External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-05-23 08:37:54 -02:30
Code Issues Packages Projects Releases Wiki Activity

Move calico-policy-controller into separate role

Browse Source 
By default Calico CNI does not create any network access policies
or profiles if 'policy' is enabled in CNI config. And without any
policies/profiles network access to/from PODs is blocked.

K8s related policies are created by calico-policy-controller in
such case. So we need to start it as soon as possible, before any
real workloads.

This patch also fixes kube-api port in calico-policy-controller
yaml template.

Closes #1132
This commit is contained in:
Aleksandr Didenko
2017-03-13 16:04:31 +01:00
parent 565d4a53b0
commit 3a39904011
11 changed files with 33 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
roles/kubernetes-apps/ansible/tasks/main.yml
View File

@@ -32,11 +32,6 @@
when: dns_mode != 'none' and inventory_hostname == groups['kube-master'][0]
tags: dnsmasq
- include: tasks/calico-policy-controller.yml
when: ( enable_network_policy is defined and enable_network_policy == True ) or
( kube_network_plugin == 'canal' )
tags: [network, canal]
- name: Kubernetes Apps | Netchecker
include: tasks/netchecker.yml
when: deploy_netchecker