mirror of
https://github.com/kubernetes-sigs/kubespray.git
synced 2026-04-12 21:49:27 -02:30
25cb90bc2d
* project: update all dependencies including ansible Upgrade to ansible 7.x and ansible-core 2.14.x. There seems to be issue with ansible 8/ansible-core 2.15 so we remain on those versions for now. It's quite a big bump already anyway. Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * tests: install aws galaxy collection Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * ansible-lint: disable various rules after ansible upgrade Temporarily disable a bunch of linting action following ansible upgrade. Those should be taken care of separately. Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: resolve deprecated-module ansible-lint error Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: resolve no-free-form ansible-lint error Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: resolve schema[meta] ansible-lint error Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: resolve schema[playbook] ansible-lint error Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: resolve schema[tasks] ansible-lint error Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: resolve risky-file-permissions ansible-lint error Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: resolve risky-shell-pipe ansible-lint error Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: remove deprecated warn args Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: use fqcn for non builtin tasks Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: resolve syntax-check[missing-file] for contrib playbook Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: use arithmetic inside jinja to fix ansible 6 upgrade Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> --------- Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch>
83 lines
2.3 KiB
YAML
83 lines
2.3 KiB
YAML
---
|
|
- name: Kubernetes Apps | Wait for kube-apiserver
|
|
uri:
|
|
url: "{{ kube_apiserver_endpoint }}/healthz"
|
|
validate_certs: no
|
|
client_cert: "{{ kube_apiserver_client_cert }}"
|
|
client_key: "{{ kube_apiserver_client_key }}"
|
|
register: result
|
|
until: result.status == 200
|
|
retries: 10
|
|
delay: 6
|
|
when: inventory_hostname == groups['kube_control_plane'][0]
|
|
|
|
- name: Kubernetes Apps | Add ClusterRoleBinding to admit nodes
|
|
template:
|
|
src: "node-crb.yml.j2"
|
|
dest: "{{ kube_config_dir }}/node-crb.yml"
|
|
mode: 0640
|
|
register: node_crb_manifest
|
|
when:
|
|
- rbac_enabled
|
|
- inventory_hostname == groups['kube_control_plane'][0]
|
|
|
|
- name: Apply workaround to allow all nodes with cert O=system:nodes to register
|
|
kube:
|
|
name: "kubespray:system:node"
|
|
kubectl: "{{ bin_dir }}/kubectl"
|
|
resource: "clusterrolebinding"
|
|
filename: "{{ kube_config_dir }}/node-crb.yml"
|
|
state: latest
|
|
register: result
|
|
until: result is succeeded
|
|
retries: 10
|
|
delay: 6
|
|
when:
|
|
- rbac_enabled
|
|
- node_crb_manifest.changed
|
|
- inventory_hostname == groups['kube_control_plane'][0]
|
|
|
|
- name: Kubernetes Apps | Remove old webhook ClusterRole
|
|
kube:
|
|
name: "system:node-webhook"
|
|
kubectl: "{{ bin_dir }}/kubectl"
|
|
resource: "clusterrole"
|
|
state: absent
|
|
when:
|
|
- rbac_enabled
|
|
- inventory_hostname == groups['kube_control_plane'][0]
|
|
tags: node-webhook
|
|
|
|
- name: Kubernetes Apps | Remove old webhook ClusterRoleBinding
|
|
kube:
|
|
name: "system:node-webhook"
|
|
kubectl: "{{ bin_dir }}/kubectl"
|
|
resource: "clusterrolebinding"
|
|
state: absent
|
|
when:
|
|
- rbac_enabled
|
|
- inventory_hostname == groups['kube_control_plane'][0]
|
|
tags: node-webhook
|
|
|
|
- include_tasks: oci.yml
|
|
tags: oci
|
|
when:
|
|
- cloud_provider is defined
|
|
- cloud_provider == 'oci'
|
|
|
|
- name: PriorityClass | Copy k8s-cluster-critical-pc.yml file
|
|
copy:
|
|
src: k8s-cluster-critical-pc.yml
|
|
dest: "{{ kube_config_dir }}/k8s-cluster-critical-pc.yml"
|
|
mode: 0640
|
|
when: inventory_hostname == groups['kube_control_plane']|last
|
|
|
|
- name: PriorityClass | Create k8s-cluster-critical
|
|
kube:
|
|
name: k8s-cluster-critical
|
|
kubectl: "{{ bin_dir }}/kubectl"
|
|
resource: "PriorityClass"
|
|
filename: "{{ kube_config_dir }}/k8s-cluster-critical-pc.yml"
|
|
state: latest
|
|
when: inventory_hostname == groups['kube_control_plane']|last
|