External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-10-30 06:13:29 -02:30
Code Issues Packages Projects Releases Wiki Activity
1,293 Commits 61 Branches 91 Tags
882544446ab76adddef56b6edf65e007c19bd820
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Matthew Mosesohn 882544446a Merge pull request #928 from sc68cal/terraform_identity_version 
Specify the version of the credentials to download from Horizon
 2017-01-24 12:21:27 +03:00
Matthew Mosesohn 8ce32eb3e1 Merge pull request #905 from galthaus/async-runs 
Add tasks to ensure that the first nodes have their directories for cert gen
 2017-01-19 18:32:27 +03:00
Matthew Mosesohn aae0314bda Merge pull request #904 from galthaus/nginx-port-config 
Add nginx local balancer port configuration variable
 2017-01-19 18:31:57 +03:00
Matthew Mosesohn 35d5248d41 Merge pull request #913 from galthaus/apps-master-only 
Ansible apps should only check for api-server running on the master.
 2017-01-19 18:30:58 +03:00
Matthew Mosesohn 0ccc2555d3 Merge pull request #917 from mattymo/rkt_resolvconf 
Fix setting resolvconf when using rkt deploy mode
 2017-01-19 18:30:21 +03:00
Matthew Mosesohn b26a711e96 Merge pull request #916 from mattymo/update_ansible 
Update Ansible to 2.2.1
 2017-01-19 18:13:45 +03:00
Matthew Mosesohn 2218a052b2 Merge pull request #921 from mattymo/docker113 
Add docker 1.13, update 1.12 to 1.12.6
 2017-01-19 18:13:21 +03:00
Matthew Mosesohn 40f419ca54 Merge pull request #922 from holser/dnsmasq_dns-forward-max 
Allow to specify number of concurrent DNS queries
 2017-01-19 18:08:04 +03:00
Matthew Mosesohn f742fc3dd1 Add scale thresholds to split etcd and k8s-masters 
Also adds calico-rr group if there are standalone etcd nodes.
Now if there are 50 or more nodes, 3 etcd nodes will be standalone.
If there are 200 or more nodes, 2 kube-masters will be standalone.
If thresholds are exceeded, kube-node group cannot add nodes that
belong to etcd or kube-master groups (according to above statements).
 2017-01-19 17:30:56 +03:00
Matthew Mosesohn 33fbcc56d6 Add docker 1.13, update 1.12 to 1.12.6 
Fixes #903
 2017-01-19 13:58:36 +03:00
Matthew Mosesohn 8a821060a3 Update Ansible to 2.2.1 2017-01-19 13:46:46 +03:00
Matthew Mosesohn b6c3e61603 Fix setting resolvconf when using rkt deploy mode 
rkt deploy mode doesn't create {{ bin_dir }}/kubelet, so
let's rely on kubelet.env file instad.
 2017-01-18 19:18:47 +03:00
Matthew Mosesohn 5420fa942e Merge pull request #897 from holser/flush_handlers_before_etcd 
Flush handlers before etcd restart
 2017-01-18 12:27:01 +03:00
Matthew Mosesohn 1ee33d3a8d Merge pull request #910 from mattymo/escape_curly 
Fix ansible 2.2.1 handling of registered vars
 2017-01-18 11:13:01 +03:00
Matthew Mosesohn b2a27ed089 Fix bash completion installation 2017-01-17 20:36:58 +03:00
Matthew Mosesohn d8ae50800a Work around escaping curly braces for docker inspect 2017-01-17 20:35:38 +03:00
Matthew Mosesohn 73204c868d Merge pull request #909 from mattymo/docker-upgrade 
Always trigger docker restart when docker package changes
 2017-01-17 11:37:42 +03:00
Matthew Mosesohn 2ee889843a Merge pull request #900 from galthaus/cn-length 
Cert fail if inventory names too long
 2017-01-16 23:39:32 +03:00
Matthew Mosesohn 74b78e75a1 Always trigger docker restart when docker package changes 
Docker upgrade doesn't auto-restart docker, causing failures
when trying to start another container
 2017-01-16 17:52:28 +03:00
Matthew Mosesohn 80703010bd Use only one certificate for all apiservers 
https://github.com/kubernetes/kubernetes/issues/25063
 2017-01-13 14:03:20 +03:00
Matthew Mosesohn 3f274115b0 Generate individual certificates for k8s hosts 2017-01-11 12:58:07 +03:00
Matthew Mosesohn 3b0918981e Merge pull request #878 from bradbeam/rkt-cni 
Adding /opt/cni /etc/cni to rkt run kubelet
 2017-01-11 12:22:04 +03:00
Matthew Mosesohn 38338e848d Merge pull request #860 from adidenko/fix-calico-rr-certs 
Fix etcd cert generation for calico-rr role
 2017-01-09 18:34:02 +03:00
Matthew Mosesohn e22f938ae5 Bind nginx localhost proxy to localhost 
This proxy should only be listening for local connections, not 0.0.0.0.

Fixes #868
 2017-01-09 17:19:54 +03:00
Matthew Mosesohn 1dce56e2f8 Fix docker dns host scenario with no search domains 
Fixes scenario where docker-dns.conf tries to create an empty
search entry
 2017-01-09 16:36:44 +03:00
Matthew Mosesohn 1f9f885379 Fix etcd cert generation to support large deployments 
Due to bash max args limits, we should pass all node filenames and
base64-encoded tar data through stdin/stdout instead.

Fixes #832
 2016-12-30 12:55:26 +03:00
Matthew Mosesohn 15589dd88f Merge pull request #816 from bogdando/paths_units 
Systemd units, limits, and bin path fixes
 2016-12-29 15:18:01 +03:00
Matthew Mosesohn 24cbf2287c Update inventory.py 2016-12-29 10:57:58 +03:00
Matthew Mosesohn 95e14ffb54 Add yaml/json loader for inventory 2016-12-28 16:50:31 +03:00
Matthew Mosesohn f0c0390646 Fix creation and sync of etcd certs 
Admin certs only go to etcd nodes
Only generate cert-data for nodes that need sync
 2016-12-28 14:21:17 +04:00
Matthew Mosesohn e7a1949d85 Merge pull request #818 from mattymo/calico-rr-certs 
Fix calico-rr to use etcd certs instead of kube certs
 2016-12-28 08:47:16 +03:00
Matthew Mosesohn 6d9cd2d720 Fix calico-rr to use etcd certs instead of kube certs 2016-12-27 17:04:50 +03:00
Matthew Mosesohn 36a5143478 Merge pull request #804 from mattymo/inventory_builder 
Add inventory builder python script
 2016-12-23 13:22:41 +03:00
Matthew Mosesohn 7b86b87dca Add inventory builder python script 
Includes tox support for running unit tests.
Small note added to getting-started guide for using
inventory_builder.py

Also adds manual-only unit test.
 2016-12-23 13:00:56 +03:00
Matthew Mosesohn 385f7f6e75 Update etcd.j2 2016-12-22 22:29:24 +03:00
Matthew Mosesohn 9f1e3db906 Adjust etcd server certificates 
ETCD doesn't need cert/key options set. It only requires peer
cert options.
 2016-12-22 23:05:17 +04:00
Matthew Mosesohn 111571b67a Document commonly used Kargo vars 2016-12-22 19:57:39 +03:00
Matthew Mosesohn a4bce333a3 Merge pull request #760 from genti-t/issue-748-flannel-options 
Fix Flannel network on CoreOS
 2016-12-22 19:02:31 +03:00
Matthew Mosesohn c53a6eca86 Merge pull request #798 from mattymo/perhostssl7 
Individual etcd ssl certs
 2016-12-22 19:02:15 +03:00
Matthew Mosesohn ad796d188d Individual etcd ssl certs 
Includes hooks for triggering calico, kubelet, and kube-apiserver restarts
if etcd certs changed.
 2016-12-22 13:31:11 +03:00
Matthew Mosesohn d314174149 Add wait for kube-apiserver to kubernetes-apps 
Fixes #777
 2016-12-21 15:39:39 +03:00
Matthew Mosesohn 348fc5b109 Fix etcd to-SSL upgrade and task register vars 2016-12-19 15:05:49 +03:00
Matthew Mosesohn 07cd81ef58 Update docker to 1.12.5 
Note the new ubuntu/debian version string change:
https://github.com/docker/docker/issues/29355
 2016-12-16 16:30:46 +03:00
Matthew Mosesohn 9df2306ee9 Bump kube_version to v1.5.1 2016-12-16 15:53:25 +03:00
Matthew Mosesohn 495d0b659a Fix weave restart after docker daemon restart 2016-12-16 14:15:22 +03:00
Matthew Mosesohn 68ad4ff4d9 Add dns_domain for each host to /etc/hosts 
Fixes #754
 2016-12-15 13:34:59 +04:00
Matthew Mosesohn 9cc73bdf08 Fix etcd member list when upgrading ETCD from an old version 2016-12-15 12:00:45 +04:00
Matthew Mosesohn e6fe9d5807 Merge pull request #726 from bogdando/netcheck_ci 
Enable netchecker for CI
 2016-12-14 17:19:30 +03:00
Matthew Mosesohn b1e852a785 Merge pull request #707 from vwfs/reset_playbook 
Add playbook and role to reset the cluster
 2016-12-12 12:43:00 +03:00
Matthew Mosesohn e5ad0836bc Merge pull request #713 from kubernetes-incubator/bump_kubedns 
Bump kubedns version to 1.9
 2016-12-10 11:08:42 +03:00
Matthew Mosesohn fb774d4317 Merge pull request #706 from vwfs/docker_storage_options 
Allow to specify docker storage driver
 2016-12-09 18:28:20 +03:00
Matthew Mosesohn 459bee6d2c Bump kubedns version to 1.9 
Version 1.9 has reduced verbosity for federation dns queries
which flood container logs.
 2016-12-09 17:57:54 +03:00
Matthew Mosesohn 4265149463 Merge pull request #703 from adidenko/fix-docker_versioned_pkg 
Convert docker_versioned_pkg dict keys to string
 2016-12-09 11:50:17 +03:00
Matthew Mosesohn a80745b5bd Merge pull request #668 from bodepd/etcd_access_address 
Use etcd host ip instead of hostname to build etcd_access_addresses
 2016-12-09 07:54:12 +03:00
Matthew Mosesohn fc769eb870 Merge pull request #693 from kubernetes-incubator/upgrades-doc 
Add document outlining upgrade process
 2016-12-08 13:02:55 +03:00
Matthew Mosesohn bfc9bcb8c7 Force hardlink for calico/canal certs 
Fixes: #669
 2016-12-07 19:03:22 +03:00
Matthew Mosesohn 3c66e4cdba Add document outlining upgrade process 2016-12-07 16:33:08 +03:00
Matthew Mosesohn 45ed6de315 Merge pull request #688 from fen4o/cluster-signing-cert 
add cluster-signing to kube-controller-manager
 2016-12-07 14:53:30 +03:00
Matthew Mosesohn 756ae926ba Re-enable debian-8-kubespray image for CI 
debian-8 image is missing memory cgroup, so it can't spawn pods.
 2016-12-06 16:00:58 +03:00
Matthew Mosesohn 7a3a473ccf Fix ipv4 forwarding on GCE 
ipv4 forwarding gets broken when restarting networking, which
breaks all networking for all pods.
 2016-12-06 11:57:57 +03:00
Matthew Mosesohn 2cdf752481 Add dbus socket dir to kube-proxy 2016-12-05 19:25:27 +03:00
Matthew Mosesohn 8b11de5425 Merge pull request #608 from sneumann/patch-1 
Fix failure if image package index is outdated
 2016-11-17 12:21:15 -05:00
Matthew Mosesohn ab0ff2ab3c Merge pull request #602 from adidenko/fix-canal-ssl 
Fix etcd ssl for canal
 2016-11-15 12:43:22 +03:00
Matthew Mosesohn 5cd65f9c45 Merge pull request #598 from kubernetes-incubator/bug_376 
Generate kubectl bash completion from kubectl instead of file
 2016-11-15 12:28:51 +03:00
Matthew Mosesohn 4e47c267fb Merge pull request #604 from kubernetes-incubator/k8s-upgrade-v1.4.6 
upgrade k8s version to 1.4.6
 2016-11-15 12:27:29 +03:00
Matthew Mosesohn 8ca1f4ce44 Fix kubelet deprecated options 
--api-servers now just reads kubeconfig
--config is now --pod-manifest-path

Fixes #542
 2016-11-14 22:13:44 +04:00
Matthew Mosesohn 8092f57695 Merge branch 'master' into calico-cni-container-support 2016-11-14 14:58:42 +03:00
Matthew Mosesohn 15bc445a9c Generate kubectl bash completion from kubectl instead of file 2016-11-14 14:54:59 +04:00
Matthew Mosesohn 6da0ecfa55 Merge pull request #550 from chadswen/hostname-alias 
Hostname alias fixes
 2016-11-14 13:09:18 +03:00
Matthew Mosesohn 1ccc10baf8 Merge pull request #597 from pcm32/patch-1 
Adds missing 'ip' var for terraform-generated inventory, based on internal ip
 2016-11-14 10:41:21 +03:00
Matthew Mosesohn 45c2900e71 Merge branch 'master' into hostname-alias 2016-11-14 09:32:35 +03:00
Matthew Mosesohn eb583dd2f3 Merge branch 'master' into idempotency_resolvconf 2016-11-14 09:30:22 +03:00
Matthew Mosesohn 46ee9faca9 Fix ca certificate loading on CoreOS 2016-11-14 08:47:09 +04:00
Matthew Mosesohn 6cc05c103a Merge pull request #592 from artem-panchenko/support_golang_calicoctl 
Support new version of 'calicoctl' (>=v1.0.0)
 2016-11-11 13:55:24 +03:00
Matthew Mosesohn 046e315bfd Merge pull request #595 from kubernetes-incubator/etcdtls-followup 
Fix canal's calico networking config for ETCD TLS
 2016-11-10 16:00:05 +03:00
Matthew Mosesohn fe16fecd8f Fix canal's calico networking config for ETCD TLS 
Also fixes kube-apiserver upgrade that was erroneously
deleted in a previous commit.
 2016-11-10 12:49:47 +03:00
Matthew Mosesohn 9ea9604b3f Merge pull request #591 from kubernetes-incubator/etcdtls 
Add etcd tls support
 2016-11-10 12:32:13 +03:00
Matthew Mosesohn a32cd85eb7 Add etcd TLS support 2016-11-09 18:38:28 +03:00
Matthew Mosesohn 95b460ae94 Remove etcd-proxy from all nodes and use etcd multiaccess 2016-11-09 13:31:12 +03:00
Matthew Mosesohn f106bf5bc4 adds ability to have hosts with no floating ips on terraform/openstack (+8 squashed commits) 
Squashed commits:
[f9355ea] Swap order in which we reload docker/socket
[2ca6819] Reload docker.socket after installing flannel on coreos

Workaround for #569
[9f976e5] Vagrantfile: setup proxy inside virtual machines

In corporate networks, it is good to pre-configure proxy variables.
[9d7142f] Vagrantfile: use Ubuntu 16.04 LTS

Use recent supported version of Ubuntu for local development setup
with Vagrant.
[50f77cc] Add CI test layouts

* Drop Wily from test matrix
* Replace the Wily cases dropped with extra cases to test separate
  roles deployment

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
[03e162b] Update OWNERS
[c7b00ca] Use tar+register instead of copy/slurp for distributing tokens and certs

Related bug: https://github.com/ansible/ansible/issues/15405

Uses tar and register because synchronize module cannot sudo on the
remote side correctly and copy is too slow.

This patch dramatically cuts down the number of tasks to process
for cert synchronization.
[2778ac6] Add new var skip_dnsmasq_k8s

If skip_dnsmasq is set, it will still not set up dnsmasq
k8s pod. This enables independent setup of resolvconf section
before kubelet is up.
 2016-11-07 10:53:13 +00:00
Matthew Mosesohn 03e162b342 Update OWNERS 2016-10-28 11:16:11 +04:00
Matthew Mosesohn d8b06f3e2f Ignore changes on check resolvconf task 2016-10-28 10:38:16 +04:00
Matthew Mosesohn 2778ac61a4 Add new var skip_dnsmasq_k8s 
If skip_dnsmasq is set, it will still not set up dnsmasq
k8s pod. This enables independent setup of resolvconf section
before kubelet is up.
 2016-10-26 17:56:15 +03:00
Matthew Mosesohn c7b00caeaa Use tar+register instead of copy/slurp for distributing tokens and certs 
Related bug: https://github.com/ansible/ansible/issues/15405

Uses tar and register because synchronize module cannot sudo on the
remote side correctly and copy is too slow.

This patch dramatically cuts down the number of tasks to process
for cert synchronization.
 2016-10-26 15:46:18 +03:00
Matthew Mosesohn 11f1f71b3b dynamically calculate etcd peer names 2016-10-21 16:17:50 +03:00
Matthew Mosesohn 0e9d1e09e3 Sync master tokens only with those in play_hosts 2016-10-21 14:43:41 +03:00
Matthew Mosesohn 65d2a3b0e5 Use only native cachable hostvars for etcd set_facts 2016-10-21 14:39:58 +03:00
Matthew Mosesohn 4b7347f1cd fix dnsmasq template cloud_provider lookup 2016-10-21 13:00:40 +03:00
Matthew Mosesohn 71347322d6 Add cluster-cidr to kube-proxy config 
This option enables masquerading for traffic directed at pods
that comes frmom outside the cluster.
 2016-10-12 19:13:33 +03:00
Matthew Mosesohn 84052ff0b6 use nginx proxy on non-master nodes to proxy apiserver traffic 
Also adds all masters by hostname and localhost/127.0.0.1 to
apiserver SSL certificate.

Includes documentation update on how localhost loadbalancer works.
 2016-10-05 20:09:10 +03:00
Matthew Mosesohn 2e90d3fe76 Merge branch 'master' into reverselookups 2016-10-05 14:46:47 +03:00
Matthew Mosesohn f4e6fdc193 Enable quorum read for apiserver 
This reduces the likelihood of apiserver status updates
timing out due to etcd write conflicts.
 2016-10-04 18:31:42 +03:00
Matthew Mosesohn d9641771ed add kube-masters to SSL certificate 2016-09-29 15:12:30 +03:00
Matthew Mosesohn 5579cddbdb Disable reverse lookups again 
Initially this was removed, but it turns out that services that
perform reverse lookups (such as MariaDB) will encounter severe
performance degredation with this disabled.
 2016-09-29 10:49:55 +04:00
Matthew Mosesohn e4a48cf53b Add Docker 1.12.1 version 2016-09-26 12:16:16 +03:00
Matthew Mosesohn a3fe1e78df Copy hyperkube CNI plugins when using weave 2016-09-26 12:02:19 +03:00
Matthew Mosesohn d313be4420 Improve management of nameservers in resolv.conf 
Changing nameservers now will clean up previous entries
 2016-09-22 18:11:15 +03:00
Matthew Mosesohn a93639650f Allow calico to configure pool if tree exists, but no pools defined 2016-09-19 15:27:47 +03:00
Matthew Mosesohn 341ea5a6ea always bind etcd_proxy to localhost 2016-09-18 19:58:15 +04:00
Matthew Mosesohn b69d5f6e6e Fix logic handling for use_hyperkube_cni 2016-09-15 16:09:40 +03:00