ClusterFirst

2
kubespray/project/roles/kubernetes-apps/external_cloud_controller/vsphere/defaults/main.yml
View File

@@ -8,7 +8,7 @@ external_vsphere_insecure: "true"
## arg1: "value1"
## arg2: "value2"
external_vsphere_cloud_controller_extra_args: {}
external_vsphere_cloud_controller_image_tag: "latest"
external_vsphere_cloud_controller_image_tag: "v1.31.0"
external_vsphere_user: "{{ lookup('env', 'VSPHERE_USER') }}"
external_vsphere_password: "{{ lookup('env', 'VSPHERE_PASSWORD') }}"

2
kubespray/project/roles/kubernetes-apps/external_cloud_controller/vsphere/templates/external-vsphere-cloud-controller-manager-ds.yml.j2
View File

@@ -36,7 +36,7 @@ spec:
serviceAccountName: cloud-controller-manager
containers:
- name: vsphere-cloud-controller-manager
image: {{ gcr_image_repo }}/cloud-provider-vsphere/cpi/release/manager:{{ external_vsphere_cloud_controller_image_tag }}
image: {{ kube_image_repo }}/cloud-pv-vsphere/cloud-provider-vsphere:{{ external_vsphere_cloud_controller_image_tag }}
args:
- --v=2
- --cloud-provider=vsphere

10
kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/defaults/main.yml
View File

@@ -1,10 +0,0 @@
---
cephfs_provisioner_namespace: "cephfs-provisioner"
cephfs_provisioner_cluster: ceph
cephfs_provisioner_monitors: ~
cephfs_provisioner_admin_id: admin
cephfs_provisioner_secret: secret
cephfs_provisioner_storage_class: cephfs
cephfs_provisioner_reclaim_policy: Delete
cephfs_provisioner_claim_root: /volumes
cephfs_provisioner_deterministic_names: true

71
kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/tasks/main.yml
View File

@@ -1,71 +0,0 @@
---
- name: CephFS Provisioner | Remove legacy addon dir and manifests
file:
path: "{{ kube_config_dir }}/addons/cephfs_provisioner"
state: absent
when:
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- upgrade
- name: CephFS Provisioner | Remove legacy namespace
command: >
{{ kubectl }} delete namespace {{ cephfs_provisioner_namespace }}
ignore_errors: true # noqa ignore-errors
when:
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- upgrade
- name: CephFS Provisioner | Remove legacy storageclass
command: >
{{ kubectl }} delete storageclass {{ cephfs_provisioner_storage_class }}
ignore_errors: true # noqa ignore-errors
when:
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- upgrade
- name: CephFS Provisioner | Create addon dir
file:
path: "{{ kube_config_dir }}/addons/cephfs_provisioner"
state: directory
owner: root
group: root
mode: "0755"
when:
- inventory_hostname == groups['kube_control_plane'][0]
- name: CephFS Provisioner | Templates list
set_fact:
cephfs_provisioner_templates:
- { name: 00-namespace, file: 00-namespace.yml, type: ns }
- { name: secret-cephfs-provisioner, file: secret-cephfs-provisioner.yml, type: secret }
- { name: sa-cephfs-provisioner, file: sa-cephfs-provisioner.yml, type: sa }
- { name: clusterrole-cephfs-provisioner, file: clusterrole-cephfs-provisioner.yml, type: clusterrole }
- { name: clusterrolebinding-cephfs-provisioner, file: clusterrolebinding-cephfs-provisioner.yml, type: clusterrolebinding }
- { name: role-cephfs-provisioner, file: role-cephfs-provisioner.yml, type: role }
- { name: rolebinding-cephfs-provisioner, file: rolebinding-cephfs-provisioner.yml, type: rolebinding }
- { name: deploy-cephfs-provisioner, file: deploy-cephfs-provisioner.yml, type: deploy }
- { name: sc-cephfs-provisioner, file: sc-cephfs-provisioner.yml, type: sc }
- name: CephFS Provisioner | Create manifests
template:
src: "{{ item.file }}.j2"
dest: "{{ kube_config_dir }}/addons/cephfs_provisioner/{{ item.file }}"
mode: "0644"
with_items: "{{ cephfs_provisioner_templates }}"
register: cephfs_provisioner_manifests
when: inventory_hostname == groups['kube_control_plane'][0]
- name: CephFS Provisioner | Apply manifests
kube:
name: "{{ item.item.name }}"
namespace: "{{ cephfs_provisioner_namespace }}"
kubectl: "{{ bin_dir }}/kubectl"
resource: "{{ item.item.type }}"
filename: "{{ kube_config_dir }}/addons/cephfs_provisioner/{{ item.item.file }}"
state: "latest"
with_items: "{{ cephfs_provisioner_manifests.results }}"
when: inventory_hostname == groups['kube_control_plane'][0]

7
kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/00-namespace.yml.j2
View File

@@ -1,7 +0,0 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: {{ cephfs_provisioner_namespace }}
labels:
name: {{ cephfs_provisioner_namespace }}

22
kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/clusterrole-cephfs-provisioner.yml.j2
View File

@@ -1,22 +0,0 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: cephfs-provisioner
namespace: {{ cephfs_provisioner_namespace }}
rules:
- apiGroups: [""]
resources: ["persistentvolumes"]
verbs: ["get", "list", "watch", "create", "delete"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "update", "patch"]
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "create", "delete"]

13
kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/clusterrolebinding-cephfs-provisioner.yml.j2
View File

@@ -1,13 +0,0 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: cephfs-provisioner
subjects:
- kind: ServiceAccount
name: cephfs-provisioner
namespace: {{ cephfs_provisioner_namespace }}
roleRef:
kind: ClusterRole
name: cephfs-provisioner
apiGroup: rbac.authorization.k8s.io

34
kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/deploy-cephfs-provisioner.yml.j2
View File

@@ -1,34 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: cephfs-provisioner
namespace: {{ cephfs_provisioner_namespace }}
labels:
app: cephfs-provisioner
version: {{ cephfs_provisioner_image_tag }}
spec:
replicas: 1
selector:
matchLabels:
app: cephfs-provisioner
version: {{ cephfs_provisioner_image_tag }}
template:
metadata:
labels:
app: cephfs-provisioner
version: {{ cephfs_provisioner_image_tag }}
spec:
priorityClassName: {% if cephfs_provisioner_namespace == 'kube-system' %}system-cluster-critical{% else %}k8s-cluster-critical{% endif %}{{ '' }}
serviceAccount: cephfs-provisioner
containers:
- name: cephfs-provisioner
image: {{ cephfs_provisioner_image_repo }}:{{ cephfs_provisioner_image_tag }}
imagePullPolicy: {{ k8s_image_pull_policy }}
env:
- name: PROVISIONER_NAME
value: ceph.com/cephfs
command:
- "/usr/local/bin/cephfs-provisioner"
args:
- "-id=cephfs-provisioner-1"

13
kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/role-cephfs-provisioner.yml.j2
View File

@@ -1,13 +0,0 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: cephfs-provisioner
namespace: {{ cephfs_provisioner_namespace }}
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["create", "get", "delete"]
- apiGroups: [""]
resources: ["endpoints"]
verbs: ["get", "list", "watch", "create", "update", "patch"]

14
kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/rolebinding-cephfs-provisioner.yml.j2
View File

@@ -1,14 +0,0 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: cephfs-provisioner
namespace: {{ cephfs_provisioner_namespace }}
subjects:
- kind: ServiceAccount
name: cephfs-provisioner
namespace: {{ cephfs_provisioner_namespace }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: cephfs-provisioner

6
kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/sa-cephfs-provisioner.yml.j2
View File

@@ -1,6 +0,0 @@
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: cephfs-provisioner
namespace: {{ cephfs_provisioner_namespace }}

15
kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/sc-cephfs-provisioner.yml.j2
View File

@@ -1,15 +0,0 @@
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: {{ cephfs_provisioner_storage_class }}
provisioner: ceph.com/cephfs
reclaimPolicy: {{ cephfs_provisioner_reclaim_policy }}
parameters:
cluster: {{ cephfs_provisioner_cluster }}
monitors: {{ cephfs_provisioner_monitors }}
adminId: {{ cephfs_provisioner_admin_id }}
adminSecretName: cephfs-provisioner
adminSecretNamespace: {{ cephfs_provisioner_namespace }}
claimRoot: {{ cephfs_provisioner_claim_root }}
deterministicNames: "{{ cephfs_provisioner_deterministic_names | bool | lower }}"

9
kubespray/project/roles/kubernetes-apps/external_provisioner/cephfs_provisioner/templates/secret-cephfs-provisioner.yml.j2
View File

@@ -1,9 +0,0 @@
---
kind: Secret
apiVersion: v1
metadata:
name: cephfs-provisioner
namespace: {{ cephfs_provisioner_namespace }}
type: Opaque
data:
secret: {{ cephfs_provisioner_secret | b64encode }}

13
kubespray/project/roles/kubernetes-apps/external_provisioner/meta/main.yml
View File

@@ -9,19 +9,6 @@ dependencies:
- local-volume-provisioner
- external-provisioner
- role: kubernetes-apps/external_provisioner/cephfs_provisioner
when: cephfs_provisioner_enabled
tags:
- apps
- cephfs-provisioner
- external-provisioner
- role: kubernetes-apps/external_provisioner/rbd_provisioner
when: rbd_provisioner_enabled
tags:
- apps
- rbd-provisioner
- external-provisioner
- role: kubernetes-apps/external_provisioner/local_path_provisioner
when: local_path_provisioner_enabled
tags:

17
kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/defaults/main.yml
View File

@@ -1,17 +0,0 @@
---
rbd_provisioner_namespace: "rbd-provisioner"
rbd_provisioner_replicas: 2
rbd_provisioner_monitors: ~
rbd_provisioner_pool: kube
rbd_provisioner_admin_id: admin
rbd_provisioner_secret_name: ceph-secret-admin
rbd_provisioner_secret: ceph-key-admin
rbd_provisioner_user_id: kube
rbd_provisioner_user_secret_name: ceph-secret-user
rbd_provisioner_user_secret: ceph-key-user
rbd_provisioner_user_secret_namespace: rbd-provisioner
rbd_provisioner_fs_type: ext4
rbd_provisioner_image_format: "2"
rbd_provisioner_image_features: layering
rbd_provisioner_storage_class: rbd
rbd_provisioner_reclaim_policy: Delete

71
kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/tasks/main.yml
View File

@@ -1,71 +0,0 @@
---
- name: RBD Provisioner | Remove legacy addon dir and manifests
file:
path: "{{ kube_config_dir }}/addons/rbd_provisioner"
state: absent
when:
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- upgrade
- name: RBD Provisioner | Remove legacy namespace
command: >
{{ kubectl }} delete namespace {{ rbd_provisioner_namespace }}
ignore_errors: true # noqa ignore-errors
when:
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- upgrade
- name: RBD Provisioner | Remove legacy storageclass
command: >
{{ kubectl }} delete storageclass {{ rbd_provisioner_storage_class }}
ignore_errors: true # noqa ignore-errors
when:
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- upgrade
- name: RBD Provisioner | Create addon dir
file:
path: "{{ kube_config_dir }}/addons/rbd_provisioner"
state: directory
owner: root
group: root
mode: "0755"
when:
- inventory_hostname == groups['kube_control_plane'][0]
- name: RBD Provisioner | Templates list
set_fact:
rbd_provisioner_templates:
- { name: 00-namespace, file: 00-namespace.yml, type: ns }
- { name: secret-rbd-provisioner, file: secret-rbd-provisioner.yml, type: secret }
- { name: sa-rbd-provisioner, file: sa-rbd-provisioner.yml, type: sa }
- { name: clusterrole-rbd-provisioner, file: clusterrole-rbd-provisioner.yml, type: clusterrole }
- { name: clusterrolebinding-rbd-provisioner, file: clusterrolebinding-rbd-provisioner.yml, type: clusterrolebinding }
- { name: role-rbd-provisioner, file: role-rbd-provisioner.yml, type: role }
- { name: rolebinding-rbd-provisioner, file: rolebinding-rbd-provisioner.yml, type: rolebinding }
- { name: deploy-rbd-provisioner, file: deploy-rbd-provisioner.yml, type: deploy }
- { name: sc-rbd-provisioner, file: sc-rbd-provisioner.yml, type: sc }
- name: RBD Provisioner | Create manifests
template:
src: "{{ item.file }}.j2"
dest: "{{ kube_config_dir }}/addons/rbd_provisioner/{{ item.file }}"
mode: "0644"
with_items: "{{ rbd_provisioner_templates }}"
register: rbd_provisioner_manifests
when: inventory_hostname == groups['kube_control_plane'][0]
- name: RBD Provisioner | Apply manifests
kube:
name: "{{ item.item.name }}"
namespace: "{{ rbd_provisioner_namespace }}"
kubectl: "{{ bin_dir }}/kubectl"
resource: "{{ item.item.type }}"
filename: "{{ kube_config_dir }}/addons/rbd_provisioner/{{ item.item.file }}"
state: "latest"
with_items: "{{ rbd_provisioner_manifests.results }}"
when: inventory_hostname == groups['kube_control_plane'][0]

7
kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/00-namespace.yml.j2
View File

@@ -1,7 +0,0 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: {{ rbd_provisioner_namespace }}
labels:
name: {{ rbd_provisioner_namespace }}

26
kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/clusterrole-rbd-provisioner.yml.j2
View File

@@ -1,26 +0,0 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: rbd-provisioner
namespace: {{ rbd_provisioner_namespace }}
rules:
- apiGroups: [""]
resources: ["persistentvolumes"]
verbs: ["get", "list", "watch", "create", "delete"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "update", "patch"]
- apiGroups: [""]
resources: ["services"]
resourceNames: ["kube-dns","coredns"]
verbs: ["list", "get"]
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "create", "delete"]

13
kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/clusterrolebinding-rbd-provisioner.yml.j2
View File

@@ -1,13 +0,0 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: rbd-provisioner
subjects:
- kind: ServiceAccount
name: rbd-provisioner
namespace: {{ rbd_provisioner_namespace }}
roleRef:
kind: ClusterRole
name: rbd-provisioner
apiGroup: rbac.authorization.k8s.io

40
kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/deploy-rbd-provisioner.yml.j2
View File

@@ -1,40 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: rbd-provisioner
namespace: {{ rbd_provisioner_namespace }}
labels:
app: rbd-provisioner
version: {{ rbd_provisioner_image_tag }}
spec:
replicas: {{ rbd_provisioner_replicas }}
strategy:
type: Recreate
selector:
matchLabels:
app: rbd-provisioner
version: {{ rbd_provisioner_image_tag }}
template:
metadata:
labels:
app: rbd-provisioner
version: {{ rbd_provisioner_image_tag }}
spec:
priorityClassName: {% if rbd_provisioner_namespace == 'kube-system' %}system-cluster-critical{% else %}k8s-cluster-critical{% endif %}{{ '' }}
serviceAccount: rbd-provisioner
containers:
- name: rbd-provisioner
image: {{ rbd_provisioner_image_repo }}:{{ rbd_provisioner_image_tag }}
imagePullPolicy: {{ k8s_image_pull_policy }}
env:
- name: PROVISIONER_NAME
value: ceph.com/rbd
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
command:
- "/usr/local/bin/rbd-provisioner"
args:
- "-id=${POD_NAME}"

13
kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/role-rbd-provisioner.yml.j2
View File

@@ -1,13 +0,0 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: rbd-provisioner
namespace: {{ rbd_provisioner_namespace }}
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get"]
- apiGroups: [""]
resources: ["endpoints"]
verbs: ["get", "list", "watch", "create", "update", "patch"]

14
kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/rolebinding-rbd-provisioner.yml.j2
View File

@@ -1,14 +0,0 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: rbd-provisioner
namespace: {{ rbd_provisioner_namespace }}
subjects:
- kind: ServiceAccount
name: rbd-provisioner
namespace: {{ rbd_provisioner_namespace }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: rbd-provisioner

6
kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/sa-rbd-provisioner.yml.j2
View File

@@ -1,6 +0,0 @@
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: rbd-provisioner
namespace: {{ rbd_provisioner_namespace }}

19
kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/sc-rbd-provisioner.yml.j2
View File

@@ -1,19 +0,0 @@
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: {{ rbd_provisioner_storage_class }}
provisioner: ceph.com/rbd
reclaimPolicy: {{ rbd_provisioner_reclaim_policy }}
parameters:
monitors: {{ rbd_provisioner_monitors }}
adminId: {{ rbd_provisioner_admin_id }}
adminSecretNamespace: {{ rbd_provisioner_namespace }}
adminSecretName: {{ rbd_provisioner_secret_name }}
pool: {{ rbd_provisioner_pool }}
userId: {{ rbd_provisioner_user_id }}
userSecretNamespace: {{ rbd_provisioner_user_secret_namespace }}
userSecretName: {{ rbd_provisioner_user_secret_name }}
fsType: "{{ rbd_provisioner_fs_type }}"
imageFormat: "{{ rbd_provisioner_image_format }}"
imageFeatures: {{ rbd_provisioner_image_features }}

18
kubespray/project/roles/kubernetes-apps/external_provisioner/rbd_provisioner/templates/secret-rbd-provisioner.yml.j2
View File

@@ -1,18 +0,0 @@
---
kind: Secret
apiVersion: v1
metadata:
name: {{ rbd_provisioner_secret_name }}
namespace: {{ rbd_provisioner_namespace }}
type: Opaque
data:
secret: {{ rbd_provisioner_secret | b64encode }}
---
kind: Secret
apiVersion: v1
metadata:
name: {{ rbd_provisioner_user_secret_name }}
namespace: {{ rbd_provisioner_user_secret_namespace }}
type: Opaque
data:
key: {{ rbd_provisioner_user_secret | b64encode }}

9
kubespray/project/roles/kubernetes-apps/gateway_api/defaults/main.yml
View File

@@ -1,4 +1,9 @@
---
gateway_api_enabled: false
gateway_api_version: v1.1.0
gateway_api_experimental_channel: false
gateway_api_version: 1.2.1
# `gateway_api_channel` default is "standard".
# "standard" release channel includes all resources that have graduated to GA or beta, including GatewayClass, Gateway, HTTPRoute, and ReferenceGrant.
# "experimental" for some experimental resources and fields. Note that future releases of the API could include breaking changes to experimental resources and fields. For example, any experimental resource or field could be removed in a future release.
# https://gateway-api.sigs.k8s.io/guides/#install-experimental-channel
gateway_api_channel: "standard"

18
kubespray/project/roles/kubernetes-apps/gateway_api/tasks/main.yml
View File

@@ -1,4 +1,9 @@
---
- name: Gateway API | Download YAML
include_tasks: "../../../download/tasks/download_file.yml"
vars:
download: "{{ download_defaults | combine(downloads.gateway_api_crds) }}"
- name: Gateway API | Create addon dir
file:
path: "{{ kube_config_dir }}/addons/gateway_api"
@@ -9,17 +14,12 @@
when:
- inventory_hostname == groups['kube_control_plane'][0]
- name: Gateway API | Set channel
set_fact:
gateway_api_channel: "{{ 'experimental' if gateway_api_experimental_channel else 'standard' }}"
when:
- "inventory_hostname == groups['kube_control_plane'][0]"
- name: Gateway API | Copy Gateway API manifests to remote
template:
src: "{{ gateway_api_channel }}-install.yaml.j2"
- name: Gateway API | Copy YAML from download dir
copy:
src: "{{ local_release_dir }}/gateway-api-{{ gateway_api_channel }}-install.yaml"
dest: "{{ kube_config_dir }}/addons/gateway_api/{{ gateway_api_channel }}-install.yaml"
mode: "0644"
remote_src: true
when:
- "inventory_hostname == groups['kube_control_plane'][0]"

18317
kubespray/project/roles/kubernetes-apps/gateway_api/templates/experimental-install.yaml.j2
View File

File diff suppressed because it is too large Load Diff

13478
kubespray/project/roles/kubernetes-apps/gateway_api/templates/standard-install.yaml.j2
View File

File diff suppressed because it is too large Load Diff

6
kubespray/project/roles/kubernetes-apps/ingress_controller/alb_ingress_controller/OWNERS
View File

@@ -1,6 +0,0 @@
# See the OWNERS docs at https://go.k8s.io/owners
approvers:
- kubespray-approvers
reviewers:
- kubespray-reviewers

4967
kubespray/project/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.crds.yml.j2
View File

File diff suppressed because it is too large Load Diff

38
kubespray/project/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.yml.j2
View File

@@ -422,7 +422,9 @@ rules:
- apiGroups: ["cert-manager.io"]
resources: ["signers"]
verbs: ["approve"]
resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"]
resourceNames:
- "issuers.cert-manager.io/*"
- "clusterissuers.cert-manager.io/*"
---
# Source: cert-manager/deploy/charts/cert-manager/templates/rbac.yaml
# Permission to:
@@ -921,9 +923,7 @@ spec:
capabilities:
drop:
- ALL
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
readOnlyRootFilesystem: true
{% if cert_manager_tolerations %}
tolerations:
{{ cert_manager_tolerations | to_nice_yaml(indent=2) | indent(width=8) }}
@@ -1009,9 +1009,7 @@ spec:
capabilities:
drop:
- ALL
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
readOnlyRootFilesystem: true
env:
- name: POD_NAMESPACE
valueFrom:
@@ -1029,6 +1027,16 @@ spec:
- name: NO_PROXY
value: "{{ cert_manager_no_proxy }}"
{% endif %}
livenessProbe:
httpGet:
port: http-healthz
path: /livez
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
timeoutSeconds: 15
successThreshold: 1
failureThreshold: 8
{% if cert_manager_trusted_internal_ca is defined %}
volumeMounts:
- mountPath: /etc/ssl/certs/internal-ca.pem
@@ -1138,9 +1146,7 @@ spec:
capabilities:
drop:
- ALL
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
readOnlyRootFilesystem: true
env:
- name: POD_NAMESPACE
valueFrom:
@@ -1189,20 +1195,18 @@ webhooks:
rules:
- apiGroups:
- "cert-manager.io"
- "acme.cert-manager.io"
apiVersions:
- "v1"
operations:
- CREATE
- UPDATE
resources:
- "*/*"
- "certificaterequests"
admissionReviewVersions: ["v1"]
# This webhook only accepts v1 cert-manager resources.
# Equivalent matchPolicy ensures that non-v1 resource requests are sent to
# this webhook (after the resources have been converted to v1).
matchPolicy: Equivalent
timeoutSeconds: 10
timeoutSeconds: 30
failurePolicy: Fail
# Only include 'sideEffects' field in Kubernetes 1.12+
sideEffects: None
@@ -1229,8 +1233,8 @@ webhooks:
- name: webhook.cert-manager.io
namespaceSelector:
matchExpressions:
- key: "cert-manager.io/disable-validation"
operator: "NotIn"
- key: cert-manager.io/disable-validation
operator: NotIn
values:
- "true"
rules:
@@ -1249,7 +1253,7 @@ webhooks:
# Equivalent matchPolicy ensures that non-v1 resource requests are sent to
# this webhook (after the resources have been converted to v1).
matchPolicy: Equivalent
timeoutSeconds: 10
timeoutSeconds: 30
failurePolicy: Fail
sideEffects: None
clientConfig:

2
kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/defaults/main.yml
View File

@@ -4,7 +4,9 @@ ingress_nginx_host_network: false
ingress_nginx_service_type: LoadBalancer
ingress_nginx_service_nodeport_http: ""
ingress_nginx_service_nodeport_https: ""
ingress_nginx_service_annotations: {}
ingress_publish_status_address: ""
ingress_nginx_publish_service: "{{ ingress_nginx_namespace }}/ingress-nginx"
ingress_nginx_nodeselector:
kubernetes.io/os: "linux"
ingress_nginx_tolerations: []

1
kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/admission-webhook-configuration.yml.j2
View File

@@ -13,6 +13,7 @@ webhooks:
name: ingress-nginx-controller-admission
namespace: {{ ingress_nginx_namespace }}
path: /networking/v1/ingresses
port: 443
failurePolicy: Fail
matchPolicy: Equivalent
name: validate.nginx.ingress.kubernetes.io

42
kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/ds-ingress-nginx-controller.yml.j2
View File

@@ -30,15 +30,18 @@ spec:
- /init_module
image: {{ ingress_nginx_opentelemetry_image_repo }}:{{ ingress_nginx_opentelemetry_image_tag }}
securityContext:
runAsNonRoot: true
runAsUser: 65532
allowPrivilegeEscalation: false
capabilities:
add:
- NET_BIND_SERVICE
drop:
- ALL
readOnlyRootFilesystem: false
runAsGroup: 82
runAsNonRoot: true
runAsUser: 101
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /modules_mount
name: modules
@@ -76,11 +79,12 @@ spec:
{% if ingress_nginx_without_class %}
- --watch-ingress-without-class=true
{% endif %}
{% if ingress_nginx_host_network %}
- --report-node-internal-ip-address
{% endif %}
{% if ingress_publish_status_address != "" %}
- --publish-status-address={{ ingress_publish_status_address }}
{% elif ingress_nginx_host_network %}
- --report-node-internal-ip-address
{% elif ingress_nginx_publish_service != "" %}
- --publish-service={{ ingress_nginx_publish_service }}
{% endif %}
{% for extra_arg in ingress_nginx_extra_args %}
- {{ extra_arg }}
@@ -122,6 +126,26 @@ spec:
{% if not ingress_nginx_host_network %}
hostPort: {{ ingress_nginx_metrics_port }}
{% endif %}
{% if ingress_nginx_configmap_tcp_services %}
{% for port in ingress_nginx_configmap_tcp_services.keys() %}
- name: tcp-port-{{ port }}
containerPort: "{{ port | int }}"
protocol: TCP
{% if not ingress_nginx_host_network %}
hostPort: "{{ port | int }}"
{% endif %}
{% endfor %}
{% endif %}
{% if ingress_nginx_configmap_udp_services %}
{% for port in ingress_nginx_configmap_udp_services.keys() %}
- name: udp-port-{{ port }}
containerPort: "{{ port | int }}"
protocol: UDP
{% if not ingress_nginx_host_network %}
hostPort: "{{ port | int }}"
{% endif %}
{% endfor %}
{% endif %}
{% if ingress_nginx_webhook_enabled %}
- name: webhook
containerPort: 8443

20
kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/svc-ingress-nginx.yml.j2
View File

@@ -7,6 +7,10 @@ metadata:
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
{% if ingress_nginx_service_annotations %}
annotations:
{{ ingress_nginx_service_annotations | to_nice_yaml(indent=2, width=1337) | indent(width=4) }}
{% endif %}
spec:
type: {{ ingress_nginx_service_type }}
ports:
@@ -23,6 +27,22 @@ spec:
protocol: TCP
{% if (ingress_nginx_service_type == 'NodePort' or ingress_nginx_service_type == 'LoadBalancer') and ingress_nginx_service_nodeport_https %}
nodePort: {{ingress_nginx_service_nodeport_https | int}}
{% endif %}
{% if ingress_nginx_configmap_tcp_services %}
{% for port in ingress_nginx_configmap_tcp_services.keys() %}
- name: tcp-port-{{ port }}
port: "{{ port | int }}"
targetPort: "{{ port | int }}"
protocol: TCP
{% endfor %}
{% endif %}
{% if ingress_nginx_configmap_udp_services %}
{% for port in ingress_nginx_configmap_udp_services.keys() %}
- name: udp-port-{{ port }}
port: "{{ port | int }}"
targetPort: "{{ port | int }}"
protocol: UDP
{% endfor %}
{% endif %}
selector:
app.kubernetes.io/name: ingress-nginx

5
kubespray/project/roles/kubernetes-apps/krew/defaults/main.yml
View File

@@ -1,5 +0,0 @@
---
krew_enabled: false
krew_root_dir: "/usr/local/krew"
krew_default_index_uri: https://github.com/kubernetes-sigs/krew-index.git
krew_no_upgrade_check: 0

38
kubespray/project/roles/kubernetes-apps/krew/tasks/krew.yml
View File

@@ -1,38 +0,0 @@
---
- name: Krew | Download krew
include_tasks: "../../../download/tasks/download_file.yml"
vars:
download: "{{ download_defaults | combine(downloads.krew) }}"
- name: Krew | krew env
template:
src: krew.j2
dest: /etc/bash_completion.d/krew
mode: "0644"
- name: Krew | Copy krew manifest
template:
src: krew.yml.j2
dest: "{{ local_release_dir }}/krew.yml"
mode: "0644"
- name: Krew | Install krew # noqa command-instead-of-shell
shell: "{{ local_release_dir }}/krew-{{ host_os }}_{{ image_arch }} install --archive={{ local_release_dir }}/krew-{{ host_os }}_{{ image_arch }}.tar.gz --manifest={{ local_release_dir }}/krew.yml"
environment:
KREW_ROOT: "{{ krew_root_dir }}"
KREW_DEFAULT_INDEX_URI: "{{ krew_default_index_uri | default('') }}"
- name: Krew | Get krew completion
command: "{{ local_release_dir }}/krew-{{ host_os }}_{{ image_arch }} completion bash"
changed_when: false
register: krew_completion
check_mode: false
ignore_errors: true # noqa ignore-errors
- name: Krew | Install krew completion
copy:
dest: /etc/bash_completion.d/krew.sh
content: "{{ krew_completion.stdout }}"
mode: "0755"
become: true
when: krew_completion.rc == 0

10
kubespray/project/roles/kubernetes-apps/krew/tasks/main.yml
View File

@@ -1,10 +0,0 @@
---
- name: Krew | install krew on kube_control_plane
import_tasks: krew.yml
- name: Krew | install krew on localhost
import_tasks: krew.yml
delegate_to: localhost
connection: local
run_once: true
when: kubectl_localhost

7
kubespray/project/roles/kubernetes-apps/krew/templates/krew.j2
View File

@@ -1,7 +0,0 @@
# krew bash env(kubespray)
export KREW_ROOT="{{ krew_root_dir }}"
{% if krew_default_index_uri is defined %}
export KREW_DEFAULT_INDEX_URI='{{ krew_default_index_uri }}'
{% endif %}
export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"
export KREW_NO_UPGRADE_CHECK={{ krew_no_upgrade_check }}

100
kubespray/project/roles/kubernetes-apps/krew/templates/krew.yml.j2
View File

@@ -1,100 +0,0 @@
apiVersion: krew.googlecontainertools.github.com/v1alpha2
kind: Plugin
metadata:
name: krew
spec:
version: "{{ krew_version }}"
homepage: https://krew.sigs.k8s.io/
shortDescription: Package manager for kubectl plugins.
caveats: |
krew is now installed! To start using kubectl plugins, you need to add
krew's installation directory to your PATH:
* macOS/Linux:
- Add the following to your ~/.bashrc or ~/.zshrc:
export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"
- Restart your shell.
* Windows: Add %USERPROFILE%\.krew\bin to your PATH environment variable
To list krew commands and to get help, run:
$ kubectl krew
For a full list of available plugins, run:
$ kubectl krew search
You can find documentation at
https://krew.sigs.k8s.io/docs/user-guide/quickstart/.
platforms:
- uri: {{ krew_download_url }}
sha256: {{ krew_archive_checksum }}
bin: krew
files:
- from: ./krew-darwin_amd64
to: krew
- from: ./LICENSE
to: .
selector:
matchLabels:
os: darwin
arch: amd64
- uri: {{ krew_download_url }}
sha256: {{ krew_archive_checksum }}
bin: krew
files:
- from: ./krew-darwin_arm64
to: krew
- from: ./LICENSE
to: .
selector:
matchLabels:
os: darwin
arch: arm64
- uri: {{ krew_download_url }}
sha256: {{ krew_archive_checksum }}
bin: krew
files:
- from: ./krew-linux_amd64
to: krew
- from: ./LICENSE
to: .
selector:
matchLabels:
os: linux
arch: amd64
- uri: {{ krew_download_url }}
sha256: {{ krew_archive_checksum }}
bin: krew
files:
- from: ./krew-linux_arm
to: krew
- from: ./LICENSE
to: .
selector:
matchLabels:
os: linux
arch: arm
- uri: {{ krew_download_url }}
sha256: {{ krew_archive_checksum }}
bin: krew
files:
- from: ./krew-linux_arm64
to: krew
- from: ./LICENSE
to: .
selector:
matchLabels:
os: linux
arch: arm64
- uri: {{ krew_download_url }}
sha256: {{ krew_archive_checksum }}
bin: krew.exe
files:
- from: ./krew-windows_amd64.exe
to: krew.exe
- from: ./LICENSE
to: .
selector:
matchLabels:
os: windows
arch: amd64

3
kubespray/project/roles/kubernetes-apps/kubelet-csr-approver/meta/main.yml
View File

@@ -13,7 +13,8 @@ dependencies:
namespace: "{{ kubelet_csr_approver_namespace }}"
chart_ref: "{{ kubelet_csr_approver_chart_ref }}"
chart_version: "{{ kubelet_csr_approver_chart_version }}"
wait: true
wait: "{{ kube_network_plugin != 'cni' }}"
atomic: "{{ kube_network_plugin != 'cni' }}"
values: "{{ kubelet_csr_approver_values }}"
repositories:
- name: "{{ kubelet_csr_approver_repository_name }}"

22
kubespray/project/roles/kubernetes-apps/meta/main.yml
View File

@@ -10,12 +10,6 @@ dependencies:
tags:
- helm
- role: kubernetes-apps/krew
when:
- krew_enabled
tags:
- krew
- role: kubernetes-apps/registry
when:
- registry_enabled
@@ -103,20 +97,12 @@ dependencies:
tags:
- container_engine_accelerator
- role: kubernetes-apps/cloud_controller/oci
- role: kubernetes-apps/kubelet-csr-approver
when:
- cloud_provider is defined
- cloud_provider == "oci"
- kubelet_csr_approver_enabled
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- oci
- role: kubernetes-apps/gateway_api
when:
- gateway_api_enabled
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- gateway_api
- kubelet-csr-approver
- role: kubernetes-apps/metallb
when:
@@ -135,7 +121,7 @@ dependencies:
- role: kubernetes-apps/scheduler_plugins
when:
- scheduler_plugins_enabled
- kube_major_version is version('v1.29', '<')
- kube_major_version is version('1.29', '<')
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- scheduler_plugins

5
kubespray/project/roles/kubernetes-apps/metallb/OWNERS
View File

@@ -1,5 +0,0 @@
# See the OWNERS docs at https://go.k8s.io/owners
approvers:
reviewers:
- oomichi

4
kubespray/project/roles/kubernetes-apps/metallb/templates/metallb.yaml.j2
View File

@@ -1716,7 +1716,7 @@ spec:
value: memberlist
- name: METALLB_DEPLOYMENT
value: controller
image: "{{ metallb_controller_image_repo }}:{{ metallb_version }}"
image: "{{ metallb_controller_image_repo }}:{{ metallb_image_tag }}"
livenessProbe:
failureThreshold: 3
httpGet:
@@ -1824,7 +1824,7 @@ spec:
secretKeyRef:
key: secretkey
name: memberlist
image: "{{ metallb_speaker_image_repo }}:{{ metallb_version }}"
image: "{{ metallb_speaker_image_repo }}:{{ metallb_image_tag }}"
livenessProbe:
failureThreshold: 3
httpGet:

6
kubespray/project/roles/kubernetes-apps/metrics_server/defaults/main.yml
View File

@@ -9,6 +9,6 @@ metrics_server_requests_cpu: 100m
metrics_server_requests_memory: 200Mi
metrics_server_host_network: false
metrics_server_replicas: 1
# metrics_server_extra_tolerations: []
# metrics_server_extra_affinity: {}
# metrics_server_nodeselector: {}
metrics_server_extra_tolerations: []
metrics_server_extra_affinity: {}
metrics_server_nodeselector: {}

5
kubespray/project/roles/kubernetes-apps/metrics_server/tasks/main.yml
View File

@@ -1,9 +1,4 @@
---
# If all masters have node role, there are no tainted master and toleration should not be specified.
- name: Check all masters are node or not
set_fact:
masters_are_not_tainted: "{{ groups['kube_node'] | intersect(groups['kube_control_plane']) == groups['kube_control_plane'] }}"
- name: Metrics Server | Delete addon dir
file:
path: "{{ kube_config_dir }}/addons/metrics_server"

20
kubespray/project/roles/kubernetes-apps/metrics_server/templates/metrics-server-deployment.yaml.j2
View File

@@ -85,16 +85,12 @@ spec:
volumes:
- name: tmp
emptyDir: {}
{% if not masters_are_not_tainted or metrics_server_extra_tolerations is defined %}
tolerations:
{% if not masters_are_not_tainted %}
- key: node-role.kubernetes.io/control-plane
effect: NoSchedule
{% endif %}
{% if metrics_server_extra_tolerations is defined %}
{% if metrics_server_extra_tolerations %}
{{ metrics_server_extra_tolerations | list | to_nice_yaml(indent=2) | indent(8) }}
{% endif %}
{% endif %}
{%- endif %}
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
@@ -109,10 +105,10 @@ spec:
topologyKey: kubernetes.io/hostname
namespaces:
- kube-system
{% if metrics_server_extra_affinity is defined %}
{{ metrics_server_extra_affinity | to_nice_yaml | indent(width=8) }}
{% endif %}
{% if metrics_server_nodeselector is defined %}
{% if metrics_server_extra_affinity %}
{{ metrics_server_extra_affinity | to_nice_yaml(indent=2) | indent(8) }}
{%- endif %}
{% if metrics_server_nodeselector %}
nodeSelector:
{{ metrics_server_nodeselector | to_nice_yaml | indent(width=8) }}
{% endif %}
{{ metrics_server_nodeselector | to_nice_yaml(indent=2) | indent(8) }}
{%- endif %}

6
kubespray/project/roles/kubernetes-apps/network_plugin/kube-router/OWNERS
View File

@@ -1,6 +0,0 @@
# See the OWNERS docs at https://go.k8s.io/owners
approvers:
- bozzo
reviewers:
- bozzo

2
kubespray/project/roles/kubernetes-apps/network_plugin/multus/tasks/main.yml
View File

@@ -9,7 +9,7 @@
state: "latest"
delegate_to: "{{ groups['kube_control_plane'][0] }}"
run_once: true
with_items: "{{ (multus_manifest_1.results | default([])) + (multus_nodes_list | map('extract', hostvars, 'multus_manifest_2.results') | default([]) | list) }}"
with_items: "{{ (multus_manifest_1.results | default([])) + (multus_nodes_list | map('extract', hostvars, 'multus_manifest_2') | map('default', []) | list | json_query('[].results')) }}"
loop_control:
label: "{{ item.item.name if item != None else 'skipped' }}"
vars:

5
kubespray/project/roles/kubernetes-apps/persistent_volumes/aws-ebs-csi/OWNERS
View File

@@ -1,5 +0,0 @@
# See the OWNERS docs at https://go.k8s.io/owners
approvers:
- alijahnas
reviewers:

7
kubespray/project/roles/kubernetes-apps/persistent_volumes/meta/main.yml
View File

@@ -1,12 +1,5 @@
---
dependencies:
- role: kubernetes-apps/persistent_volumes/openstack
when:
- cloud_provider is defined
- cloud_provider in [ 'openstack' ]
tags:
- persistent_volumes_openstack
- role: kubernetes-apps/persistent_volumes/cinder-csi
when:
- cinder_csi_enabled

7
kubespray/project/roles/kubernetes-apps/persistent_volumes/openstack/defaults/main.yml
View File

@@ -1,7 +0,0 @@
---
persistent_volumes_enabled: false
storage_classes:
- name: standard
is_default: true
parameters:
availability: nova

20
kubespray/project/roles/kubernetes-apps/persistent_volumes/openstack/tasks/main.yml
View File

@@ -1,20 +0,0 @@
---
- name: Kubernetes Persistent Volumes | Lay down OpenStack Cinder Storage Class template
template:
src: "openstack-storage-class.yml.j2"
dest: "{{ kube_config_dir }}/openstack-storage-class.yml"
mode: "0644"
register: manifests
when:
- inventory_hostname == groups['kube_control_plane'][0]
- name: Kubernetes Persistent Volumes | Add OpenStack Cinder Storage Class
kube:
name: storage-class
kubectl: "{{ bin_dir }}/kubectl"
resource: StorageClass
filename: "{{ kube_config_dir }}/openstack-storage-class.yml"
state: "latest"
when:
- inventory_hostname == groups['kube_control_plane'][0]
- manifests.changed

27
kubespray/project/roles/kubernetes-apps/persistent_volumes/openstack/templates/openstack-storage-class.yml.j2
View File

@@ -1,27 +0,0 @@
{% for class in storage_classes %}
---
kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
name: "{{ class.name }}"
annotations:
storageclass.kubernetes.io/is-default-class: "{{ class.is_default | default(false) | ternary("true","false") }}"
provisioner: kubernetes.io/cinder
{% if class.mount_options is defined %}
mountOptions:
{% for option in class.mount_options | default([]) %}
- "{{ option }}"
{% endfor %}
{% endif %}
parameters:
{% for key, value in (class.parameters | default({})).items() %}
"{{ key }}": "{{ value }}"
{% endfor %}
{% if class.reclaim_policy is defined %}
reclaimPolicy: "{{ class.reclaim_policy }}"
{% endif %}
{% if class.volume_binding_mode is defined %}
volumeBindingMode: "{{ class.volume_binding_mode }}"
{% endif %}
allowVolumeExpansion: {{ expand_persistent_volumes }}
{% endfor %}

6
kubespray/project/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2
View File

@@ -30,6 +30,8 @@ spec:
operator: Exists
- key: node-role.kubernetes.io/control-plane
effect: NoSchedule
- key: node-role.kubernetes.io/master
effect: NoSchedule
{% if policy_controller_extra_tolerations is defined %}
{{ policy_controller_extra_tolerations | list | to_nice_yaml(indent=2) | indent(8) }}
{% endif %}
@@ -59,6 +61,8 @@ spec:
- /usr/bin/check-status
- -r
periodSeconds: 10
securityContext:
runAsNonRoot: true
env:
- name: LOG_LEVEL
value: {{ calico_policy_controller_log_level }}
@@ -68,6 +72,8 @@ spec:
- name: DATASTORE_TYPE
value: kubernetes
{% else %}
- name: ENABLED_CONTROLLERS
value: policy,namespace,serviceaccount,workloadendpoint,node
- name: ETCD_ENDPOINTS
value: "{{ etcd_access_addresses }}"
- name: ETCD_CA_CERT_FILE

15
kubespray/project/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2
View File

@@ -19,19 +19,6 @@ rules:
- watch
- list
- get
- apiGroups:
- ""
resources:
- nodes
verbs:
- get
- apiGroups:
- networking.k8s.io
resources:
- networkpolicies
verbs:
- watch
- list
{% elif calico_datastore == "kdd" %}
# Nodes are watched to monitor for deletions.
- apiGroups: [""]
@@ -67,6 +54,7 @@ rules:
- blockaffinities
- ipamblocks
- ipamhandles
- tiers
verbs:
- get
- list
@@ -101,6 +89,7 @@ rules:
verbs:
# read its own config
- get
- list
# create a default if none exists
- create
# update status

2
kubespray/project/roles/kubernetes-apps/vars/main.yml Normal file
View File

@@ -0,0 +1,2 @@
---
kubectl_apply_stdin: "{{ kubectl }} apply -f - -n {{ namespace }}"