kubernetes-sigs
/
kubespray
mirror of https://github.com/kubernetes-sigs/kubespray.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
kubespray/roles/kubernetes/master/templates/manifests/kube-apiserver.manifest.j2

108 lines
3.8 KiB
Plaintext
Raw Normal View History

running kubernetes master processes as pods
2015-12-11 18:52:20 +08:00
apiVersion: v1
kind: Pod
metadata:
name: kube-apiserver
Address standalone kubelet config case Also place in global vars and do not repeat the kube_*_config_dir and kube_namespace vars for better code maintainability and UX. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-12-13 18:43:06 +08:00
namespace: {{system_namespace}}
Label k8s apps, adjust collect/upload info steps - Drop debugs from collect-info playbook - Drop sudo from collect-info step and add target dir var (required for travis jobs) - Label all k8s apps, including static manifests - Add logs for K8s apps to be collected as well - Fix upload to GCS as a public-read tarball Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-11-09 21:15:27 +08:00
labels:
k8s-app: kube-apiserver
Individual etcd ssl certs Includes hooks for triggering calico, kubelet, and kube-apiserver restarts if etcd certs changed.
2016-12-13 17:03:35 +08:00
kargo: v2
running kubernetes master processes as pods
2015-12-11 18:52:20 +08:00
spec:
hostNetwork: true
containers:
- name: kube-apiserver
Renaming hyperkube image vars
2015-12-14 16:54:58 +08:00
image: {{ hyperkube_image_repo }}:{{ hyperkube_image_tag }}
Allow pre-downloaded images to be used effectively According to http://kubernetes.io/docs/user-guide/images/ : By default, the kubelet will try to pull each image from the specified registry. However, if the imagePullPolicy property of the container is set to IfNotPresent or Never, then a local\ image is used (preferentially or exclusively, respectively). Use IfNotPresent value to allow images prepared by the download role dependencies to be effectively used by kubelet without pull errors resulting apps to stay blocked in PullBackOff/Error state even when there are images on the localhost exist. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-11-22 23:16:04 +08:00
imagePullPolicy: {{ k8s_image_pull_policy }}
Systemd units, limits, and bin path fixes * Add restart for weave service unit * Reuse docker_bin_dir everythere * Limit systemd managed docker containers by CPU/RAM. Do not configure native systemd limits due to the lack of consensus in the kernel community requires out-of-tree kernel patches. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-12-23 22:44:44 +08:00
resources:
limits:
cpu: {{ kube_apiserver_cpu_limit }}
memory: {{ kube_apiserver_memory_limit }}
requests:
cpu: {{ kube_apiserver_cpu_requests }}
memory: {{ kube_apiserver_memory_requests }}
running kubernetes master processes as pods
2015-12-11 18:52:20 +08:00
command:
- /hyperkube
- apiserver
fixes issue #258 Kubernetes API server has an option: ``` --advertise-address=<nil>: The IP address on which to advertise the apiserver to members of the cluster. This address must be reachable by the rest of the cluster. If blank, the --bind-address will be used. If --bind-address is unspecified, the host's default interface will be used. ``` kargo does not set --bind-address, thus it binds to eth0, in vagrant and similar environments this causes issues because nodes cannot talk to eachother over eth0. This sets `--advertise-address` to `ip` if its set, otherwise the default behavior of is persisted by using `ansible_default_ipv4.address`.
2016-05-23 02:44:17 +08:00
- --advertise-address={{ ip | default(ansible_default_ipv4.address) }}
Add etcd proxy support * Enforce a etcd-proxy role to a k8s-cluster group members. This provides an HA layout for all of the k8s cluster internal clients. * Proxies to be run on each node in the group as a separate etcd instances with a readwrite proxy mode and listen the given endpoint, which is either the access_ip:2379 or the localhost:2379. * A notion for the 'kube_etcd_multiaccess' is: ignore endpoints and loadbalancers and use the etcd members IPs as a comma-separated list. Otherwise, clients shall use the local endpoint provided by a etcd-proxy instances on each etcd node. A Netwroking plugins always use that access mode. * Fix apiserver's etcd servers args to use the etcd_access_endpoint. * Fix networking plugins flannel/calico to use the etcd_endpoint. * Fix name env var for non masters to be set as well. * Fix etcd_client_url was not used anywhere and other etcd_* facts evaluation was duplicated in a few places. * Define proxy modes only in the env file, if not a master. Del an automatic proxy mode decisions for etcd nodes in init/unit scripts. * Use Wants= instead of Requires= as "This is the recommended way to hook start-up of one unit to the start-up of another unit" * Make apiserver/calico Wants= etcd-proxy to keep it always up Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> Co-authored-by: Matthew Mosesohn <mmosesohn@mirantis.com>
2016-07-11 22:05:05 +08:00
- --etcd-servers={{ etcd_access_endpoint }}
Enable quorum read for apiserver This reduces the likelihood of apiserver status updates timing out due to etcd write conflicts.
2016-10-04 23:31:42 +08:00
- --etcd-quorum-read=true
Add etcd TLS support
2016-11-09 18:44:41 +08:00
- --etcd-cafile={{ etcd_cert_dir }}/ca.pem
Individual etcd ssl certs Includes hooks for triggering calico, kubelet, and kube-apiserver restarts if etcd certs changed.
2016-12-13 17:03:35 +08:00
- --etcd-certfile={{ etcd_cert_dir }}/node-{{ inventory_hostname }}.pem
- --etcd-keyfile={{ etcd_cert_dir }}/node-{{ inventory_hostname }}-key.pem
Add HA/LB endpoints for kube-apiserver * Add HA docs for API server. * Add auto-evaluated internal endpoints and clarify the loadbalancer_apiserver vars and usecases. * Use facts for kube_apiserver to not repeat code and enable LB endpoints use. * Use /healthz check for the wait-for apiserver. * Use the single endpoint for kubelet instead of the list of apiservers * Specify kube_apiserver_count to for HA layout Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-07-13 23:13:47 +08:00
- --insecure-bind-address={{ kube_apiserver_insecure_bind_address }}
- --apiserver-count={{ kube_apiserver_count }}
update admission controllers for > 1.4
2016-11-05 00:54:35 +08:00
- --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota
running kubernetes master processes as pods
2015-12-11 18:52:20 +08:00
- --service-cluster-ip-range={{ kube_service_addresses }}
Add service-node-port-range parameter for kube-apiserver
2016-11-18 20:56:55 +08:00
- --service-node-port-range={{ kube_apiserver_node_port_range }}
running kubernetes master processes as pods
2015-12-11 18:52:20 +08:00
- --client-ca-file={{ kube_cert_dir }}/ca.pem
Granular authentication Control It is now possible to deactivate selected authentication methods (basic auth, token auth) inside the cluster by adding removing the required arguments to the Kube API Server and generating the secrets accordingly. The x509 authentification is currently not optional because disabling it would affect the kubectl clients deployed on the master nodes.
2017-02-27 21:15:50 +08:00
{% if kube_basic_auth|default(true) %}
running kubernetes master processes as pods
2015-12-11 18:52:20 +08:00
- --basic-auth-file={{ kube_users_dir }}/known_users.csv
Granular authentication Control It is now possible to deactivate selected authentication methods (basic auth, token auth) inside the cluster by adding removing the required arguments to the Kube API Server and generating the secrets accordingly. The x509 authentification is currently not optional because disabling it would affect the kubectl clients deployed on the master nodes.
2017-02-27 21:15:50 +08:00
{% endif %}
Use only one certificate for all apiservers https://github.com/kubernetes/kubernetes/issues/25063
2017-01-13 19:03:20 +08:00
- --tls-cert-file={{ kube_cert_dir }}/apiserver.pem
- --tls-private-key-file={{ kube_cert_dir }}/apiserver-key.pem
Granular authentication Control It is now possible to deactivate selected authentication methods (basic auth, token auth) inside the cluster by adding removing the required arguments to the Kube API Server and generating the secrets accordingly. The x509 authentification is currently not optional because disabling it would affect the kubectl clients deployed on the master nodes.
2017-02-27 21:15:50 +08:00
{% if kube_token_auth|default(true) %}
Deploy kubelet and kube-apiserver as containers kubelet via docker kube-apiserver as a static pod Fixed etcd service start to be more tolerant of slow start. Workaround for kube_version to stay in download role, but not download an files by creating a new "nothing" download entry.
2016-07-08 17:59:21 +08:00
- --token-auth-file={{ kube_token_dir }}/known_tokens.csv
Granular authentication Control It is now possible to deactivate selected authentication methods (basic auth, token auth) inside the cluster by adding removing the required arguments to the Kube API Server and generating the secrets accordingly. The x509 authentification is currently not optional because disabling it would affect the kubectl clients deployed on the master nodes.
2017-02-27 21:15:50 +08:00
{% endif %}
Use only one certificate for all apiservers https://github.com/kubernetes/kubernetes/issues/25063
2017-01-13 19:03:20 +08:00
- --service-account-key-file={{ kube_cert_dir }}/apiserver-key.pem
Added Support for OpenID Connect Authentication To use OpenID Connect Authentication beside deploying an OpenID Connect Identity Provider it is necesarry to pass additional arguments to the Kube API Server. These required arguments were added to the kube apiserver manifest.
2017-02-27 20:24:21 +08:00
{% if kube_oidc_auth|default(false) and kube_oidc_url is defined and kube_oidc_client_id is defined %}
- --oidc-issuer-url={{ kube_oidc_url }}
- --oidc-client-id={{ kube_oidc_client_id }}
replace non-breakable space with regular space Non-brekable space is 0xc2 0xa0 byte sequence in UTF-8. To find one: $ git grep -I -P '\xc2\xa0' To replace with regular space: $ git grep -l -I -P '\xc2\xa0' | xargs sed -i 's/\xc2\xa0/ /g' This commit doesn't include changes that will overlap with commit f1c59a91a1.
2017-03-23 05:25:01 +08:00
{% if kube_oidc_ca_file is defined %}
Added Support for OpenID Connect Authentication To use OpenID Connect Authentication beside deploying an OpenID Connect Identity Provider it is necesarry to pass additional arguments to the Kube API Server. These required arguments were added to the kube apiserver manifest.
2017-02-27 20:24:21 +08:00
- --oidc-ca-file={{ kube_oidc_ca_file }}
{% endif %}
replace non-breakable space with regular space Non-brekable space is 0xc2 0xa0 byte sequence in UTF-8. To find one: $ git grep -I -P '\xc2\xa0' To replace with regular space: $ git grep -l -I -P '\xc2\xa0' | xargs sed -i 's/\xc2\xa0/ /g' This commit doesn't include changes that will overlap with commit f1c59a91a1.
2017-03-23 05:25:01 +08:00
{% if kube_oidc_username_claim is defined %}
Added Support for OpenID Connect Authentication To use OpenID Connect Authentication beside deploying an OpenID Connect Identity Provider it is necesarry to pass additional arguments to the Kube API Server. These required arguments were added to the kube apiserver manifest.
2017-02-27 20:24:21 +08:00
- --oidc-username-claim={{ kube_oidc_username_claim }}
{% endif %}
replace non-breakable space with regular space Non-brekable space is 0xc2 0xa0 byte sequence in UTF-8. To find one: $ git grep -I -P '\xc2\xa0' To replace with regular space: $ git grep -l -I -P '\xc2\xa0' | xargs sed -i 's/\xc2\xa0/ /g' This commit doesn't include changes that will overlap with commit f1c59a91a1.
2017-03-23 05:25:01 +08:00
{% if kube_oidc_groups_claim is defined %}
Added Support for OpenID Connect Authentication To use OpenID Connect Authentication beside deploying an OpenID Connect Identity Provider it is necesarry to pass additional arguments to the Kube API Server. These required arguments were added to the kube apiserver manifest.
2017-02-27 20:24:21 +08:00
- --oidc-groups-claim={{ kube_oidc_groups_claim }}
{% endif %}
{% endif %}
running kubernetes master processes as pods
2015-12-11 18:52:20 +08:00
- --secure-port={{ kube_apiserver_port }}
Use kube_apiserver_port
2015-12-15 23:27:12 +08:00
- --insecure-port={{ kube_apiserver_insecure_port }}
Allow to specify etcd backend for kube-api Kubernetes project is about to set etcdv3 as default storage engine in 1.6. This patch allows to specify particular backend for kube-apiserver. User may force the option to etcdv3 for new environment. At the same time if the environment uses v2 it will continue uses it until user decides to upgrade to v3. Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>
2017-02-21 22:44:36 +08:00
- --storage-backend={{ kube_apiserver_storage_backend }}
optionnal api runtime extensions
2015-12-13 01:24:21 +08:00
{% if kube_api_runtime_config is defined %}
{% for conf in kube_api_runtime_config %}
- --runtime-config={{ conf }}
{% endfor %}
Add possibility to enable network policy via Calico network controller The requirements for network policy feature are described here [1]. In order to enable it, appropriate configuration must be provided to the CNI plug in and Calico policy controller must be set up. Beside that corresponding extensions needed to be enabled in k8s API. Now to turn on the feature user can define `enable_network_policy` customization variable for Ansible. [1] http://kubernetes.io/docs/user-guide/networkpolicies/
2016-10-10 22:09:50 +08:00
{% endif %}
Move calico-policy-controller into separate role By default Calico CNI does not create any network access policies or profiles if 'policy' is enabled in CNI config. And without any policies/profiles network access to/from PODs is blocked. K8s related policies are created by calico-policy-controller in such case. So we need to start it as soon as possible, before any real workloads. This patch also fixes kube-api port in calico-policy-controller yaml template. Closes #1132
2017-03-13 23:04:31 +08:00
{% if enable_network_policy %}
Add possibility to enable network policy via Calico network controller The requirements for network policy feature are described here [1]. In order to enable it, appropriate configuration must be provided to the CNI plug in and Calico policy controller must be set up. Beside that corresponding extensions needed to be enabled in k8s API. Now to turn on the feature user can define `enable_network_policy` customization variable for Ansible. [1] http://kubernetes.io/docs/user-guide/networkpolicies/
2016-10-10 22:09:50 +08:00
- --runtime-config=extensions/v1beta1/networkpolicies=true
optionnal api runtime extensions
2015-12-13 01:24:21 +08:00
{% endif %}
Tune dnsmasq/kubedns limits, replicas, logging * Add dns_replicas, dns_memory/cpu_limit/requests vars for dns related apps. * When kube_log_level=4, log dnsmasq queries as well. * Add log level control for skydns (part of kubedns app). * Add limits/requests vars for dnsmasq (part of kubedns app) and dnsmasq daemon set. * Drop string defaults for kube_log_level as it is int and is defined in the global vars as well. * Add docs Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-11-25 18:33:39 +08:00
- --v={{ kube_log_level }}
running kubernetes master processes as pods
2015-12-11 18:52:20 +08:00
- --allow-privileged=true
Initial support for vsphere as cloud provider
2016-11-07 19:11:16 +08:00
{% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere"] %}
Deploy kubelet and kube-apiserver as containers kubelet via docker kube-apiserver as a static pod Fixed etcd service start to be more tolerant of slow start. Workaround for kube_version to stay in download role, but not download an files by creating a new "nothing" download entry.
2016-07-08 17:59:21 +08:00
- --cloud-provider={{ cloud_provider }}
- --cloud-config={{ kube_config_dir }}/cloud_config
updated to no longer handle gce as cloud-provider. provided aws setup doc
2016-08-24 21:48:32 +08:00
{% elif cloud_provider is defined and cloud_provider == "aws" %}
pass cloud provider flag in all cases, not just openstack
2016-08-24 00:42:22 +08:00
- --cloud-provider={{ cloud_provider }}
Pass --anonymous-auth to apiserver Fixes #732
2016-12-14 00:06:53 +08:00
{% endif %}
{% if kube_api_anonymous_auth is defined and kube_version | version_compare('v1.5', '>=') %}
- --anonymous-auth={{ kube_api_anonymous_auth }}
Deploy kubelet and kube-apiserver as containers kubelet via docker kube-apiserver as a static pod Fixed etcd service start to be more tolerant of slow start. Workaround for kube_version to stay in download role, but not download an files by creating a new "nothing" download entry.
2016-07-08 17:59:21 +08:00
{% endif %}
Add missing liveness probe for apiserver static pod Fix unreliable waiting for the apiserver to become ready. Remove logfile mount to align with the rest of static pods and because containers shall write logs to stdout only. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-11-21 20:11:47 +08:00
livenessProbe:
httpGet:
host: 127.0.0.1
path: /healthz
port: 8080
initialDelaySeconds: 30
timeoutSeconds: 10
running kubernetes master processes as pods
2015-12-11 18:52:20 +08:00
volumeMounts:
- mountPath: {{ kube_config_dir }}
name: kubernetes-config
readOnly: true
- mountPath: /etc/ssl/certs
name: ssl-certs-host
readOnly: true
Add etcd TLS support
2016-11-09 18:44:41 +08:00
- mountPath: {{ etcd_cert_dir }}
name: etcd-certs
readOnly: true
running kubernetes master processes as pods
2015-12-11 18:52:20 +08:00
volumes:
- hostPath:
path: {{ kube_config_dir }}
name: kubernetes-config
- hostPath:
Changed path to hosts ssl certs from /usr/share/ca-certificates to /etc/ssl/certs/ which fixes https problems in kube-controller-manager and kube-apiserver (#189) caused by the lack of certificates on debian and redhat based systems.
2016-04-01 15:34:28 +08:00
path: /etc/ssl/certs/
running kubernetes master processes as pods
2015-12-11 18:52:20 +08:00
name: ssl-certs-host
Add etcd TLS support
2016-11-09 18:44:41 +08:00
- hostPath:
path: {{ etcd_cert_dir }}
name: etcd-certs