kubernetes-sigs
/
kubespray
mirror of https://github.com/kubernetes-sigs/kubespray.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
kubespray/cluster.yml

107 lines
3.7 KiB
YAML
Raw Normal View History

Initial commit
2015-10-04 04:19:50 +08:00
---
Add support for bastion hosts
2016-12-09 17:38:17 +08:00
- hosts: localhost
gather_facts: False
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
Add default var role
2017-02-23 19:07:17 +08:00
- { role: bastion-ssh-config, tags: ["localhost", "bastion"]}
Add support for bastion hosts
2016-12-09 17:38:17 +08:00
Rework wildcards matching all nodes * Re-enable ansible_ssh_pipelining as expected for the cluster.yml * Do not use 'all' wildcasts for hosts, limit only to k8s-cluster, etcd, calico-rr groups instead. Other nodes in inventory are out of Kargo scope and it's up to users how to manage them. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
2016-12-27 23:00:02 +08:00
- hosts: k8s-cluster:etcd:calico-rr
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
combine bootstrap options, add xenial support
2016-09-06 22:04:41 +08:00
gather_facts: false
Remove requiretty from sudoers to actually make pipelining work Some systems (e.g. CentOS on Azure) have requiretty in sudoers which makes pipelining fail.
2016-12-09 17:38:45 +08:00
vars:
Add comment about why ansible_ssh_pipelining is set to false in bootstrap-os
2016-12-09 18:04:42 +08:00
# Need to disable pipelining for bootstrap-os as some systems have requiretty in sudoers set, which makes pipelining
# fail. bootstrap-os fixes this on these systems, so in later plays it can be enabled.
Remove requiretty from sudoers to actually make pipelining work Some systems (e.g. CentOS on Azure) have requiretty in sudoers which makes pipelining fail.
2016-12-09 17:38:45 +08:00
ansible_ssh_pipelining: false
combine bootstrap options, add xenial support
2016-09-06 22:04:41 +08:00
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
Add default var role
2017-02-23 19:07:17 +08:00
- { role: bootstrap-os, tags: bootstrap-os}
force fact check of all nodes first thing
2016-08-12 22:06:31 +08:00
Rework wildcards matching all nodes * Re-enable ansible_ssh_pipelining as expected for the cluster.yml * Do not use 'all' wildcasts for hosts, limit only to k8s-cluster, etcd, calico-rr groups instead. Other nodes in inventory are out of Kargo scope and it's up to users how to manage them. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
2016-12-27 23:00:02 +08:00
- hosts: k8s-cluster:etcd:calico-rr
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
Rework wildcards matching all nodes * Re-enable ansible_ssh_pipelining as expected for the cluster.yml * Do not use 'all' wildcasts for hosts, limit only to k8s-cluster, etcd, calico-rr groups instead. Other nodes in inventory are out of Kargo scope and it's up to users how to manage them. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
2016-12-27 23:00:02 +08:00
vars:
ansible_ssh_pipelining: true
combine bootstrap options, add xenial support
2016-09-06 22:04:41 +08:00
gather_facts: true
restored gather facts on all hosts
2016-09-20 03:12:42 +08:00
Rework wildcards matching all nodes * Re-enable ansible_ssh_pipelining as expected for the cluster.yml * Do not use 'all' wildcasts for hosts, limit only to k8s-cluster, etcd, calico-rr groups instead. Other nodes in inventory are out of Kargo scope and it's up to users how to manage them. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
2016-12-27 23:00:02 +08:00
- hosts: k8s-cluster:etcd:calico-rr
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
Use 0755 mode for binaries
2015-12-18 05:46:50 +08:00
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
rename role common to kubernetes/preinstall
2015-12-31 17:03:22 +08:00
- { role: kubernetes/preinstall, tags: preinstall }
Preconfigure DNS stack and docker early In order to enable offline/intranet installation cases: * Move DNS/resolvconf configuration to preinstall role. Remove skip_dnsmasq_k8s var as not needed anymore. * Preconfigure DNS stack early, which may be the case when downloading artifacts from intranet repositories. Do not configure K8s DNS resolvers for hosts /etc/resolv.conf yet early (as they may be not existing). * Reconfigure K8s DNS resolvers for hosts only after kubedns/dnsmasq was set up and before K8s apps to be created. * Move docker install task to early stage as well and unbind it from the etcd role's specific install path. Fix external flannel dependency on docker role handlers. Also fix the docker restart handlers' steps ordering to match the expected sequence (the socket then the service). * Add default resolver fact, which is the cloud provider specific and remove hardcoded GCE resolver. * Reduce default ndots for hosts /etc/resolv.conf to 2. Multiple search domains combined with high ndots values lead to poor performance of DNS stack and make ansible workers to fail very often with the "Timeout (12s) waiting for privilege escalation prompt:" error. * Update docs. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-12-07 23:57:05 +08:00
- { role: docker, tags: docker }
Vault security hardening and role isolation
2017-02-09 05:41:36 +08:00
- role: rkt
tags: rkt
when: "'rkt' in [etcd_deployment_type, kubelet_deployment_type, vault_deployment_type]"
Refactor downloads to use download role directly (#1824) * Refactor downloads to use download role directly Also disable fact delegation so download delegate works acros OSes. * clean up bools and ansible_os_family conditionals
2017-10-19 16:17:11 +08:00
- { role: download, tags: download, skip_downloads: false }
Fix idempotency/recurrence of download and preinstall * Don't push containers if not changed * Do preinstall role only once and redistribute defaults to corresponding roles Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-10-24 21:11:52 +08:00
Vault security hardening and role isolation
2017-02-09 05:41:36 +08:00
- hosts: etcd:k8s-cluster:vault
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
Adding the Vault role
2017-01-14 04:31:10 +08:00
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults, when: "cert_management == 'vault'" }
Adding the Vault role
2017-01-14 04:31:10 +08:00
- { role: vault, tags: vault, vault_bootstrap: true, when: "cert_management == 'vault'" }
Remove standalone etcd specific play, cleanup host mode Now etcd role can optionally disable etcd cluster setup for faster deployment when it is combined with etcd role.
2017-03-04 04:30:37 +08:00
- hosts: etcd
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
Vault security hardening and role isolation
2017-02-09 05:41:36 +08:00
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
Remove standalone etcd specific play, cleanup host mode Now etcd role can optionally disable etcd cluster setup for faster deployment when it is combined with etcd role.
2017-03-04 04:30:37 +08:00
- { role: etcd, tags: etcd, etcd_cluster_setup: true }
Vault security hardening and role isolation
2017-02-09 05:41:36 +08:00
- hosts: k8s-cluster
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
Fix idempotency/recurrence of download and preinstall * Don't push containers if not changed * Do preinstall role only once and redistribute defaults to corresponding roles Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-10-24 21:11:52 +08:00
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
Remove standalone etcd specific play, cleanup host mode Now etcd role can optionally disable etcd cluster setup for faster deployment when it is combined with etcd role.
2017-03-04 04:30:37 +08:00
- { role: etcd, tags: etcd, etcd_cluster_setup: false }
Fix etcd standalone deployment etcd facts are generated in kubernetes/preinstall, so etcd nodes need to be evaluated first before the rest of the deployment. Moved several directory facts from kubernetes/node to kubernetes/preinstall because they are not backward dependent.
2016-07-26 21:18:47 +08:00
Adding the Vault role
2017-01-14 04:31:10 +08:00
- hosts: etcd:k8s-cluster:vault
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
Adding the Vault role
2017-01-14 04:31:10 +08:00
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
Adding the Vault role
2017-01-14 04:31:10 +08:00
- { role: vault, tags: vault, when: "cert_management == 'vault'"}
Fix etcd standalone deployment etcd facts are generated in kubernetes/preinstall, so etcd nodes need to be evaluated first before the rest of the deployment. Moved several directory facts from kubernetes/node to kubernetes/preinstall because they are not backward dependent.
2016-07-26 21:18:47 +08:00
- hosts: k8s-cluster
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
Fix etcd standalone deployment etcd facts are generated in kubernetes/preinstall, so etcd nodes need to be evaluated first before the rest of the deployment. Moved several directory facts from kubernetes/node to kubernetes/preinstall because they are not backward dependent.
2016-07-26 21:18:47 +08:00
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
Run etcd as pod
2015-12-24 06:27:40 +08:00
- { role: kubernetes/node, tags: node }
Initial commit
2015-10-04 04:19:50 +08:00
review roles order
2015-12-11 18:40:56 +08:00
- hosts: kube-master
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
review roles order
2015-12-11 18:40:56 +08:00
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
review roles order
2015-12-11 18:40:56 +08:00
- { role: kubernetes/master, tags: master }
Move cluster roles and system namespace to new role This should be done after kubeconfig is set for admin and before network plugins are up.
2017-10-26 16:10:33 +08:00
- { role: kubernetes/client, tags: client }
- { role: kubernetes-apps/cluster_roles, tags: cluster-roles }
kubeadm support (#1631) * kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml
2017-09-14 02:00:51 +08:00
- hosts: k8s-cluster
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
roles:
- { role: kubespray-defaults}
- { role: kubernetes/kubeadm, tags: kubeadm, when: "kubeadm_enabled" }
Use api lookup for kubelet hostname when using cloudprovider (#1686) The value cannot be determined properly via local facts, so checking k8s api is the most reliable way to look up what hostname is used when using a cloudprovider.
2017-09-24 16:22:15 +08:00
- { role: network_plugin, tags: network }
kubeadm support (#1631) * kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml
2017-09-14 02:00:51 +08:00
- hosts: kube-master
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
roles:
- { role: kubespray-defaults}
Upgrade to kubeadm (#1667) * Enable upgrade to kubeadm * fix kubedns upgrade * try upgrade route * use init/upgrade strategy for kubeadm and ignore kubedns svc * Use bin_dir for kubeadm * delete more secrets * fix waiting for terminating pods * Manually enforce kube-proxy for kubeadm deploy * remove proxy. update to kubeadm 1.8.0rc1
2017-09-26 17:38:58 +08:00
- { role: kubernetes-apps/rotate_tokens, tags: rotate_tokens, when: "secret_changed|default(false)" }
Adding support for canal network plugin This patch provides support for Canal network plugin installation as a self-hosted app, see the following link for details: https://github.com/tigera/canal/tree/master/k8s-install
2016-11-03 23:57:11 +08:00
- { role: kubernetes-apps/network_plugin, tags: network }
Move calico-policy-controller into separate role By default Calico CNI does not create any network access policies or profiles if 'policy' is enabled in CNI config. And without any policies/profiles network access to/from PODs is blocked. K8s related policies are created by calico-policy-controller in such case. So we need to start it as soon as possible, before any real workloads. This patch also fixes kube-api port in calico-policy-controller yaml template. Closes #1132
2017-03-13 23:04:31 +08:00
- { role: kubernetes-apps/policy_controller, tags: policy-controller }
Use dnsmasq inside pods
2016-03-18 22:07:33 +08:00
Add calico/routereflector support Add BGP route reflectors support in order to optimize BGP topology for deployments with Calico network plugin. Also bump version of calico/ctl for some bug fixes.
2016-12-09 00:48:54 +08:00
- hosts: calico-rr
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
Add calico/routereflector support Add BGP route reflectors support in order to optimize BGP topology for deployments with Calico network plugin. Also bump version of calico/ctl for some bug fixes.
2016-12-09 00:48:54 +08:00
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
Add calico/routereflector support Add BGP route reflectors support in order to optimize BGP topology for deployments with Calico network plugin. Also bump version of calico/ctl for some bug fixes.
2016-12-09 00:48:54 +08:00
- { role: network_plugin/calico/rr, tags: network }
Dnsmasq runs on all nodes
2016-03-21 18:37:35 +08:00
- hosts: k8s-cluster
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
Use dnsmasq inside pods
2016-03-18 22:07:33 +08:00
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
Introduce dns_mode and resolvconf_mode and implement docker_dns mode Also update reset.yml to do more dns/network related cleanup.
2016-12-22 00:18:11 +08:00
- { role: dnsmasq, when: "dns_mode == 'dnsmasq_kubedns'", tags: dnsmasq }
- { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf }
Add kubedns as default package to install
2016-05-05 00:00:46 +08:00
- hosts: kube-master[0]
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later.
2017-04-04 17:52:39 +08:00
any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
Add kubedns as default package to install
2016-05-05 00:00:46 +08:00
roles:
rename kargo mentions in top-level yml files
2017-06-17 00:18:35 +08:00
- { role: kubespray-defaults}
restored gather facts on all hosts
2016-09-20 03:12:42 +08:00
- { role: kubernetes-apps, tags: apps }