revert calico-related changes

pull/1382/head
jwfang 2017-07-10 16:53:11 +08:00
parent cea3e224aa
commit 0b3badf3d8
9 changed files with 1 additions and 110 deletions

View File

@ -3,31 +3,6 @@
when: kube_network_plugin == 'canal' when: kube_network_plugin == 'canal'
tags: [facts, canal] tags: [facts, canal]
- name: Lay Down calico-policy-controller RBAC Template
template:
src: "{{item.file}}"
dest: "{{kube_config_dir}}/{{item.file}}"
with_items:
- {name: calico-policy-controller, file: calico-policy-controller-sa.yml, type: sa}
- {name: calico-policy-controller, file: calico-policy-controller-clusterrole.yml, type: clusterrole}
- {name: calico-policy-controller, file: calico-policy-controller-clusterrolebinding.yml, type: clusterrolebinding}
register: manifests
when: inventory_hostname == groups['kube-master'][0] and rbac_enabled
tags: canal
- name: Create calico-policy-controller RBAC Resources
kube:
name: "{{item.item.name}}"
namespace: "{{ system_namespace }}"
kubectl: "{{bin_dir}}/kubectl"
resource: "{{item.item.type}}"
filename: "{{kube_config_dir}}/{{item.item.file}}"
state: "{{item.changed | ternary('latest','present') }}"
with_items: "{{ manifests.results }}"
failed_when: manifests|failed and "Error from server (AlreadyExists)" not in manifests.msg
when: inventory_hostname == groups['kube-master'][0] and rbac_enabled
tags: canal
- name: Write calico-policy-controller yaml - name: Write calico-policy-controller yaml
template: template:
src: calico-policy-controller.yml.j2 src: calico-policy-controller.yml.j2

View File

@ -1,16 +0,0 @@
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: calico-policy-controller
namespace: {{ system_namespace }}
rules:
- apiGroups:
- ""
- extensions
resources:
- pods
- namespaces
- networkpolicies
verbs:
- watch
- list

View File

@ -1,12 +0,0 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: calico-policy-controller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: calico-policy-controller
subjects:
- kind: ServiceAccount
name: calico-policy-controller
namespace: {{ system_namespace }}

View File

@ -1,7 +0,0 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: calico-policy-controller
namespace: {{ system_namespace }}
labels:
kubernetes.io/cluster-service: "true"

View File

@ -60,6 +60,3 @@ spec:
- hostPath: - hostPath:
path: {{ calico_cert_dir }} path: {{ calico_cert_dir }}
name: etcd-certs name: etcd-certs
{% if rbac_enabled %}
serviceAccountName: calico-policy-controller
{% endif %}

View File

@ -118,5 +118,5 @@ enable_network_policy: false
## List of authorization modes that must be configured for ## List of authorization modes that must be configured for
## the k8s cluster. Only 'AlwaysAllow','AlwaysDeny', and ## the k8s cluster. Only 'AlwaysAllow','AlwaysDeny', and
## 'RBAC' modes are tested. ## 'RBAC' modes are tested.
authorization_modes: [] authorization_modes: ['AlwaysAllow']
rbac_enabled: "{{ 'RBAC' in authorization_modes }}" rbac_enabled: "{{ 'RBAC' in authorization_modes }}"

View File

@ -195,28 +195,6 @@
when: secret_changed|default(false) or etcd_secret_changed|default(false) when: secret_changed|default(false) or etcd_secret_changed|default(false)
notify: restart calico-node notify: restart calico-node
- name: Calico | Lay Down calico-node RBAC Template
template:
src: "{{item.file}}"
dest: "{{kube_config_dir}}/{{item.file}}"
with_items:
- {name: calico-node, file: calico-node-clusterrole.yml, type: clusterrole}
- {name: calico-node, file: calico-node-clusterrolebinding.yml, type: clusterrolebinding}
register: manifests
when: inventory_hostname == groups['kube-master'][0] and rbac_enabled
- name: Calico | Create calico-node RBAC Resources
kube:
name: "{{item.item.name}}"
namespace: "{{ system_namespace }}"
kubectl: "{{bin_dir}}/kubectl"
resource: "{{item.item.type}}"
filename: "{{kube_config_dir}}/{{item.item.file}}"
state: "{{item.changed | ternary('latest','present') }}"
with_items: "{{ manifests.results }}"
failed_when: manifests|failed and "Error from server (AlreadyExists)" not in manifests.msg
when: inventory_hostname == groups['kube-master'][0] and rbac_enabled
- meta: flush_handlers - meta: flush_handlers
- name: Calico | Enable calico-node - name: Calico | Enable calico-node

View File

@ -1,12 +0,0 @@
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: calico-node
namespace: {{ system_namespace }}
rules:
- apiGroups: [""]
resources:
- pods
- nodes
verbs:
- get

View File

@ -1,12 +0,0 @@
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: calico-node
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: calico-node
subjects:
- kind: Group
name: system:nodes
namespace: kube-system