kubeasz/90.setup.yml

# [可选]操作系统安全加固 https://github.com/dev-sec/ansible-os-hardening
- hosts: all
  roles:
  - { role: os-harden, when: "OS_HARDEN is defined and OS_HARDEN == 'yes'" }

# 在deploy节点生成CA相关证书，以供整个集群使用
# 以及初始化kubedns.yaml配置文件
- hosts: deploy
  roles:
  - deploy

# 集群节点的公共配置任务
- hosts:
  - kube-master
  - kube-node
  - deploy
  - etcd
  - lb
  roles:
  - prepare

# [可选]多master部署时的负载均衡配置
- hosts: lb
  roles:
  - lb

# 创建etcd集群
- hosts: etcd
  roles:
  - etcd

# docker服务安装
- hosts:
  - kube-master
  - kube-node
  roles:
  - docker

- hosts: kube-master
  roles:
  - kube-master
  - kube-node
  # 禁止业务 pod调度到 master节点
  tasks:
  - name: 禁止业务 pod调度到 master节点
    shell: "{{ bin_dir }}/kubectl cordon {{ NODE_IP }} "
    when: DEPLOY_MODE != "allinone"
    ignore_errors: true

  - name: 设置master节点role
    shell: "{{ bin_dir }}/kubectl label node {{ NODE_IP }} kubernetes.io/role=master --overwrite"
    ignore_errors: true

# node 节点部署
- hosts: kube-node
  roles:
  - { role: kube-node, when: "DEPLOY_MODE != 'allinone'" }

# 集群网络插件部署，只能选择一种安装
- hosts:
  - kube-master
  - kube-node
  roles:
  - { role: calico, when: "CLUSTER_NETWORK == 'calico'" }
  - { role: flannel, when: "CLUSTER_NETWORK == 'flannel'" }