External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-10-29 22:03:22 -02:30
Code Issues Packages Projects Releases Wiki Activity
3,061 Commits 61 Branches 91 Tags
59be5788422cc9a1b71ad800872e4b2b1bc90e49
Commit Graph
91 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Matthew Mosesohn 59be578842 Revert "wip pr for improved cert sync" (#2849) 2018-06-06 17:22:25 +03:00
Matthew Mosesohn 7c93e71801 Upgrade k8s to 1.10.2 (#2748) 
* Upgrade k8s to 1.10.2

Bumped etcd version to 3.2.16 as recommended

* Add ipvs fix for v1.10

* change flannel addons test to ha
 2018-05-15 16:00:29 +03:00
Matthew Mosesohn 07cc981971 refactor vault role (#2733) 
* Move front-proxy-client certs back to kube mount

We want the same CA for all k8s certs

* Refactor vault to use a third party module

The module adds idempotency and reduces some of the repetitive
logic in the vault role

Requires ansible-modules-hashivault on ansible node and hvac
on the vault hosts themselves

Add upgrade test scenario
Remove bootstrap-os tags from tasks

* fix upgrade issues

* improve unseal logic

* specify ca and fix etcd check

* Fix initialization check

bump machine size
 2018-05-11 19:11:38 +03:00
Matthew Mosesohn 1a14f1ecc1 Fix vol format for local volume provisioner in rkt (#2698) 2018-04-24 20:32:08 +03:00
Matthew Mosesohn 51f4e6585a Revert "Add openSUSE support" (#2697) 2018-04-23 14:28:24 +03:00
Matthew Mosesohn 0945eb990a Make it possible to skip docker role as a var (#2686) 2018-04-19 16:47:20 +03:00
Matthew Mosesohn 02cd5418c2 Weave limits (#2660) 
* Raise limits for weave

* Adjust weave limits
 2018-04-15 18:32:49 +03:00
Matthew Mosesohn 49e3665d96 Remove prometheus operator from Kubespray (#2658) 
Kubespray should not install any helm charts. This is a task
that a user should do on his/her own through ansible or another
tool. It opens the door to wrapping installation of any helm
chart.
 2018-04-13 18:53:39 +03:00
Matthew Mosesohn e95ba800ea Define local volume provisioner dirs in defaults (#2656) 2018-04-13 17:23:10 +03:00
Matthew Mosesohn f73717ea35 Mount local volume provisioner dirs for containerized kubelet (#2648) 2018-04-12 22:55:13 +03:00
Matthew Mosesohn 09f93d9e0c Fix CI upgrade scenario by using dynamic inventory file (#2635) 
Also updates the commit ID we use as a basis for upgrade tests.
 2018-04-10 16:02:33 +03:00
Matthew Mosesohn 45f15bf753 Revert "Fix new envvar for setting openstack_tenant_id" (#2640) 2018-04-10 14:37:24 +03:00
Matthew Mosesohn 3004791c64 Add pre-upgrade task for moving credentials file (#2394) 
* Add pre-upgrade task for moving credentials file

This reverts commit 7ef9f4dfdd.

* add python interpreter workaround for localhost
 2018-04-02 11:19:23 +03:00
Matthew Mosesohn 03bcfa7ff5 Stop templating kube-system namespace and creating it (#2545) 
Kubernetes makes this namespace automatically, so there is
no need for kubespray to manage it.
 2018-03-30 14:29:13 +03:00
Matthew Mosesohn 9837b7926f Use proper lookup of etcd host for calico (#2408) 
Fixes #2397
 2018-03-02 15:36:52 +03:00
Matthew Mosesohn 7ef9f4dfdd Revert "Add pre-upgrade task for moving credentials file" (#2393) 2018-02-28 22:41:52 +03:00
Matthew Mosesohn bc0fc5df98 Use node cert for etcd tasks instead of delegating to first etcd (#2386) 
For etcdctl commands, use admin cert instead of node because this file
doesn't exist on etcd only hosts.
 2018-02-27 22:23:51 +03:00
Matthew Mosesohn bb469005b2 Add pre-upgrade task for moving credentials file 2018-02-27 17:35:15 +03:00
Matthew Mosesohn 5903aea86f Update coreos-calico-aio scenario to test no group vars (#2314) 
This updated scenario ensures deployment still passes without
having any group_vars available.
 2018-02-12 12:38:06 +01:00
Matthew Mosesohn 16629d0b8e Vault should use cert auth for etcd 2018-01-31 20:37:14 +03:00
Matthew Mosesohn 2df4b6c5d2 Rename default_resolver to cloud_resolver (#2209) 
Cloud resolvers are mandatory for hosts on GCE and OpenStack
clouds. The 8.8.8.8 alternative resolver was dropped because
there is already a default nameserver. The new var name
reflects the purpose better.

Also restart apiserver when modifying dns settings.
 2018-01-31 00:26:07 +03:00
Matthew Mosesohn 62dd3d2a9d Add missing group var default values to kubespray-defaults 2018-01-30 16:04:00 +03:00
Matthew Mosesohn dc6a17e092 Use include/import tasks (#2192) 
import_tasks will consume far less memory, so it should be
used whenever it is compatible.
 2018-01-29 14:37:48 +03:00
Matthew Mosesohn ac66e98ae9 Upgrade to Kubernetes v1.9.1 (#2152) 
Raise drain timeout to 5m
 2018-01-25 18:44:44 +03:00
Matthew Mosesohn d2935ffed0 Optionally ignore the presence of extra calico pools (#2190) 2018-01-25 18:44:20 +03:00
Matthew Mosesohn bf1411060e Add optional manual dns_mode (#2178) 2018-01-23 14:28:42 +01:00
Matthew Mosesohn 1401286910 Add support for cert alt names for etcd (#2139) 
* Add support for cert alt names for etcd

* Update gen_certs_vault.yml
 2018-01-09 14:37:34 +03:00
Matthew Mosesohn ad6fecefa8 Update Kubernetes to v1.9.0 (#2100) 
Update checksum for kubeadm
Use v1.9.0 kubeadm params
Include hash of ca.crt for kubeadm join
Update tag for testing upgrades
Add workaround for testing upgrades
Remove scale CI scenarios because of slow inventory parsing
in ansible 2.4.x.

Change region for tests to us-central1 to
improve ansible performance
 2017-12-25 08:57:45 +00:00
Matthew Mosesohn 29f5b55d42 remove unwanted whitespace for kube_override_hostname (#2105) 2017-12-22 11:31:18 +00:00
Matthew Mosesohn 6bb46e3ecb Fix param names in preparation for Kubernetes v1.9.0 (#2098) 
This does not update v1.9.0, but fixes two incompatibilities
when trying to deploy v1.9.0.
 2017-12-20 10:48:09 +00:00
Matthew Mosesohn 127bc01857 Do not override kubelet hostname if cloud_provider is used (#2095) 
Starting with Kubernetes v1.8.4, kubelet ignores the AWS cloud
provider string and uses the override hostname, which fails
Node admission checks.

Fixes #2094
 2017-12-19 20:18:20 +00:00
Matthew Mosesohn bfb25fa47b Change vault cert ttl to 8y (#2013) 2017-12-15 13:34:00 +00:00
Matthew Mosesohn b135bcb9d9 Split download container task for delegate and non-delegate modes (#2077) 
Ansible cannot seem to handle omitting delegate_to since v2.4.0.0.

Possibly related: https://github.com/ansible/ansible/issues/30760
 2017-12-14 16:45:54 +00:00
Matthew Mosesohn 952ec65a40 Remove RBAC from boolean checks 2017-12-06 11:57:40 +03:00
Matthew Mosesohn a0225507a0 Set helm deployment type to host (#2012) 2017-11-29 19:52:54 +00:00
Matthew Mosesohn 4d3326b542 Raise default vault lease TTL to 10y (#2008) 2017-11-29 10:38:59 +00:00
Matthew Mosesohn ec54b36e05 add retries for calico/canal etcd commands (#2007) 2017-11-28 16:39:55 +00:00
Matthew Mosesohn 67419e8d0a Run rotate_tokens role only once (#1970) 2017-11-15 18:50:23 +00:00
Matthew Mosesohn a67349b076 Disable initializers feature gate if istio is not used 2017-11-15 12:56:36 +00:00
Matthew Mosesohn f9b68a5d17 Revert "Support for disabling apiserver insecure port" (#1974) 2017-11-14 13:41:28 +00:00
Matthew Mosesohn ab3832f3e7 Set host IP for kubelet always (#1924) 
* Set host IP for kubelet always

Use ansible default IP if ip var is not set.

* Update main.yml
 2017-11-03 10:19:37 +00:00
Matthew Mosesohn 66c67dbe73 Add optional helm deployment mode for host (#1920) 2017-11-03 07:09:24 +00:00
Matthew Mosesohn c0e989b17c New addon: local_volume_provisioner (#1909) 2017-11-01 14:25:35 +00:00
Matthew Mosesohn fe81bba08d Force kubelet certificates to be generated as lowercase (#1886) 
All nodes get converted to lowercase, so certs should set
CN with lowercase as well.
 2017-10-27 15:58:25 +01:00
Matthew Mosesohn b0f04d925a Update network policy setting for Kubernetes 1.8 (#1879) 
It is now enabled by default in 1.8 with the api changed
to networking.k8s.io/v1 instead of extensions/v1beta1.
 2017-10-26 15:35:26 +01:00
Matthew Mosesohn 7b78e68727 disable idempotency tests (#1872) 2017-10-26 15:35:12 +01:00
Matthew Mosesohn 86fb669fd3 Idempotency fixes (#1838) 2017-10-25 21:19:40 +01:00
Matthew Mosesohn 7123956ecd update checksum for kubeadm (#1869) 2017-10-25 21:15:16 +01:00
Matthew Mosesohn a52bc44f5a Fix broken CI jobs (#1854) 
* Fix broken CI jobs

Adjust image and image_family scenarios for debian.
Checkout CI file for upgrades

* add debugging to file download

* Fix download for alternate playbooks

* Update ansible ssh args to force ssh user

* Update sync_container.yml
 2017-10-25 11:45:54 +01:00
Matthew Mosesohn acb63a57fa Only limit etcd memory on small hosts (#1860) 
Also disable oom killer on etcd
 2017-10-25 10:25:15 +01:00
Matthew Mosesohn 33c4d64b62 Make ClusterRoleBinding to admit all nodes with right cert (#1861) 
This is to work around #1856 which can occur when kubelet
hostname and resolvable hostname (or cloud instance name)
do not match.
 2017-10-24 17:05:58 +01:00
Matthew Mosesohn 25de6825df Update Kubernetes to v1.8.1 (#1858) 2017-10-24 17:05:45 +01:00
Matthew Mosesohn cea41a544e Use include instead of import tasks to support v2.3 (#1855) 
Eventually 2.3 support will be dropped, so this is
a temporary change.
 2017-10-23 13:56:03 +01:00
Matthew Mosesohn 7ed140cea7 Update refs to kubernetes version to v1.8.0 (#1845) 2017-10-20 08:29:28 +01:00
Matthew Mosesohn cb97c2184e typo fix for ci job name (#1847) 2017-10-20 08:26:42 +01:00
Matthew Mosesohn 0b4fcc83bd Fix up warnings and deprecations (#1848) 2017-10-20 08:25:57 +01:00
Matthew Mosesohn 514359e556 Improve etcd scale up (#1846) 
Now adding unjoined members to existing etcd cluster
occurs one at a time so that the cluster does not
lose quorum.
 2017-10-20 08:02:31 +01:00
Matthew Mosesohn fc9a65be2b Refactor downloads to use download role directly (#1824) 
* Refactor downloads to use download role directly

Also disable fact delegation so download delegate works acros OSes.

* clean up bools and ansible_os_family conditionals
 2017-10-19 09:17:11 +01:00
Matthew Mosesohn 4efb0b78fa Move CI vars out of gitlab and into var files (#1808) 2017-10-18 17:28:54 +01:00
Matthew Mosesohn 16462292e1 Properly skip extra SANs when not specified for kubeadm (#1831) 2017-10-18 12:04:13 +01:00
Matthew Mosesohn c766bd077b Use batch mode for graceful docker/rkt upgrade (#1815) 2017-10-17 14:12:11 +01:00
Matthew Mosesohn d4b10eb9f5 Fix path for calico get node names (#1816) 2017-10-17 10:54:48 +01:00
Matthew Mosesohn a9f4038fcd Update roadmap (#1814) 2017-10-16 17:02:53 +01:00
Matthew Mosesohn d9879d8026 Update roadmap (#1795) 2017-10-16 07:06:06 +01:00
Matthew Mosesohn d487b2f927 Security best practice fixes (#1783) 
* Disable basic and token auth by default

* Add recommended security params

* allow basic auth to fail in tests

* Enable TLS authentication for kubelet
 2017-10-15 20:41:17 +01:00
Matthew Mosesohn 7e4668859b Change file used to check kubeadm upgrade method (#1784) 
* Change file used to check kubeadm upgrade method

Test for ca.crt instead of admin.conf because admin.conf
is created during normal deployment.

* more fixes for upgrade
 2017-10-15 10:33:22 +01:00
Matthew Mosesohn 92d038062e Fix node authorization for cloudprovider installs (#1794) 
In 1.8, the Node authorization mode should be listed first to
allow kubelet to access secrets. This seems to only impact
environments with cloudprovider enabled.
 2017-10-14 11:28:46 +01:00
Matthew Mosesohn 3ee91e15ff Use commas in no_proxy (#1782) 2017-10-13 15:43:10 +01:00
Matthew Mosesohn ef47a73382 Add new addon Istio (#1744) 
* add istio addon

* add addons to a ci job
 2017-10-13 15:42:54 +01:00
Matthew Mosesohn dc515e5ac5 Remove kernel-upgrade role (#1798) 
This role only support Red Hat type distros and is not maintained
or used by many users. It should be removed because it creates
feature disparity between supported OSes and is not maintained.
 2017-10-13 15:36:21 +01:00
Matthew Mosesohn 10dd049912 Revert "Security fixes for etcd (#1778)" (#1786) 
This reverts commit 4209f1cbfd.
 2017-10-12 14:02:51 +01:00
Matthew Mosesohn 4209f1cbfd Security fixes for etcd (#1778) 
* Security fixes for etcd

* Use certs when querying etcd
 2017-10-12 13:32:54 +01:00
Matthew Mosesohn ee83e874a8 Clear admin kubeconfig when rotating certs (#1772) 
* Clear admin kubeconfig when rotating certs

* Update main.yml
 2017-10-12 09:55:46 +01:00
Matthew Mosesohn eeb7274d65 Adjust memory reservation for master nodes (#1769) 2017-10-11 19:47:42 +01:00
Matthew Mosesohn eb0dcf6063 Improve proxy (#1771) 
* Set no_proxy to all local ips

* Use proxy settings on all necessary tasks
 2017-10-11 19:47:27 +01:00
Matthew Mosesohn 83be0735cd Fix setting etcd client cert serial (#1775) 2017-10-11 19:47:11 +01:00
Matthew Mosesohn fe4ba51d1a Set node IP correctly (#1770) 
Fixes #1741
 2017-10-11 15:28:42 +01:00
Matthew Mosesohn 994324e19c Update gce CI (#1748) 
Use image family for picking latest coreos image
Update python deps
 2017-10-05 16:52:28 +01:00
Matthew Mosesohn f14f04c5ea Upgrade to kubernetes v1.8.0 (#1730) 
* Upgrade to kubernetes v1.8.0

hyperkube no longer contains rsync, so now use cp

* Enable node authorization mode

* change kube-proxy cert group name
 2017-10-05 10:51:21 +01:00
Matthew Mosesohn e42cb43ca5 add bootstrap for debian (#1726) 2017-10-03 08:30:45 +01:00
Matthew Mosesohn dae9f6d3c2 Test if tokens are expired from host instead of inside container (#1727) 
* Test if tokens are expired from host instead of inside container

* Update main.yml
 2017-10-02 13:14:50 +01:00
Matthew Mosesohn 56aa683f28 Fix logic in idempotency tests in CI (#1722) 2017-10-01 10:42:33 +01:00
Matthew Mosesohn a55675acf8 Enable RBAC with kubeadm always (#1711) 2017-09-29 09:18:24 +01:00
Matthew Mosesohn 25dd3d476a Fix error for azure+calico assert (#1717) 
Fixes #1716
 2017-09-29 08:17:18 +01:00
Matthew Mosesohn 3ff5f40bdb fix graceful upgrade (#1704) 
Fix system namespace creation
Only rotate tokens when necessary
 2017-09-27 14:49:20 +01:00
Matthew Mosesohn 689ded0413 Enable kubeadm upgrades to any version (#1709) 2017-09-27 14:48:18 +01:00
Matthew Mosesohn 327ed157ef Verify valid settings before deploy (#1705) 
Also fix yaml lint issues

Fixes #1703
 2017-09-27 14:47:47 +01:00
Matthew Mosesohn bd272e0b3c Upgrade to kubeadm (#1667) 
* Enable upgrade to kubeadm

* fix kubedns upgrade

* try upgrade route

* use init/upgrade strategy for kubeadm and ignore kubedns svc

* Use bin_dir for kubeadm

* delete more secrets

* fix waiting for terminating pods

* Manually enforce kube-proxy for kubeadm deploy

* remove proxy. update to kubeadm 1.8.0rc1
 2017-09-26 10:38:58 +01:00
Matthew Mosesohn a1cde03b20 Correct master manifest cleanup logic (#1693) 
Fixes #1666
 2017-09-25 12:19:04 +01:00
Matthew Mosesohn d94e3a81eb Use api lookup for kubelet hostname when using cloudprovider (#1686) 
The value cannot be determined properly via local facts, so
checking k8s api is the most reliable way to look up what hostname
is used when using a cloudprovider.
 2017-09-24 09:22:15 +01:00
Matthew Mosesohn 188bae142b Fix wait for hosts in CI (#1679) 
Also fix usage of failed_when and handling exit code.
 2017-09-20 14:30:09 +01:00