actualized for kubespray version 2.28.0

2025-06-15 20:25:45 +03:00
parent c819d4f51f
commit c2df2abc78
366 changed files with 9939 additions and 40388 deletions
--- a/kubespray/project/roles/kubernetes-apps/ansible/templates/coredns-config.yml.j2
+++ b/kubespray/project/roles/kubernetes-apps/ansible/templates/coredns-config.yml.j2
@@ -68,12 +68,14 @@ data:
 {% endif %}
        }
        prometheus :9153
-        forward . {{ upstream_dns_servers | join(' ') if upstream_dns_servers is defined and upstream_dns_servers | length > 0 else '/etc/resolv.conf' }} {
+        forward . {{ upstream_dns_servers | join(' ') if upstream_dns_servers | length > 0 else '/etc/resolv.conf' }} {
          prefer_udp
          max_concurrent 1000
 {% if dns_upstream_forward_extra_opts is defined %}
 {% for optname, optvalue in dns_upstream_forward_extra_opts.items() %}
-          {{ optname }} {{ optvalue }}
+          {{ (optname ~ ' ' ~ optvalue) | trim }}
+          {# do not add a trailing space when optvalue == ''
+             workaround for: https://github.com/kubernetes/kubernetes/issues/36222 #}
 {% endfor %}
 {% endif %}
        }
--- a/kubespray/project/roles/kubernetes-apps/ansible/templates/dashboard.yml.j2
+++ b/kubespray/project/roles/kubernetes-apps/ansible/templates/dashboard.yml.j2
@@ -17,16 +17,15 @@
 #
 # Example usage: kubectl create -f <this_file>

-{% if dashboard_namespace != "kube-system" %}
+{% if namespace != 'kube-system' %}
 ---
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: {{ dashboard_namespace }}
+  name: {{ namespace }}
  labels:
-    name: {{ dashboard_namespace }}
+    name: {{ namespace }}
 {% endif %}
-
 ---
 # ------------------- Dashboard Secrets ------------------- #
 apiVersion: v1
@@ -35,7 +34,6 @@ metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-certs
-  namespace: {{ dashboard_namespace }}
 type: Opaque

 ---
@@ -45,7 +43,6 @@ metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-csrf
-  namespace: {{ dashboard_namespace }}
 type: Opaque
 data:
  csrf: ""
@@ -57,7 +54,6 @@ metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-key-holder
-  namespace: {{ dashboard_namespace }}
 type: Opaque

 ---
@@ -68,7 +64,6 @@ metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-settings
-  namespace: {{ dashboard_namespace }}

 ---
 # ------------------- Dashboard Service Account ------------------- #
@@ -79,7 +74,6 @@ metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
-  namespace: {{ dashboard_namespace }}

 ---
 # ------------------- Dashboard Role & Role Binding ------------------- #
@@ -89,7 +83,6 @@ metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
-  namespace: {{ dashboard_namespace }}
 rules:
  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
  - apiGroups: [""]
@@ -118,7 +111,6 @@ metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
-  namespace: {{ dashboard_namespace }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
@@ -126,7 +118,7 @@ roleRef:
 subjects:
  - kind: ServiceAccount
    name: kubernetes-dashboard
-    namespace: {{ dashboard_namespace }}
+    namespace: {{ namespace }}

 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -140,7 +132,7 @@ roleRef:
 subjects:
  - kind: ServiceAccount
    name: kubernetes-dashboard
-    namespace: {{ dashboard_namespace }}
+    namespace: {{ namespace }}

 ---
 # ------------------- Dashboard Deployment ------------------- #
@@ -151,7 +143,6 @@ metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
-  namespace: {{ dashboard_namespace }}
 spec:
  replicas: {{ dashboard_replicas }}
  revisionHistoryLimit: 10
@@ -182,7 +173,7 @@ spec:
            - containerPort: 8443
              protocol: TCP
          args:
-            - --namespace={{ dashboard_namespace }}
+            - --namespace={{ namespace }}
 {% if dashboard_use_custom_certs %}
            - --tls-key-file={{ dashboard_tls_key_file }}
            - --tls-cert-file={{ dashboard_tls_cert_file }}
@@ -238,7 +229,6 @@ metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
-  namespace: {{ dashboard_namespace }}
 spec:
  ports:
    - port: 443
@@ -270,7 +260,6 @@ metadata:
  labels:
    k8s-app: kubernetes-metrics-scraper
  name: dashboard-metrics-scraper
-  namespace: {{ dashboard_namespace }}
 spec:
  ports:
    - port: 8000
@@ -287,7 +276,6 @@ metadata:
  labels:
    k8s-app: kubernetes-metrics-scraper
  name: kubernetes-metrics-scraper
-  namespace: {{ dashboard_namespace }}
 spec:
  replicas: 1
  revisionHistoryLimit: 10
--- a/kubespray/project/roles/kubernetes-apps/ansible/templates/dns-autoscaler.yml.j2
+++ b/kubespray/project/roles/kubernetes-apps/ansible/templates/dns-autoscaler.yml.j2
@@ -48,21 +48,7 @@ spec:
        {{ dns_autoscaler_extra_tolerations | list | to_nice_yaml(indent=2) | indent(8) }}
 {% endif %}
      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-          - topologyKey: "kubernetes.io/hostname"
-            labelSelector:
-              matchLabels:
-                k8s-app: dns-autoscaler{{ coredns_ordinal_suffix }}
-        nodeAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            preference:
-              matchExpressions:
-              - key: node-role.kubernetes.io/control-plane
-                operator: In
-                values:
-                - ""
+        {{ dns_autoscaler_affinity | to_nice_yaml(indent=2) | indent(8) }}
      containers:
      - name: autoscaler
        image: "{{ dnsautoscaler_image_repo }}:{{ dnsautoscaler_image_tag }}"
--- a/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-config.yml.j2
+++ b/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-config.yml.j2
@@ -75,6 +75,9 @@ data:
        prometheus {% if nodelocaldns_bind_metrics_host_ip %}{$MY_HOST_IP}{% endif %}:{{ nodelocaldns_prometheus_port }}
    }
    .:53 {
+{% if nodelocaldns_additional_configs is defined %}
+        {{ nodelocaldns_additional_configs | indent(width=8, first=False) }}
+{% endif %}
        errors
        cache 30
        reload
@@ -82,7 +85,9 @@ data:
        bind {{ nodelocaldns_ip }}
        forward . {{ upstreamForwardTarget }}{% if dns_upstream_forward_extra_opts is defined %} {
 {% for optname, optvalue in dns_upstream_forward_extra_opts.items() %}
-          {{ optname }} {{ optvalue }}
+          {{ (optname ~ ' ' ~ optvalue) | trim }}
+          {# do not add a trailing space when optvalue == ''
+             workaround for: https://github.com/kubernetes/kubernetes/issues/36222 #}
 {% endfor %}
        }{% endif %}

@@ -157,6 +162,9 @@ data:
        prometheus {% if nodelocaldns_bind_metrics_host_ip %}{$MY_HOST_IP}{% endif %}:{{ nodelocaldns_secondary_prometheus_port }}
    }
    .:53 {
+{% if nodelocaldns_additional_configs is defined %}
+        {{ nodelocaldns_additional_configs | indent(width=8, first=False) }}
+{% endif %}
        errors
        cache 30
        reload
@@ -164,7 +172,9 @@ data:
        bind {{ nodelocaldns_ip }}
        forward . {{ upstreamForwardTarget }}{% if dns_upstream_forward_extra_opts is defined %} {
 {% for optname, optvalue in dns_upstream_forward_extra_opts.items() %}
-          {{ optname }} {{ optvalue }}
+          {{ (optname ~ ' ' ~ optvalue) | trim }}
+          {# do not add a trailing space when optvalue == ''
+             workaround for: https://github.com/kubernetes/kubernetes/issues/36222 #}
 {% endfor %}
        }{% endif %}

--- a/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-daemonset.yml.j2
+++ b/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-daemonset.yml.j2
@@ -47,7 +47,7 @@ spec:
        - coredns
 {% if enable_nodelocaldns_secondary %}
        - -skipteardown
-{% else %}
+{% endif %}
        ports:
        - containerPort: 53
          name: dns
@@ -55,10 +55,9 @@ spec:
        - containerPort: 53
          name: dns-tcp
          protocol: TCP
-        - containerPort: 9253
+        - containerPort: {{ nodelocaldns_prometheus_port }}
          name: metrics
          protocol: TCP
-{% endif %}
        securityContext:
          privileged: true
 {% if nodelocaldns_bind_metrics_host_ip %}
--- a/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-second-daemonset.yml.j2
+++ b/kubespray/project/roles/kubernetes-apps/ansible/templates/nodelocaldns-second-daemonset.yml.j2
@@ -39,6 +39,10 @@ spec:
            cpu: {{ nodelocaldns_cpu_requests }}
            memory: {{ nodelocaldns_memory_requests }}
        args: [ "-localip", "{{ nodelocaldns_ip }}", "-conf", "/etc/coredns/Corefile", "-upstreamsvc", "coredns", "-skipteardown" ]
+        ports:
+        - containerPort: {{ nodelocaldns_secondary_prometheus_port }}
+          name: metrics
+          protocol: TCP
        securityContext:
          privileged: true
 {% if nodelocaldns_bind_metrics_host_ip %}