kubespray/cluster.yml

---
- hosts: localhost
  gather_facts: false
  become: no
  tasks:
    - name: "Check ansible version >=2.7.8"
      assert:
        msg: "Ansible must be v2.7.8 or higher"
        that:
          - ansible_version.string is version("2.7.8", ">=")
      tags:
        - check
  vars:
    ansible_connection: local

- hosts: bastion[0]
  gather_facts: False
  roles:
    - { role: kubespray-defaults}
    - { role: bastion-ssh-config, tags: ["localhost", "bastion"]}

- hosts: k8s-cluster:etcd:calico-rr
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  gather_facts: false
  vars:
    # Need to disable pipelining for bootstrap-os as some systems have requiretty in sudoers set, which makes pipelining
    # fail. bootstrap-os fixes this on these systems, so in later plays it can be enabled.
    ansible_ssh_pipelining: false
  roles:
    - { role: kubespray-defaults}
    - { role: bootstrap-os, tags: bootstrap-os}

- hosts: k8s-cluster:etcd:calico-rr
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  vars:
    ansible_ssh_pipelining: true
  gather_facts: false
  pre_tasks:
    - name: gather facts from all instances
      setup:
      delegate_to: "{{item}}"
      delegate_facts: true
      with_items: "{{ groups['k8s-cluster'] + groups['etcd'] + groups['calico-rr']|default([]) }}"
      run_once: true

- hosts: k8s-cluster:etcd:calico-rr
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  roles:
    - { role: kubespray-defaults}
    - { role: kubernetes/preinstall, tags: preinstall }
    - { role: "container-engine", tags: "container-engine", when: deploy_container_engine|default(true) }
    - { role: download, tags: download, when: "not skip_downloads" }
  environment: "{{proxy_env}}"

- hosts: etcd
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  roles:
    - { role: kubespray-defaults}
    - { role: etcd, tags: etcd, etcd_cluster_setup: true, etcd_events_cluster_setup: "{{ etcd_events_cluster_enabled }}" }

- hosts: k8s-cluster:calico-rr
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  roles:
    - { role: kubespray-defaults}
    - { role: etcd, tags: etcd, etcd_cluster_setup: false, etcd_events_cluster_setup: false }

- hosts: k8s-cluster
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  roles:
    - { role: kubespray-defaults}
    - { role: kubernetes/node, tags: node }
  environment: "{{proxy_env}}"

- hosts: kube-master
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  roles:
    - { role: kubespray-defaults}
    - { role: kubernetes/master, tags: master }
    - { role: kubernetes/client, tags: client }
    - { role: kubernetes-apps/cluster_roles, tags: cluster-roles }

- hosts: k8s-cluster
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  roles:
    - { role: kubespray-defaults}
    - { role: kubernetes/kubeadm, tags: kubeadm}
    - { role: network_plugin, tags: network }

- hosts: kube-master[0]
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  roles:
    - { role: kubespray-defaults}
    - { role: kubernetes-apps/rotate_tokens, tags: rotate_tokens, when: "secret_changed|default(false)" }
    - { role: win_nodes/kubernetes_patch, tags: ["master", "win_nodes"]}

- hosts: kube-master
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  roles:
    - { role: kubespray-defaults}
    - { role: kubernetes-apps/network_plugin, tags: network }
    - { role: kubernetes-apps/policy_controller, tags: policy-controller }
    - { role: kubernetes-apps/ingress_controller, tags: ingress-controller }
    - { role: kubernetes-apps/external_provisioner, tags: external-provisioner }

- hosts: calico-rr
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  roles:
    - { role: kubespray-defaults}
    - { role: network_plugin/calico/rr, tags: network }

- hosts: kube-master
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  roles:
    - { role: kubespray-defaults}
    - { role: kubernetes-apps, tags: apps }
    - { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_late: true }
  environment: "{{proxy_env}}"
Initial commit 2015-10-04 04:19:50 +08:00			`---`
Assert if ansible 2.7 is used (#3589) 2018-10-26 15:29:21 +08:00			`- hosts: localhost`
Disable gather facts when checking ansible version (#3615) 2018-10-31 18:19:17 +08:00			`gather_facts: false`
Disable become for localhost (#4287) 2019-02-26 11:36:44 +08:00			`become: no`
Assert if ansible 2.7 is used (#3589) 2018-10-26 15:29:21 +08:00			`tasks:`
Upgrade to Ansible 2.7.8 (#4535) 2019-04-18 01:18:05 +08:00			`- name: "Check ansible version >=2.7.8"`
Assert if ansible 2.7 is used (#3589) 2018-10-26 15:29:21 +08:00			`assert:`
Upgrade to Ansible 2.7.8 (#4535) 2019-04-18 01:18:05 +08:00			`msg: "Ansible must be v2.7.8 or higher"`
Assert if ansible 2.7 is used (#3589) 2018-10-26 15:29:21 +08:00			`that:`
Upgrade to Ansible 2.7.8 (#4535) 2019-04-18 01:18:05 +08:00			`- ansible_version.string is version("2.7.8", ">=")`
Assert if ansible 2.7 is used (#3589) 2018-10-26 15:29:21 +08:00			`tags:`
			`- check`
			`vars:`
			`ansible_connection: local`

Split deploy steps in separate playbooks: part1 (#3451) * Fix bootstrap_os/ubuntu idempotency * Update bastion role * move container_engine in sub-roles * requires ansible 2.5 * ubuntu18 as first CI job 2018-10-10 10:14:33 +08:00			`- hosts: bastion[0]`
Add support for bastion hosts 2016-12-09 17:38:17 +08:00			`gather_facts: False`
			`roles:`
rename kargo mentions in top-level yml files 2017-06-17 00:18:35 +08:00			`- { role: kubespray-defaults}`
Add default var role 2017-02-23 19:07:17 +08:00			`- { role: bastion-ssh-config, tags: ["localhost", "bastion"]}`
Add support for bastion hosts 2016-12-09 17:38:17 +08:00
Rework wildcards matching all nodes * Re-enable ansible_ssh_pipelining as expected for the cluster.yml * Do not use 'all' wildcasts for hosts, limit only to k8s-cluster, etcd, calico-rr groups instead. Other nodes in inventory are out of Kargo scope and it's up to users how to manage them. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru> 2016-12-27 23:00:02 +08:00			`- hosts: k8s-cluster:etcd:calico-rr`
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later. 2017-04-04 17:52:39 +08:00			`any_errors_fatal: "{{ any_errors_fatal \| default(true) }}"`
combine bootstrap options, add xenial support 2016-09-06 22:04:41 +08:00			`gather_facts: false`
Remove requiretty from sudoers to actually make pipelining work Some systems (e.g. CentOS on Azure) have requiretty in sudoers which makes pipelining fail. 2016-12-09 17:38:45 +08:00			`vars:`
Add comment about why ansible_ssh_pipelining is set to false in bootstrap-os 2016-12-09 18:04:42 +08:00			`# Need to disable pipelining for bootstrap-os as some systems have requiretty in sudoers set, which makes pipelining`
			`# fail. bootstrap-os fixes this on these systems, so in later plays it can be enabled.`
Remove requiretty from sudoers to actually make pipelining work Some systems (e.g. CentOS on Azure) have requiretty in sudoers which makes pipelining fail. 2016-12-09 17:38:45 +08:00			`ansible_ssh_pipelining: false`
combine bootstrap options, add xenial support 2016-09-06 22:04:41 +08:00			`roles:`
rename kargo mentions in top-level yml files 2017-06-17 00:18:35 +08:00			`- { role: kubespray-defaults}`
Add default var role 2017-02-23 19:07:17 +08:00			`- { role: bootstrap-os, tags: bootstrap-os}`
force fact check of all nodes first thing 2016-08-12 22:06:31 +08:00
Rework wildcards matching all nodes * Re-enable ansible_ssh_pipelining as expected for the cluster.yml * Do not use 'all' wildcasts for hosts, limit only to k8s-cluster, etcd, calico-rr groups instead. Other nodes in inventory are out of Kargo scope and it's up to users how to manage them. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru> 2016-12-27 23:00:02 +08:00			`- hosts: k8s-cluster:etcd:calico-rr`
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later. 2017-04-04 17:52:39 +08:00			`any_errors_fatal: "{{ any_errors_fatal \| default(true) }}"`
Rework wildcards matching all nodes * Re-enable ansible_ssh_pipelining as expected for the cluster.yml * Do not use 'all' wildcasts for hosts, limit only to k8s-cluster, etcd, calico-rr groups instead. Other nodes in inventory are out of Kargo scope and it's up to users how to manage them. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru> 2016-12-27 23:00:02 +08:00			`vars:`
			`ansible_ssh_pipelining: true`
Speed up tasks (#4278) * fact gathering should run only once per node * eliminate ansible version check, it is at the beginning of each playbook 2019-02-26 11:56:23 +08:00			`gather_facts: false`
gather facts for all nodes, even if running for single one (--limit) 2018-02-14 23:43:41 +08:00			`pre_tasks:`
			`- name: gather facts from all instances`
			`setup:`
			`delegate_to: "{{item}}"`
Speed up tasks (#4278) * fact gathering should run only once per node * eliminate ansible version check, it is at the beginning of each playbook 2019-02-26 11:56:23 +08:00			`delegate_facts: true`
gather facts from all instances, maybe include calico-rr 2018-03-19 14:35:45 +08:00			`with_items: "{{ groups['k8s-cluster'] + groups['etcd'] + groups['calico-rr']\|default([]) }}"`
Speed up tasks (#4278) * fact gathering should run only once per node * eliminate ansible version check, it is at the beginning of each playbook 2019-02-26 11:56:23 +08:00			`run_once: true`
restored gather facts on all hosts 2016-09-20 03:12:42 +08:00
Rework wildcards matching all nodes * Re-enable ansible_ssh_pipelining as expected for the cluster.yml * Do not use 'all' wildcasts for hosts, limit only to k8s-cluster, etcd, calico-rr groups instead. Other nodes in inventory are out of Kargo scope and it's up to users how to manage them. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru> 2016-12-27 23:00:02 +08:00			`- hosts: k8s-cluster:etcd:calico-rr`
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later. 2017-04-04 17:52:39 +08:00			`any_errors_fatal: "{{ any_errors_fatal \| default(true) }}"`
Use 0755 mode for binaries 2015-12-18 05:46:50 +08:00			`roles:`
rename kargo mentions in top-level yml files 2017-06-17 00:18:35 +08:00			`- { role: kubespray-defaults}`
rename role common to kubernetes/preinstall 2015-12-31 17:03:22 +08:00			`- { role: kubernetes/preinstall, tags: preinstall }`
Add flag to deploy container engine manually. (#3753) This feature was removed by PR#3061. But change flag manage_docker to deploy_container_engine. 2018-11-26 23:26:40 +08:00			`- { role: "container-engine", tags: "container-engine", when: deploy_container_engine\|default(true) }`
Fix skip_downloads condition. 2018-08-08 18:49:49 +08:00			`- { role: download, tags: download, when: "not skip_downloads" }`
improved proxy support 2017-10-28 05:14:05 +08:00			`environment: "{{proxy_env}}"`
Fix idempotency/recurrence of download and preinstall * Don't push containers if not changed * Do preinstall role only once and redistribute defaults to corresponding roles Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> 2016-10-24 21:11:52 +08:00
Remove standalone etcd specific play, cleanup host mode Now etcd role can optionally disable etcd cluster setup for faster deployment when it is combined with etcd role. 2017-03-04 04:30:37 +08:00			`- hosts: etcd`
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later. 2017-04-04 17:52:39 +08:00			`any_errors_fatal: "{{ any_errors_fatal \| default(true) }}"`
Vault security hardening and role isolation 2017-02-09 05:41:36 +08:00			`roles:`
rename kargo mentions in top-level yml files 2017-06-17 00:18:35 +08:00			`- { role: kubespray-defaults}`
Improve variable handling for disabling etcd events cluster 2018-06-18 21:19:12 +08:00			`- { role: etcd, tags: etcd, etcd_cluster_setup: true, etcd_events_cluster_setup: "{{ etcd_events_cluster_enabled }}" }`
Vault security hardening and role isolation 2017-02-09 05:41:36 +08:00
fix broken variable in ansible 2.4.1.0 and ensure tasks for calico-rr (#1982) 2017-11-17 02:44:15 +08:00			`- hosts: k8s-cluster:calico-rr`
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later. 2017-04-04 17:52:39 +08:00			`any_errors_fatal: "{{ any_errors_fatal \| default(true) }}"`
Fix idempotency/recurrence of download and preinstall * Don't push containers if not changed * Do preinstall role only once and redistribute defaults to corresponding roles Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> 2016-10-24 21:11:52 +08:00			`roles:`
rename kargo mentions in top-level yml files 2017-06-17 00:18:35 +08:00			`- { role: kubespray-defaults}`
Do not run setup on all the nodes. 2018-05-02 16:58:38 +08:00			`- { role: etcd, tags: etcd, etcd_cluster_setup: false, etcd_events_cluster_setup: false }`
Fix etcd standalone deployment etcd facts are generated in kubernetes/preinstall, so etcd nodes need to be evaluated first before the rest of the deployment. Moved several directory facts from kubernetes/node to kubernetes/preinstall because they are not backward dependent. 2016-07-26 21:18:47 +08:00
			`- hosts: k8s-cluster`
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later. 2017-04-04 17:52:39 +08:00			`any_errors_fatal: "{{ any_errors_fatal \| default(true) }}"`
Fix etcd standalone deployment etcd facts are generated in kubernetes/preinstall, so etcd nodes need to be evaluated first before the rest of the deployment. Moved several directory facts from kubernetes/node to kubernetes/preinstall because they are not backward dependent. 2016-07-26 21:18:47 +08:00			`roles:`
rename kargo mentions in top-level yml files 2017-06-17 00:18:35 +08:00			`- { role: kubespray-defaults}`
Run etcd as pod 2015-12-24 06:27:40 +08:00			`- { role: kubernetes/node, tags: node }`
improved proxy support 2017-10-28 05:14:05 +08:00			`environment: "{{proxy_env}}"`
Initial commit 2015-10-04 04:19:50 +08:00
review roles order 2015-12-11 18:40:56 +08:00			`- hosts: kube-master`
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later. 2017-04-04 17:52:39 +08:00			`any_errors_fatal: "{{ any_errors_fatal \| default(true) }}"`
review roles order 2015-12-11 18:40:56 +08:00			`roles:`
rename kargo mentions in top-level yml files 2017-06-17 00:18:35 +08:00			`- { role: kubespray-defaults}`
review roles order 2015-12-11 18:40:56 +08:00			`- { role: kubernetes/master, tags: master }`
Move cluster roles and system namespace to new role This should be done after kubeconfig is set for admin and before network plugins are up. 2017-10-26 16:10:33 +08:00			`- { role: kubernetes/client, tags: client }`
			`- { role: kubernetes-apps/cluster_roles, tags: cluster-roles }`
kubeadm support (#1631) * kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml 2017-09-14 02:00:51 +08:00
			`- hosts: k8s-cluster`
			`any_errors_fatal: "{{ any_errors_fatal \| default(true) }}"`
			`roles:`
			`- { role: kubespray-defaults}`
Remove non-kubeadm deployment (#3811) * Remove non-kubeadm deployment * More cleanup * More cleanup * More cleanup * More cleanup * Fix gitlab * Try stop gce first before absent to make the delete process work * More cleanup * Fix bug with checking if kubeadm has already run * Fix bug with checking if kubeadm has already run * More fixes * Fix test * fix * Fix gitlab checkout untill kubespray 2.8 is on quay * Fixed * Add upgrade path from non-kubeadm to kubeadm. Revert ssl path * Readd secret checking * Do gitlab checks from v2.7.0 test upgrade path to 2.8.0 * fix typo * Fix CI jobs to kubeadm again. Fix broken hyperkube path * Fix gitlab * Fix rotate tokens * More fixes * More fixes * Fix tokens 2018-12-06 18:33:38 +08:00			`- { role: kubernetes/kubeadm, tags: kubeadm}`
Use api lookup for kubelet hostname when using cloudprovider (#1686) The value cannot be determined properly via local facts, so checking k8s api is the most reliable way to look up what hostname is used when using a cloudprovider. 2017-09-24 16:22:15 +08:00			`- { role: network_plugin, tags: network }`
kubeadm support (#1631) * kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml 2017-09-14 02:00:51 +08:00
Run rotate_tokens role only once (#1970) 2017-11-16 02:50:23 +08:00			`- hosts: kube-master[0]`
kubeadm support (#1631) * kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml 2017-09-14 02:00:51 +08:00			`any_errors_fatal: "{{ any_errors_fatal \| default(true) }}"`
			`roles:`
			`- { role: kubespray-defaults}`
Upgrade to kubeadm (#1667) * Enable upgrade to kubeadm * fix kubedns upgrade * try upgrade route * use init/upgrade strategy for kubeadm and ignore kubedns svc * Use bin_dir for kubeadm * delete more secrets * fix waiting for terminating pods * Manually enforce kube-proxy for kubeadm deploy * remove proxy. update to kubeadm 1.8.0rc1 2017-09-26 17:38:58 +08:00			`- { role: kubernetes-apps/rotate_tokens, tags: rotate_tokens, when: "secret_changed\|default(false)" }`
Remove non-kubeadm deployment (#3811) * Remove non-kubeadm deployment * More cleanup * More cleanup * More cleanup * More cleanup * Fix gitlab * Try stop gce first before absent to make the delete process work * More cleanup * Fix bug with checking if kubeadm has already run * Fix bug with checking if kubeadm has already run * More fixes * Fix test * fix * Fix gitlab checkout untill kubespray 2.8 is on quay * Fixed * Add upgrade path from non-kubeadm to kubeadm. Revert ssl path * Readd secret checking * Do gitlab checks from v2.7.0 test upgrade path to 2.8.0 * fix typo * Fix CI jobs to kubeadm again. Fix broken hyperkube path * Fix gitlab * Fix rotate tokens * More fixes * More fixes * Fix tokens 2018-12-06 18:33:38 +08:00			`- { role: win_nodes/kubernetes_patch, tags: ["master", "win_nodes"]}`
Run rotate_tokens role only once (#1970) 2017-11-16 02:50:23 +08:00
			`- hosts: kube-master`
			`any_errors_fatal: "{{ any_errors_fatal \| default(true) }}"`
			`roles:`
			`- { role: kubespray-defaults}`
Adding support for canal network plugin This patch provides support for Canal network plugin installation as a self-hosted app, see the following link for details: https://github.com/tigera/canal/tree/master/k8s-install 2016-11-03 23:57:11 +08:00			`- { role: kubernetes-apps/network_plugin, tags: network }`
Move calico-policy-controller into separate role By default Calico CNI does not create any network access policies or profiles if 'policy' is enabled in CNI config. And without any policies/profiles network access to/from PODs is blocked. K8s related policies are created by calico-policy-controller in such case. So we need to start it as soon as possible, before any real workloads. This patch also fixes kube-api port in calico-policy-controller yaml template. Closes #1132 2017-03-13 23:04:31 +08:00			`- { role: kubernetes-apps/policy_controller, tags: policy-controller }`
Integrate kubernetes/ingress-nginx 0.11.0 to Kubespray 2018-02-13 09:08:44 +08:00			`- { role: kubernetes-apps/ingress_controller, tags: ingress-controller }`
Upgrade Local Volume Provisioner Addon to v2.0.0 2018-02-15 09:55:43 +08:00			`- { role: kubernetes-apps/external_provisioner, tags: external-provisioner }`
Use dnsmasq inside pods 2016-03-18 22:07:33 +08:00
Add calico/routereflector support Add BGP route reflectors support in order to optimize BGP topology for deployments with Calico network plugin. Also bump version of calico/ctl for some bug fixes. 2016-12-09 00:48:54 +08:00			`- hosts: calico-rr`
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later. 2017-04-04 17:52:39 +08:00			`any_errors_fatal: "{{ any_errors_fatal \| default(true) }}"`
Add calico/routereflector support Add BGP route reflectors support in order to optimize BGP topology for deployments with Calico network plugin. Also bump version of calico/ctl for some bug fixes. 2016-12-09 00:48:54 +08:00			`roles:`
rename kargo mentions in top-level yml files 2017-06-17 00:18:35 +08:00			`- { role: kubespray-defaults}`
Add calico/routereflector support Add BGP route reflectors support in order to optimize BGP topology for deployments with Calico network plugin. Also bump version of calico/ctl for some bug fixes. 2016-12-09 00:48:54 +08:00			`- { role: network_plugin/calico/rr, tags: network }`

Install Helm on all masters 2018-09-10 17:39:26 +08:00			`- hosts: kube-master`
Make any_errors_fatal configurable Useful at scale when 1 or 2 noes my fail and you can proceed with the majority and go back and fix the others later. 2017-04-04 17:52:39 +08:00			`any_errors_fatal: "{{ any_errors_fatal \| default(true) }}"`
Add kubedns as default package to install 2016-05-05 00:00:46 +08:00			`roles:`
rename kargo mentions in top-level yml files 2017-06-17 00:18:35 +08:00			`- { role: kubespray-defaults}`
restored gather facts on all hosts 2016-09-20 03:12:42 +08:00			`- { role: kubernetes-apps, tags: apps }`
Remove kubedns and dnsmasq. Move dns_late phase after apps (#4406) Both kubedns and dnsmasq modes are long not maintained. We should run dns_late steps at the end because sshd makes DNS lookups during Ansible run and has 2s timeouts for each failed lookup trying to connect to coredns before it is ready. 2019-04-02 03:32:34 +08:00			`- { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_late: true }`
			`environment: "{{proxy_env}}"`