ab4356aa69
Calico: bump default version to 3.20.2 ( #8058 )
2021-10-07 12:59:33 -07:00
5fcf047191
local-volume-provisioner quay.io -> k8s.gcr.io ( #8054 )
2021-10-06 17:08:41 -07:00
e707f78899
After upgrade, allow cilium to be back before uncordoning ( #7978 )
...
* After upgrade, allow cilium to be back before uncordoning
* add eol
* use kube_config_dir variable
resolves https://github.com/kubernetes-sigs/kubespray/pull/7978#discussion_r721685549
2021-10-05 12:56:58 -07:00
41e0ca3f85
Move kube_feature_gates to kubelet config ( #8048 )
...
to remove deprecation warning:
> Flag --feature-gates has been deprecated, This parameter should be set via the config file specified by the Kubelet's --config flag.
2021-10-05 06:07:10 -07:00
43958614e3
Fix kubespray flatcar ansible_os_family and ansible_distribution ( #8029 )
...
Closes https://github.com/kubernetes-sigs/kubespray/issues/8028
Signed-off-by: Iago Santos <iago.santos.pardo@adfinis.com>
2021-10-01 09:11:23 -07:00
af04906b51
Ensure apparmor is installed ( #8036 )
...
Kubespray deployment failed when using containerd backend on nodes that apparmor was not installed or previously removed. This PR ensure apparmor is installed by adding it into required_pkgs var.
2021-09-29 23:52:08 -07:00
c7e17688b9
gVisor: bump release to 20210921 version ( #8015 )
...
* gVisor: bump release to 20210921 version
* gVisor: drop support for 20210518.0 version
2021-09-29 11:35:20 -07:00
f5885d05ea
In CentOS 8.x Docker install Step: remove podman when existing ( #8016 )
2021-09-29 06:32:48 -07:00
eee2eb11d8
Update weave template to match source for 2.8.1 ( #8013 )
2021-09-28 09:16:43 -07:00
8d3961edbe
Add metrics_server_resizer option ( #8018 )
...
The addon-resizer container can reduce resource limits of cpu and
memory of metrics-server container in the pod, and that caused
OOMKilled.
In addition, the original metrics-server manifest doesn't contain
the addon-resizer container as [1].
So this adds metrics_server_resizer option to control the addon-resizer
container deployment and the default value is false to make it stable
for most environments.
[1]: 527679e5e8/manifests/base/deployment.yaml
2021-09-28 00:02:42 -07:00
4c5328fd1f
Determine root filesistem device and partition before running growpart ( #8024 )
2021-09-27 23:58:42 -07:00
1472528f6d
check if 'plugins' key exists in calico_cni_config object ( #7717 )
...
* check if 'plugins' key exists in calico_cni_config object
* fix whitespace linting error
* fixed when list indentation
2021-09-27 11:04:20 -07:00
9416c9aa86
Enable stable and edge Docker CLI versions ( #8019 )
2021-09-27 10:44:19 -07:00
da92c7e215
Add proxy for subscription-manager ( #8012 )
...
If using proxy, it is necessary to configure it before running
"subscription-manager status" command.
This adds the step.
2021-09-27 08:47:35 -07:00
d27cf375af
Remove allowPrivilegeEscalation from metrics-server ( #8014 )
...
"allowPrivilegeEscalation: false" blocks deploying metrics-server
on CentOS7. In addition, the original metrics-server manifest doesn't
contain it as [1]. This removes it.
[1]: 527679e5e8/manifests/base/deployment.yaml
2021-09-27 08:43:36 -07:00
432a312a35
Enable stable and edge containerd versions ( #8020 )
2021-09-27 08:11:35 -07:00
3a6230af6b
Kata-Containers: update versions 2.2.0 (default) and 2.1.1 ( #8017 )
...
* Kata-Containers: add 2.2.0 hashes and make default
* Kata-Containers: replace 2.1.0 with bugfix version 2.1.1
* Kata-Containers: move to q35 a more modern VM architecture as 'pc' is removed in 2.2.0
2021-09-27 08:07:35 -07:00
ecd267854b
Move ovn4nvf crd from v1beta1 to v1 ( #8006 )
2021-09-27 01:18:22 -07:00
ac846667b7
Check if openstack application credentials are empty since they always exists ( #8021 )
2021-09-27 01:14:22 -07:00
4bace2491d
Ensure apparmor is installed ( #8011 )
...
Kubespray deployment failed when using containerd backend on nodes that apparmor was not installed or previously removed. This PR ensure apparmor is installed by adding it into required_pkgs var.
2021-09-24 07:55:23 -07:00
22017b7ff0
kube-router 1.3.0 -> 1.3.1 ( #8007 )
2021-09-23 13:42:55 -07:00
88c11b5946
Revert "etcd: enable v2 api only if needed ( #8001 )" ( #8008 )
...
This reverts commit c0e1211abe
2021-09-23 10:43:14 -07:00
843252c968
Use kube_config_dir for kubeconfig ( #7996 )
...
The path of kubeconfig should be configurable, and its default value
is /etc/kubernetes/admin.conf. Most paths of the file are configurable
but some were not. This make those configurable.
2021-09-23 10:19:13 -07:00
ddea79f0f0
Issue 8004: Fix typha prometheus ( #8005 )
...
The typha prometheus settings were in the `volumeMounts` section of the
spec and not in the `envs` section. This was cauing the deployment to
fail because it was looking for a volumeMount.
```
failed: [controller-001.a2.da.dev.logdna.net] (item=calico-typha.yml) => {"ansible_loop_var": "item", "changed": false, "item": {"ansible_loop_var": "item", "changed": true, "checksum": "598ac79530749e8e2110793b53fc49ac208e7130", "dest": "/etc/kubernetes/calico-typha.yml", "diff": [], "failed": false, "gid": 0, "group": "root", "invocation": {"module_args": {"_original_basename": "calico-typha.yml.j2", "attributes": null, "backup": false, "checksum": "598ac79530749e8e2110793b53fc49ac208e7130", "content": null, "delimiter": null, "dest": "/etc/kubernetes/calico-typha.yml", "directory_mode": null, "follow": false, "force": true, "group": null, "local_follow": null, "mode": null, "owner": null, "regexp": null, "remote_src": null, "selevel": null, "serole": null, "setype": null, "seuser": null, "src": "/home/core/.ansible/tmp/ansible-tmp-1632349768.56-75434-32452975679246/source", "unsafe_writes": null, "validate": null}}, "item": {"file": "calico-typha.yml", "name": "calico", "type": "typha"}, "md5sum": "53c00ac7f562cf9ecbbfd27899ea066d", "mode": "0644", "owner": "root", "size": 5378, "src": "/home/core/.ansible/tmp/ansible-tmp-1632349768.56-75434-32452975679246/source", "state": "file", "uid": 0}, "msg": "error running kubectl (/opt/bin/kubectl --namespace=kube-system apply --force --filename=/etc/kubernetes/calico-typha.yml) command (rc=1), out='service/calico-typha unchanged\n', err='error: error validating \"/etc/kubernetes/calico-typha.yml\": error validating data: [ValidationError(Deployment.spec.template.spec.containers[0].volumeMounts[2]): unknown field \"value\" in io.k8s.api.core.v1.VolumeMount, ValidationError(Deployment.spec.template.spec.containers[0].volumeMounts[2]): missing required field \"mountPath\" in io.k8s.api.core.v1.VolumeMount, ValidationError(Deployment.spec.template.spec.containers[0].volumeMounts[3]): unknown field \"value\" in io.k8s.api.core.v1.VolumeMount, ValidationError(Deployment.spec.template.spec.containers[0].volumeMounts[3]): missing required field \"mountPath\" in io.k8s.api.core.v1.VolumeMount]; if you choose to ignore these errors, turn validation off with --validate=false\n'"}
```
2021-09-23 08:37:22 -07:00
c0e1211abe
etcd: enable v2 api only if needed ( #8001 )
...
* etcd: enable v2 api only if needed
Only enable v2 API if we have a consumer (flannel)
This reduce the exposed surface for etcd.
* Fix bad group name
2021-09-22 12:36:32 -07:00
c8d7f000c9
Remove k8s hooks for versions prior to 1.20 ( #7998 )
2021-09-22 10:32:01 -07:00
598f178054
Fix cilium operator metrics activation ( #8000 )
2021-09-22 10:00:02 -07:00
5d1b34bdcd
Move min k8s version to 1.20
2021-09-22 09:50:01 -07:00
8efde799e1
Update kubernetes version to 1.22.2
2021-09-22 09:50:01 -07:00
a517a8db01
Drop chech for kubelet_shutdown_grace_period ( #7993 )
...
and kubelet_shutdown_grace_period_critical_pods as ansible cannot do
sane time interval calculations
2021-09-21 18:34:00 -07:00
2211504790
Fix k8s-certs-renew cp path ( #7992 )
...
Signed-off-by: Wang Zhen <lazybetrayer@gmail.com>
2021-09-21 00:36:22 -07:00
fb8662ec19
Calico: update versions 3.20.1, 3.19.3 ( #7984 )
...
* make Calico 3.20.1 the default version
* drop Calico 3.17.x support
2021-09-20 17:40:23 -07:00
6f7911264f
Calico: make calico_min_version check relevant ( #7939 )
...
* Calico: make calico_min_version check relevant
* Calico: only check currently installed version against the oldest supported version by the previous release
2021-09-20 07:58:09 -07:00
ae44aff330
Calico: increase calico node probe timeouts and allow tunning ( #7981 )
2021-09-17 16:08:07 -07:00
b83e8b020a
Fix default version ( #7977 )
2021-09-17 07:31:00 -07:00
30cd91dc6b
Add option to kubeadm upgrade command to control certificates renewal during control plane upgrade ( #7976 )
...
* Add option to kubeadm upgrade command to control certificates renewal during control plane upgrade
* Remove training whitespace
2021-09-17 04:31:00 -07:00
f2fa9c3b31
Update hashes with new versions
2021-09-17 00:39:02 -07:00
30a7dfa4f8
Fix ubuntu16/centos8 CI jobs ( #7972 )
2021-09-16 23:39:01 -07:00
62ab477838
remove kube_proxy_conntrack_max var ( #7971 )
2021-09-15 08:22:31 -07:00
f8a57f7598
Fix iptables missing on Debian 11 if APT::Install-Recommends=0 ( #7964 )
...
On Debian 11, `ipset` just recommend `iptables` so on the system that apt is configured with `APT::Install-Recommends "0";` iptables will not install automatically.
2021-09-14 08:19:09 -07:00
35c928798d
Fix missing file mode (risky-file-permissions) ( #7959 )
...
* Fix missing file mode (risky-file-permissions)
Found this using ansible-lint.
Signed-off-by: Bryan Hundven <bryanhundven@gmail.com>
* Fix another missing file mode (risky-file-permissions)
This one fixes `/etc/crio/config.json`
Signed-off-by: Bryan Hundven <bryanhundven@gmail.com>
2021-09-09 23:35:59 -07:00
83f64a7ff9
Bugfix/cinder csi cloud config template ( #7955 )
...
* Fix invalid condition for username and password inclusion
* Use length filter to test variable conditions
2021-09-09 10:04:11 -07:00
60853fa682
Update kube-ovn to 1.7.2
2021-09-09 08:14:10 -07:00
b66356be65
Update cilium to 1.9.10
2021-09-09 08:14:10 -07:00
efae2dbad6
Update snapshot-controller repository and image versions ( #7957 )
2021-09-09 08:10:11 -07:00
bd8b8916a8
Remove invalid spec - deployment.spec.serviceName ( #7949 )
2021-09-08 13:05:56 -07:00
57063b6828
Replace incorrect {% end %} tags with {% endif %} in csi_crd templates ( #7947 )
2021-09-08 12:59:57 -07:00
69b67a293a
Calico: Add kube_service_addresses_ipv6 to serviceClusterIPs ( #7889 ) ( #7944 )
...
Add IPv6 Service Addresses to BGP advertisement when
calico_advertise_cluster_ips is true.
2021-09-08 00:37:20 -07:00
d57ddf0be8
Feature DynamicKubeletConfig is deprecated in 1.22 and will not move to GA ( #7938 )
...
* Feature DynamicKubeletConfig is deprecated in 1.22 and will not move to GA
* Add check for dynamic_kubelet_configuration with kube >= 1.22
2021-09-07 10:47:16 -07:00
43e7e2d663
nginx-ingress: bump to 1.0.0 to support kube 1.22 ( #7942 )
2021-09-06 04:50:36 -07:00
d355b43dce
ContainerD: bump containerd version to 1.4.9 ( #7940 )
2021-09-06 04:50:29 -07:00
5d52025266
crictl: add hashes for 1.22 ( #7936 )
2021-09-06 04:46:29 -07:00
db470f8529
Update CSI snaphotter and make it independent ( #7943 )
...
* CSI: update CSI snapshot CRDs
* CSI: update snapshot controller tag version with kubernetes specific versions
* CSI: allow enabling csi_snapshot_controller independent of Cinder CSI
* CSI: Align csi-snapshot-controller with upstream and use a Deployment instead of a StatefulSet
2021-09-06 04:24:29 -07:00
81bf4f9304
cri-o registry auth support ( #7837 )
...
* cri-o registry auth support
* yaml lint for comments
* crio_registry_auth from registry_auth
* crio_registry_auth as defaults
2021-09-01 10:20:59 -07:00
e1967b0700
MetalLB: keep nodeSelector in one place ( #7931 )
...
Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>
2021-09-01 09:05:00 -07:00
507091ec8b
Replace cluster_name by dns_domain ( #7923 )
...
`cluster_name` defaults to `dns_domain` value (see [here][1] and [here][2])
but they could have different values.
`dns_domain` should be used here instead of `cluster_name` because the DNS
resolution is configured to use `dns_domain`.
[1]: 0ef7af76bc/roles/kubespray-defaults/defaults/main.yaml (L104)1afdb05ea9/inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml (L196)
2021-09-01 08:18:59 -07:00
48ceca4919
MetalLB: update to v0.10.2 ( #7925 )
...
Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>
2021-09-01 03:00:59 -07:00
426ad81db0
Calico: replace hashes for latest 3.17 and 3.18 to the .5 minor versions ( #7924 )
2021-08-31 13:38:21 -07:00
497d2ca306
Fix Calico's FelixConfiguration when "IP in IP" is disabled ( #7926 )
...
When using Calico with:
- `calico_network_backend: vxlan`,
- `calico_ipip_mode: "Never"`,
- `calico_vxlan_mode: "Always"`,
the `FelixConfiguration` object has `ipipEnabled: true`, when it should be false:
This is caused by an error in the `| bool` conversion in the install task:
when `calico_ipip_mode` is `Never`,
`{{ calico_ipip_mode != 'Never' | bool }}` evaluates to `true`:
2021-08-31 13:14:21 -07:00
9d3888a756
During pre-upgrade add a flag to always cordon ( #7892 )
...
* During pre-upgrade add a flag to always cordon
* empty
* empty
* empty
* Better default val
2021-08-30 10:56:09 -07:00
c8e090c17f
Add preliminary Debian 11 (bullseye) support ( #7853 )
...
- Use python3-apt instead because python-apt was removed in Debian 11
- Add gnupg (fix "container-engine/containerd : ensure containerd repository public key is installed" task failed)
- Remove aufs-tools
Signed-off-by: rtsp <git@rtsp.us>
2021-08-30 09:53:06 -07:00
1ccf32e08f
Update docker to 20.10.8 ( #7918 )
2021-08-30 08:25:06 -07:00
17af348be8
Add bunch of Kubernetes versions missing
2021-08-30 08:17:05 -07:00
1afdb05ea9
Fedora and RHEL use etc_t and the convention is <type_name>_t ( #7891 )
...
* Fedora and RHEL use etc_t and the convention is <type_name>_t
* Docs: specify all values for preinstall_selinux_state
* CI: Add Fedora 34 with SELinux in enforcing mode
2021-08-27 14:20:53 -07:00
89993e4833
fix error metrics server capabilities name ( #7905 )
2021-08-25 12:06:15 -07:00
1c3d33e146
Calico: 3.20.0 policy update to allow access to endpointslices ( #7899 )
2021-08-25 12:06:01 -07:00
f66c49bf42
Calico: replace version 3.19.1 with 3.19.2 and set as default ( #7867 )
...
Bump calico version to 3.19.2 due to adding 3.20.0 earlier
2021-08-25 07:32:41 -07:00
4c9d7dedb3
addons/cert_manager: retries until webhook pods has been created ( #7850 )
...
Fix task 'Cert Manager | Wait for Webhook pods become ready' failed due to webhook pods don't exist yet by using `retries..until` trick like kubernetes-sigs/kubespray#7842
This fix should be removed in the future if the kubernetes/kubernetes#83242 is resolved.
Signed-off-by: rtsp <git@rtsp.us>
2021-08-25 07:16:41 -07:00
5336943a8c
add cilium_operator_api_serve_addr to cilium operator config ( #7901 )
2021-08-24 03:49:13 -07:00
a040e521b4
feat(containerd): auth support ( #7868 )
...
* feat(containerd): auth support
* fix(registry-auth): rename variable
2021-08-23 06:40:00 -07:00
0ac364dfae
Calico: use --allow-version-mismatch in calicoctl.sh to allow upgrades ( #7873 )
2021-08-20 14:30:48 -07:00
79166496f3
debian: Fix test failed after bullseye release ( #7888 )
2021-08-19 15:37:24 -07:00
1f09229740
Update cilium to 1.9.9 ( #7871 )
...
Now that 1.10 is out this is to make 1.9.9 the default. I am running
this version successfully.
2021-08-16 13:34:22 -07:00
c06896a352
Update metrics-server to 0.5.0 ( #7864 )
2021-08-12 08:19:48 -07:00
c119620f7c
Calico: add v3.20.0 hashes ( #7855 )
2021-08-11 07:50:46 -07:00
7f309bb092
fix parameters for module replace in 0060-resolvconf ( #7858 )
2021-08-10 17:13:26 -07:00
e2b67b5700
Add suport of Vsphere CSI driver 2.2.X versions ( #7848 )
2021-08-09 08:19:38 -07:00
82a9064d8d
addons/cert_manager: fix kubernetes-sigs#7085 by adding retries..until ( #7842 )
...
Fix task 'Cert Manager | Apply ClusterIssuer manifest' failed due to service/endpoints updating delayed even though the wekhook pod status is ready.
Signed-off-by: rtsp <git@rtsp.us>
2021-08-09 08:19:31 -07:00
a70fab2249
Bump crun to 0.21 version ( #7854 )
2021-08-09 08:11:31 -07:00
31a5a4e808
retry to fetch binary if it fails first time ( #7839 )
2021-07-30 00:17:38 -07:00
5db86f4c2b
Update vSphere CPI ( #7838 )
...
Changes:
* ClusterRole updated according to the latest manifests from
https://github.com/kubernetes/cloud-provider-vsphere
* vSphere CPI/CSI default versions bumped and
tested successfully on K8S 1.21.1
* vSphere documentation updated
Signed-off-by: Vitaliy D <vi7alya@gmail.com>
2021-07-29 18:17:37 -07:00
627a06e30d
CRI-O: Install libseccomp2 from backports on Debian 10 ( #7816 )
...
* CRI-O: Install libseccomp2 from backports on Debian 10
libseccomp2 is a required dependency of cri-o-runc package
The one provided in Debian 10 repositories is outdated
* 7816: Remove useless when condition
As this condition is handled by block
2021-07-23 07:07:16 -07:00
56e230863a
Separate gvisor_download_url for runsc and shim ( #7760 )
...
To download necessary files in advance for offline deployment,
we can see all file URLs with contrib/offline/generate_list.sh
Most URLs are downloadable, but gvisor's one is not because the
URL is a part of full URLs for gvisor.
To download gvisor's files from the URLs directory, this separates
into two URLs for runsc and the shim.
2021-07-22 07:51:51 -07:00
f21a707e99
Add containerd on Flatcar Container Linux ( #7681 )
2021-07-21 06:28:07 -07:00
0ef7af76bc
Fixup label for oracle linux bootstrap
2021-07-20 01:29:31 -07:00
18666b3e2d
Update multus to 3.7.2 (and move to ghcr.io)
2021-07-20 01:29:31 -07:00
ed87386d7b
Set default k8s version to 1.21.3
2021-07-20 01:29:31 -07:00
1ad9b33b08
Add hashes for k8s 1.20.8/.9 and 1.19.12/.13 and 1.21.3
2021-07-20 01:29:31 -07:00
000b4565c2
Fix erroneous ansible args
2021-07-20 01:29:31 -07:00
eda75fc706
Update kube-router to 1.3.0
2021-07-20 01:29:31 -07:00
6583add63a
Update flannel to 0.14.0 (moved from coreos repo to flannel-io)
2021-07-20 01:29:31 -07:00
441ad841cc
Use dashboard 2.3.1 image
2021-07-20 01:29:31 -07:00
6511c5dd7a
Set Helm default version to 3.6.3
2021-07-20 01:29:31 -07:00
d5cbb19b39
Update kube-ovn to 1.7.1
2021-07-20 01:29:31 -07:00
417180246c
Fix: typos in docs and comments ( #7805 )
2021-07-16 18:58:50 -07:00
802fb8b591
Add application credentials support for cinder ( #7799 )
...
* csi-driver: Added possibility to use application credentials for cinder
* external-cloud-controller: Added env vars for openstack application credentials
2021-07-15 00:56:48 -07:00
c2cf0d9945
add containerd on fedora CoreOS ( #7794 )
...
* set selinux type t_etc if selinux state is enforcing
* workaround with update repo is no longer needed
remove comments about failing playbook
* grubby is not available in distros using ostree
* remove docker support because removed in fcos
update install script example with live rootfs
* do not call grubby on ostree based distro
* update docs enabling containerd on fedora coreos
2021-07-15 00:00:48 -07:00
e61a9077f4
Clean up extra spaces about configuration-qemu.toml.j2 ( #7795 )
...
Clean up extra spaces, although these errors are not important, they affect the code specification.
2021-07-13 06:38:34 -07:00
bf54dc082b
set selinux type t_etc if selinux state is enforcing ( #7791 )
2021-07-13 06:34:29 -07:00
3ff7bc1f64
Added k8s 1.21.2 ( #7789 )
2021-07-13 06:26:29 -07:00
Cristian Calin
Maxim Pogozhiy
Rene Luria
Ilya Margolin
Iago Santos
rtsp
Peter Pan
Frank Filippone
Kenichi Omichi
Marcos Lorenzo
David Louks
Victor Morales
Florian Ruynat
Hugo Blom
Eric Lake
Max Gautier
Léopold Jacquot
Wang Zhen
Hari Hud
Samuel Liu
Bryan Hundven
jhchong92
Ole Mathias Aa. Heggem
kranthi guttikonda
Maciej Wereski
Olivier Lemasle
Calvin Park
Sergey
Samuel
Frank Ritchie
Léopold Jacquot
Daniil Muidinov
Eugene Artemenko
rtsp
Smita Srivastava
Vitaliy D
AnatomicJC
cola-zero
Atsushi Nukariya
Fredrik Liv
spaced
jayonlau
cleveritcz