kubernetes-sigs
/
kubespray
mirror of https://github.com/kubernetes-sigs/kubespray.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
kubespray/cluster.yml

117 lines
3.8 KiB
YAML
Raw Normal View History

Initial commit
2015-10-04 04:19:50 +08:00
---
Assert if ansible 2.7 is used (#3589)
2018-10-26 15:29:21 +08:00
- hosts: localhost
Disable gather facts when checking ansible version (#3615)
2018-10-31 18:19:17 +08:00
gather_facts: false
Disable become for localhost (#4287)
2019-02-26 11:36:44 +08:00
become: no
Assert if ansible 2.7 is used (#3589)
2018-10-26 15:29:21 +08:00
tasks:
Upgrade to Ansible 2.7.8 (#4535)
2019-04-18 01:18:05 +08:00
- name: "Check ansible version >=2.7.8"
Assert if ansible 2.7 is used (#3589)
2018-10-26 15:29:21 +08:00
assert:
Upgrade to Ansible 2.7.8 (#4535)
2019-04-18 01:18:05 +08:00
msg: "Ansible must be v2.7.8 or higher"
Assert if ansible 2.7 is used (#3589)
2018-10-26 15:29:21 +08:00
that:
Upgrade to Ansible 2.7.8 (#4535)
2019-04-18 01:18:05 +08:00
- ansible_version.string is version("2.7.8", ">=")
Assert if ansible 2.7 is used (#3589)
2018-10-26 15:29:21 +08:00
tags:
- check
vars:
ansible_connection: local
Split deploy steps in separate playbooks: part1 (#3451) * Fix bootstrap_os/ubuntu idempotency * Update bastion role * move container_engine in sub-roles * requires ansible 2.5 * ubuntu18 as first CI job
2018-10-10 10:14:33 +08:00
- hosts: bastion[0]
Add support for bastion hosts
2016-12-09 17:38:17 +08:00
gather_facts: False
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
Add default var role
2017-02-23 19:07:17 +08:00
- { role: bastion-ssh-config, tags: ["localhost", "bastion"]}
Add support for bastion hosts
2016-12-09 17:38:17 +08:00
Refactor calico route reflector to run in k8s cluster (#4975) * Refactor calico-rr to run in k8s cluster with taint Change-Id: I75a3169ff5b36ce8302fc7ef1c32d3eb697b5afa * add preinstall checks * rework calico/rr role Change-Id: I2f0a7e6cb77cf91ad4a615923680760d2e5d9ca8 * add empty calico-rr group Change-Id: I006c0a60db9b72d02245bf8fdfabcf982144a5ad
2019-08-08 22:37:22 +08:00
- hosts: k8s-cluster:etcd
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
combine bootstrap options, add xenial support
2016-09-06 22:04:41 +08:00
gather_facts: false
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
Add default var role
2017-02-23 19:07:17 +08:00
- { role: bootstrap-os, tags: bootstrap-os}
force fact check of all nodes first thing
2016-08-12 22:06:31 +08:00
Refactor calico route reflector to run in k8s cluster (#4975) * Refactor calico-rr to run in k8s cluster with taint Change-Id: I75a3169ff5b36ce8302fc7ef1c32d3eb697b5afa * add preinstall checks * rework calico/rr role Change-Id: I2f0a7e6cb77cf91ad4a615923680760d2e5d9ca8 * add empty calico-rr group Change-Id: I006c0a60db9b72d02245bf8fdfabcf982144a5ad
2019-08-08 22:37:22 +08:00
- hosts: k8s-cluster:etcd
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
Use 0755 mode for binaries
2015-12-18 05:46:50 +08:00
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
rename role common to kubernetes/preinstall
2015-12-31 17:03:22 +08:00
- { role: kubernetes/preinstall, tags: preinstall }
Add flag to deploy container engine manually. (#3753) This feature was removed by PR#3061. But change flag manage_docker to deploy_container_engine.
2018-11-26 23:26:40 +08:00
- { role: "container-engine", tags: "container-engine", when: deploy_container_engine|default(true) }
Fix skip_downloads condition.
2018-08-08 18:49:49 +08:00
- { role: download, tags: download, when: "not skip_downloads" }
ansible-lint: add spaces around variables [E206] (#4699)
2019-05-03 05:24:21 +08:00
environment: "{{ proxy_env }}"
Fix idempotency/recurrence of download and preinstall * Don't push containers if not changed * Do preinstall role only once and redistribute defaults to corresponding roles Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-10-24 21:11:52 +08:00
Remove standalone etcd specific play, cleanup host mode Now etcd role can optionally disable etcd cluster setup for faster deployment when it is combined with etcd role.
2017-03-04 04:30:37 +08:00
- hosts: etcd
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
Vault security hardening and role isolation
2017-02-09 05:41:36 +08:00
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
Enable kubeadm etcd mode (#4818) * Enable kubeadm etcd mode Uses cert commands from kubeadm experimental control plane to enable non-master nodes to obtain etcd certs. Related story: PROD-29434 Change-Id: Idafa1d223e5c6ceadf819b6f9c06adf4c4f74178 * Add validation checks and exclude calico kdd mode Change-Id: Ic234f5e71261d33191376e70d438f9f6d35f358c * Move etcd mode test to ubuntu flannel HA job Change-Id: I9af6fd80a1bbb1692ab10d6da095eb368f6bc732 * rename etcd_mode to etcd_kubeadm_enabled Change-Id: Ib196d6c8a52f48cae370b026f7687ff9ca69c172
2019-06-21 02:12:51 +08:00
- role: etcd
tags: etcd
vars:
etcd_cluster_setup: true
etcd_events_cluster_setup: "{{ etcd_events_cluster_enabled }}"
when: not etcd_kubeadm_enabled| default(false)
Vault security hardening and role isolation
2017-02-09 05:41:36 +08:00
Refactor calico route reflector to run in k8s cluster (#4975) * Refactor calico-rr to run in k8s cluster with taint Change-Id: I75a3169ff5b36ce8302fc7ef1c32d3eb697b5afa * add preinstall checks * rework calico/rr role Change-Id: I2f0a7e6cb77cf91ad4a615923680760d2e5d9ca8 * add empty calico-rr group Change-Id: I006c0a60db9b72d02245bf8fdfabcf982144a5ad
2019-08-08 22:37:22 +08:00
- hosts: k8s-cluster
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
Fix idempotency/recurrence of download and preinstall * Don't push containers if not changed * Do preinstall role only once and redistribute defaults to corresponding roles Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-10-24 21:11:52 +08:00
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
Enable kubeadm etcd mode (#4818) * Enable kubeadm etcd mode Uses cert commands from kubeadm experimental control plane to enable non-master nodes to obtain etcd certs. Related story: PROD-29434 Change-Id: Idafa1d223e5c6ceadf819b6f9c06adf4c4f74178 * Add validation checks and exclude calico kdd mode Change-Id: Ic234f5e71261d33191376e70d438f9f6d35f358c * Move etcd mode test to ubuntu flannel HA job Change-Id: I9af6fd80a1bbb1692ab10d6da095eb368f6bc732 * rename etcd_mode to etcd_kubeadm_enabled Change-Id: Ib196d6c8a52f48cae370b026f7687ff9ca69c172
2019-06-21 02:12:51 +08:00
- role: etcd
tags: etcd
vars:
etcd_cluster_setup: false
etcd_events_cluster_setup: false
when: not etcd_kubeadm_enabled| default(false)
Fix etcd standalone deployment etcd facts are generated in kubernetes/preinstall, so etcd nodes need to be evaluated first before the rest of the deployment. Moved several directory facts from kubernetes/node to kubernetes/preinstall because they are not backward dependent.
2016-07-26 21:18:47 +08:00
- hosts: k8s-cluster
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
Fix etcd standalone deployment etcd facts are generated in kubernetes/preinstall, so etcd nodes need to be evaluated first before the rest of the deployment. Moved several directory facts from kubernetes/node to kubernetes/preinstall because they are not backward dependent.
2016-07-26 21:18:47 +08:00
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
Run etcd as pod
2015-12-24 06:27:40 +08:00
- { role: kubernetes/node, tags: node }
ansible-lint: add spaces around variables [E206] (#4699)
2019-05-03 05:24:21 +08:00
environment: "{{ proxy_env }}"
Initial commit
2015-10-04 04:19:50 +08:00
review roles order
2015-12-11 18:40:56 +08:00
- hosts: kube-master
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
review roles order
2015-12-11 18:40:56 +08:00
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
review roles order
2015-12-11 18:40:56 +08:00
- { role: kubernetes/master, tags: master }
Move cluster roles and system namespace to new role This should be done after kubeconfig is set for admin and before network plugins are up.
2017-10-26 16:10:33 +08:00
- { role: kubernetes/client, tags: client }
- { role: kubernetes-apps/cluster_roles, tags: cluster-roles }
kubeadm support (#1631) * kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml
2017-09-14 02:00:51 +08:00
- hosts: k8s-cluster
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
roles:
- { role: kubespray-defaults}
Remove non-kubeadm deployment (#3811) * Remove non-kubeadm deployment * More cleanup * More cleanup * More cleanup * More cleanup * Fix gitlab * Try stop gce first before absent to make the delete process work * More cleanup * Fix bug with checking if kubeadm has already run * Fix bug with checking if kubeadm has already run * More fixes * Fix test * fix * Fix gitlab checkout untill kubespray 2.8 is on quay * Fixed * Add upgrade path from non-kubeadm to kubeadm. Revert ssl path * Readd secret checking * Do gitlab checks from v2.7.0 test upgrade path to 2.8.0 * fix typo * Fix CI jobs to kubeadm again. Fix broken hyperkube path * Fix gitlab * Fix rotate tokens * More fixes * More fixes * Fix tokens
2018-12-06 18:33:38 +08:00
- { role: kubernetes/kubeadm, tags: kubeadm}
Use api lookup for kubelet hostname when using cloudprovider (#1686) The value cannot be determined properly via local facts, so checking k8s api is the most reliable way to look up what hostname is used when using a cloudprovider.
2017-09-24 16:22:15 +08:00
- { role: network_plugin, tags: network }
tag role kubernetes/node-label in playbooks (#5560)
2020-01-21 03:43:36 +08:00
- { role: kubernetes/node-label, tags: node-label }
kubeadm support (#1631) * kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml
2017-09-14 02:00:51 +08:00
Refactor calico route reflector to run in k8s cluster (#4975) * Refactor calico-rr to run in k8s cluster with taint Change-Id: I75a3169ff5b36ce8302fc7ef1c32d3eb697b5afa * add preinstall checks * rework calico/rr role Change-Id: I2f0a7e6cb77cf91ad4a615923680760d2e5d9ca8 * add empty calico-rr group Change-Id: I006c0a60db9b72d02245bf8fdfabcf982144a5ad
2019-08-08 22:37:22 +08:00
- hosts: calico-rr
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
roles:
- { role: kubespray-defaults}
- { role: network_plugin/calico/rr, tags: ['network', 'calico_rr']}
Run rotate_tokens role only once (#1970)
2017-11-16 02:50:23 +08:00
- hosts: kube-master[0]
kubeadm support (#1631) * kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml
2017-09-14 02:00:51 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
roles:
- { role: kubespray-defaults}
Upgrade to kubeadm (#1667) * Enable upgrade to kubeadm * fix kubedns upgrade * try upgrade route * use init/upgrade strategy for kubeadm and ignore kubedns svc * Use bin_dir for kubeadm * delete more secrets * fix waiting for terminating pods * Manually enforce kube-proxy for kubeadm deploy * remove proxy. update to kubeadm 1.8.0rc1
2017-09-26 17:38:58 +08:00
- { role: kubernetes-apps/rotate_tokens, tags: rotate_tokens, when: "secret_changed|default(false)" }
Remove non-kubeadm deployment (#3811) * Remove non-kubeadm deployment * More cleanup * More cleanup * More cleanup * More cleanup * Fix gitlab * Try stop gce first before absent to make the delete process work * More cleanup * Fix bug with checking if kubeadm has already run * Fix bug with checking if kubeadm has already run * More fixes * Fix test * fix * Fix gitlab checkout untill kubespray 2.8 is on quay * Fixed * Add upgrade path from non-kubeadm to kubeadm. Revert ssl path * Readd secret checking * Do gitlab checks from v2.7.0 test upgrade path to 2.8.0 * fix typo * Fix CI jobs to kubeadm again. Fix broken hyperkube path * Fix gitlab * Fix rotate tokens * More fixes * More fixes * Fix tokens
2018-12-06 18:33:38 +08:00
- { role: win_nodes/kubernetes_patch, tags: ["master", "win_nodes"]}
Run rotate_tokens role only once (#1970)
2017-11-16 02:50:23 +08:00
- hosts: kube-master
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
roles:
- { role: kubespray-defaults}
Adding support for canal network plugin This patch provides support for Canal network plugin installation as a self-hosted app, see the following link for details: https://github.com/tigera/canal/tree/master/k8s-install
2016-11-03 23:57:11 +08:00
- { role: kubernetes-apps/network_plugin, tags: network }
Move calico-policy-controller into separate role By default Calico CNI does not create any network access policies or profiles if 'policy' is enabled in CNI config. And without any policies/profiles network access to/from PODs is blocked. K8s related policies are created by calico-policy-controller in such case. So we need to start it as soon as possible, before any real workloads. This patch also fixes kube-api port in calico-policy-controller yaml template. Closes #1132
2017-03-13 23:04:31 +08:00
- { role: kubernetes-apps/policy_controller, tags: policy-controller }
Integrate kubernetes/ingress-nginx 0.11.0 to Kubespray
2018-02-13 09:08:44 +08:00
- { role: kubernetes-apps/ingress_controller, tags: ingress-controller }
Upgrade Local Volume Provisioner Addon to v2.0.0
2018-02-15 09:55:43 +08:00
- { role: kubernetes-apps/external_provisioner, tags: external-provisioner }
Use dnsmasq inside pods
2016-03-18 22:07:33 +08:00
Install Helm on all masters
2018-09-10 17:39:26 +08:00
- hosts: kube-master
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
Add kubedns as default package to install
2016-05-05 00:00:46 +08:00
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
restored gather facts on all hosts
2016-09-20 03:12:42 +08:00
- { role: kubernetes-apps, tags: apps }
ansible-lint: add spaces around variables [E206] (#4699)
2019-05-03 05:24:21 +08:00
environment: "{{ proxy_env }}"
Run dns_late preinstall tasks on all k8s nodes (#4672) * Run dns_late preinstall tasks on all k8s nodes Related issue: #4656 Change-Id: I63f8559ef1a497b7580ab084561e6603fe647834 * Fix ansible-lint Change-Id: Ia5b33fa63dbc36d8c3e9557ef3f2ea02af2325a5 * Fix recover_control_plane lint issues Change-Id: I16643a3193c11b6ba704e9698812cac7e4fd19a8
2019-04-29 20:12:22 +08:00
- hosts: k8s-cluster
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
roles:
- { role: kubespray-defaults}
- { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_late: true }