mirror of
https://github.com/kubernetes-sigs/kubespray.git
synced 2026-02-24 22:46:06 -03:30
68718dcb6f
* kubeadm: do not ignore preflight errors blindly The "ignoring all errors" seems to date back to the inception of the kubeadm support (it was --skip-preflight-check before). This can mask real errors and prevent users from seeing them. Do not ignore any errors by default and make the set of ignored errors configurable. * download/kubeadm: remove redundant task The mode is already set by the previous `copy` task. * Validate kubeadm configs This should help to fail early when we have invalid kubeadm configs (from a kubespray bug or a misconfiguration). * kubeadm-upgrade: remove unnecessary bool cast * Convert kubeadm join discovery timeout to v1beta4 config * CI: Ignore kubeadm:Mem errors on some setup.
81 lines
2.8 KiB
YAML
81 lines
2.8 KiB
YAML
---
|
|
- name: Kubeadm | Check api is up
|
|
uri:
|
|
url: "https://{{ ip | default(fallback_ip) }}:{{ kube_apiserver_port }}/healthz"
|
|
validate_certs: false
|
|
when: ('kube_control_plane' in group_names)
|
|
register: _result
|
|
retries: 60
|
|
delay: 5
|
|
until: _result.status == 200
|
|
|
|
- name: Kubeadm | Upgrade first control plane node
|
|
command: >-
|
|
timeout -k 600s 600s
|
|
{{ bin_dir }}/kubeadm
|
|
upgrade apply -y {{ kube_version }}
|
|
--certificate-renewal={{ kubeadm_upgrade_auto_cert_renewal }}
|
|
--ignore-preflight-errors={{ kubeadm_ignore_preflight_errors | join(',') }}
|
|
--allow-experimental-upgrades
|
|
--etcd-upgrade={{ (etcd_deployment_type == "kubeadm") | lower }}
|
|
{% if kubeadm_patches | length > 0 %}--patches={{ kubeadm_patches_dir }}{% endif %}
|
|
--force
|
|
register: kubeadm_upgrade
|
|
# Retry is because upload config sometimes fails
|
|
retries: 3
|
|
until: kubeadm_upgrade.rc == 0
|
|
when: inventory_hostname == first_kube_control_plane
|
|
failed_when: kubeadm_upgrade.rc != 0 and "field is immutable" not in kubeadm_upgrade.stderr
|
|
environment:
|
|
PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
|
|
notify: Control plane | restart kubelet
|
|
|
|
- name: Kubeadm | Upgrade other control plane nodes
|
|
command: >-
|
|
timeout -k 600s 600s
|
|
{{ bin_dir }}/kubeadm
|
|
upgrade apply -y {{ kube_version }}
|
|
--certificate-renewal={{ kubeadm_upgrade_auto_cert_renewal }}
|
|
--ignore-preflight-errors={{ kubeadm_ignore_preflight_errors | join(',') }}
|
|
--allow-experimental-upgrades
|
|
--etcd-upgrade={{ (etcd_deployment_type == "kubeadm") | lower }}
|
|
{% if kubeadm_patches | length > 0 %}--patches={{ kubeadm_patches_dir }}{% endif %}
|
|
--force
|
|
register: kubeadm_upgrade
|
|
# Retry is because upload config sometimes fails
|
|
retries: 3
|
|
until: kubeadm_upgrade.rc == 0
|
|
when: inventory_hostname != first_kube_control_plane
|
|
failed_when: kubeadm_upgrade.rc != 0 and "field is immutable" not in kubeadm_upgrade.stderr
|
|
environment:
|
|
PATH: "{{ bin_dir }}:{{ ansible_env.PATH }}"
|
|
notify: Control plane | restart kubelet
|
|
|
|
- name: Kubeadm | Remove binding to anonymous user
|
|
command: "{{ kubectl }} -n kube-public delete rolebinding kubeadm:bootstrap-signer-clusterinfo --ignore-not-found"
|
|
when: remove_anonymous_access
|
|
|
|
- name: Kubeadm | clean kubectl cache to refresh api types
|
|
file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
with_items:
|
|
- /root/.kube/cache
|
|
- /root/.kube/http-cache
|
|
|
|
# FIXME: https://github.com/kubernetes/kubeadm/issues/1318
|
|
- name: Kubeadm | scale down coredns replicas to 0 if not using coredns dns_mode
|
|
command: >-
|
|
{{ kubectl }}
|
|
-n kube-system
|
|
scale deployment/coredns --replicas 0
|
|
register: scale_down_coredns
|
|
retries: 6
|
|
delay: 5
|
|
until: scale_down_coredns is succeeded
|
|
run_once: true
|
|
when:
|
|
- kubeadm_scale_down_coredns_enabled
|
|
- dns_mode not in ['coredns', 'coredns_dual']
|
|
changed_when: false
|