kubernetes-sigs
/
kubespray
mirror of https://github.com/kubernetes-sigs/kubespray.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
kubespray/roles/kubernetes/node/defaults/main.yml

47 lines
1.0 KiB
YAML
Raw Normal View History

Fix idempotency/recurrence of download and preinstall * Don't push containers if not changed * Do preinstall role only once and redistribute defaults to corresponding roles Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-10-24 21:11:52 +08:00
# change to 0.0.0.0 to enable insecure access from anywhere (not recommended)
kube_apiserver_insecure_bind_address: 127.0.0.1
Add variable kube_resolv_conf Allow configuration of a custom /etc/resolv.conf for kubelet.
2016-07-20 16:57:47 +08:00
# resolv.conf to base dns config
kube_resolv_conf: "/etc/resolv.conf"
use iptables as default proxy mode
2016-07-12 16:20:43 +08:00
kube_proxy_mode: iptables
Add api runtime config option, review kubernetes handlers
2015-11-27 19:32:31 +08:00
Add support for --masquerade-all in kube-proxy New boolean var `kube_proxy_masquerade_all` which enables/disables `--masquerade-all` argument for kube-proxy. Closes #524
2016-10-03 18:08:41 +08:00
# If using the pure iptables proxy, SNAT everything
kube_proxy_masquerade_all: true
Systemd units, limits, and bin path fixes * Add restart for weave service unit * Reuse docker_bin_dir everythere * Limit systemd managed docker containers by CPU/RAM. Do not configure native systemd limits due to the lack of consensus in the kernel community requires out-of-tree kernel patches. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-12-23 22:44:44 +08:00
# Limits for kube components and nginx load balancer app
kubelet_memory_limit: 512M
kubelet_cpu_limit: 100m
kube_proxy_memory_limit: 2000M
kube_proxy_cpu_limit: 500m
kube_proxy_memory_requests: 256M
kube_proxy_cpu_requests: 150m
nginx_memory_limit: 512M
nginx_cpu_limit: 300m
nginx_memory_requests: 64M
nginx_cpu_requests: 50m
Upgrade to docker 1.10.3
2016-03-17 17:22:52 +08:00
# kube_api_runtime_config:
# - extensions/v1beta1/daemonsets=true
# - extensions/v1beta1/deployments=true
use nginx proxy on non-master nodes to proxy apiserver traffic Also adds all masters by hostname and localhost/127.0.0.1 to apiserver SSL certificate. Includes documentation update on how localhost loadbalancer works.
2016-09-28 19:05:08 +08:00
nginx_image_repo: nginx
nginx_image_tag: 1.11.4-alpine
Adding /opt/cni /etc/cni to rkt run kubelet
2017-01-10 12:54:01 +08:00
etcd_config_dir: /etc/ssl/etcd
Drop linux capabilities and rework users/groups * Drop linux capabilities for unprivileged containerized worlkoads Kargo configures for deployments. * Configure required securityContext/user/group/groups for kube components' static manifests, etcd, calico-rr and k8s apps, like dnsmasq daemonset. * Rework cloud-init (etcd) users creation for CoreOS. * Fix nologin paths, adjust defaults for addusers role and ensure supplementary groups membership added for users. * Add netplug user for network plugins (yet unused by privileged networking containers though). * Grant the kube and netplug users read access for etcd certs via the etcd certs group. * Grant group read access to kube certs via the kube cert group. * Remove priveleged mode for calico-rr and run it under its uid/gid and supplementary etcd_cert group. * Adjust docs. * Align cpu/memory limits and dropped caps with added rkt support for control plane. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
2016-12-28 21:58:37 +08:00
# Linux capabilities to be dropped for container engines
apps_drop_cap:
- chown
- dac_override
- fowner
- fsetid
- kill
- setgid
- setuid
- setpcap
- sys_chroot
- mknod
- audit_write
- setfcap