External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-10-30 22:16:23 -02:30
Code Issues Packages Projects Releases Wiki Activity
4,486 Commits 61 Branches 91 Tags
2aa66eb12de71d0e72fc89d2cce58f62d0a257d3
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Matthew Mosesohn 2aa66eb12d Default to refreshing kubeadm etcd key (#4931) 
Change-Id: Icc0176773b6d581c43647de433214079440d7321
 2019-06-30 03:37:22 -07:00
Matthew Mosesohn bc7d1f36ea Remove wasteful extra gather facts step (#4928) 
Ansible will gather facts on the preinstall/download role
automatically at the start of that play.
 2019-06-27 06:25:21 -07:00
Matthew Mosesohn 80fa294a31 Disable redundant CI test cases (#4918) 
Change-Id: I1991bca8368adc20832d2bb15644411653446b51
 2019-06-27 04:49:22 -07:00
Matthew Mosesohn 465dfd68bc Fix empty kube_override_hostname in apiserver_sans (#4916) 
kubernetes/master role defines this value as an empty string
when using a cloud provider, not undefined. The check was updated
accordingly.

Change-Id: I58dc31ef4fd568a717a6753eb89ca687933018ae
 2019-06-25 08:00:37 -07:00
Matthew Mosesohn 73f45fbe94 Revert "Filter undefined SANs for apiserver cert (#4913)" (#4914) 
This reverts commit d270678bda.
 2019-06-25 06:56:00 -07:00
Matthew Mosesohn d270678bda Filter undefined SANs for apiserver cert (#4913) 
Change-Id: I37442fb095fb4217f67f74744ad07c1d5d8229ea
 2019-06-25 05:54:36 -07:00
Matthew Mosesohn 6025981ceb Allow skip kubeadm image prep but install kubeadm (#4904) 
Change-Id: I744e9a192cd863a1ce22fbd16d217c5dfb16750c
 2019-06-23 23:17:56 -07:00
Matthew Mosesohn 4348e78b24 Enable kubeadm etcd mode (#4818) 
* Enable kubeadm etcd mode

Uses cert commands from kubeadm experimental control plane to
enable non-master nodes to obtain etcd certs.

Related story: PROD-29434

Change-Id: Idafa1d223e5c6ceadf819b6f9c06adf4c4f74178

* Add validation checks and exclude calico kdd mode

Change-Id: Ic234f5e71261d33191376e70d438f9f6d35f358c

* Move etcd mode test to ubuntu flannel HA job

Change-Id: I9af6fd80a1bbb1692ab10d6da095eb368f6bc732

* rename etcd_mode to etcd_kubeadm_enabled

Change-Id: Ib196d6c8a52f48cae370b026f7687ff9ca69c172
 2019-06-20 11:12:51 -07:00
Matthew Mosesohn f504d0ea99 Remove invalid field dnsPolicy from podSecurityPolicy (#4863) 
Change-Id: I02864011bf5fda5dbd35c7513c73875769036f87
 2019-06-10 07:11:10 -07:00
Matthew Mosesohn 3b7797b1a1 Ensure haproxy and nginx reload when config changes (#4862) 
Change-Id: Ia9a41e7b1cfcb1e6acb2dbae6eecc541dce25a74
 2019-06-10 05:59:08 -07:00
Matthew Mosesohn 3617ae31f6 Optionally skip predownload of kubeadm images (#4832) 2019-06-04 04:35:02 -07:00
Matthew Mosesohn 6347419233 Avoid duplicating nameservers (#4833) 2019-06-04 00:13:02 -07:00
Matthew Mosesohn 15eb7db36d Fix k8s api endpoint for secondary nodes in control plane mode (#4675) 
Change-Id: I1588458b54c52443ad8d0afbd266f77ac0afea67
 2019-04-29 07:50:24 -07:00
Matthew Mosesohn a5b46bfc8c Run dns_late preinstall tasks on all k8s nodes (#4672) 
* Run dns_late preinstall tasks on all k8s nodes

Related issue: #4656

Change-Id: I63f8559ef1a497b7580ab084561e6603fe647834

* Fix ansible-lint

Change-Id: Ia5b33fa63dbc36d8c3e9557ef3f2ea02af2325a5

* Fix recover_control_plane lint issues

Change-Id: I16643a3193c11b6ba704e9698812cac7e4fd19a8
 2019-04-29 05:12:21 -07:00
Matthew Mosesohn 741de6051c Fix nodeselectors for contiv and nginx-ingress (#4662) 
* Fix nodeselectors for contiv and nginx-ingress

Change-Id: Ib3eb6bd87193c69a90ee944c9164a0b6792c79ba

* Set kube proxy mode to iptables for addons task

Change-Id: Iff71a71f672405c74b4708c71db15ddc4391a53a
 2019-04-28 23:36:19 -07:00
Matthew Mosesohn 338eb4ce65 Fix kubeadm upload certs with when condition (#4659) 
* Fix kubeadm upload certs with when condition

Change-Id: I916dd2375b71eea2386047c7f185a2f8361f7a61

* Update kubeadm-secondary-experimental.yml
 2019-04-27 01:14:20 -07:00
Matthew Mosesohn 009e208bcd Remove RHEL from packet deploy (#4661) 
Change-Id: I131d77bb9d16cc0f252dd86166c29f72daa9a64a
 2019-04-26 09:56:29 -07:00
Matthew Mosesohn 81e6877b02 Make cilium tests pass (#4660) 
Cilium requires a high kernel. rhel7 and centos7 are too low, so they are removed.
Bumping ubuntu to ubuntu-1804

Change-Id: Ib1bffa45b8f9ed0ba500f751714372b3a3f7878b
 2019-04-26 05:54:37 -07:00
Matthew Mosesohn c9ed5f69d7 Prepend docker.io for all docker hub images (#4648) 
Change-Id: I71dc793641bc168e40419e38f33f68f5325e77a9
 2019-04-25 01:34:46 -07:00
Matthew Mosesohn 4d57ed314d Clean up check for setting kubeadm certificate key (#4634) 
Change-Id: I2c97c4753089eb3ec2e6b01b2681a8be98ecbb57
 2019-04-24 07:14:12 -07:00
Matthew Mosesohn fc072300ea Purge legacy cleanup tasks from older than 1 year (#4450) 
We don't need to support upgrades from 2 year old installs,
just from the last major version.

Also changed most retried tasks to 1s delay instead of longer.
 2019-04-24 00:08:05 -07:00
Matthew Mosesohn d6d7458d68 Fix control plane setup without a hardcoded key (#4610) 2019-04-23 14:37:59 -07:00
Matthew Mosesohn d89ecb8308 disable metrics server and fix terraform (#4617) 
* disable metrics server in centos7-flannel-addons job

Change-Id: I1d87923547584896f64dda9ea8feb5581ad48cbe

* Fix tf facility->facilities syntax

Change-Id: I434bfe53f47e8e4a546890e0b62d24bde6e6d6a7

* Update Terraform CI for facilities

* Fix undefined variable error
 2019-04-23 12:06:03 -07:00
Matthew Mosesohn 09fe95bc60 Avoid creating k8s cert dir on non-k8s nodes (#4602) 2019-04-21 15:27:43 -07:00
Matthew Mosesohn 05dc2b3a09 Use K8s 1.14 and add kubeadm experimental control plane mode (#4514) 
* Use K8s 1.14 and add kubeadm experimental control plane mode

This reverts commit d39c273d96.

* Cleanup kubeadm setup run on first master

* pin kubeadm_certificate_key in test

* Remove kubelet autolabel of kube-node, add symlink for pki dir

Change-Id: Id5e74dd667c60675dbfe4193b0bc9fb44380e1ca
 2019-04-19 06:01:54 -07:00
Matthew Mosesohn c5fb734098 Switch calicoctl from a container to a binary (#4524) 2019-04-15 04:24:04 -07:00
Matthew Mosesohn d39c273d96 Revert "Use K8s 1.14 and add kubeadm experimental control plane mode (#4317)" (#4510) 
This reverts commit 316508626d.
 2019-04-11 12:52:43 -07:00
Matthew Mosesohn 316508626d Use K8s 1.14 and add kubeadm experimental control plane mode (#4317) 
* Use Kubernetes 1.14 and experimental control plane support

* bump to v1.14.0
 2019-04-11 05:30:13 -07:00
Matthew Mosesohn 4fe2aa6bf7 Use install_cni init container for cni copy for calico/canal (#4416) 2019-04-02 03:32:36 -07:00
Matthew Mosesohn 5f12b7aedf Remove kubedns and dnsmasq. Move dns_late phase after apps (#4406) 
Both kubedns and dnsmasq modes are long not maintained.
We should run dns_late steps at the end because sshd
makes DNS lookups during Ansible run and has 2s timeouts
for each failed lookup trying to connect to coredns before
it is ready.
 2019-04-01 12:32:34 -07:00
Matthew Mosesohn 6d7f3c4405 Reduce jinja2 filters in coredns templates (#4390) 2019-03-26 11:09:17 -07:00
Matthew Mosesohn b7fd462944 Fix support for ansible 2.7.9 (#4375) 2019-03-20 11:29:42 -07:00
Matthew Mosesohn ec08303f82 Revert "Fix #4237: update kube cert path (#4354)" (#4369) 
This reverts commit ea7a6f1cf1.

This change modified the certs dir for Kubernetes, but did not move the directories for existing clusters.
 2019-03-20 05:56:57 -07:00
Matthew Mosesohn 150a969cf4 Forcefully delete pods when necessary (#4328) 
Pods on down/unresponsive nodes can't be deleted without
--force --grace-period=0.

Fixes #4314
 2019-03-14 07:45:46 -07:00
Matthew Mosesohn fd2c47b56a Move most coredns templates to static files (#4341) 
* Move most coredns templates to static files

This should speed up the task slightly

* yaml lint fixes
 2019-03-12 21:17:31 -07:00
Matthew Mosesohn acbf3db233 Remove hard dependence on facts for all nodes (#4304) 
* Remove hard dependence on facts for all nodes

* Update main.yaml

* Update main.yaml
 2019-03-05 03:04:39 -08:00
Matthew Mosesohn adf6a7121f Reenable set_facts task for dns_late (#4312) 2019-03-01 05:39:30 -08:00
Matthew Mosesohn 4fe61968cf Set default value for local_path_provisioner_enabled in role (#4309) 2019-02-28 05:36:08 -08:00
Matthew Mosesohn b07641c3f3 Move kube_proxy_remove out of set_facts and set default (#4180) 2019-02-25 00:08:06 -08:00
Matthew Mosesohn 4638acfe81 Retry applying podsecurity policies (#4279) 2019-02-24 22:50:55 -08:00
Matthew Mosesohn 8373fa393a Update CNAME 2019-02-07 16:30:25 +03:00
Matthew Mosesohn 613841381d Create CNAME 2019-02-07 16:28:44 +03:00
Matthew Mosesohn 9b5096ab10 Set theme jekyll-theme-slate 2019-02-07 15:47:50 +03:00
Matthew Mosesohn 2e1e27219e Refactor collect-info.yaml playbook (#4157) 
Run only commands that apply to the current deployed cluster (only get
calico info and skip weave/flannel when deploying calico, for example).

Add helm release info if helm is deployed
 2019-02-04 12:46:48 -08:00
Matthew Mosesohn 77d31e679a fixup external kube-apiserver port (#4075) 2019-01-21 14:43:27 +03:00
Matthew Mosesohn 28aee0fc34 Update OWNERS_ALIASES (#4068) 2019-01-18 18:58:04 +03:00
Matthew Mosesohn eecaba6b84 Generate external admin.conf with kubeadm (#4056) 
* Generate external admin.conf with kubeadm

* Fix apiserver sans
 2019-01-16 16:30:50 +03:00
Matthew Mosesohn 50b884a32d Fixup line breaks for kubeadm SANs (#3908) 2018-12-19 02:47:31 -08:00
Matthew Mosesohn 3c44ffcf80 set kubespray-defaults kube_api_anonymous_auth to true (#3909) 2018-12-18 06:53:58 -08:00
Matthew Mosesohn daa290100c Fix helper script to refer to admin.conf as relative path (#3738) 2018-11-19 18:28:51 -08:00
Matthew Mosesohn ac00d23b80 Skip etcd upgrade steps in kubeadm because it is not used (#3737) 2018-11-19 06:29:58 -08:00
Matthew Mosesohn ff09141a14 Retry kubeadm proxy and secondary master init tasks (#3715) 
Due to suboptimal external loadbalancer configs, the LoadBalancer
might point to a downed kube-apiserver that is not set up yet.
 2018-11-15 10:03:23 -08:00
Matthew Mosesohn 2ba4e9bda5 Skip most of kubernetes/preinstall role during late DNS config (#3627) 
When using resolvconf_mode host_resolvconf, there is an early DNS
config stage where Kubernetes cluster DNS is not injected for host
DNS intially. Later, the cluster DNS is enabled, but we do not
need to run every task from the kubernetes/preinstall role.
 2018-11-01 08:08:50 -07:00
Matthew Mosesohn bc74a37696 Calculate etcd client cert serial for appropriate groups (#3605) 
Standalone etcd nodes do not generate node-$hostname certs and do
not need this serial calculated.
 2018-11-01 05:50:26 -07:00
Matthew Mosesohn 152c15b19f Disable gather facts when checking ansible version (#3615) 2018-10-31 03:19:17 -07:00
Matthew Mosesohn 7e84de2ae1 Purge /root/.kube/config when migrating to kubeadm (#3566) 2018-10-23 05:09:11 -07:00
Matthew Mosesohn 127969d65f Align node-role value for kubeadm compatibility (#3558) 
kubeadm sets node label node-role.kubernetes.io/master=''
and this is not configurable. We should use it everywhere.
 2018-10-20 07:12:54 -07:00
Matthew Mosesohn 4bdd0ce417 Allow kubeadm master untaint to fail (#3549) 2018-10-19 00:38:12 -07:00
Matthew Mosesohn 4b7d59224d Fix tag based deploy of apps by skipping kubeadm dns tasks (#3462) 2018-10-08 01:22:57 -07:00
Matthew Mosesohn fe35c32c62 Fix tiller override command 2018-09-15 16:35:19 +03:00
Matthew Mosesohn 55d76ea3d8 Update install.yml 2018-09-13 12:04:53 +03:00
Matthew Mosesohn 1091e82327 Update install.yml 2018-09-12 22:15:46 +03:00
Matthew Mosesohn cc79125d3e Update install.yml 2018-09-12 17:03:55 +03:00
Matthew Mosesohn dc3e317d20 Fix backward compatibility with calico 2.6 2018-09-06 15:54:20 +03:00
Matthew Mosesohn ea918e1999 Reduce instance sizes in gce 2018-09-06 15:22:46 +03:00
Matthew Mosesohn b614a3504b Fix openstack cacert task 2018-09-06 14:06:06 +03:00
Matthew Mosesohn cd8e469b9c Add missing variable kube_proxy_nodeport_addresses 2018-09-06 13:36:17 +03:00
Matthew Mosesohn 991b3dbe54 put back endif in kubelet rkt template 2018-09-06 13:21:22 +03:00
Matthew Mosesohn faedfb6307 remove broken endifs in kubelet rkt mode 2018-09-06 11:59:25 +03:00
Matthew Mosesohn fd57fde075 Always run helm init to allow for settings changes 2018-09-03 11:16:01 +03:00
Matthew Mosesohn 581a30fdec Remove erroneous cloud-config task 2018-08-10 15:59:18 +03:00
Matthew Mosesohn 8b3ce6e418 bump upgrade tests to v2.5.0 commit (#3087) 2018-08-10 13:05:05 +03:00
Matthew Mosesohn 97e0de7e29 Fix vault file owner issues and k8s apiserver cert creation (#2985) 
apiserver cert should be created only once
 2018-07-11 14:58:02 +03:00
Matthew Mosesohn 5c617c5a8b Add tags to deploy components by --tags option (#2960) 
* Add tags for cert serial tasks

This will help facilitate tag-based deployment of specific components.

* fixup kubernetes node
 2018-07-06 09:12:13 +03:00
Matthew Mosesohn 0b939a495b Improve vault etcd initialization check (#2959) 2018-07-05 12:27:45 +03:00
Matthew Mosesohn 77c910c1c3 Fixup vault etcd check (#2938) 
* Fixup vault etcd

* Update main.yml
 2018-07-02 15:37:37 +03:00
Matthew Mosesohn c20196f9a0 Remove modprobe binary from kubelet rkt deployment (#2917) 2018-07-02 15:37:24 +03:00
Matthew Mosesohn a36e3fbec3 Add rkt gc task (#2945) 2018-06-29 19:53:21 +03:00
Matthew Mosesohn 59be578842 Revert "wip pr for improved cert sync" (#2849) 2018-06-06 17:22:25 +03:00
Matthew Mosesohn 7c93e71801 Upgrade k8s to 1.10.2 (#2748) 
* Upgrade k8s to 1.10.2

Bumped etcd version to 3.2.16 as recommended

* Add ipvs fix for v1.10

* change flannel addons test to ha
 2018-05-15 16:00:29 +03:00
Matthew Mosesohn 07cc981971 refactor vault role (#2733) 
* Move front-proxy-client certs back to kube mount

We want the same CA for all k8s certs

* Refactor vault to use a third party module

The module adds idempotency and reduces some of the repetitive
logic in the vault role

Requires ansible-modules-hashivault on ansible node and hvac
on the vault hosts themselves

Add upgrade test scenario
Remove bootstrap-os tags from tasks

* fix upgrade issues

* improve unseal logic

* specify ca and fix etcd check

* Fix initialization check

bump machine size
 2018-05-11 19:11:38 +03:00
Matthew Mosesohn 1a14f1ecc1 Fix vol format for local volume provisioner in rkt (#2698) 2018-04-24 20:32:08 +03:00
Matthew Mosesohn 51f4e6585a Revert "Add openSUSE support" (#2697) 2018-04-23 14:28:24 +03:00
Matthew Mosesohn 0945eb990a Make it possible to skip docker role as a var (#2686) 2018-04-19 16:47:20 +03:00
Matthew Mosesohn 02cd5418c2 Weave limits (#2660) 
* Raise limits for weave

* Adjust weave limits
 2018-04-15 18:32:49 +03:00
Matthew Mosesohn 49e3665d96 Remove prometheus operator from Kubespray (#2658) 
Kubespray should not install any helm charts. This is a task
that a user should do on his/her own through ansible or another
tool. It opens the door to wrapping installation of any helm
chart.
 2018-04-13 18:53:39 +03:00
Matthew Mosesohn e95ba800ea Define local volume provisioner dirs in defaults (#2656) 2018-04-13 17:23:10 +03:00
Matthew Mosesohn f73717ea35 Mount local volume provisioner dirs for containerized kubelet (#2648) 2018-04-12 22:55:13 +03:00
Matthew Mosesohn 09f93d9e0c Fix CI upgrade scenario by using dynamic inventory file (#2635) 
Also updates the commit ID we use as a basis for upgrade tests.
 2018-04-10 16:02:33 +03:00
Matthew Mosesohn 45f15bf753 Revert "Fix new envvar for setting openstack_tenant_id" (#2640) 2018-04-10 14:37:24 +03:00
Matthew Mosesohn 3004791c64 Add pre-upgrade task for moving credentials file (#2394) 
* Add pre-upgrade task for moving credentials file

This reverts commit 7ef9f4dfdd.

* add python interpreter workaround for localhost
 2018-04-02 11:19:23 +03:00
Matthew Mosesohn 03bcfa7ff5 Stop templating kube-system namespace and creating it (#2545) 
Kubernetes makes this namespace automatically, so there is
no need for kubespray to manage it.
 2018-03-30 14:29:13 +03:00
Matthew Mosesohn 9837b7926f Use proper lookup of etcd host for calico (#2408) 
Fixes #2397
 2018-03-02 15:36:52 +03:00
Matthew Mosesohn 7ef9f4dfdd Revert "Add pre-upgrade task for moving credentials file" (#2393) 2018-02-28 22:41:52 +03:00
Matthew Mosesohn bc0fc5df98 Use node cert for etcd tasks instead of delegating to first etcd (#2386) 
For etcdctl commands, use admin cert instead of node because this file
doesn't exist on etcd only hosts.
 2018-02-27 22:23:51 +03:00
Matthew Mosesohn bb469005b2 Add pre-upgrade task for moving credentials file 2018-02-27 17:35:15 +03:00
Matthew Mosesohn 5903aea86f Update coreos-calico-aio scenario to test no group vars (#2314) 
This updated scenario ensures deployment still passes without
having any group_vars available.
 2018-02-12 12:38:06 +01:00
Matthew Mosesohn 16629d0b8e Vault should use cert auth for etcd 2018-01-31 20:37:14 +03:00
Matthew Mosesohn 2df4b6c5d2 Rename default_resolver to cloud_resolver (#2209) 
Cloud resolvers are mandatory for hosts on GCE and OpenStack
clouds. The 8.8.8.8 alternative resolver was dropped because
there is already a default nameserver. The new var name
reflects the purpose better.

Also restart apiserver when modifying dns settings.
 2018-01-31 00:26:07 +03:00
Matthew Mosesohn 62dd3d2a9d Add missing group var default values to kubespray-defaults 2018-01-30 16:04:00 +03:00