External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-10-30 22:16:23 -02:30
Code Issues Packages Projects Releases Wiki Activity
4,208 Commits 61 Branches 91 Tags
0a3cf1a08775d89efa168ce300e115dc486d72f2
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Matthew Mosesohn 6d7f3c4405 Reduce jinja2 filters in coredns templates (#4390) 2019-03-26 11:09:17 -07:00
Matthew Mosesohn b7fd462944 Fix support for ansible 2.7.9 (#4375) 2019-03-20 11:29:42 -07:00
Matthew Mosesohn ec08303f82 Revert "Fix #4237: update kube cert path (#4354)" (#4369) 
This reverts commit ea7a6f1cf1.

This change modified the certs dir for Kubernetes, but did not move the directories for existing clusters.
 2019-03-20 05:56:57 -07:00
Matthew Mosesohn 150a969cf4 Forcefully delete pods when necessary (#4328) 
Pods on down/unresponsive nodes can't be deleted without
--force --grace-period=0.

Fixes #4314
 2019-03-14 07:45:46 -07:00
Matthew Mosesohn fd2c47b56a Move most coredns templates to static files (#4341) 
* Move most coredns templates to static files

This should speed up the task slightly

* yaml lint fixes
 2019-03-12 21:17:31 -07:00
Matthew Mosesohn acbf3db233 Remove hard dependence on facts for all nodes (#4304) 
* Remove hard dependence on facts for all nodes

* Update main.yaml

* Update main.yaml
 2019-03-05 03:04:39 -08:00
Matthew Mosesohn adf6a7121f Reenable set_facts task for dns_late (#4312) 2019-03-01 05:39:30 -08:00
Matthew Mosesohn 4fe61968cf Set default value for local_path_provisioner_enabled in role (#4309) 2019-02-28 05:36:08 -08:00
Matthew Mosesohn b07641c3f3 Move kube_proxy_remove out of set_facts and set default (#4180) 2019-02-25 00:08:06 -08:00
Matthew Mosesohn 4638acfe81 Retry applying podsecurity policies (#4279) 2019-02-24 22:50:55 -08:00
Matthew Mosesohn 8373fa393a Update CNAME 2019-02-07 16:30:25 +03:00
Matthew Mosesohn 613841381d Create CNAME 2019-02-07 16:28:44 +03:00
Matthew Mosesohn 9b5096ab10 Set theme jekyll-theme-slate 2019-02-07 15:47:50 +03:00
Matthew Mosesohn 2e1e27219e Refactor collect-info.yaml playbook (#4157) 
Run only commands that apply to the current deployed cluster (only get
calico info and skip weave/flannel when deploying calico, for example).

Add helm release info if helm is deployed
 2019-02-04 12:46:48 -08:00
Matthew Mosesohn 77d31e679a fixup external kube-apiserver port (#4075) 2019-01-21 14:43:27 +03:00
Matthew Mosesohn 28aee0fc34 Update OWNERS_ALIASES (#4068) 2019-01-18 18:58:04 +03:00
Matthew Mosesohn eecaba6b84 Generate external admin.conf with kubeadm (#4056) 
* Generate external admin.conf with kubeadm

* Fix apiserver sans
 2019-01-16 16:30:50 +03:00
Matthew Mosesohn 50b884a32d Fixup line breaks for kubeadm SANs (#3908) 2018-12-19 02:47:31 -08:00
Matthew Mosesohn 3c44ffcf80 set kubespray-defaults kube_api_anonymous_auth to true (#3909) 2018-12-18 06:53:58 -08:00
Matthew Mosesohn daa290100c Fix helper script to refer to admin.conf as relative path (#3738) 2018-11-19 18:28:51 -08:00
Matthew Mosesohn ac00d23b80 Skip etcd upgrade steps in kubeadm because it is not used (#3737) 2018-11-19 06:29:58 -08:00
Matthew Mosesohn ff09141a14 Retry kubeadm proxy and secondary master init tasks (#3715) 
Due to suboptimal external loadbalancer configs, the LoadBalancer
might point to a downed kube-apiserver that is not set up yet.
 2018-11-15 10:03:23 -08:00
Matthew Mosesohn 2ba4e9bda5 Skip most of kubernetes/preinstall role during late DNS config (#3627) 
When using resolvconf_mode host_resolvconf, there is an early DNS
config stage where Kubernetes cluster DNS is not injected for host
DNS intially. Later, the cluster DNS is enabled, but we do not
need to run every task from the kubernetes/preinstall role.
 2018-11-01 08:08:50 -07:00
Matthew Mosesohn bc74a37696 Calculate etcd client cert serial for appropriate groups (#3605) 
Standalone etcd nodes do not generate node-$hostname certs and do
not need this serial calculated.
 2018-11-01 05:50:26 -07:00
Matthew Mosesohn 152c15b19f Disable gather facts when checking ansible version (#3615) 2018-10-31 03:19:17 -07:00
Matthew Mosesohn 7e84de2ae1 Purge /root/.kube/config when migrating to kubeadm (#3566) 2018-10-23 05:09:11 -07:00
Matthew Mosesohn 127969d65f Align node-role value for kubeadm compatibility (#3558) 
kubeadm sets node label node-role.kubernetes.io/master=''
and this is not configurable. We should use it everywhere.
 2018-10-20 07:12:54 -07:00
Matthew Mosesohn 4bdd0ce417 Allow kubeadm master untaint to fail (#3549) 2018-10-19 00:38:12 -07:00
Matthew Mosesohn 4b7d59224d Fix tag based deploy of apps by skipping kubeadm dns tasks (#3462) 2018-10-08 01:22:57 -07:00
Matthew Mosesohn fe35c32c62 Fix tiller override command 2018-09-15 16:35:19 +03:00
Matthew Mosesohn 55d76ea3d8 Update install.yml 2018-09-13 12:04:53 +03:00
Matthew Mosesohn 1091e82327 Update install.yml 2018-09-12 22:15:46 +03:00
Matthew Mosesohn cc79125d3e Update install.yml 2018-09-12 17:03:55 +03:00
Matthew Mosesohn dc3e317d20 Fix backward compatibility with calico 2.6 2018-09-06 15:54:20 +03:00
Matthew Mosesohn ea918e1999 Reduce instance sizes in gce 2018-09-06 15:22:46 +03:00
Matthew Mosesohn b614a3504b Fix openstack cacert task 2018-09-06 14:06:06 +03:00
Matthew Mosesohn cd8e469b9c Add missing variable kube_proxy_nodeport_addresses 2018-09-06 13:36:17 +03:00
Matthew Mosesohn 991b3dbe54 put back endif in kubelet rkt template 2018-09-06 13:21:22 +03:00
Matthew Mosesohn faedfb6307 remove broken endifs in kubelet rkt mode 2018-09-06 11:59:25 +03:00
Matthew Mosesohn fd57fde075 Always run helm init to allow for settings changes 2018-09-03 11:16:01 +03:00
Matthew Mosesohn 581a30fdec Remove erroneous cloud-config task 2018-08-10 15:59:18 +03:00
Matthew Mosesohn 8b3ce6e418 bump upgrade tests to v2.5.0 commit (#3087) 2018-08-10 13:05:05 +03:00
Matthew Mosesohn 97e0de7e29 Fix vault file owner issues and k8s apiserver cert creation (#2985) 
apiserver cert should be created only once
 2018-07-11 14:58:02 +03:00
Matthew Mosesohn 5c617c5a8b Add tags to deploy components by --tags option (#2960) 
* Add tags for cert serial tasks

This will help facilitate tag-based deployment of specific components.

* fixup kubernetes node
 2018-07-06 09:12:13 +03:00
Matthew Mosesohn 0b939a495b Improve vault etcd initialization check (#2959) 2018-07-05 12:27:45 +03:00
Matthew Mosesohn 77c910c1c3 Fixup vault etcd check (#2938) 
* Fixup vault etcd

* Update main.yml
 2018-07-02 15:37:37 +03:00
Matthew Mosesohn c20196f9a0 Remove modprobe binary from kubelet rkt deployment (#2917) 2018-07-02 15:37:24 +03:00
Matthew Mosesohn a36e3fbec3 Add rkt gc task (#2945) 2018-06-29 19:53:21 +03:00
Matthew Mosesohn 59be578842 Revert "wip pr for improved cert sync" (#2849) 2018-06-06 17:22:25 +03:00
Matthew Mosesohn 7c93e71801 Upgrade k8s to 1.10.2 (#2748) 
* Upgrade k8s to 1.10.2

Bumped etcd version to 3.2.16 as recommended

* Add ipvs fix for v1.10

* change flannel addons test to ha
 2018-05-15 16:00:29 +03:00
Matthew Mosesohn 07cc981971 refactor vault role (#2733) 
* Move front-proxy-client certs back to kube mount

We want the same CA for all k8s certs

* Refactor vault to use a third party module

The module adds idempotency and reduces some of the repetitive
logic in the vault role

Requires ansible-modules-hashivault on ansible node and hvac
on the vault hosts themselves

Add upgrade test scenario
Remove bootstrap-os tags from tasks

* fix upgrade issues

* improve unseal logic

* specify ca and fix etcd check

* Fix initialization check

bump machine size
 2018-05-11 19:11:38 +03:00
Matthew Mosesohn 1a14f1ecc1 Fix vol format for local volume provisioner in rkt (#2698) 2018-04-24 20:32:08 +03:00
Matthew Mosesohn 51f4e6585a Revert "Add openSUSE support" (#2697) 2018-04-23 14:28:24 +03:00
Matthew Mosesohn 0945eb990a Make it possible to skip docker role as a var (#2686) 2018-04-19 16:47:20 +03:00
Matthew Mosesohn 02cd5418c2 Weave limits (#2660) 
* Raise limits for weave

* Adjust weave limits
 2018-04-15 18:32:49 +03:00
Matthew Mosesohn 49e3665d96 Remove prometheus operator from Kubespray (#2658) 
Kubespray should not install any helm charts. This is a task
that a user should do on his/her own through ansible or another
tool. It opens the door to wrapping installation of any helm
chart.
 2018-04-13 18:53:39 +03:00
Matthew Mosesohn e95ba800ea Define local volume provisioner dirs in defaults (#2656) 2018-04-13 17:23:10 +03:00
Matthew Mosesohn f73717ea35 Mount local volume provisioner dirs for containerized kubelet (#2648) 2018-04-12 22:55:13 +03:00
Matthew Mosesohn 09f93d9e0c Fix CI upgrade scenario by using dynamic inventory file (#2635) 
Also updates the commit ID we use as a basis for upgrade tests.
 2018-04-10 16:02:33 +03:00
Matthew Mosesohn 45f15bf753 Revert "Fix new envvar for setting openstack_tenant_id" (#2640) 2018-04-10 14:37:24 +03:00
Matthew Mosesohn 3004791c64 Add pre-upgrade task for moving credentials file (#2394) 
* Add pre-upgrade task for moving credentials file

This reverts commit 7ef9f4dfdd.

* add python interpreter workaround for localhost
 2018-04-02 11:19:23 +03:00
Matthew Mosesohn 03bcfa7ff5 Stop templating kube-system namespace and creating it (#2545) 
Kubernetes makes this namespace automatically, so there is
no need for kubespray to manage it.
 2018-03-30 14:29:13 +03:00
Matthew Mosesohn 9837b7926f Use proper lookup of etcd host for calico (#2408) 
Fixes #2397
 2018-03-02 15:36:52 +03:00
Matthew Mosesohn 7ef9f4dfdd Revert "Add pre-upgrade task for moving credentials file" (#2393) 2018-02-28 22:41:52 +03:00
Matthew Mosesohn bc0fc5df98 Use node cert for etcd tasks instead of delegating to first etcd (#2386) 
For etcdctl commands, use admin cert instead of node because this file
doesn't exist on etcd only hosts.
 2018-02-27 22:23:51 +03:00
Matthew Mosesohn bb469005b2 Add pre-upgrade task for moving credentials file 2018-02-27 17:35:15 +03:00
Matthew Mosesohn 5903aea86f Update coreos-calico-aio scenario to test no group vars (#2314) 
This updated scenario ensures deployment still passes without
having any group_vars available.
 2018-02-12 12:38:06 +01:00
Matthew Mosesohn 16629d0b8e Vault should use cert auth for etcd 2018-01-31 20:37:14 +03:00
Matthew Mosesohn 2df4b6c5d2 Rename default_resolver to cloud_resolver (#2209) 
Cloud resolvers are mandatory for hosts on GCE and OpenStack
clouds. The 8.8.8.8 alternative resolver was dropped because
there is already a default nameserver. The new var name
reflects the purpose better.

Also restart apiserver when modifying dns settings.
 2018-01-31 00:26:07 +03:00
Matthew Mosesohn 62dd3d2a9d Add missing group var default values to kubespray-defaults 2018-01-30 16:04:00 +03:00
Matthew Mosesohn dc6a17e092 Use include/import tasks (#2192) 
import_tasks will consume far less memory, so it should be
used whenever it is compatible.
 2018-01-29 14:37:48 +03:00
Matthew Mosesohn ac66e98ae9 Upgrade to Kubernetes v1.9.1 (#2152) 
Raise drain timeout to 5m
 2018-01-25 18:44:44 +03:00
Matthew Mosesohn d2935ffed0 Optionally ignore the presence of extra calico pools (#2190) 2018-01-25 18:44:20 +03:00
Matthew Mosesohn bf1411060e Add optional manual dns_mode (#2178) 2018-01-23 14:28:42 +01:00
Matthew Mosesohn 1401286910 Add support for cert alt names for etcd (#2139) 
* Add support for cert alt names for etcd

* Update gen_certs_vault.yml
 2018-01-09 14:37:34 +03:00
Matthew Mosesohn ad6fecefa8 Update Kubernetes to v1.9.0 (#2100) 
Update checksum for kubeadm
Use v1.9.0 kubeadm params
Include hash of ca.crt for kubeadm join
Update tag for testing upgrades
Add workaround for testing upgrades
Remove scale CI scenarios because of slow inventory parsing
in ansible 2.4.x.

Change region for tests to us-central1 to
improve ansible performance
 2017-12-25 08:57:45 +00:00
Matthew Mosesohn 29f5b55d42 remove unwanted whitespace for kube_override_hostname (#2105) 2017-12-22 11:31:18 +00:00
Matthew Mosesohn 6bb46e3ecb Fix param names in preparation for Kubernetes v1.9.0 (#2098) 
This does not update v1.9.0, but fixes two incompatibilities
when trying to deploy v1.9.0.
 2017-12-20 10:48:09 +00:00
Matthew Mosesohn 127bc01857 Do not override kubelet hostname if cloud_provider is used (#2095) 
Starting with Kubernetes v1.8.4, kubelet ignores the AWS cloud
provider string and uses the override hostname, which fails
Node admission checks.

Fixes #2094
 2017-12-19 20:18:20 +00:00
Matthew Mosesohn bfb25fa47b Change vault cert ttl to 8y (#2013) 2017-12-15 13:34:00 +00:00
Matthew Mosesohn b135bcb9d9 Split download container task for delegate and non-delegate modes (#2077) 
Ansible cannot seem to handle omitting delegate_to since v2.4.0.0.

Possibly related: https://github.com/ansible/ansible/issues/30760
 2017-12-14 16:45:54 +00:00
Matthew Mosesohn 952ec65a40 Remove RBAC from boolean checks 2017-12-06 11:57:40 +03:00
Matthew Mosesohn a0225507a0 Set helm deployment type to host (#2012) 2017-11-29 19:52:54 +00:00
Matthew Mosesohn 4d3326b542 Raise default vault lease TTL to 10y (#2008) 2017-11-29 10:38:59 +00:00
Matthew Mosesohn ec54b36e05 add retries for calico/canal etcd commands (#2007) 2017-11-28 16:39:55 +00:00
Matthew Mosesohn 67419e8d0a Run rotate_tokens role only once (#1970) 2017-11-15 18:50:23 +00:00
Matthew Mosesohn a67349b076 Disable initializers feature gate if istio is not used 2017-11-15 12:56:36 +00:00
Matthew Mosesohn f9b68a5d17 Revert "Support for disabling apiserver insecure port" (#1974) 2017-11-14 13:41:28 +00:00
Matthew Mosesohn ab3832f3e7 Set host IP for kubelet always (#1924) 
* Set host IP for kubelet always

Use ansible default IP if ip var is not set.

* Update main.yml
 2017-11-03 10:19:37 +00:00
Matthew Mosesohn 66c67dbe73 Add optional helm deployment mode for host (#1920) 2017-11-03 07:09:24 +00:00
Matthew Mosesohn c0e989b17c New addon: local_volume_provisioner (#1909) 2017-11-01 14:25:35 +00:00
Matthew Mosesohn fe81bba08d Force kubelet certificates to be generated as lowercase (#1886) 
All nodes get converted to lowercase, so certs should set
CN with lowercase as well.
 2017-10-27 15:58:25 +01:00
Matthew Mosesohn b0f04d925a Update network policy setting for Kubernetes 1.8 (#1879) 
It is now enabled by default in 1.8 with the api changed
to networking.k8s.io/v1 instead of extensions/v1beta1.
 2017-10-26 15:35:26 +01:00
Matthew Mosesohn 7b78e68727 disable idempotency tests (#1872) 2017-10-26 15:35:12 +01:00
Matthew Mosesohn 86fb669fd3 Idempotency fixes (#1838) 2017-10-25 21:19:40 +01:00
Matthew Mosesohn 7123956ecd update checksum for kubeadm (#1869) 2017-10-25 21:15:16 +01:00
Matthew Mosesohn a52bc44f5a Fix broken CI jobs (#1854) 
* Fix broken CI jobs

Adjust image and image_family scenarios for debian.
Checkout CI file for upgrades

* add debugging to file download

* Fix download for alternate playbooks

* Update ansible ssh args to force ssh user

* Update sync_container.yml
 2017-10-25 11:45:54 +01:00
Matthew Mosesohn acb63a57fa Only limit etcd memory on small hosts (#1860) 
Also disable oom killer on etcd
 2017-10-25 10:25:15 +01:00
Matthew Mosesohn 33c4d64b62 Make ClusterRoleBinding to admit all nodes with right cert (#1861) 
This is to work around #1856 which can occur when kubelet
hostname and resolvable hostname (or cloud instance name)
do not match.
 2017-10-24 17:05:58 +01:00
Matthew Mosesohn 25de6825df Update Kubernetes to v1.8.1 (#1858) 2017-10-24 17:05:45 +01:00