mirror of
https://github.com/kubernetes-sigs/kubespray.git
synced 2026-01-12 18:40:03 -03:30
Compare commits
No commits in common. "master" and "v2.29.0" have entirely different histories.
@ -1,4 +1,5 @@
|
||||
---
|
||||
parseable: true
|
||||
skip_list:
|
||||
# see https://docs.ansible.com/ansible-lint/rules/default_rules.html for a list of all default rules
|
||||
|
||||
@ -33,8 +34,6 @@ skip_list:
|
||||
# Disable run-once check with free strategy
|
||||
# (Disabled in June 2023 after ansible upgrade; FIXME)
|
||||
- 'run-once[task]'
|
||||
|
||||
- 'jinja[spacing]'
|
||||
exclude_paths:
|
||||
# Generated files
|
||||
- tests/files/custom_cni/cilium.yaml
|
||||
|
||||
6
.github/workflows/auto-label-os.yml
vendored
6
.github/workflows/auto-label-os.yml
vendored
@ -13,16 +13,16 @@ jobs:
|
||||
issues: write
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
|
||||
|
||||
- name: Parse issue form
|
||||
uses: stefanbuck/github-issue-parser@25f1485edffc1fee3ea68eb9f59a72e58720ffc4
|
||||
uses: stefanbuck/github-issue-parser@2ea9b35a8c584529ed00891a8f7e41dc46d0441e
|
||||
id: issue-parser
|
||||
with:
|
||||
template-path: .github/ISSUE_TEMPLATE/bug-report.yaml
|
||||
|
||||
- name: Set labels based on OS field
|
||||
uses: redhat-plumbers-in-action/advanced-issue-labeler@b80ae64e3e156e9c111b075bfa04b295d54e8e2e
|
||||
uses: redhat-plumbers-in-action/advanced-issue-labeler@e38e6809c5420d038eed380d49ee9a6ca7c92dbf
|
||||
with:
|
||||
issue-form: ${{ steps.issue-parser.outputs.jsonString }}
|
||||
section: os
|
||||
|
||||
@ -13,14 +13,14 @@ jobs:
|
||||
outputs:
|
||||
branches: ${{ steps.get-branches.outputs.data }}
|
||||
steps:
|
||||
- uses: octokit/graphql-action@ddde8ebb2493e79f390e6449c725c21663a67505
|
||||
- uses: octokit/graphql-action@8ad880e4d437783ea2ab17010324de1075228110
|
||||
id: get-branches
|
||||
with:
|
||||
query: |
|
||||
query get_release_branches($owner:String!, $name:String!) {
|
||||
repository(owner:$owner, name:$name) {
|
||||
refs(refPrefix: "refs/heads/",
|
||||
first: 2, # TODO increment once we have release branch with the new checksums format
|
||||
first: 1, # TODO increment once we have release branch with the new checksums format
|
||||
query: "release-",
|
||||
orderBy: {
|
||||
field: ALPHABETICAL,
|
||||
|
||||
6
.github/workflows/upgrade-patch-versions.yml
vendored
6
.github/workflows/upgrade-patch-versions.yml
vendored
@ -11,7 +11,7 @@ jobs:
|
||||
update-patch-versions:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
|
||||
with:
|
||||
ref: ${{ inputs.branch }}
|
||||
- uses: actions/setup-python@v6
|
||||
@ -22,14 +22,14 @@ jobs:
|
||||
- run: update-hashes
|
||||
env:
|
||||
API_KEY: ${{ secrets.GITHUB_TOKEN }}
|
||||
- uses: actions/cache@v5
|
||||
- uses: actions/cache@v4
|
||||
with:
|
||||
key: pre-commit-hook-propagate
|
||||
path: |
|
||||
~/.cache/pre-commit
|
||||
- run: pre-commit run --all-files propagate-ansible-variables
|
||||
continue-on-error: true
|
||||
- uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725
|
||||
- uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e
|
||||
with:
|
||||
commit-message: Patch versions updates
|
||||
title: Patch versions updates - ${{ inputs.branch }}
|
||||
|
||||
@ -24,7 +24,7 @@ variables:
|
||||
ANSIBLE_REMOTE_USER: kubespray
|
||||
ANSIBLE_PRIVATE_KEY_FILE: /tmp/id_rsa
|
||||
ANSIBLE_INVENTORY: /tmp/inventory
|
||||
ANSIBLE_STDOUT_CALLBACK: "default"
|
||||
ANSIBLE_STDOUT_CALLBACK: "debug"
|
||||
RESET_CHECK: "false"
|
||||
REMOVE_NODE_CHECK: "false"
|
||||
UPGRADE_TEST: "false"
|
||||
|
||||
@ -4,7 +4,7 @@
|
||||
interruptible: true
|
||||
script:
|
||||
- ansible-playbook tests/cloud_playbooks/create-kubevirt.yml
|
||||
-e @"tests/files/${TESTCASE}.yml"
|
||||
-c local -e @"tests/files/${TESTCASE}.yml"
|
||||
- ./tests/scripts/testcases_run.sh
|
||||
variables:
|
||||
ANSIBLE_TIMEOUT: "120"
|
||||
@ -43,7 +43,6 @@ pr:
|
||||
- fedora39-kube-router
|
||||
- openeuler24-calico
|
||||
- rockylinux9-cilium
|
||||
- rockylinux10-cilium
|
||||
- ubuntu22-calico-all-in-one
|
||||
- ubuntu22-calico-all-in-one-upgrade
|
||||
- ubuntu24-calico-etcd-datastore
|
||||
@ -128,7 +127,6 @@ pr_extended:
|
||||
- debian12-docker
|
||||
- debian13-calico
|
||||
- rockylinux9-calico
|
||||
- rockylinux10-calico
|
||||
- ubuntu22-all-in-one-docker
|
||||
- ubuntu24-all-in-one-docker
|
||||
- ubuntu24-calico-all-in-one
|
||||
|
||||
@ -89,10 +89,11 @@ tf-elastx_cleanup:
|
||||
- ./scripts/openstack-cleanup/main.py
|
||||
allow_failure: true
|
||||
|
||||
tf-elastx_ubuntu24-calico:
|
||||
tf-elastx_ubuntu20-calico:
|
||||
extends: .terraform_apply
|
||||
stage: deploy-part1
|
||||
when: on_success
|
||||
allow_failure: true
|
||||
variables:
|
||||
<<: *elastx_variables
|
||||
PROVIDER: openstack
|
||||
@ -115,5 +116,5 @@ tf-elastx_ubuntu24-calico:
|
||||
TF_VAR_az_list_node: '["sto1"]'
|
||||
TF_VAR_flavor_k8s_master: 3f73fc93-ec61-4808-88df-2580d94c1a9b # v1-standard-2
|
||||
TF_VAR_flavor_k8s_node: 3f73fc93-ec61-4808-88df-2580d94c1a9b # v1-standard-2
|
||||
TF_VAR_image: ubuntu-24.04-server-latest
|
||||
TF_VAR_image: ubuntu-20.04-server-latest
|
||||
TF_VAR_k8s_allowed_remote_ips: '["0.0.0.0/0"]'
|
||||
|
||||
@ -36,7 +36,7 @@ vagrant:
|
||||
policy: pull-push # TODO: change to "pull" when not on main
|
||||
stage: deploy-extended
|
||||
rules:
|
||||
- if: $PR_LABELS =~ /.*ci-full.*/
|
||||
- if: $PR_LABELS =~ /.*(ci-extended|ci-full).*/
|
||||
when: on_success
|
||||
- if: $CI_PIPELINE_SOURCE == "schedule" && $CI_PIPELINE_SCHEDULE_DESCRIPTION == "daily-ci"
|
||||
when: on_success
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
repos:
|
||||
- repo: https://github.com/pre-commit/pre-commit-hooks
|
||||
rev: v6.0.0
|
||||
rev: v5.0.0
|
||||
hooks:
|
||||
- id: check-added-large-files
|
||||
- id: check-case-conflict
|
||||
@ -15,13 +15,13 @@ repos:
|
||||
- id: trailing-whitespace
|
||||
|
||||
- repo: https://github.com/adrienverge/yamllint.git
|
||||
rev: v1.37.1
|
||||
rev: v1.35.1
|
||||
hooks:
|
||||
- id: yamllint
|
||||
args: [--strict]
|
||||
|
||||
- repo: https://github.com/shellcheck-py/shellcheck-py
|
||||
rev: v0.11.0.1
|
||||
rev: v0.10.0.1
|
||||
hooks:
|
||||
- id: shellcheck
|
||||
args: ["--severity=error"]
|
||||
@ -29,7 +29,7 @@ repos:
|
||||
files: "\\.sh$"
|
||||
|
||||
- repo: https://github.com/ansible/ansible-lint
|
||||
rev: v25.11.0
|
||||
rev: v25.1.1
|
||||
hooks:
|
||||
- id: ansible-lint
|
||||
additional_dependencies:
|
||||
@ -38,7 +38,7 @@ repos:
|
||||
- distlib
|
||||
|
||||
- repo: https://github.com/golangci/misspell
|
||||
rev: v0.7.0
|
||||
rev: v0.6.0
|
||||
hooks:
|
||||
- id: misspell
|
||||
exclude: "OWNERS_ALIASES$"
|
||||
|
||||
@ -35,8 +35,8 @@ RUN --mount=type=bind,source=requirements.txt,target=requirements.txt \
|
||||
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
||||
|
||||
RUN OS_ARCHITECTURE=$(dpkg --print-architecture) \
|
||||
&& curl -L "https://dl.k8s.io/release/v1.34.3/bin/linux/${OS_ARCHITECTURE}/kubectl" -o /usr/local/bin/kubectl \
|
||||
&& echo "$(curl -L "https://dl.k8s.io/release/v1.34.3/bin/linux/${OS_ARCHITECTURE}/kubectl.sha256")" /usr/local/bin/kubectl | sha256sum --check \
|
||||
&& curl -L "https://dl.k8s.io/release/v1.33.5/bin/linux/${OS_ARCHITECTURE}/kubectl" -o /usr/local/bin/kubectl \
|
||||
&& echo "$(curl -L "https://dl.k8s.io/release/v1.33.5/bin/linux/${OS_ARCHITECTURE}/kubectl.sha256")" /usr/local/bin/kubectl | sha256sum --check \
|
||||
&& chmod a+x /usr/local/bin/kubectl
|
||||
|
||||
COPY *.yml ./
|
||||
|
||||
24
README.md
24
README.md
@ -89,13 +89,13 @@ vagrant up
|
||||
- **Flatcar Container Linux by Kinvolk**
|
||||
- **Debian** Bookworm, Bullseye, Trixie
|
||||
- **Ubuntu** 22.04, 24.04
|
||||
- **CentOS Stream / RHEL** [9, 10](docs/operating_systems/rhel.md#rhel-8)
|
||||
- **CentOS/RHEL** [8, 9](docs/operating_systems/rhel.md#rhel-8)
|
||||
- **Fedora** 39, 40
|
||||
- **Fedora CoreOS** (see [fcos Note](docs/operating_systems/fcos.md))
|
||||
- **openSUSE** Leap 15.x/Tumbleweed
|
||||
- **Oracle Linux** [9, 10](docs/operating_systems/rhel.md#rhel-8)
|
||||
- **Alma Linux** [9, 10](docs/operating_systems/rhel.md#rhel-8)
|
||||
- **Rocky Linux** [9, 10](docs/operating_systems/rhel.md#rhel-8) (experimental in 10: see [Rocky Linux 10 notes](docs/operating_systems/rhel.md#rocky-linux-10))
|
||||
- **Oracle Linux** [8, 9](docs/operating_systems/rhel.md#rhel-8)
|
||||
- **Alma Linux** [8, 9](docs/operating_systems/rhel.md#rhel-8)
|
||||
- **Rocky Linux** [8, 9](docs/operating_systems/rhel.md#rhel-8)
|
||||
- **Kylin Linux Advanced Server V10** (experimental: see [kylin linux notes](docs/operating_systems/kylinlinux.md))
|
||||
- **Amazon Linux 2** (experimental: see [amazon linux notes](docs/operating_systems/amazonlinux.md))
|
||||
- **UOS Linux** (experimental: see [uos linux notes](docs/operating_systems/uoslinux.md))
|
||||
@ -111,23 +111,23 @@ Note:
|
||||
<!-- BEGIN ANSIBLE MANAGED BLOCK -->
|
||||
|
||||
- Core
|
||||
- [kubernetes](https://github.com/kubernetes/kubernetes) 1.34.3
|
||||
- [etcd](https://github.com/etcd-io/etcd) 3.5.26
|
||||
- [kubernetes](https://github.com/kubernetes/kubernetes) 1.33.5
|
||||
- [etcd](https://github.com/etcd-io/etcd) 3.5.23
|
||||
- [docker](https://www.docker.com/) 28.3
|
||||
- [containerd](https://containerd.io/) 2.2.1
|
||||
- [cri-o](http://cri-o.io/) 1.34.3 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
|
||||
- [containerd](https://containerd.io/) 2.1.4
|
||||
- [cri-o](http://cri-o.io/) 1.33.5 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
|
||||
- Network Plugin
|
||||
- [cni-plugins](https://github.com/containernetworking/plugins) 1.8.0
|
||||
- [calico](https://github.com/projectcalico/calico) 3.30.5
|
||||
- [cilium](https://github.com/cilium/cilium) 1.18.5
|
||||
- [calico](https://github.com/projectcalico/calico) 3.30.3
|
||||
- [cilium](https://github.com/cilium/cilium) 1.18.2
|
||||
- [flannel](https://github.com/flannel-io/flannel) 0.27.3
|
||||
- [kube-ovn](https://github.com/alauda/kube-ovn) 1.12.21
|
||||
- [kube-router](https://github.com/cloudnativelabs/kube-router) 2.1.1
|
||||
- [multus](https://github.com/k8snetworkplumbingwg/multus-cni) 4.2.2
|
||||
- [kube-vip](https://github.com/kube-vip/kube-vip) 1.0.3
|
||||
- [kube-vip](https://github.com/kube-vip/kube-vip) 0.8.0
|
||||
- Application
|
||||
- [cert-manager](https://github.com/jetstack/cert-manager) 1.15.3
|
||||
- [coredns](https://github.com/coredns/coredns) 1.12.1
|
||||
- [coredns](https://github.com/coredns/coredns) 1.12.0
|
||||
- [ingress-nginx](https://github.com/kubernetes/ingress-nginx) 1.13.3
|
||||
- [argocd](https://argoproj.github.io/) 2.14.5
|
||||
- [helm](https://helm.sh/) 3.18.4
|
||||
|
||||
@ -1,9 +0,0 @@
|
||||
#!/bin/bash -eux
|
||||
# Install collection from source assuming dependencies are present.
|
||||
# Run in SemaphoreUI this bash script can install Kubespray from the repo
|
||||
NAMESPACE=kubernetes_sigs
|
||||
COLLECTION=kubespray
|
||||
MY_VER=$(grep '^version:' galaxy.yml|cut -d: -f2|sed 's/ //')
|
||||
|
||||
ansible-galaxy collection build --force --output-path .
|
||||
ansible-galaxy collection install --offline --force $NAMESPACE-$COLLECTION-$MY_VER.tar.gz
|
||||
@ -20,6 +20,7 @@ function create_container_image_tar() {
|
||||
|
||||
kubectl describe cronjobs,jobs,pods --all-namespaces | grep " Image:" | awk '{print $2}' | sort | uniq > "${IMAGES}"
|
||||
# NOTE: etcd and pause cannot be seen as pods.
|
||||
# The pause image is used for --pod-infra-container-image option of kubelet.
|
||||
kubectl cluster-info dump | grep -E "quay.io/coreos/etcd:|registry.k8s.io/pause:" | sed s@\"@@g >> "${IMAGES}"
|
||||
else
|
||||
echo "Getting images from file \"${IMAGES_FROM_FILE}\""
|
||||
|
||||
@ -281,9 +281,9 @@ For your cluster, edit `inventory/$CLUSTER/cluster.tfvars`.
|
||||
|`k8s_allowed_remote_ips_ipv6` | List of IPv6 CIDR allowed to initiate a SSH connection, empty by default |
|
||||
|`k8s_allowed_egress_ipv6_ips` | List of IPv6 CIDRs allowed for egress traffic, `["::/0"]` by default |
|
||||
|`worker_allowed_ports` | List of ports to open on worker nodes, `[{ "protocol" = "tcp", "port_range_min" = 30000, "port_range_max" = 32767, "remote_ip_prefix" = "0.0.0.0/0"}]` by default |
|
||||
|`worker_allowed_ports_ipv6` | List of ports to open on worker nodes for IPv6 CIDR blocks, `[{ "protocol" = "tcp", "port_range_min" = 30000, "port_range_max" = 32767, "remote_ip_prefix" = "::/0"}, { "protocol" = "ipv6-icmp", "port_range_min" = 0, "port_range_max" = 0, "remote_ip_prefix" = "::/0"}]` by default |
|
||||
|`worker_allowed_ports_ipv6` | List of ports to open on worker nodes for IPv6 CIDR blocks, `[{ "protocol" = "tcp", "port_range_min" = 30000, "port_range_max" = 32767, "remote_ip_prefix" = "::/0"}]` by default |
|
||||
|`master_allowed_ports` | List of ports to open on master nodes, expected format is `[{ "protocol" = "tcp", "port_range_min" = 443, "port_range_max" = 443, "remote_ip_prefix" = "0.0.0.0/0"}]`, empty by default |
|
||||
|`master_allowed_ports_ipv6` | List of ports to open on master nodes for IPv6 CIDR blocks, `[{ "protocol" = "ipv6-icmp", "port_range_min" = 0, "port_range_max" = 0, "remote_ip_prefix" = "::/0"}]` by default |
|
||||
|`master_allowed_ports_ipv6` | List of ports to open on master nodes for IPv6 CIDR blocks, expected format is `[{ "protocol" = "tcp", "port_range_min" = 443, "port_range_max" = 443, "remote_ip_prefix" = "::/0"}]`, empty by default |
|
||||
|`node_root_volume_size_in_gb` | Size of the root volume for nodes, 0 to use ephemeral storage |
|
||||
|`master_root_volume_size_in_gb` | Size of the root volume for masters, 0 to use ephemeral storage |
|
||||
|`master_volume_type` | Volume type of the root volume for control_plane, 'Default' by default |
|
||||
|
||||
@ -271,14 +271,7 @@ variable "master_allowed_ports" {
|
||||
variable "master_allowed_ports_ipv6" {
|
||||
type = list(any)
|
||||
|
||||
default = [
|
||||
{
|
||||
"protocol" = "ipv6-icmp"
|
||||
"port_range_min" = 0
|
||||
"port_range_max" = 0
|
||||
"remote_ip_prefix" = "::/0"
|
||||
},
|
||||
]
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "worker_allowed_ports" {
|
||||
@ -304,12 +297,6 @@ variable "worker_allowed_ports_ipv6" {
|
||||
"port_range_max" = 32767
|
||||
"remote_ip_prefix" = "::/0"
|
||||
},
|
||||
{
|
||||
"protocol" = "ipv6-icmp"
|
||||
"port_range_min" = 0
|
||||
"port_range_max" = 0
|
||||
"remote_ip_prefix" = "::/0"
|
||||
},
|
||||
]
|
||||
}
|
||||
|
||||
|
||||
@ -3,7 +3,7 @@ terraform {
|
||||
required_providers {
|
||||
upcloud = {
|
||||
source = "UpCloudLtd/upcloud"
|
||||
version = "~>5.29.1"
|
||||
version = "~>5.9.0"
|
||||
}
|
||||
}
|
||||
required_version = ">= 0.13"
|
||||
|
||||
@ -3,7 +3,7 @@ terraform {
|
||||
required_providers {
|
||||
upcloud = {
|
||||
source = "UpCloudLtd/upcloud"
|
||||
version = "~>5.29.1"
|
||||
version = "~>5.9.0"
|
||||
}
|
||||
}
|
||||
required_version = ">= 0.13"
|
||||
|
||||
@ -1,13 +1,5 @@
|
||||
# Cilium
|
||||
|
||||
## Unprivileged agent configuration
|
||||
|
||||
By default, Cilium is installed with `securityContext.privileged: false`. You need to set the `kube_owner` variable to `root` in the inventory:
|
||||
|
||||
```yml
|
||||
kube_owner: root
|
||||
```
|
||||
|
||||
## IP Address Management (IPAM)
|
||||
|
||||
IP Address Management (IPAM) is responsible for the allocation and management of IP addresses used by network endpoints (container and others) managed by Cilium. The default mode is "Cluster Scope".
|
||||
@ -245,7 +237,7 @@ cilium_operator_extra_volume_mounts:
|
||||
## Choose Cilium version
|
||||
|
||||
```yml
|
||||
cilium_version: "1.18.5"
|
||||
cilium_version: "1.18.2"
|
||||
```
|
||||
|
||||
## Add variable to config
|
||||
|
||||
@ -32,7 +32,7 @@ add `kube_proxy_masquerade_all: true` in `group_vars/all/all.yml`
|
||||
|
||||
* Disable nodelocaldns
|
||||
|
||||
The nodelocal dns IP is not reachable.
|
||||
The nodelocal dns IP is not reacheable.
|
||||
|
||||
Disable it in `sample/group_vars/k8s_cluster/k8s_cluster.yml`
|
||||
|
||||
|
||||
@ -65,8 +65,9 @@ In kubespray, the default runtime name is "runc", and it can be configured with
|
||||
containerd_runc_runtime:
|
||||
name: runc
|
||||
type: "io.containerd.runc.v2"
|
||||
engine: ""
|
||||
root: ""
|
||||
options:
|
||||
Root: ""
|
||||
SystemdCgroup: "false"
|
||||
BinaryName: /usr/local/bin/my-runc
|
||||
base_runtime_spec: cri-base.json
|
||||
|
||||
@ -80,7 +80,7 @@ The `crio_remap_enable` configures the `/etc/subuid` and `/etc/subgid` files to
|
||||
By default, 16M uids and gids are reserved for user namespaces (256 pods * 65536 uids/gids) at the end of the uid/gid space.
|
||||
|
||||
The `crio_default_capabilities` configure the default containers capabilities for the crio.
|
||||
Defaults capabilities are:
|
||||
Defaults capabilties are:
|
||||
|
||||
```yaml
|
||||
crio_default_capabilities:
|
||||
|
||||
1
docs/_sidebar.md
generated
1
docs/_sidebar.md
generated
@ -6,6 +6,7 @@
|
||||
* [Downloads](/docs/advanced/downloads.md)
|
||||
* [Gcp-lb](/docs/advanced/gcp-lb.md)
|
||||
* [Kubernetes-reliability](/docs/advanced/kubernetes-reliability.md)
|
||||
* [Mitogen](/docs/advanced/mitogen.md)
|
||||
* [Netcheck](/docs/advanced/netcheck.md)
|
||||
* [Ntp](/docs/advanced/ntp.md)
|
||||
* [Proxy](/docs/advanced/proxy.md)
|
||||
|
||||
@ -6,7 +6,7 @@
|
||||
- [Create New TLS Root CA Certificate and Key](#create-new-tls-root-ca-certificate-and-key)
|
||||
- [Install Cloudflare PKI/TLS `cfssl` Toolkit.](#install-cloudflare-pkitls-cfssl-toolkit)
|
||||
- [Create Root Certificate Authority (CA) Configuration File](#create-root-certificate-authority-ca-configuration-file)
|
||||
- [Create Certificate Signing Request (CSR) Configuration File](#create-certificate-signing-request-csr-configuration-file)
|
||||
- [Create Certficate Signing Request (CSR) Configuration File](#create-certficate-signing-request-csr-configuration-file)
|
||||
- [Create TLS Root CA Certificate and Key](#create-tls-root-ca-certificate-and-key)
|
||||
|
||||
Cert-Manager is a native Kubernetes certificate management controller. It can help with issuing certificates from a variety of sources, such as Let’s Encrypt, HashiCorp Vault, Venafi, a simple signing key pair, or self signed. It will ensure certificates are valid and up to date, and attempt to renew certificates at a configured time before expiry.
|
||||
@ -134,7 +134,7 @@ $ cat > ca-config.json <<EOF
|
||||
EOF
|
||||
```
|
||||
|
||||
#### Create Certificate Signing Request (CSR) Configuration File
|
||||
#### Create Certficate Signing Request (CSR) Configuration File
|
||||
|
||||
The TLS certificate `names` details can be updated to your own specific requirements.
|
||||
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
# GCP Load Balancers for type=LoadBalancer of Kubernetes Services
|
||||
# GCP Load Balancers for type=LoadBalacer of Kubernetes Services
|
||||
|
||||
> **Removed**: Since v1.31 (the Kubespray counterpart is v2.27), Kubernetes no longer supports `cloud_provider`. (except external cloud provider)
|
||||
|
||||
|
||||
30
docs/advanced/mitogen.md
Normal file
30
docs/advanced/mitogen.md
Normal file
@ -0,0 +1,30 @@
|
||||
# Mitogen
|
||||
|
||||
*Warning:* Mitogen support is now deprecated in kubespray due to upstream not releasing an updated version to support ansible 4.x (ansible-base 2.11.x) and above. The CI support has been stripped for mitogen and we are no longer validating any support or regressions for it. The supporting mitogen install playbook and integration documentation will be removed in a later version.
|
||||
|
||||
[Mitogen for Ansible](https://mitogen.networkgenomics.com/ansible_detailed.html) allow a 1.25x - 7x speedup and a CPU usage reduction of at least 2x, depending on network conditions, modules executed, and time already spent by targets on useful work. Mitogen cannot improve a module once it is executing, it can only ensure the module executes as quickly as possible.
|
||||
|
||||
## Install
|
||||
|
||||
```ShellSession
|
||||
ansible-playbook contrib/mitogen/mitogen.yml
|
||||
```
|
||||
|
||||
The above playbook sets the ansible `strategy` and `strategy_plugins` in `ansible.cfg` but you can also enable them if you use your own `ansible.cfg` by setting the environment varialbles:
|
||||
|
||||
```ShellSession
|
||||
export ANSIBLE_STRATEGY=mitogen_linear
|
||||
export ANSIBLE_STRATEGY_PLUGINS=plugins/mitogen/ansible_mitogen/plugins/strategy
|
||||
```
|
||||
|
||||
... or `ansible.cfg` setup:
|
||||
|
||||
```ini
|
||||
[defaults]
|
||||
strategy_plugins = plugins/mitogen/ansible_mitogen/plugins/strategy
|
||||
strategy=mitogen_linear
|
||||
```
|
||||
|
||||
## Limitation
|
||||
|
||||
If you are experiencing problems, please see the [documentation](https://mitogen.networkgenomics.com/ansible_detailed.html#noteworthy-differences).
|
||||
@ -42,10 +42,13 @@ Kubespray expects users to use one of the following variables sources for settin
|
||||
|----------------------------------------|------------------------------------------------------------------------------|
|
||||
| inventory vars | |
|
||||
| - **inventory group_vars** | most used |
|
||||
| - inventory host_vars | host specific vars overrides, group_vars is usually more practical |
|
||||
| - inventory host_vars | host specifc vars overrides, group_vars is usually more practical |
|
||||
| **extra vars** (always win precedence) | override with ``ansible-playbook -e @foo.yml`` |
|
||||
|
||||
> Extra vars are best used to override kubespray internal variables, for instances, roles/vars/. Those vars are usually **not expected** (by Kubespray developers) to be modified by end users, and not part of Kubespray interface. Thus they can change, disappear, or break stuff unexpectedly.
|
||||
[!IMPORTANT]
|
||||
Extra vars are best used to override kubespray internal variables, for instances, roles/vars/.
|
||||
Those vars are usually **not expected** (by Kubespray developers) to be modified by end users, and not part of Kubespray
|
||||
interface. Thus they can change, disappear, or break stuff unexpectedly.
|
||||
|
||||
## Ansible tags
|
||||
|
||||
@ -119,7 +122,7 @@ The following tags are defined in playbooks:
|
||||
| metrics_server | Configuring metrics_server |
|
||||
| netchecker | Installing netchecker K8s app |
|
||||
| network | Configuring networking plugins for K8s |
|
||||
| mounts | Umount kubelet dirs when resetting |
|
||||
| mounts | Umount kubelet dirs when reseting |
|
||||
| multus | Network plugin multus |
|
||||
| nginx | Configuring LB for kube-apiserver instances |
|
||||
| node | Configuring K8s minion (compute) node role |
|
||||
@ -178,13 +181,17 @@ ansible-playbook -i inventory/sample/hosts.ini cluster.yml \
|
||||
|
||||
Note: use `--tags` and `--skip-tags` wisely and only if you're 100% sure what you're doing.
|
||||
|
||||
## Mitogen
|
||||
|
||||
Mitogen support is deprecated, please see [mitogen related docs](/docs/advanced/mitogen.md) for usage and reasons for deprecation.
|
||||
|
||||
## Troubleshooting Ansible issues
|
||||
|
||||
Having the wrong version of ansible, ansible collections or python dependencies can cause issue.
|
||||
In particular, Kubespray ship custom modules which Ansible needs to find, for which you should specify [ANSIBLE_LIBRARY](https://docs.ansible.com/ansible/latest/dev_guide/developing_locally.html#adding-a-module-or-plugin-outside-of-a-collection)
|
||||
In particular, Kubespray ship custom modules which Ansible needs to find, for which you should specify [ANSIBLE_LIBRAY](https://docs.ansible.com/ansible/latest/dev_guide/developing_locally.html#adding-a-module-or-plugin-outside-of-a-collection)
|
||||
|
||||
```ShellSession
|
||||
export ANSIBLE_LIBRARY=<kubespray_dir>/library`
|
||||
export ANSIBLE_LIBRAY=<kubespray_dir>/library`
|
||||
```
|
||||
|
||||
A simple way to ensure you get all the correct version of Ansible is to use
|
||||
|
||||
@ -6,7 +6,7 @@ See [.gitlab-ci.yml](/.gitlab-ci.yml) and the included files for an overview.
|
||||
|
||||
## Runners
|
||||
|
||||
Kubespray has 2 types of GitLab runners, both deployed on the Kubespray CI cluster (hosted on Oracle Cloud Infrastructure):
|
||||
Kubespray has 2 types of GitLab runners, both deployed on the Kubespray CI cluster (hosted on Oracle Cloud Infrastucture):
|
||||
|
||||
- pods: use the [gitlab-ci kubernetes executor](https://docs.gitlab.com/runner/executors/kubernetes/)
|
||||
- vagrant: custom executor running in pods with access to the libvirt socket on the nodes
|
||||
@ -156,7 +156,7 @@ kube_feature_gates:
|
||||
- "NodeSwap=True"
|
||||
```
|
||||
|
||||
## Additional files
|
||||
## Aditional files
|
||||
|
||||
This section documents additional files used to complete a deployment of the kubespray CI, these files sit on the control-plane node and assume a working kubernetes cluster.
|
||||
|
||||
|
||||
@ -15,8 +15,8 @@ fedora39 | :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x
|
||||
fedora40 | :x: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
flatcar4081 | :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
openeuler24 | :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
rockylinux10 | :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
|
||||
rockylinux9 | :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: | :x: |
|
||||
ubuntu20 | :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
ubuntu22 | :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
ubuntu24 | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | :x: | :white_check_mark: | :x: |
|
||||
|
||||
@ -33,8 +33,8 @@ fedora39 | :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
fedora40 | :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
flatcar4081 | :x: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
openeuler24 | :x: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
rockylinux10 | :x: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
rockylinux9 | :x: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
ubuntu20 | :x: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
ubuntu22 | :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
ubuntu24 | :x: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
|
||||
@ -51,7 +51,7 @@ fedora39 | :x: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
fedora40 | :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
flatcar4081 | :x: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
openeuler24 | :x: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
rockylinux10 | :x: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
rockylinux9 | :x: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
ubuntu20 | :x: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
ubuntu22 | :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
ubuntu24 | :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: |
|
||||
|
||||
@ -35,7 +35,7 @@ metallb_config:
|
||||
effect: "NoSchedule"
|
||||
```
|
||||
|
||||
If you'd like to set additional nodeSelector and tolerations values, you can do so in the following fashion:
|
||||
If you'd like to set additional nodeSelector and tolerations values, you can do so in the following fasion:
|
||||
|
||||
```yaml
|
||||
metallb_config:
|
||||
|
||||
@ -37,12 +37,4 @@ If you have containers that are using iptables in the host network namespace (`h
|
||||
you need to ensure they are using iptables-nft.
|
||||
An example how k8s do the autodetection can be found [in this PR](https://github.com/kubernetes/kubernetes/pull/82966)
|
||||
|
||||
The kernel version is lower than the kubernetes 1.32 system validation, please refer to the [kernel requirements](../operations/kernel-requirements.md).
|
||||
|
||||
## Rocky Linux 10
|
||||
|
||||
(Experimental in Kubespray CI)
|
||||
|
||||
The official Rocky Linux 10 cloud image does not include `kernel-module-extra`. Both Kube Proxy and CNI rely on this package, and since it relates to kernel version compatibility (which may require VM reboots, etc.), we haven't found an ideal solution.
|
||||
|
||||
However, some users report that it doesn't affect them (minimal version). Therefore, the Kubespray CI Rocky Linux 10 image is built by Kubespray maintainers using `diskimage-builder`. For detailed methods, please refer to [the comments](https://github.com/kubernetes-sigs/kubespray/pull/12355#issuecomment-3705400093).
|
||||
The kernel version is lower than the kubenretes 1.32 system validation, please refer to the [kernel requirements](../operations/kernel-requirements.md).
|
||||
|
||||
@ -11,7 +11,7 @@ kubeadm_ignore_preflight_errors:
|
||||
|
||||
The Kernel Version Matrixs:
|
||||
|
||||
| OS Version | Kernel Version | Kernel >=4.19 |
|
||||
| OS Verion | Kernel Verion | Kernel >=4.19 |
|
||||
|--- | --- | --- |
|
||||
| RHEL 9 | 5.14 | :white_check_mark: |
|
||||
| RHEL 8 | 4.18 | :x: |
|
||||
|
||||
@ -31,8 +31,6 @@ That's it.
|
||||
|
||||
Append the new host to the inventory and run `cluster.yml`. You can NOT use `scale.yml` for that.
|
||||
|
||||
**Note:** When adding new control plane nodes, always append them to the end of the `kube_control_plane` group in your inventory. Adding control plane nodes in the first position is not supported and will cause the playbook to fail.
|
||||
|
||||
### 2) Restart kube-system/nginx-proxy
|
||||
|
||||
In all hosts, restart nginx-proxy pod. This pod is a local proxy for the apiserver. Kubespray will update its static config, but it needs to be restarted in order to reload.
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
namespace: kubernetes_sigs
|
||||
description: Deploy a production ready Kubernetes cluster
|
||||
name: kubespray
|
||||
version: 2.30.0
|
||||
version: 2.29.0
|
||||
readme: README.md
|
||||
authors:
|
||||
- The Kubespray maintainers (https://kubernetes.slack.com/channels/kubespray)
|
||||
|
||||
@ -38,7 +38,6 @@
|
||||
loadSidebar: 'docs/_sidebar.md',
|
||||
repo: 'https://github.com/kubernetes-sigs/kubespray',
|
||||
auto2top: true,
|
||||
noCompileLinks: ['.*\.ini'],
|
||||
logo: '/logo/logo-clear.png'
|
||||
}
|
||||
</script>
|
||||
|
||||
@ -11,15 +11,15 @@
|
||||
# containerd_runc_runtime:
|
||||
# name: runc
|
||||
# type: "io.containerd.runc.v2"
|
||||
# options:
|
||||
# Root: ""
|
||||
# engine: ""
|
||||
# root: ""
|
||||
|
||||
# containerd_additional_runtimes:
|
||||
# Example for Kata Containers as additional runtime:
|
||||
# - name: kata
|
||||
# type: "io.containerd.kata.v2"
|
||||
# options:
|
||||
# Root: ""
|
||||
# engine: ""
|
||||
# root: ""
|
||||
|
||||
# containerd_grpc_max_recv_message_size: 16777216
|
||||
# containerd_grpc_max_send_message_size: 16777216
|
||||
|
||||
@ -22,8 +22,7 @@ local_release_dir: "/tmp/releases"
|
||||
# Random shifts for retrying failed ops like pushing/downloading
|
||||
retry_stagger: 5
|
||||
|
||||
# This is the user that owns the cluster installation.
|
||||
# Note: cilium needs to set kube_owner to root https://kubespray.io/#/docs/CNI/cilium?id=unprivileged-agent-configuration
|
||||
# This is the user that owns tha cluster installation.
|
||||
kube_owner: kube
|
||||
|
||||
# This is the group that the cert creation scripts chgrp the
|
||||
|
||||
@ -47,8 +47,8 @@ RUN update-alternatives --install /usr/bin/python python /usr/bin/python3 1 \
|
||||
&& pip install --no-compile --no-cache-dir pip -U \
|
||||
&& pip install --no-compile --no-cache-dir -r tests/requirements.txt \
|
||||
&& pip install --no-compile --no-cache-dir -r requirements.txt \
|
||||
&& curl -L https://dl.k8s.io/release/v1.34.3/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
|
||||
&& echo $(curl -L https://dl.k8s.io/release/v1.34.3/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
|
||||
&& curl -L https://dl.k8s.io/release/v1.33.5/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
|
||||
&& echo $(curl -L https://dl.k8s.io/release/v1.33.5/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
|
||||
&& chmod a+x /usr/local/bin/kubectl \
|
||||
# Install Vagrant
|
||||
&& curl -LO https://releases.hashicorp.com/vagrant/${VAGRANT_VERSION}/vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb \
|
||||
|
||||
@ -55,7 +55,7 @@
|
||||
- { role: kubernetes-apps/kubelet-csr-approver, tags: kubelet-csr-approver }
|
||||
- { role: container-engine, tags: "container-engine", when: deploy_container_engine }
|
||||
- { role: kubernetes/node, tags: node }
|
||||
- { role: kubernetes/control-plane, tags: control-plane, upgrade_cluster_setup: true }
|
||||
- { role: kubernetes/control-plane, tags: master, upgrade_cluster_setup: true }
|
||||
- { role: kubernetes/client, tags: client }
|
||||
- { role: kubernetes/node-label, tags: node-label }
|
||||
- { role: kubernetes/node-taint, tags: node-taint }
|
||||
@ -100,7 +100,7 @@
|
||||
environment: "{{ proxy_disable_env }}"
|
||||
roles:
|
||||
- { role: kubespray_defaults }
|
||||
- { role: win_nodes/kubernetes_patch, tags: ["control-plane", "win_nodes"] }
|
||||
- { role: win_nodes/kubernetes_patch, tags: ["master", "win_nodes"] }
|
||||
|
||||
- name: Install Calico Route Reflector
|
||||
hosts: calico_rr
|
||||
|
||||
@ -1,3 +0,0 @@
|
||||
---
|
||||
- name: Remove node
|
||||
ansible.builtin.import_playbook: playbooks/remove_node.yml
|
||||
@ -1,6 +1,6 @@
|
||||
ansible==10.7.0
|
||||
# Needed for community.crypto module
|
||||
cryptography==46.0.3
|
||||
cryptography==46.0.2
|
||||
# Needed for jinja2 json_query templating
|
||||
jmespath==1.0.1
|
||||
# Needed for ansible.utils.ipaddr
|
||||
|
||||
@ -9,8 +9,6 @@ platforms:
|
||||
vm_memory: 512
|
||||
provisioner:
|
||||
name: ansible
|
||||
env:
|
||||
ANSIBLE_ROLES_PATH: ../../../
|
||||
config_options:
|
||||
defaults:
|
||||
callbacks_enabled: profile_tasks
|
||||
|
||||
@ -9,8 +9,6 @@ platforms:
|
||||
vm_memory: 512
|
||||
provisioner:
|
||||
name: ansible
|
||||
env:
|
||||
ANSIBLE_ROLES_PATH: ../../../
|
||||
config_options:
|
||||
defaults:
|
||||
callbacks_enabled: profile_tasks
|
||||
|
||||
@ -37,3 +37,8 @@ override_system_hostname: true
|
||||
is_fedora_coreos: false
|
||||
|
||||
skip_http_proxy_on_os_packages: false
|
||||
|
||||
# If this is true, debug information will be displayed but
|
||||
# may contain some private data, so it is recommended to set it to false
|
||||
# in the production environment.
|
||||
unsafe_show_logs: false
|
||||
|
||||
@ -21,8 +21,6 @@ platforms:
|
||||
vm_memory: 512
|
||||
provisioner:
|
||||
name: ansible
|
||||
env:
|
||||
ANSIBLE_ROLES_PATH: ../../../
|
||||
config_options:
|
||||
defaults:
|
||||
callbacks_enabled: profile_tasks
|
||||
|
||||
@ -13,9 +13,10 @@ containerd_snapshotter: "overlayfs"
|
||||
containerd_runc_runtime:
|
||||
name: runc
|
||||
type: "io.containerd.runc.v2"
|
||||
engine: ""
|
||||
root: ""
|
||||
base_runtime_spec: cri-base.json
|
||||
options:
|
||||
Root: ""
|
||||
SystemdCgroup: "{{ containerd_use_systemd_cgroup | ternary('true', 'false') }}"
|
||||
BinaryName: "{{ bin_dir }}/runc"
|
||||
|
||||
@ -23,8 +24,8 @@ containerd_additional_runtimes: []
|
||||
# Example for Kata Containers as additional runtime:
|
||||
# - name: kata
|
||||
# type: "io.containerd.kata.v2"
|
||||
# options:
|
||||
# Root: ""
|
||||
# engine: ""
|
||||
# root: ""
|
||||
|
||||
containerd_base_runtime_spec_rlimit_nofile: 65535
|
||||
|
||||
@ -35,8 +36,8 @@ containerd_default_base_runtime_spec_patch:
|
||||
hard: "{{ containerd_base_runtime_spec_rlimit_nofile }}"
|
||||
soft: "{{ containerd_base_runtime_spec_rlimit_nofile }}"
|
||||
|
||||
# Only for containerd < 2.1; discard unpacked layers to save disk space
|
||||
# https://github.com/containerd/containerd/blob/release/2.1/docs/cri/config.md#image-pull-configuration-since-containerd-v21
|
||||
# Can help reduce disk usage
|
||||
# https://github.com/containerd/containerd/discussions/6295
|
||||
containerd_discard_unpacked_layers: true
|
||||
|
||||
containerd_base_runtime_specs:
|
||||
|
||||
@ -34,6 +34,8 @@
|
||||
with_items:
|
||||
- "{{ containerd_systemd_dir }}"
|
||||
- "{{ containerd_cfg_dir }}"
|
||||
- "{{ containerd_storage_dir }}"
|
||||
- "{{ containerd_state_dir }}"
|
||||
|
||||
- name: Containerd | Write containerd proxy drop-in
|
||||
template:
|
||||
|
||||
@ -52,6 +52,8 @@ oom_score = {{ containerd_oom_score }}
|
||||
{% for runtime in [containerd_runc_runtime] + containerd_additional_runtimes %}
|
||||
[plugins."io.containerd.cri.v1.runtime".containerd.runtimes.{{ runtime.name }}]
|
||||
runtime_type = "{{ runtime.type }}"
|
||||
runtime_engine = "{{ runtime.engine }}"
|
||||
runtime_root = "{{ runtime.root }}"
|
||||
{% if runtime.base_runtime_spec is defined %}
|
||||
base_runtime_spec = "{{ containerd_cfg_dir }}/{{ runtime.base_runtime_spec }}"
|
||||
{% endif %}
|
||||
@ -76,9 +78,7 @@ oom_score = {{ containerd_oom_score }}
|
||||
|
||||
[plugins."io.containerd.cri.v1.images"]
|
||||
snapshotter = "{{ containerd_snapshotter }}"
|
||||
{% if containerd_discard_unpacked_layers and containerd_version is version('2.1.0', '<') %}
|
||||
discard_unpacked_layers = {{ containerd_discard_unpacked_layers | lower }}
|
||||
{% endif %}
|
||||
image_pull_progress_timeout = "{{ containerd_image_pull_progress_timeout }}"
|
||||
[plugins."io.containerd.cri.v1.images".pinned_images]
|
||||
sandbox = "{{ pod_infra_image_repo }}:{{ pod_infra_image_tag }}"
|
||||
|
||||
@ -25,8 +25,6 @@ provisioner:
|
||||
group_vars:
|
||||
all:
|
||||
become: true
|
||||
k8s_cluster:
|
||||
container_manager: docker
|
||||
playbooks:
|
||||
create: ../../../../../tests/cloud_playbooks/create-kubevirt.yml
|
||||
prepare: ../../../molecule/prepare.yml
|
||||
|
||||
@ -32,8 +32,6 @@ crio_registry_auth: []
|
||||
crio_seccomp_profile: ""
|
||||
crio_selinux: "{{ (preinstall_selinux_state == 'enforcing') | lower }}"
|
||||
crio_signature_policy: "{% if ansible_os_family == 'ClearLinux' %}/usr/share/defaults/crio/policy.json{% endif %}"
|
||||
# Set the pull progress timeout
|
||||
crio_pull_progress_timeout: "10s"
|
||||
|
||||
# Override system default for storage driver
|
||||
# crio_storage_driver: "overlay"
|
||||
|
||||
@ -2,6 +2,8 @@
|
||||
- name: Converge
|
||||
hosts: all
|
||||
become: true
|
||||
vars:
|
||||
container_manager: crio
|
||||
roles:
|
||||
- role: kubespray_defaults
|
||||
- role: container-engine/cri-o
|
||||
|
||||
@ -41,10 +41,6 @@ provisioner:
|
||||
defaults:
|
||||
callbacks_enabled: profile_tasks
|
||||
timeout: 120
|
||||
inventory:
|
||||
group_vars:
|
||||
k8s_cluster:
|
||||
container_manager: crio
|
||||
playbooks:
|
||||
create: ../../../../../tests/cloud_playbooks/create-kubevirt.yml
|
||||
prepare: ../../../molecule/prepare.yml
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
- name: Test CRI-O cri
|
||||
import_playbook: ../../../molecule/test_cri.yml
|
||||
vars:
|
||||
container_manager: crio
|
||||
cri_socket: unix:///var/run/crio/crio.sock
|
||||
cri_name: cri-o
|
||||
- name: Test running a container with crun
|
||||
|
||||
@ -348,12 +348,6 @@ signature_policy = "{{ crio_signature_policy }}"
|
||||
# ignore; the latter will ignore volumes entirely.
|
||||
image_volumes = "mkdir"
|
||||
|
||||
# The timeout for an image pull to make progress until the pull operation gets
|
||||
# canceled. This value will be also used for calculating the pull progress interval
|
||||
# to pull_progress_timeout / 10. Can be set to 0 to disable the timeout as well as
|
||||
# the progress output.
|
||||
pull_progress_timeout = "{{ crio_pull_progress_timeout }}"
|
||||
|
||||
# The crio.network table containers settings pertaining to the management of
|
||||
# CNI plugins.
|
||||
[crio.network]
|
||||
|
||||
22
roles/container-engine/crictl/tasks/crictl.yml
Normal file
22
roles/container-engine/crictl/tasks/crictl.yml
Normal file
@ -0,0 +1,22 @@
|
||||
---
|
||||
- name: Crictl | Download crictl
|
||||
include_tasks: "../../../download/tasks/download_file.yml"
|
||||
vars:
|
||||
download: "{{ download_defaults | combine(downloads.crictl) }}"
|
||||
|
||||
- name: Install crictl config
|
||||
template:
|
||||
src: crictl.yaml.j2
|
||||
dest: /etc/crictl.yaml
|
||||
owner: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Copy crictl binary from download dir
|
||||
copy:
|
||||
src: "{{ local_release_dir }}/crictl"
|
||||
dest: "{{ bin_dir }}/crictl"
|
||||
mode: "0755"
|
||||
remote_src: true
|
||||
notify:
|
||||
- Get crictl completion
|
||||
- Install crictl completion
|
||||
@ -1,22 +1,3 @@
|
||||
---
|
||||
- name: Crictl | Download crictl
|
||||
include_tasks: "../../../download/tasks/download_file.yml"
|
||||
vars:
|
||||
download: "{{ download_defaults | combine(downloads.crictl) }}"
|
||||
|
||||
- name: Install crictl config
|
||||
template:
|
||||
src: crictl.yaml.j2
|
||||
dest: /etc/crictl.yaml
|
||||
owner: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Copy crictl binary from download dir
|
||||
copy:
|
||||
src: "{{ local_release_dir }}/crictl"
|
||||
dest: "{{ bin_dir }}/crictl"
|
||||
mode: "0755"
|
||||
remote_src: true
|
||||
notify:
|
||||
- Get crictl completion
|
||||
- Install crictl completion
|
||||
- name: Install crictl
|
||||
include_tasks: crictl.yml
|
||||
|
||||
@ -21,11 +21,6 @@ provisioner:
|
||||
defaults:
|
||||
callbacks_enabled: profile_tasks
|
||||
timeout: 120
|
||||
inventory:
|
||||
group_vars:
|
||||
k8s_cluster:
|
||||
gvisor_enabled: true
|
||||
container_manager: containerd
|
||||
playbooks:
|
||||
create: ../../../../../tests/cloud_playbooks/create-kubevirt.yml
|
||||
prepare: ../../../molecule/prepare.yml
|
||||
|
||||
@ -12,20 +12,11 @@
|
||||
is_ostree: "{{ ostree.stat.exists }}"
|
||||
|
||||
- name: Runc | Uninstall runc package managed by package manager
|
||||
package:
|
||||
name: "{{ runc_package_name }}"
|
||||
state: absent
|
||||
when:
|
||||
- not is_ostree
|
||||
- ansible_distribution != "Flatcar Container Linux by Kinvolk"
|
||||
- ansible_distribution != "Flatcar"
|
||||
block:
|
||||
- name: Runc | Remove package
|
||||
package:
|
||||
name: "{{ runc_package_name }}"
|
||||
state: absent
|
||||
- name: Runc | Remove orphaned binary
|
||||
file:
|
||||
path: /usr/bin/runc
|
||||
state: absent
|
||||
when: runc_bin_dir != "/usr/bin"
|
||||
- not (is_ostree or (ansible_distribution == "Flatcar Container Linux by Kinvolk") or (ansible_distribution == "Flatcar"))
|
||||
|
||||
- name: Runc | Download runc binary
|
||||
include_tasks: "../../../download/tasks/download_file.yml"
|
||||
@ -38,3 +29,10 @@
|
||||
dest: "{{ runc_bin_dir }}/runc"
|
||||
mode: "0755"
|
||||
remote_src: true
|
||||
|
||||
- name: Runc | Remove orphaned binary
|
||||
file:
|
||||
path: /usr/bin/runc
|
||||
state: absent
|
||||
when: runc_bin_dir != "/usr/bin"
|
||||
ignore_errors: true # noqa ignore-errors
|
||||
|
||||
@ -21,11 +21,6 @@ provisioner:
|
||||
defaults:
|
||||
callbacks_enabled: profile_tasks
|
||||
timeout: 120
|
||||
inventory:
|
||||
group_vars:
|
||||
k8s_cluster:
|
||||
youki_enabled: true
|
||||
container_manager: crio
|
||||
playbooks:
|
||||
create: ../../../../../tests/cloud_playbooks/create-kubevirt.yml
|
||||
prepare: ../../../molecule/prepare.yml
|
||||
|
||||
@ -39,12 +39,16 @@ DNS.{{ counter["dns"] }} = {{ apiserver_loadbalancer_domain_name }}{{ increment(
|
||||
DNS.{{ counter["dns"] }} = {{ etcd_alt_name }}{{ increment(counter, 'dns') }}
|
||||
{% endfor %}
|
||||
{% for host in groups['etcd'] %}
|
||||
{% for address in hostvars[host]['main_access_ips'] %}
|
||||
IP.{{ counter["ip"] }} = {{ address }}{{ increment(counter, 'ip') }}
|
||||
{% endfor %}
|
||||
{% for address in hostvars[host]['main_ips'] %}
|
||||
IP.{{ counter["ip"] }} = {{ address }}{{ increment(counter, 'ip') }}
|
||||
{% endfor %}
|
||||
{% if hostvars[host]['access_ip'] is defined %}
|
||||
IP.{{ counter["ip"] }} = {{ hostvars[host]['access_ip'] }}{{ increment(counter, 'ip') }}
|
||||
{% endif %}
|
||||
{% if hostvars[host]['access_ip6'] is defined %}
|
||||
IP.{{ counter["ip"] }} = {{ hostvars[host]['access_ip6'] }}{{ increment(counter, 'ip') }}
|
||||
{% endif %}
|
||||
{% if ipv6_stack %}
|
||||
IP.{{ counter["ip"] }} = {{ hostvars[host]['ip6'] | default(hostvars[host]['fallback_ip6']) }}{{ increment(counter, 'ip') }}
|
||||
{% endif %}
|
||||
IP.{{ counter["ip"] }} = {{ hostvars[host]['main_ip'] }}{{ increment(counter, 'ip') }}
|
||||
{% endfor %}
|
||||
{% for cert_alt_ip in etcd_cert_alt_ips %}
|
||||
IP.{{ counter["ip"] }} = {{ cert_alt_ip }}{{ increment(counter, 'ip') }}
|
||||
|
||||
@ -117,6 +117,11 @@ etcd_retries: 4
|
||||
# https://groups.google.com/a/kubernetes.io/g/dev/c/B7gJs88XtQc/m/rSgNOzV2BwAJ?utm_medium=email&utm_source=footer
|
||||
etcd_experimental_initial_corrupt_check: true
|
||||
|
||||
# If this is true, debug information will be displayed but
|
||||
# may contain some private data, so it is recommended to set it to false
|
||||
# in the production environment.
|
||||
unsafe_show_logs: false
|
||||
|
||||
# Enable distributed tracing
|
||||
# https://etcd.io/docs/v3.5/op-guide/monitoring/#distributed-tracing
|
||||
etcd_experimental_enable_distributed_tracing: false
|
||||
|
||||
@ -1,5 +1,6 @@
|
||||
---
|
||||
gateway_api_enabled: false
|
||||
gateway_api_version: 1.2.1
|
||||
|
||||
# `gateway_api_channel` default is "standard".
|
||||
# "standard" release channel includes all resources that have graduated to GA or beta, including GatewayClass, Gateway, HTTPRoute, and ReferenceGrant.
|
||||
|
||||
@ -27,6 +27,11 @@ vsphere_csi_aggressive_node_not_ready_timeout: 300
|
||||
|
||||
vsphere_csi_node_affinity: {}
|
||||
|
||||
# If this is true, debug information will be displayed but
|
||||
# may contain some private data, so it is recommended to set it to false
|
||||
# in the production environment.
|
||||
unsafe_show_logs: false
|
||||
|
||||
# https://github.com/kubernetes-sigs/vsphere-csi-driver/blob/master/docs/book/features/volume_snapshot.md#how-to-enable-volume-snapshot--restore-feature-in-vsphere-csi-
|
||||
# according to the above link , we can controler the block-volume-snapshot parameter
|
||||
vsphere_csi_block_volume_snapshot: false
|
||||
|
||||
@ -1,7 +1,5 @@
|
||||
---
|
||||
dependencies:
|
||||
- role: kubernetes-apps/utils
|
||||
|
||||
- role: kubernetes-apps/ansible
|
||||
when:
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
|
||||
@ -26,16 +26,6 @@ rules:
|
||||
verbs:
|
||||
- watch
|
||||
- list
|
||||
# Services are monitored for service LoadBalancer IP allocation
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- services
|
||||
- services/status
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- update
|
||||
- watch
|
||||
{% elif calico_datastore == "kdd" %}
|
||||
# Nodes are watched to monitor for deletions.
|
||||
- apiGroups: [""]
|
||||
@ -89,7 +79,6 @@ rules:
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
- watch
|
||||
# Needs access to update clusterinformations.
|
||||
- apiGroups: ["crd.projectcalico.org"]
|
||||
resources:
|
||||
|
||||
@ -1,12 +0,0 @@
|
||||
---
|
||||
_kubectl_apply_stdin:
|
||||
- "{{ kubectl }}"
|
||||
- apply
|
||||
- -f
|
||||
- "-"
|
||||
- -n
|
||||
- "{{ k8s_namespace }}"
|
||||
- --server-side="{{ server_side_apply | lower }}"
|
||||
# TODO: switch to default SSA
|
||||
server_side_apply: false
|
||||
kubectl_apply_stdin: "{{ _kubectl_apply_stdin | join(' ') }}"
|
||||
2
roles/kubernetes-apps/vars/main.yml
Normal file
2
roles/kubernetes-apps/vars/main.yml
Normal file
@ -0,0 +1,2 @@
|
||||
---
|
||||
kubectl_apply_stdin: "{{ kubectl }} apply -f - -n {{ k8s_namespace }}"
|
||||
@ -240,10 +240,6 @@ auto_renew_certificates_systemd_calendar: "Mon *-*-1,2,3,4,5,6,7 03:00:00"
|
||||
# we can opt out from the default behavior by setting kubeadm_upgrade_auto_cert_renewal to false
|
||||
kubeadm_upgrade_auto_cert_renewal: true
|
||||
|
||||
# Add Subject Alternative Names to the Kubernetes apiserver certificates.
|
||||
# Useful if you access the API from multiples load balancers, for instance.
|
||||
supplementary_addresses_in_ssl_keys: []
|
||||
|
||||
# Bash alias of kubectl to interact with Kubernetes cluster much easier
|
||||
# kubectl_alias: k
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
- name: Kubeadm | Check api is up
|
||||
uri:
|
||||
url: "https://{{ main_ip | ansible.utils.ipwrap }}:{{ kube_apiserver_port }}/healthz"
|
||||
url: "https://{{ ip | default(fallback_ip) }}:{{ kube_apiserver_port }}/healthz"
|
||||
validate_certs: false
|
||||
when: ('kube_control_plane' in group_names)
|
||||
register: _result
|
||||
|
||||
@ -0,0 +1,19 @@
|
||||
---
|
||||
|
||||
- name: Check which kube-control nodes are already members of the cluster
|
||||
command: "{{ bin_dir }}/kubectl get nodes --selector=node-role.kubernetes.io/control-plane -o json"
|
||||
register: kube_control_planes_raw
|
||||
ignore_errors: true
|
||||
changed_when: false
|
||||
|
||||
- name: Set fact joined_control_planes
|
||||
set_fact:
|
||||
joined_control_planes: "{{ ((kube_control_planes_raw.stdout | from_json)['items']) | default([]) | map(attribute='metadata') | map(attribute='name') | list }}"
|
||||
delegate_to: "{{ item }}"
|
||||
loop: "{{ groups['kube_control_plane'] }}"
|
||||
when: kube_control_planes_raw is succeeded
|
||||
run_once: true
|
||||
|
||||
- name: Set fact first_kube_control_plane
|
||||
set_fact:
|
||||
first_kube_control_plane: "{{ joined_control_planes | default([]) | first | default(groups['kube_control_plane'] | first) }}"
|
||||
@ -11,23 +11,24 @@
|
||||
tags:
|
||||
- facts
|
||||
|
||||
- name: Obtain kubeadm certificate key for joining control planes nodes
|
||||
- name: Upload certificates so they are fresh and not expired
|
||||
command: >-
|
||||
{{ bin_dir }}/kubeadm init phase
|
||||
--config {{ kube_config_dir }}/kubeadm-config.yaml
|
||||
upload-certs
|
||||
--upload-certs
|
||||
register: kubeadm_upload_cert
|
||||
when:
|
||||
- inventory_hostname == first_kube_control_plane
|
||||
- not kube_external_ca_mode
|
||||
run_once: true
|
||||
block:
|
||||
- name: Upload certificates so they are fresh and not expired
|
||||
command: >-
|
||||
{{ bin_dir }}/kubeadm init phase
|
||||
--config {{ kube_config_dir }}/kubeadm-config.yaml
|
||||
upload-certs
|
||||
--upload-certs
|
||||
register: kubeadm_upload_cert
|
||||
delegate_to: "{{ first_kube_control_plane }}"
|
||||
|
||||
- name: Parse certificate key if not set
|
||||
set_fact:
|
||||
kubeadm_certificate_key: "{{ kubeadm_upload_cert.stdout_lines[-1] | trim }}"
|
||||
- name: Parse certificate key if not set
|
||||
set_fact:
|
||||
kubeadm_certificate_key: "{{ hostvars[first_kube_control_plane]['kubeadm_upload_cert'].stdout_lines[-1] | trim }}"
|
||||
run_once: true
|
||||
when:
|
||||
- hostvars[first_kube_control_plane]['kubeadm_upload_cert'] is defined
|
||||
- hostvars[first_kube_control_plane]['kubeadm_upload_cert'] is not skipped
|
||||
|
||||
- name: Wait for k8s apiserver
|
||||
wait_for:
|
||||
|
||||
@ -25,9 +25,9 @@
|
||||
|
||||
- name: Kubeadm | aggregate all SANs
|
||||
set_fact:
|
||||
apiserver_sans: "{{ _apiserver_sans | flatten | select | unique }}"
|
||||
apiserver_sans: "{{ (sans_base + groups['kube_control_plane'] + sans_lb + sans_lb_ip + sans_supp + sans_access_ip + sans_ip + sans_ipv4_address + sans_ipv6_address + sans_override + sans_hostname + sans_fqdn + sans_kube_vip_address) | unique }}"
|
||||
vars:
|
||||
_apiserver_sans:
|
||||
sans_base:
|
||||
- "kubernetes"
|
||||
- "kubernetes.default"
|
||||
- "kubernetes.default.svc"
|
||||
@ -36,17 +36,17 @@
|
||||
- "localhost"
|
||||
- "127.0.0.1"
|
||||
- "::1"
|
||||
- "{{ apiserver_loadbalancer_domain_name }}"
|
||||
- "{{ loadbalancer_apiserver.address | d('') }}"
|
||||
- "{{ supplementary_addresses_in_ssl_keys }}"
|
||||
- "{{ groups['kube_control_plane'] | map('extract', hostvars, 'main_access_ip') }}"
|
||||
- "{{ groups['kube_control_plane'] | map('extract', hostvars, 'main_ip') }}"
|
||||
- "{{ groups['kube_control_plane'] | map('extract', hostvars, ['ansible_default_ipv4', 'address']) | select('defined') }}"
|
||||
- "{{ groups['kube_control_plane'] | map('extract', hostvars, ['ansible_default_ipv6', 'address']) | select('defined') }}"
|
||||
- "{{ groups['kube_control_plane'] | map('extract', hostvars, 'ansible_hostname') }}"
|
||||
- "{{ groups['kube_control_plane'] | map('extract', hostvars, 'ansible_fqdn') }}"
|
||||
- "{{ kube_override_hostname }}"
|
||||
- "{{ kube_vip_address }}"
|
||||
sans_lb: "{{ [apiserver_loadbalancer_domain_name] if apiserver_loadbalancer_domain_name is defined else [] }}"
|
||||
sans_lb_ip: "{{ [loadbalancer_apiserver.address] if loadbalancer_apiserver is defined and loadbalancer_apiserver.address is defined else [] }}"
|
||||
sans_supp: "{{ supplementary_addresses_in_ssl_keys if supplementary_addresses_in_ssl_keys is defined else [] }}"
|
||||
sans_access_ip: "{{ groups['kube_control_plane'] | map('extract', hostvars, 'main_access_ip') | list | select('defined') | list }}"
|
||||
sans_ip: "{{ groups['kube_control_plane'] | map('extract', hostvars, 'main_ip') | list | select('defined') | list }}"
|
||||
sans_ipv4_address: "{{ groups['kube_control_plane'] | map('extract', hostvars, ['ansible_default_ipv4', 'address']) | list | select('defined') | list }}"
|
||||
sans_ipv6_address: "{{ groups['kube_control_plane'] | map('extract', hostvars, ['ansible_default_ipv6', 'address']) | list | select('defined') | list }}"
|
||||
sans_override: "{{ [kube_override_hostname] if kube_override_hostname else [] }}"
|
||||
sans_hostname: "{{ groups['kube_control_plane'] | map('extract', hostvars, ['ansible_hostname']) | list | select('defined') | list }}"
|
||||
sans_fqdn: "{{ groups['kube_control_plane'] | map('extract', hostvars, ['ansible_fqdn']) | list | select('defined') | list }}"
|
||||
sans_kube_vip_address: "{{ [kube_vip_address] if kube_vip_address is defined and kube_vip_address else [] }}"
|
||||
tags: facts
|
||||
|
||||
- name: Create audit-policy directory
|
||||
@ -179,10 +179,9 @@
|
||||
timeout -k {{ kubeadm_init_timeout }} {{ kubeadm_init_timeout }}
|
||||
{{ bin_dir }}/kubeadm init
|
||||
--config={{ kube_config_dir }}/kubeadm-config.yaml
|
||||
--ignore-preflight-errors={{ _ignore_errors | flatten | join(',') }}
|
||||
--ignore-preflight-errors={{ kubeadm_ignore_preflight_errors | join(',') }}
|
||||
--skip-phases={{ kubeadm_init_phases_skip | join(',') }}
|
||||
{{ kube_external_ca_mode | ternary('', '--upload-certs') }}
|
||||
_ignore_errors: "{{ kubeadm_ignore_preflight_errors }}"
|
||||
environment:
|
||||
PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
|
||||
notify: Control plane | restart kubelet
|
||||
@ -196,15 +195,6 @@
|
||||
# This retry task is separated from 1st task to show log of failure of 1st task.
|
||||
- name: Kubeadm | Initialize first control plane node (retry)
|
||||
command: "{{ kubeadm_init_first_control_plane_cmd }}"
|
||||
vars:
|
||||
_errors_from_first_try:
|
||||
- 'FileAvailable--etc-kubernetes-manifests-kube-controller-manager.yaml'
|
||||
- 'FileAvailable--etc-kubernetes-manifests-kube-scheduler.yaml'
|
||||
- 'FileAvailable--etc-kubernetes-manifests-kube-apiserver.yaml'
|
||||
- 'Port-10250'
|
||||
_ignore_errors:
|
||||
- "{{ kubeadm_ignore_preflight_errors }}"
|
||||
- "{{ _errors_from_first_try if 'all' not in kubeadm_ignore_preflight_errors else [] }}"
|
||||
register: kubeadm_init
|
||||
retries: 2
|
||||
until: kubeadm_init is succeeded or "field is immutable" in kubeadm_init.stderr
|
||||
|
||||
@ -92,6 +92,9 @@
|
||||
- upgrade
|
||||
ignore_errors: true # noqa ignore-errors
|
||||
|
||||
- name: Define nodes already joined to existing cluster and first_kube_control_plane
|
||||
import_tasks: define-first-kube-control.yml
|
||||
|
||||
- name: Include kubeadm setup
|
||||
import_tasks: kubeadm-setup.yml
|
||||
|
||||
|
||||
@ -61,6 +61,8 @@ eviction_hard_control_plane: {}
|
||||
kubelet_status_update_frequency: 10s
|
||||
|
||||
# kube-vip
|
||||
kube_vip_version: 0.8.0
|
||||
|
||||
kube_vip_arp_enabled: false
|
||||
kube_vip_interface:
|
||||
kube_vip_services_interface:
|
||||
@ -78,6 +80,7 @@ kube_vip_bgp_peeraddress:
|
||||
kube_vip_bgp_peerpass:
|
||||
kube_vip_bgp_peeras: 65000
|
||||
kube_vip_bgppeers:
|
||||
kube_vip_address:
|
||||
kube_vip_enableServicesElection: false
|
||||
kube_vip_lb_enable: false
|
||||
kube_vip_leasename: plndr-cp-lock
|
||||
|
||||
@ -18,7 +18,14 @@
|
||||
owner: root
|
||||
mode: "0755"
|
||||
backup: true
|
||||
register: haproxy_conf
|
||||
|
||||
- name: Haproxy | Get checksum from config
|
||||
stat:
|
||||
path: "{{ haproxy_config_dir }}/haproxy.cfg"
|
||||
get_attributes: false
|
||||
get_checksum: true
|
||||
get_mime: false
|
||||
register: haproxy_stat
|
||||
|
||||
- name: Haproxy | Write static pod
|
||||
template:
|
||||
|
||||
@ -18,7 +18,14 @@
|
||||
owner: root
|
||||
mode: "0755"
|
||||
backup: true
|
||||
register: nginx_conf
|
||||
|
||||
- name: Nginx-proxy | Get checksum from config
|
||||
stat:
|
||||
path: "{{ nginx_config_dir }}/nginx.conf"
|
||||
get_attributes: false
|
||||
get_checksum: true
|
||||
get_mime: false
|
||||
register: nginx_stat
|
||||
|
||||
- name: Nginx-proxy | Write static pod
|
||||
template:
|
||||
|
||||
@ -7,7 +7,7 @@ metadata:
|
||||
addonmanager.kubernetes.io/mode: Reconcile
|
||||
k8s-app: kube-haproxy
|
||||
annotations:
|
||||
haproxy-cfg-checksum: "{{ haproxy_conf.checksum }}"
|
||||
haproxy-cfg-checksum: "{{ haproxy_stat.stat.checksum }}"
|
||||
spec:
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
# Inspired by https://github.com/kube-vip/kube-vip/blob/v1.0.3/pkg/kubevip/config_generator.go#L103
|
||||
# Inspired by https://github.com/kube-vip/kube-vip/blob/v0.8.0/pkg/kubevip/config_generator.go#L103
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
@ -27,7 +27,7 @@ spec:
|
||||
value: {{ kube_vip_services_interface | string | to_json }}
|
||||
{% endif %}
|
||||
{% if kube_vip_cidr %}
|
||||
- name: vip_{{ "subnet" if kube_vip_version is version('0.9.0', '>=') else "cidr" }}
|
||||
- name: vip_cidr
|
||||
value: {{ kube_vip_cidr | string | to_json }}
|
||||
{% endif %}
|
||||
{% if kube_vip_dns_mode %}
|
||||
@ -113,8 +113,6 @@ spec:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
drop:
|
||||
- ALL
|
||||
{% endif %}
|
||||
volumeMounts:
|
||||
- mountPath: /etc/kubernetes/admin.conf
|
||||
|
||||
@ -7,7 +7,7 @@ metadata:
|
||||
addonmanager.kubernetes.io/mode: Reconcile
|
||||
k8s-app: kube-nginx
|
||||
annotations:
|
||||
nginx-cfg-checksum: "{{ nginx_conf.checksum }}"
|
||||
nginx-cfg-checksum: "{{ nginx_stat.stat.checksum }}"
|
||||
spec:
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
|
||||
@ -74,33 +74,8 @@
|
||||
- not is_fedora_coreos
|
||||
- not ansible_os_family in ["Flatcar", "Flatcar Container Linux by Kinvolk"]
|
||||
|
||||
- name: Gather selinux facts
|
||||
ansible.builtin.setup:
|
||||
gather_subset: selinux
|
||||
when:
|
||||
- ntp_timezone
|
||||
- ansible_os_family == "RedHat"
|
||||
|
||||
- name: Put SELinux in permissive mode, logging actions that would be blocked.
|
||||
ansible.posix.selinux:
|
||||
policy: targeted
|
||||
state: permissive
|
||||
when:
|
||||
- ntp_timezone
|
||||
- ansible_os_family == "RedHat"
|
||||
- ansible_facts.selinux.mode == 'enforcing'
|
||||
|
||||
- name: Set ntp_timezone
|
||||
- name: Set timezone
|
||||
community.general.timezone:
|
||||
name: "{{ ntp_timezone }}"
|
||||
when:
|
||||
- ntp_timezone
|
||||
|
||||
- name: Re-enable SELinux
|
||||
ansible.posix.selinux:
|
||||
policy: targeted
|
||||
state: "{{ preinstall_selinux_state }}"
|
||||
when:
|
||||
- ntp_timezone
|
||||
- ansible_os_family == "RedHat"
|
||||
- ansible_facts.selinux.status == 'enabled'
|
||||
|
||||
@ -5,9 +5,7 @@ download_cache_dir: /tmp/kubespray_cache
|
||||
# If this is true, debug information will be displayed but
|
||||
# may contain some private data, so it is recommended to set it to false
|
||||
# in the production environment.
|
||||
# false by default, unless we're running in CI. (CI_PROJECT_URL should be globally unique even if kubespray happens to run
|
||||
# in gitlab-ci in other contexts
|
||||
unsafe_show_logs: "{{ lookup('env', 'CI_PROJECT_URL') == 'https://gitlab.com/kargo-ci/kubernetes-sigs-kubespray' }}"
|
||||
unsafe_show_logs: false
|
||||
|
||||
# do not delete remote cache files after using them
|
||||
# NOTE: Setting this parameter to TRUE is only really useful when developing kubespray
|
||||
@ -116,7 +114,7 @@ flannel_version: 0.27.3
|
||||
flannel_cni_version: 1.7.1-flannel1
|
||||
cni_version: "{{ (cni_binary_checksums['amd64'] | dict2items)[0].key }}"
|
||||
|
||||
cilium_version: "1.18.5"
|
||||
cilium_version: "1.18.2"
|
||||
cilium_cli_version: "{{ (ciliumcli_binary_checksums['amd64'] | dict2items)[0].key }}"
|
||||
cilium_enable_hubble: false
|
||||
|
||||
@ -142,7 +140,7 @@ scheduler_plugins_version: "{{ scheduler_plugins_supported_versions[kube_major_v
|
||||
|
||||
yq_version: "{{ (yq_checksums['amd64'] | dict2items)[0].key }}"
|
||||
|
||||
gateway_api_version: "{{ (gateway_api_standard_crds_checksums.no_arch | dict2items)[0].key }}"
|
||||
gateway_api_version: "1.2.1"
|
||||
gateway_api_channel: "standard"
|
||||
|
||||
prometheus_operator_crds_version: "{{ (prometheus_operator_crds_checksums.no_arch | dict2items)[0].key }}"
|
||||
@ -251,7 +249,7 @@ cilium_hubble_ui_image_tag: "v0.13.3"
|
||||
cilium_hubble_ui_backend_image_repo: "{{ quay_image_repo }}/cilium/hubble-ui-backend"
|
||||
cilium_hubble_ui_backend_image_tag: "v0.13.3"
|
||||
cilium_hubble_envoy_image_repo: "{{ quay_image_repo }}/cilium/cilium-envoy"
|
||||
cilium_hubble_envoy_image_tag: "v1.34.10-1762597008-ff7ae7d623be00078865cff1b0672cc5d9bfc6d5"
|
||||
cilium_hubble_envoy_image_tag: "v1.34.7-1757592137-1a52bb680a956879722f48c591a2ca90f7791324"
|
||||
kube_ovn_container_image_repo: "{{ docker_image_repo }}/kubeovn/kube-ovn"
|
||||
kube_ovn_container_image_tag: "v{{ kube_ovn_version }}"
|
||||
kube_ovn_vpc_container_image_repo: "{{ docker_image_repo }}/kubeovn/vpc-nat-gateway"
|
||||
@ -265,9 +263,8 @@ multus_image_tag: "v{{ multus_version }}"
|
||||
external_openstack_cloud_controller_image_repo: "{{ kube_image_repo }}/provider-os/openstack-cloud-controller-manager"
|
||||
external_openstack_cloud_controller_image_tag: "v1.32.0"
|
||||
|
||||
kube_vip_version: 1.0.3
|
||||
kube_vip_image_repo: "{{ github_image_repo }}/kube-vip/kube-vip{{ '-iptables' if kube_vip_lb_fwdmethod == 'masquerade' else '' }}"
|
||||
kube_vip_image_tag: "v{{ kube_vip_version }}"
|
||||
kube_vip_image_tag: v0.8.9
|
||||
nginx_image_repo: "{{ docker_image_repo }}/library/nginx"
|
||||
nginx_image_tag: 1.28.0-alpine
|
||||
haproxy_image_repo: "{{ docker_image_repo }}/library/haproxy"
|
||||
@ -277,9 +274,9 @@ haproxy_image_tag: 3.2.4-alpine
|
||||
# bundle with kubeadm; if not 'basic' upgrade can sometimes fail
|
||||
|
||||
coredns_supported_versions:
|
||||
'1.34': 1.12.1
|
||||
'1.33': 1.12.0
|
||||
'1.32': 1.11.3
|
||||
'1.31': 1.11.3
|
||||
coredns_version: "{{ coredns_supported_versions[kube_major_version] }}"
|
||||
coredns_image_repo: "{{ kube_image_repo }}{{ '/coredns' if coredns_version is version('1.7.1', '>=') else '' }}/coredns"
|
||||
coredns_image_tag: "{{ 'v' if coredns_version is version('1.7.1', '>=') else '' }}{{ coredns_version }}"
|
||||
@ -327,22 +324,22 @@ cert_manager_webhook_image_repo: "{{ quay_image_repo }}/jetstack/cert-manager-we
|
||||
cert_manager_webhook_image_tag: "v{{ cert_manager_version }}"
|
||||
|
||||
csi_attacher_image_repo: "{{ kube_image_repo }}/sig-storage/csi-attacher"
|
||||
csi_attacher_image_tag: "v4.4.2"
|
||||
csi_attacher_image_tag: "v3.3.0"
|
||||
csi_provisioner_image_repo: "{{ kube_image_repo }}/sig-storage/csi-provisioner"
|
||||
csi_provisioner_image_tag: "v3.6.2"
|
||||
csi_provisioner_image_tag: "v3.0.0"
|
||||
csi_snapshotter_image_repo: "{{ kube_image_repo }}/sig-storage/csi-snapshotter"
|
||||
csi_snapshotter_image_tag: "v6.3.2"
|
||||
csi_snapshotter_image_tag: "v5.0.0"
|
||||
csi_resizer_image_repo: "{{ kube_image_repo }}/sig-storage/csi-resizer"
|
||||
csi_resizer_image_tag: "v1.9.2"
|
||||
csi_resizer_image_tag: "v1.3.0"
|
||||
csi_node_driver_registrar_image_repo: "{{ kube_image_repo }}/sig-storage/csi-node-driver-registrar"
|
||||
csi_node_driver_registrar_image_tag: "v2.4.0"
|
||||
csi_livenessprobe_image_repo: "{{ kube_image_repo }}/sig-storage/livenessprobe"
|
||||
csi_livenessprobe_image_tag: "v2.11.0"
|
||||
csi_livenessprobe_image_tag: "v2.5.0"
|
||||
|
||||
snapshot_controller_supported_versions:
|
||||
'1.34': "v7.0.2"
|
||||
'1.33': "v7.0.2"
|
||||
'1.32': "v7.0.2"
|
||||
'1.31': "v7.0.2"
|
||||
snapshot_controller_image_repo: "{{ kube_image_repo }}/sig-storage/snapshot-controller"
|
||||
snapshot_controller_image_tag: "{{ snapshot_controller_supported_versions[kube_major_version] }}"
|
||||
|
||||
@ -787,9 +784,9 @@ downloads:
|
||||
url: "{{ calico_crds_download_url }}"
|
||||
unarchive: true
|
||||
unarchive_extra_opts:
|
||||
- "--strip=3"
|
||||
- "{{ '--strip=6' if (calico_version is version('3.22.3', '<')) else '--strip=3' }}"
|
||||
- "--wildcards"
|
||||
- "*/libcalico-go/config/crd/"
|
||||
- "{{ '*/_includes/charts/calico/crds/kdd/' if (calico_version is version('3.22.3', '<')) else '*/libcalico-go/config/crd/' }}"
|
||||
owner: "root"
|
||||
mode: "0755"
|
||||
groups:
|
||||
@ -1038,15 +1035,6 @@ downloads:
|
||||
groups:
|
||||
- kube_node
|
||||
|
||||
csi_livenessprobe:
|
||||
enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}"
|
||||
container: true
|
||||
repo: "{{ csi_livenessprobe_image_repo }}"
|
||||
tag: "{{ csi_livenessprobe_image_tag }}"
|
||||
checksum: "{{ csi_livenessprobe_digest_checksum | default(None) }}"
|
||||
groups:
|
||||
- kube_node
|
||||
|
||||
csi_node_driver_registrar:
|
||||
enabled: "{{ cinder_csi_enabled or aws_ebs_csi_enabled }}"
|
||||
container: true
|
||||
|
||||
@ -96,7 +96,6 @@ ignore_assert_errors: false
|
||||
# kube-vip
|
||||
kube_vip_enabled: false
|
||||
kube_vip_lb_fwdmethod: local
|
||||
kube_vip_address:
|
||||
|
||||
# nginx-proxy configure
|
||||
nginx_config_dir: "/etc/nginx"
|
||||
@ -633,8 +632,6 @@ ssl_ca_dirs: |-
|
||||
{% endif -%}
|
||||
]
|
||||
|
||||
# used for delegating tasks on a working control plane node
|
||||
first_kube_control_plane: "{{ groups['kube_control_plane'] | first }}"
|
||||
# Vars for pointing to kubernetes api endpoints
|
||||
kube_apiserver_count: "{{ groups['kube_control_plane'] | length }}"
|
||||
kube_apiserver_address: "{{ hostvars[inventory_hostname]['main_ip'] }}"
|
||||
@ -647,8 +644,8 @@ apiserver_loadbalancer_domain_name: "lb-apiserver.kubernetes.local"
|
||||
kube_apiserver_global_endpoint: |-
|
||||
{% if loadbalancer_apiserver is defined -%}
|
||||
https://{{ apiserver_loadbalancer_domain_name }}:{{ loadbalancer_apiserver.port | default(kube_apiserver_port) }}
|
||||
{%- elif loadbalancer_apiserver_localhost -%}
|
||||
https://localhost:{{ loadbalancer_apiserver_port | default(kube_apiserver_port) }}
|
||||
{%- elif loadbalancer_apiserver_localhost and (loadbalancer_apiserver_port is not defined or loadbalancer_apiserver_port == kube_apiserver_port) -%}
|
||||
https://localhost:{{ kube_apiserver_port }}
|
||||
{%- else -%}
|
||||
https://{{ first_kube_control_plane_address | ansible.utils.ipwrap }}:{{ kube_apiserver_port }}
|
||||
{%- endif %}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -7,14 +7,14 @@ kube_next: "{{ ((kube_version | split('.'))[1] | int) + 1 }}"
|
||||
kube_major_next_version: "1.{{ kube_next }}"
|
||||
|
||||
pod_infra_supported_versions:
|
||||
'1.34': '3.10.1'
|
||||
'1.33': '3.10'
|
||||
'1.32': '3.10'
|
||||
'1.31': '3.10'
|
||||
|
||||
etcd_supported_versions:
|
||||
'1.34': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.6', '<'))[0] }}"
|
||||
'1.33': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.6', '<'))[0] }}"
|
||||
'1.32': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.6', '<'))[0] }}"
|
||||
'1.31': "{{ (etcd_binary_checksums['amd64'].keys() | select('version', '3.6', '<'))[0] }}"
|
||||
# Kubespray constants
|
||||
|
||||
kube_proxy_deployed: "{{ 'addon/kube-proxy' not in kubeadm_init_phases_skip }}"
|
||||
|
||||
@ -3,36 +3,54 @@
|
||||
tags:
|
||||
- always
|
||||
block:
|
||||
- name: Gather node IPs
|
||||
- name: Gather ansible_default_ipv4
|
||||
setup:
|
||||
gather_subset: '!all,!min,network'
|
||||
filter: "ansible_default_ip*"
|
||||
when: ansible_default_ipv4 is not defined or ansible_default_ipv6 is not defined
|
||||
gather_subset: '!all,network'
|
||||
filter: "ansible_default_ipv4"
|
||||
when: ansible_default_ipv4 is not defined
|
||||
ignore_unreachable: true
|
||||
|
||||
- name: Set computed IPs varables
|
||||
vars:
|
||||
# Set 127.0.0.1 as fallback IP if we do not have host facts for host
|
||||
# ansible_default_ipv4 isn't what you think.
|
||||
# https://medium.com/opsops/ansible-default-ipv4-is-not-what-you-think-edb8ab154b10
|
||||
# TODO: discard this and update all the location relying on it in "looping on hostvars" templates
|
||||
- name: Set fallback_ip
|
||||
set_fact:
|
||||
fallback_ip: "{{ ansible_default_ipv4.address | d('127.0.0.1') }}"
|
||||
when: fallback_ip is not defined
|
||||
|
||||
- name: Gather ansible_default_ipv6
|
||||
setup:
|
||||
gather_subset: '!all,network'
|
||||
filter: "ansible_default_ipv6"
|
||||
when: ansible_default_ipv6 is not defined
|
||||
ignore_unreachable: true
|
||||
- name: Set fallback_ip6
|
||||
set_fact:
|
||||
fallback_ip6: "{{ ansible_default_ipv6.address | d('::1') }}"
|
||||
# Set 127.0.0.1 as fallback IP if we do not have host facts for host
|
||||
# ansible_default_ipv4 isn't what you think.
|
||||
_ipv4: "{{ ip | default(fallback_ip) }}"
|
||||
_access_ipv4: "{{ access_ip | default(_ipv4) }}"
|
||||
_ipv6: "{{ ip6 | default(fallback_ip6) }}"
|
||||
_access_ipv6: "{{ access_ip6 | default(_ipv6) }}"
|
||||
_access_ips:
|
||||
- "{{ _access_ipv4 if ipv4_stack }}"
|
||||
- "{{ _access_ipv6 if ipv6_stack }}"
|
||||
_ips:
|
||||
- "{{ _ipv4 if ipv4_stack }}"
|
||||
- "{{ _ipv6 if ipv6_stack }}"
|
||||
when: fallback_ip6 is not defined
|
||||
|
||||
- name: Set main access ip(access_ip based on ipv4_stack/ipv6_stack options).
|
||||
set_fact:
|
||||
cacheable: true
|
||||
main_access_ip: "{{ _access_ipv4 if ipv4_stack else _access_ipv6 }}"
|
||||
main_ip: "{{ _ipv4 if ipv4_stack else _ipv6 }}"
|
||||
# Mixed IPs - for dualstack
|
||||
main_access_ips: "{{ _access_ips | select }}"
|
||||
main_ips: "{{ _ips | select }}"
|
||||
main_access_ip: >-
|
||||
{%- if ipv4_stack -%}
|
||||
{{ access_ip | default(ip | default(fallback_ip)) }}
|
||||
{%- else -%}
|
||||
{{ access_ip6 | default(ip6 | default(fallback_ip6)) }}
|
||||
{%- endif -%}
|
||||
|
||||
- name: Set main ip(ip based on ipv4_stack/ipv6_stack options).
|
||||
set_fact:
|
||||
cacheable: true
|
||||
main_ip: "{{ (ip | default(fallback_ip)) if ipv4_stack else (ip6 | default(fallback_ip6)) }}"
|
||||
|
||||
- name: Set main access ips(mixed ips for dualstack).
|
||||
set_fact:
|
||||
main_access_ips: ["{{ (main_access_ip + ',' + (access_ip6 | default(ip6 | default(fallback_ip6)))) if (ipv4_stack and ipv6_stack) else main_access_ip }}"]
|
||||
|
||||
- name: Set main ips(mixed ips for dualstack).
|
||||
set_fact:
|
||||
main_ips: ["{{ (main_ip + ',' + (ip6 | default(fallback_ip6))) if (ipv4_stack and ipv6_stack) else main_ip }}"]
|
||||
|
||||
- name: Set no_proxy
|
||||
import_tasks: no_proxy.yml
|
||||
|
||||
@ -61,7 +61,6 @@
|
||||
executable: /bin/bash
|
||||
register: calico_version_on_server
|
||||
changed_when: false
|
||||
check_mode: false
|
||||
|
||||
- name: Assert that current calico version is enough for upgrade
|
||||
assert:
|
||||
|
||||
@ -126,9 +126,23 @@
|
||||
- ('kube_control_plane' in group_names)
|
||||
- calico_datastore == "kdd"
|
||||
block:
|
||||
- name: Calico | Check if extra directory is needed
|
||||
stat:
|
||||
path: "{{ local_release_dir }}/calico-{{ calico_version }}-kdd-crds/{{ 'kdd' if (calico_version is version('3.22.3', '<')) else 'crd' }}"
|
||||
register: kdd_path
|
||||
- name: Calico | Set kdd path when calico < v3.22.3
|
||||
set_fact:
|
||||
calico_kdd_path: "{{ local_release_dir }}/calico-{{ calico_version }}-kdd-crds{{ '/kdd' if kdd_path.stat.exists is defined and kdd_path.stat.exists }}"
|
||||
when:
|
||||
- calico_version is version('3.22.3', '<')
|
||||
- name: Calico | Set kdd path when calico > 3.22.2
|
||||
set_fact:
|
||||
calico_kdd_path: "{{ local_release_dir }}/calico-{{ calico_version }}-kdd-crds{{ '/crd' if kdd_path.stat.exists is defined and kdd_path.stat.exists }}"
|
||||
when:
|
||||
- calico_version is version('3.22.2', '>')
|
||||
- name: Calico | Create calico manifests for kdd
|
||||
assemble:
|
||||
src: "{{ local_release_dir }}/calico-{{ calico_version }}-kdd-crds/crd/"
|
||||
src: "{{ calico_kdd_path }}"
|
||||
dest: "{{ kube_config_dir }}/kdd-crds.yml"
|
||||
mode: "0644"
|
||||
delimiter: "---\n"
|
||||
|
||||
@ -235,8 +235,6 @@ rules:
|
||||
resources:
|
||||
- mutatingwebhookconfigurations
|
||||
- validatingwebhookconfigurations
|
||||
- validatingadmissionpolicies # Required for Kubernetes 1.33+
|
||||
- validatingadmissionpolicybindings # Required for Kubernetes 1.33+
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
|
||||
@ -5,7 +5,7 @@ metadata:
|
||||
namespace: kube-system
|
||||
name: kubernetes-services-endpoint
|
||||
data:
|
||||
{% if calico_bpf_enabled or loadbalancer_apiserver_localhost %}
|
||||
{% if calico_bpf_enabled %}
|
||||
KUBERNETES_SERVICE_HOST: "{{ kube_apiserver_global_endpoint | urlsplit('hostname') }}"
|
||||
KUBERNETES_SERVICE_PORT: "{{ kube_apiserver_global_endpoint | urlsplit('port') }}"
|
||||
{% endif %}
|
||||
|
||||
@ -1,6 +1,8 @@
|
||||
---
|
||||
cilium_min_version_required: "1.15"
|
||||
|
||||
# remove migrate after 2.29 released
|
||||
cilium_remove_old_resources: false
|
||||
# Log-level
|
||||
cilium_debug: false
|
||||
|
||||
|
||||
@ -30,6 +30,13 @@
|
||||
when:
|
||||
- cilium_identity_allocation_mode == "kvstore"
|
||||
|
||||
- name: Cilium | Enable portmap addon
|
||||
template:
|
||||
src: 000-cilium-portmap.conflist.j2
|
||||
dest: /etc/cni/net.d/000-cilium-portmap.conflist
|
||||
mode: "0644"
|
||||
when: cilium_enable_portmap
|
||||
|
||||
- name: Cilium | Render values
|
||||
template:
|
||||
src: values.yaml.j2
|
||||
|
||||
@ -5,5 +5,10 @@
|
||||
- name: Cilium install
|
||||
include_tasks: install.yml
|
||||
|
||||
# Remove after 2.29 released
|
||||
- name: Cilium remove old resources
|
||||
when: cilium_remove_old_resources
|
||||
include_tasks: remove_old_resources.yml
|
||||
|
||||
- name: Cilium apply
|
||||
include_tasks: apply.yml
|
||||
|
||||
45
roles/network_plugin/cilium/tasks/remove_old_resources.yml
Normal file
45
roles/network_plugin/cilium/tasks/remove_old_resources.yml
Normal file
@ -0,0 +1,45 @@
|
||||
---
|
||||
# Remove after 2.29 released
|
||||
- name: Cilium | Delete Old Resource
|
||||
command: |
|
||||
{{ kubectl }} delete {{ item.kind | lower }} {{ item.name }} \
|
||||
{{ '-n kube-system' if item.kind not in ['ClusterRole', 'ClusterRoleBinding'] else '' }} \
|
||||
loop:
|
||||
- { kind: ServiceAccount, name: cilium }
|
||||
- { kind: ServiceAccount, name: cilium-operator }
|
||||
- { kind: ServiceAccount, name: hubble-generate-certs }
|
||||
- { kind: ServiceAccount, name: hubble-relay }
|
||||
- { kind: ServiceAccount, name: hubble-ui }
|
||||
- { kind: Service, name: hubble-metrics }
|
||||
- { kind: Service, name: hubble-relay-metrics }
|
||||
- { kind: Service, name: hubble-relay }
|
||||
- { kind: Service, name: hubble-ui }
|
||||
- { kind: Service, name: hubble-peer }
|
||||
- { kind: Deployment, name: cilium-operator }
|
||||
- { kind: Deployment, name: hubble-relay }
|
||||
- { kind: Deployment, name: hubble-ui }
|
||||
- { kind: DaemonSet, name: cilium }
|
||||
- { kind: CronJob, name: hubble-generate-certs }
|
||||
- { kind: Job, name: hubble-generate-certs }
|
||||
- { kind: ConfigMap, name: cilium-config }
|
||||
- { kind: ConfigMap, name: ip-masq-agent }
|
||||
- { kind: ConfigMap, name: hubble-relay-config }
|
||||
- { kind: ConfigMap, name: hubble-ui-nginx }
|
||||
- { kind: ClusterRole, name: cilium }
|
||||
- { kind: ClusterRole, name: cilium-operator }
|
||||
- { kind: ClusterRole, name: hubble-generate-certs }
|
||||
- { kind: ClusterRole, name: hubble-relay }
|
||||
- { kind: ClusterRole, name: hubble-ui }
|
||||
- { kind: ClusterRoleBinding, name: cilium }
|
||||
- { kind: ClusterRoleBinding, name: cilium-operator }
|
||||
- { kind: ClusterRoleBinding, name: hubble-generate-certs }
|
||||
- { kind: ClusterRoleBinding, name: hubble-relay }
|
||||
- { kind: ClusterRoleBinding, name: hubble-ui }
|
||||
- { kind: Secret, name: hubble-ca-secret }
|
||||
- { kind: Secret, name: hubble-relay-client-certs }
|
||||
- { kind: Secret, name: hubble-server-certs }
|
||||
register: patch_result
|
||||
when: inventory_hostname == groups['kube_control_plane'][0]
|
||||
failed_when:
|
||||
- patch_result.rc != 0
|
||||
- "'not found' not in patch_result.stderr"
|
||||
@ -0,0 +1,13 @@
|
||||
{
|
||||
"cniVersion": "0.3.1",
|
||||
"name": "cilium-portmap",
|
||||
"plugins": [
|
||||
{
|
||||
"type": "cilium-cni"
|
||||
},
|
||||
{
|
||||
"type": "portmap",
|
||||
"capabilities": { "portMappings": true }
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -7,8 +7,8 @@ image:
|
||||
repository: {{ cilium_image_repo }}
|
||||
tag: {{ cilium_image_tag }}
|
||||
|
||||
k8sServiceHost: "{{ kube_apiserver_global_endpoint | urlsplit('hostname') }}"
|
||||
k8sServicePort: "{{ kube_apiserver_global_endpoint | urlsplit('port') }}"
|
||||
k8sServiceHost: "auto"
|
||||
k8sServicePort: "auto"
|
||||
|
||||
ipv4:
|
||||
enabled: {{ cilium_enable_ipv4 | to_json }}
|
||||
@ -27,7 +27,7 @@ identityAllocationMode: {{ cilium_identity_allocation_mode }}
|
||||
|
||||
tunnelProtocol: {{ cilium_tunnel_mode }}
|
||||
|
||||
loadBalancer:
|
||||
loadbalancer:
|
||||
mode: {{ cilium_loadbalancer_mode }}
|
||||
|
||||
kubeProxyReplacement: {{ cilium_kube_proxy_replacement | to_json }}
|
||||
@ -56,9 +56,6 @@ bpf:
|
||||
cni:
|
||||
exclusive: {{ cilium_cni_exclusive | to_json }}
|
||||
logFile: {{ cilium_cni_log_file }}
|
||||
{% if cilium_enable_portmap %}
|
||||
chainingMode: portmap
|
||||
{% endif %}
|
||||
|
||||
autoDirectNodeRoutes: {{ cilium_auto_direct_node_routes | to_json }}
|
||||
|
||||
@ -110,14 +107,8 @@ hubble:
|
||||
metrics:
|
||||
enabled: {{ cilium_hubble_metrics | to_json }}
|
||||
export:
|
||||
{% if cilium_version is version('1.18.0', '>=') %}
|
||||
static:
|
||||
fileMaxBackups: {{ cilium_hubble_export_file_max_backups }}
|
||||
fileMaxSizeMb: {{ cilium_hubble_export_file_max_size_mb }}
|
||||
{% else %}
|
||||
fileMaxBackups: {{ cilium_hubble_export_file_max_backups }}
|
||||
fileMaxSizeMb: {{ cilium_hubble_export_file_max_size_mb }}
|
||||
{% endif %}
|
||||
dynamic:
|
||||
enabled: {{ cilium_hubble_export_dynamic_enabled | to_json }}
|
||||
config:
|
||||
|
||||
@ -1,4 +1,14 @@
|
||||
---
|
||||
- name: Lookup node IP in kubernetes
|
||||
command: >
|
||||
{{ kubectl }} get nodes {{ node }}
|
||||
-o jsonpath-as-json='{.status.addresses[?(@.type=="InternalIP")].address}'
|
||||
register: k8s_node_ips
|
||||
changed_when: false
|
||||
when:
|
||||
- groups['kube_control_plane'] | length > 0
|
||||
delegate_to: "{{ groups['kube_control_plane'] | first }}"
|
||||
|
||||
- name: Remove etcd member from cluster
|
||||
environment:
|
||||
ETCDCTL_API: "3"
|
||||
@ -9,18 +19,25 @@
|
||||
delegate_to: "{{ groups['etcd'] | first }}"
|
||||
block:
|
||||
- name: Lookup members infos
|
||||
command: "{{ bin_dir }}/etcdctl member list -w json"
|
||||
command: "{{ bin_dir }}/etcdctl member list"
|
||||
register: etcd_members
|
||||
changed_when: false
|
||||
check_mode: false
|
||||
tags:
|
||||
- facts
|
||||
- name: Remove member from cluster
|
||||
vars:
|
||||
node_ip: >-
|
||||
{%- if not ipv4_stack -%}
|
||||
{{ ip6 if ip6 is defined else (access_ip6 if access_ip6 is defined else (k8s_node_ips.stdout | from_json)[0]) | ansible.utils.ipwrap }}
|
||||
{%- else -%}
|
||||
{{ ip if ip is defined else (access_ip if access_ip is defined else (k8s_node_ips.stdout | from_json)[0]) | ansible.utils.ipwrap }}
|
||||
{%- endif -%}
|
||||
command:
|
||||
argv:
|
||||
- "{{ bin_dir }}/etcdctl"
|
||||
- member
|
||||
- remove
|
||||
- "{{ '%x' | format(((etcd_members.stdout | from_json).members | selectattr('peerURLs.0', '==', etcd_peer_url))[0].ID) }}"
|
||||
- "{{ ((etcd_members.stdout_lines | select('contains', '//' + node_ip + ':'))[0] | split(','))[0] }}"
|
||||
register: etcd_removal_output
|
||||
changed_when: "'Removed member' in etcd_removal_output.stdout"
|
||||
|
||||
@ -432,6 +432,16 @@
|
||||
- files
|
||||
- dns
|
||||
|
||||
# TODO: remove after release 2.29
|
||||
- name: Reset | remove host entries from /etc/hosts
|
||||
blockinfile:
|
||||
path: "/etc/hosts"
|
||||
state: absent
|
||||
marker: "# Ansible inventory hosts {mark}"
|
||||
tags:
|
||||
- files
|
||||
- dns
|
||||
|
||||
- name: Reset | include file with reset tasks specific to the network_plugin if exists
|
||||
include_role:
|
||||
name: "network_plugin/{{ kube_network_plugin }}"
|
||||
|
||||
@ -31,14 +31,14 @@
|
||||
command: >
|
||||
{{ kubectl }} get node {{ kube_override_hostname | default(inventory_hostname) }}
|
||||
-o jsonpath='{ .spec.unschedulable }'
|
||||
register: kubectl_node_unschedulable
|
||||
register: kubectl_node_schedulable
|
||||
delegate_to: "{{ groups['kube_control_plane'][0] }}"
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
|
||||
- name: Set if node needs cordoning
|
||||
set_fact:
|
||||
needs_cordoning: "{{ (kubectl_node_ready.stdout == 'True' and not kubectl_node_unschedulable.stdout) or upgrade_node_always_cordon }}"
|
||||
needs_cordoning: "{{ (kubectl_node_ready.stdout == 'True' and not kubectl_node_schedulable.stdout) or upgrade_node_always_cordon }}"
|
||||
|
||||
- name: Node draining
|
||||
delegate_to: "{{ groups['kube_control_plane'][0] }}"
|
||||
|
||||
@ -6,6 +6,14 @@
|
||||
# -> nothing depending on facts or similar cluster state
|
||||
# Checks depending on current state (of the nodes or the cluster)
|
||||
# should be in roles/kubernetes/preinstall/tasks/0040-verify-settings.yml
|
||||
- name: Stop if removed tags are used
|
||||
assert:
|
||||
msg: The tag 'master' is removed. Use 'control-plane' instead
|
||||
that:
|
||||
- ('master' not in ansible_run_tags)
|
||||
- ('master' not in ansible_skip_tags)
|
||||
# TODO: Remove checks after next release
|
||||
|
||||
- name: Stop if kube_control_plane group is empty
|
||||
assert:
|
||||
that: groups.get( 'kube_control_plane' )
|
||||
|
||||
@ -101,19 +101,9 @@ infos = {
|
||||
"graphql_id": "R_kgDOApOQGQ",
|
||||
},
|
||||
"argocd_install": {
|
||||
"url": "https://raw.githubusercontent.com/argoproj/argo-cd/v{version}/manifests/install.yaml",
|
||||
"graphql_id": "R_kgDOBzS60g",
|
||||
"binary": True,
|
||||
"hashtype": "sha256",
|
||||
},
|
||||
"gateway_api_standard_crds": {
|
||||
"url": "https://github.com/kubernetes-sigs/gateway-api/releases/download/v{version}/standard-install.yaml",
|
||||
"graphql_id": "R_kgDODQ6RZw",
|
||||
"binary": True,
|
||||
},
|
||||
"gateway_api_experimental_crds": {
|
||||
"url": "https://github.com/kubernetes-sigs/gateway-api/releases/download/v{version}/experimental-install.yaml",
|
||||
"graphql_id": "R_kgDODQ6RZw",
|
||||
"binary": True,
|
||||
"url": "https://raw.githubusercontent.com/argoproj/argo-cd/v{version}/manifests/install.yaml",
|
||||
"graphql_id": "R_kgDOBzS60g",
|
||||
"binary": True,
|
||||
"hashtype": "sha256",
|
||||
},
|
||||
}
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user