kubespray/roles/kubernetes/master/tasks/main.yml

---
- import_tasks: pre-upgrade.yml
  tags:
    - k8s-pre-upgrade

- import_tasks: users-file.yml
  when: kube_basic_auth|default(true)

- import_tasks: encrypt-at-rest.yml
  when: kube_encrypt_secret_data

- name: install | Copy kubectl binary from download dir
  command: rsync -piu "{{ local_release_dir }}/hyperkube" "{{ bin_dir }}/kubectl"
  changed_when: false
  tags:
    - hyperkube
    - kubectl
    - upgrade

- name: install | Set kubectl binary permissions
  file:
    path: "{{ bin_dir }}/kubectl"
    mode: "0755"
    state: file
  tags:
    - hyperkube
    - kubectl
    - upgrade

- name: Install kubectl bash completion
  shell: "{{ bin_dir }}/kubectl completion bash >/etc/bash_completion.d/kubectl.sh"
  when: ansible_os_family in ["Debian","RedHat"]
  tags:
    - kubectl

- name: Set kubectl bash completion file
  file:
    path: /etc/bash_completion.d/kubectl.sh
    owner: root
    group: root
    mode: 0755
  when: ansible_os_family in ["Debian","RedHat"]
  tags:
    - kubectl
    - upgrade

- name: Disable SecurityContextDeny admission-controller and enable PodSecurityPolicy
  set_fact:
    kube_apiserver_admission_control: "{{ kube_apiserver_admission_control | default([]) | difference(['SecurityContextDeny']) | union(['PodSecurityPolicy']) | unique }}"
    kube_apiserver_enable_admission_plugins: "{{ kube_apiserver_enable_admission_plugins | difference(['SecurityContextDeny']) | union(['PodSecurityPolicy']) | unique }}"
  when: podsecuritypolicy_enabled

- name: Include kubeadm setup if enabled
  import_tasks: kubeadm-setup.yml
  when: kubeadm_enabled|bool|default(false)

- name: Include static pod setup if not using kubeadm
  import_tasks: static-pod-setup.yml
  when: not kubeadm_enabled|bool|default(false)
Initial commit 2015-10-04 04:19:50 +08:00			`---`
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible. 2018-01-29 19:37:48 +08:00			`- import_tasks: pre-upgrade.yml`
Normalize tags in all places to prepare for tag fixing in future (#1739) 2017-10-05 15:43:04 +08:00			`tags:`
			`- k8s-pre-upgrade`
Review role order, use master ip even when fqdn are used in the inventory 2015-12-17 06:49:01 +08:00
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible. 2018-01-29 19:37:48 +08:00			`- import_tasks: users-file.yml`
kubeadm support (#1631) * kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml 2017-09-14 02:00:51 +08:00			`when: kube_basic_auth\|default(true)`

Added option for encrypting secrets to etcd v.2 (#2428) * Added option for encrypting secrets to etcd * Fix keylength to 32 * Forgot the default * Rename secrets.yaml to secrets_encryption.yaml * Fix static path for secrets file to use ansible variable * Rename secrets.yaml.j2 to secrets_encryption.yaml.j2 * Base64 encode the token * Fixed merge error * Changed path to credentials dir * Update path to secrets file which is now readable inside the apiserver container. Set better file permissions * Add encryption option to k8s-cluster.yml 2018-03-16 03:20:05 +08:00			`- import_tasks: encrypt-at-rest.yml`
			`when: kube_encrypt_secret_data`

Download etcd and hyperkube binary. 2018-07-30 17:55:25 +08:00			`- name: install \| Copy kubectl binary from download dir`
			`command: rsync -piu "{{ local_release_dir }}/hyperkube" "{{ bin_dir }}/kubectl"`
Idempotency fixes (#1838) 2017-10-26 04:19:40 +08:00			`changed_when: false`
			`tags:`
			`- hyperkube`
			`- kubectl`
			`- upgrade`

Download etcd and hyperkube binary. 2018-07-30 17:55:25 +08:00			`- name: install \| Set kubectl binary permissions`
			`file:`
			`path: "{{ bin_dir }}/kubectl"`
			`mode: "0755"`
			`state: file`
Normalize tags in all places to prepare for tag fixing in future (#1739) 2017-10-05 15:43:04 +08:00			`tags:`
			`- hyperkube`
			`- kubectl`
			`- upgrade`
running kubernetes master processes as pods 2015-12-11 18:52:20 +08:00
Fix bash completion installation 2017-01-18 01:36:58 +08:00			`- name: Install kubectl bash completion`
			`shell: "{{ bin_dir }}/kubectl completion bash >/etc/bash_completion.d/kubectl.sh"`
Download etcd and hyperkube binary. 2018-07-30 17:55:25 +08:00			`when: ansible_os_family in ["Debian","RedHat"]`
Normalize tags in all places to prepare for tag fixing in future (#1739) 2017-10-05 15:43:04 +08:00			`tags:`
			`- kubectl`
Generate kubectl bash completion from kubectl instead of file 2016-11-14 16:22:46 +08:00
Fix bash completion installation 2017-01-18 01:36:58 +08:00			`- name: Set kubectl bash completion file`
			`file:`
			`path: /etc/bash_completion.d/kubectl.sh`
Generate kubectl bash completion from kubectl instead of file 2016-11-14 16:22:46 +08:00			`owner: root`
			`group: root`
			`mode: 0755`
Fix bash completion installation 2017-01-18 01:36:58 +08:00			`when: ansible_os_family in ["Debian","RedHat"]`
Normalize tags in all places to prepare for tag fixing in future (#1739) 2017-10-05 15:43:04 +08:00			`tags:`
			`- kubectl`
			`- upgrade`
Generate kubectl bash completion from kubectl instead of file 2016-11-14 16:22:46 +08:00
psp, roles and rbs for PodSecurityPolicy when podsecuritypolicy_enabled is true 2018-08-23 00:16:13 +08:00			`- name: Disable SecurityContextDeny admission-controller and enable PodSecurityPolicy`
			`set_fact:`
			`kube_apiserver_admission_control: "{{ kube_apiserver_admission_control \| default([]) \| difference(['SecurityContextDeny']) \| union(['PodSecurityPolicy']) \| unique }}"`
			`kube_apiserver_enable_admission_plugins: "{{ kube_apiserver_enable_admission_plugins \| difference(['SecurityContextDeny']) \| union(['PodSecurityPolicy']) \| unique }}"`
			`when: podsecuritypolicy_enabled`

Fix up warnings and deprecations (#1848) 2017-10-20 15:25:57 +08:00			`- name: Include kubeadm setup if enabled`
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible. 2018-01-29 19:37:48 +08:00			`import_tasks: kubeadm-setup.yml`
kubeadm support (#1631) * kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml 2017-09-14 02:00:51 +08:00			`when: kubeadm_enabled\|bool\|default(false)`
basic rbac support 2017-06-27 12:27:25 +08:00
Fix up warnings and deprecations (#1848) 2017-10-20 15:25:57 +08:00			`- name: Include static pod setup if not using kubeadm`
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible. 2018-01-29 19:37:48 +08:00			`import_tasks: static-pod-setup.yml`
kubeadm support (#1631) * kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml 2017-09-14 02:00:51 +08:00			`when: not kubeadm_enabled\|bool\|default(false)`