Commit Graph

5037 Commits (0e26f6f3e288e0e251ca070866bc239cc69d8799)

Author SHA1 Message Date
Maxime Leroy ab0163a3ad
fix(kubernetes): taint nodes with kubectl (#10705)
Signed-off-by: Maxime Leroy <19607336+maxime1907@users.noreply.github.com>
2024-01-23 15:46:13 +01:00
Daniel Strufe 2eb588bed9
Update external huawei cloud controller to 0.26.6 (#10824)
* Update huaweicloud controller to 0.26.6

See <https://github.com/kubernetes-sigs/cloud-provider-huaweicloud/compare/v0.26.3...v0.26.6>

* Update huaweicloud sample to use 0.26.6
2024-01-23 09:28:00 +01:00
Louis Tu a88bad7947
Add scheduler plugins support (#10747)
Signed-off-by: tu1h <lihai.tu@daocloud.io>
2024-01-23 07:42:33 +01:00
Max Gautier 89d42a7716
Fix coredns_dual usage (#10821) 2024-01-22 18:36:16 +01:00
yun 13e1f33898
Correct the POLY1305 cipher suites by adding the suffix _SHA256 (#10641) 2024-01-22 18:00:52 +01:00
Alexander de2c4429a4
Enable configuring mountOptions, reclaimPolicy and volumeBindingMode … (#10450)
* Enable configuring mountOptions, reclaimPolicy and volumeBindingMode for cinder-csi StorageClasses

* Check if class.mount_options is defined at all, before generating the option list
2024-01-22 18:00:34 +01:00
Max Gautier 22bb0976d5
Adjust kubelet_event_record_qps to K8S default (#10826)
Also remove redundant check in the kubelet config template (we define a
default, so the setting will always be "true")
2024-01-22 17:49:14 +01:00
my-git9 5a405336ae
Support following k8s version selection pause image (#10756)
Signed-off-by: xin.li <xin.li@daocloud.io>
2024-01-22 17:28:09 +01:00
Yuhao Zhang 0e971a37aa
Offline control plane recover (#10660)
* ignore_unreachable for etcd dir cleanup

ignore_errors ignores errors occur within "file" module. However, when
the target node is offline, the playbook will still fail at this task
with node "unreachable" state. Setting "ignore_unreachable: true" allows
the playbook to bypass offline nodes and move on to proceed recovery
tasks on remaining online nodes.

* Re-arrange control plane recovery runbook steps

* Remove suggestion to manually update IP addresses

The suggestion was added in 48a182844c 4
years ago. But a new task added 2 years ago, in
ee0f1e9d58, automatically update API
server arg with updated etcd node ip addresses. This suggestion is no
longer needed.
2024-01-22 17:22:27 +01:00
Noam 3e7b568d3e
crictl allow setting grace period for stop containers upon reset (#10651)
* crictl allow setting different grace period for stop containers and pods

* correct grace period location
2024-01-22 17:11:08 +01:00
kyrie a45a40a398
update kube-version-min-required to v1.27 (#10817) 2024-01-22 14:26:12 +01:00
Takuya Murakami 4cb1f529d1
[kubernetes] Add hashes for kubernetes 1.29.0 and 1.29.1 (#10778)
* Add hashes of crictl and crio
* Add versions of etcd, crictl, crio and csi-snapshotter
2024-01-22 09:39:15 +01:00
Mohamed Omar Zaian 64447e745e
[kubernetes] Make kubernetes v1.28.6 default (#10810) 2024-01-19 09:07:27 +01:00
Max Gautier b7a83531e7
etcd: update to v3.5.10 (#10798) 2024-01-17 09:50:48 +01:00
Kay Yan a0a2f40295
add containerd config override_path (#10776) 2024-01-16 14:15:53 +01:00
lobiyed.karim 7b7c9f509e
Add PodDisruptionBudget for CoreDNS deployment. Allows users to control disruption behavior and set maximum unavailable pods (#10557) 2024-01-16 10:04:47 +01:00
Louis Tu 3f78bf9298
Fix incorrect ciliumcli binary (#10575)
Signed-off-by: tu1h <lihai.tu@daocloud.io>
2024-01-16 05:23:00 +01:00
Gaëtan Trellu 50fbfa2a9a
Fix PyYAML package name on SLES and openSUSE (#10794) 2024-01-15 04:21:08 +01:00
Gaëtan Trellu 747d8bb4c2
Fix ntp installation on SLES and openSUSE (#10786) 2024-01-12 04:03:35 +01:00
Serge Hartmann bb67d9524d
Fix crio_version version comparison (#10780)
Signed-off-by: serge Hartmann <serge.hartmann@gmail.com>
2024-01-11 11:49:35 +01:00
Kay Yan 8c09c3fda2
fix image pull in insecure-registry (#10775) 2024-01-09 10:20:16 +01:00
Louis Tu a656b7ed9a
Add kube_vip_lb_fwdmethod option for kube-vip (#10762)
Signed-off-by: tu1h <lihai.tu@daocloud.io>
2024-01-09 08:22:13 +01:00
Kay Yan 2e8b72e278
fix disable swap in centos (#10751) 2024-01-08 17:38:14 +01:00
Louis Tu ddf5c6ee12
Update coredns rolling update strategy (#10748)
Signed-off-by: tu1h <lihai.tu@daocloud.io>
2024-01-08 17:38:05 +01:00
Ryan Lonergan eda7ea5695
feat: add support for Cilium 1.14 (#10684)
* update cilium configmap template for new routing mode and tunnel-protocol options
Ryan Lonergan ryan.tlonergan@gmail.com

* add rbac for new cilium crd in 1.14
Ryan Lonergan ryan.tlonergan@gmail.com

* add conditional for cni-install.sh that's no longer included in cilium 1.14
Ryan Lonergan ryan.tlonergan@gmail.com

* Update roles/network_plugin/cilium/templates/cilium/ds.yml.j2

Co-authored-by: Cyclinder <qifeng.guo@daocloud.io>

---------

Co-authored-by: Cyclinder <qifeng.guo@daocloud.io>
2024-01-08 02:43:02 +01:00
刘旭 08c0b34270
[cert-manager] upgrade to v1.13.2 (#10616) 2024-01-05 04:45:10 +01:00
Romain 1a86b4cb6d
Fix download retry when get_url has no status_code. (#10613)
* Fix download retry when get_url has no status_code.

* Fix until clause in download role.
2024-01-04 04:00:47 +01:00
Mohamed Omar Zaian aea150e5dc
[kubernetes] Make kubernetes v1.28.5 default (#10739)
* Add hashes for kubernetes 1.29.0, 1.28.5, 1.27.9, 1.26.12
2023-12-21 17:30:45 +01:00
Andrei Costescu c3b674526d
Fix modprobe module on Flatcar (#10678)
* Fix modprobe module on Flatcar

* Add todo about upstream issue report
2023-12-21 16:16:34 +01:00
Kay Yan 565eab901b
remove containerd registries (#10738) 2023-12-21 10:01:12 +01:00
Max Gautier c3315ac742
systemd-resolved: use a drop-in for kubespray dns (#10732)
This avoid needlessly overriding things and make cleanup easier.
Also simplifies the template a bit.
2023-12-21 09:52:14 +01:00
Olivier Levitt 29ea790c30
Fix calico-node in etcd mode (#10438)
* Calico : add ETCD endpoints to install-cni container

* Calico : remove nodename from configmap in etcd mode
2023-12-19 04:09:06 +01:00
Ugur Can Ozturk ae780e6a9b
[etcd]: add etcd distributed tracing flags (#10666)
* [etcd]: add etcd distributed tracing flags

Signed-off-by: Ugur Ozturk <ugurozturk918@gmail.com>

* [etcd]: add etcd distributed tracing flags - fix

Signed-off-by: Ugur Ozturk <ugurozturk918@gmail.com>

* [etcd]: add etcd distributed tracing flags - fix

Signed-off-by: Ugur Ozturk <ugurozturk918@gmail.com>

---------

Signed-off-by: Ugur Ozturk <ugurozturk918@gmail.com>
2023-12-19 04:00:10 +01:00
Max Gautier 471326f458
Remove PodSecurityPolicy support and references (#10723)
This is removed from kubernetes since 1.25, time to cut some dead code.
2023-12-18 14:13:43 +01:00
Michael Kebe d435edefc4
Removed DEPRECATED --logtostderr from metrics-server (#10709)
The --logtostderr is deprecated.

https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components
2023-12-14 22:49:28 +01:00
刘旭 eb73f1d27d
support disable dns autoscaler when use CoreDNS (#10608) 2023-12-14 10:03:34 +01:00
Mohamed Omar Zaian ccb742c7ab
[containerd] add hashes for versions 1.6.25-26 and 1.7.9-11 make v1.7.11 default (#10671) 2023-12-12 17:53:32 +01:00
jandres - moscardo cb848fa7cb
New PR default node selector (#10607) 2023-12-12 14:51:26 +01:00
Max Gautier 8abf49ae13
Disable podCIDR allocation from control-plane when using calico (#10639)
* Disable control plane allocating podCIDR for nodes when using calico

Calico does not use the .spec.podCIDR field for its IP address
management.
Furthermore, it can false positives from the kube controller manager if
kube_network_node_prefix and calico_pool_blocksize are unaligned, which
is the case with the default shipped by kubespray.

If the subnets obtained from using kube_network_node_prefix are bigger,
this would result at some point in the control plane thinking it does
not have subnets left for a new node, while calico will work without
problems.

Explicitely set a default value of false for calico_ipam_host_local to
facilitate its use in templates.

* Don't default to kube_network_node_prefix for calico_pool_blocksize

They have different semantics: kube_network_node_prefix is intended to
be the size of the subnet for all pods on a node, while there can be
more than on calico block of the specified size (they are allocated on
demand).

Besides, this commit does not actually change anything, because the
current code is buggy: we don't ever default to
kube_network_node_prefix, since the variable is defined in the role
defaults.
2023-12-12 14:38:36 +01:00
Max Gautier 81a3f81aa1
Revert "Update etcd-servers for apiserver (#8253)" (#10652)
This reverts commit ee0f1e9d58.

Avoid restarting all api servers at once by changing their config.
2023-12-12 11:22:38 +01:00
Max Gautier 0fb404c775
etcd: use dynamic group for certs generation check (#10610)
We take advantage of group_by to create the list of nodes needing new
certs, instead of manually looping inside a Jinja template.

This should make the role more readable and less susceptible to
white space problems.
2023-12-12 11:22:29 +01:00
Max Gautier 51069223f5
Decouple kubespray-defaults from download (#10626)
* Decouple role kubespray-defaults from download

Avoids doing re-importing the download role on every invocation of
kubespray-defaults (and skipping everything).

This has a measurable effect on playbook performance.

* Update docs refering to moved download defaults
2023-12-11 16:56:17 +01:00
David Leadbeater 17b51240c9
Remove legacy crio packaging cleanup (#10702)
This has now been removed and results in a 404 when trying to remove the
old key, even if it's not present.
2023-12-11 15:41:13 +01:00
piwinkler eb628efbc4
Update 0040-verify-settings.yml (#10699)
remove embedded template
2023-12-11 10:56:13 +01:00
Max Gautier 2c3ea84e6f
Use systemd for disabling swap when it's used (#10587)
* Mask systemd swap.target do disable swap

This is a more generic way to disable swap, since it pulls .swap units
in systemd distributions; fstab is only one way to generate .swap units.

* Unconditionally disable swap

We only care to disable it (the "swapon" registered variable is not used
anywhere else.
This allows to get rid of the ignore_errors, since this was added
because swapon.stdout does not exist in check_mode (see issue #6642).

* Don't explicitly disable swapOnZram

We're already masking the swap.target, which would pull the zram unit,
hence no need to handle zram-generator specifically.
2023-12-07 13:26:21 +01:00
Max Gautier 85f15900a4
Remove unneeded workaround for removing kubeadm DNS (#10695)
Kubeadm dns phase is correctly skipped.
This was a workaround for kubernetes/kubeadm#1557, which was actually
not a bug ; the correct fix was #4867
2023-12-07 12:54:15 +01:00
Mohamed Omar Zaian a9321aaf86
[calico] Add version 3.26.4 and make it default (#10669) 2023-12-06 03:05:33 +01:00
Kay Yan fe02d21d23
update nerdctl to v1.7.1 (#10685)
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
2023-12-05 19:00:41 +01:00
Kay Yan 5160e7e20b
using ctr pull instead of nerdctl (#10687) 2023-12-05 16:00:55 +01:00
Alexander c440106eff
add dnsPolicy: ClusterFirstWithHostNet to DaemonSets with hostNetwork: true value to avoid DNSConfigFormat events (#10618) 2023-12-05 02:52:17 +01:00