5603f9f374
Update security contacts file ( #9235 )
2022-08-30 22:43:00 -07:00
7ebb8c3f2e
make calico installation more stable ( #9227 )
...
Signed-off-by: hang.jiang <hang.jiang@daocloud.io>
Signed-off-by: hang.jiang <hang.jiang@daocloud.io>
2022-08-30 21:13:01 -07:00
acb6f243fd
feat: add kubelet systemd service hardening option ( #9194 )
...
* feat: add kubelet systemd service hardening option
* refactor: move variable name to kubelet_secure_addresses
Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
* docs: add diagram about kubelet_secure_addresses variable
Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
2022-08-30 11:18:55 -07:00
220f149299
Fix abort because calicoctl.sh is not a full path ( #9217 )
2022-08-30 08:07:02 -07:00
1baabb3c05
Fix cloud_init files for different distros ( #9232 )
2022-08-30 08:03:02 -07:00
617b17ad46
Fix kube_ovn_hw_offload value ( #9218 )
2022-08-30 03:21:01 -07:00
8af86e4c1e
Fix typo.
2022-08-30 11:30:57 +02:00
9dc9a670a5
add runc v1.1.4 ( #9230 )
2022-08-30 02:01:01 -07:00
b46ddf35fc
kube-vip shoud fail if kube_proxy_strict_arp is false in arp mod ( #9223 )
...
* fix-kube-vip-strict-arp
* fix-kube-vip-strict-arp
2022-08-30 00:21:02 -07:00
de762400ad
Fixes for calico_datastore: etcd ( #9228 )
...
It seems that PR #8839 broke `calico_datastore: etcd` when it removed ipamconfig support for etcd mode.
This PR fixes some failing tasks when `calico_datastore == etcd`, but it does not restore ipamconfig support for calico in etcd mode. If someone wants to restore ipamconfig support for `calico_datastore: etcd` please submit a follow up PR for that.
2022-08-29 22:41:00 -07:00
e60ece2b5e
[CI] remove opensuse Leap from molecule test blocking CI ( #9229 )
2022-08-29 11:44:49 -07:00
e6976a54e1
add pre-commit hook to facilitate local testing ( #9158 )
...
* add pre-commit hook configuration
* add tmp.md to .gitignore
* describe the use of pre-commit hook in CONTRIBUTING.md
* fix docs/integration.md errors identified by markdownlint
* fix docs/<file>.md errors identified by markdownlint
* docs/azure-csi.md
* docs/azure.md
* docs/bootstrap-os.md
* docs/calico.md
* docs/debian.md
* docs/fcos.md
* docs/vagrant.md
* docs/gcp-lb.md
* docs/kubernetes-apps/registry.md
* docs/setting-up-your-first-cluster.md
* docs/vagrant.md
* docs/vars.md
* fix contrib/<file>.md errors identified by markdownlint
2022-08-24 06:54:03 -07:00
64daaf1887
cri-dockerd: add restart of docker.service ( #9205 )
...
* cri-dockerd: add restart of docker.service
* remove enabling of cri-dockerd.socket
2022-08-24 05:50:02 -07:00
1c75ec9ec1
do not run etcd role in scale.yml playbook when etcd installed by kubeadm ( #9210 )
2022-08-24 00:16:24 -07:00
c8a61ec98c
optimize the format of evictionHard in kubelet-config.yaml template ( #9204 )
2022-08-23 01:55:24 -07:00
aeeae76750
Update vars.md ( #9172 )
2022-08-22 23:31:24 -07:00
30b062fd43
fix one bug in docs/nodes ( #9203 )
2022-08-22 23:17:23 -07:00
8f899a1101
Fix containerd (<1.7) configuration for insecure registries ( #9207 )
...
For the following configuration
```
containerd_insecure_registries:
docker.io:
- dockerhubcache.example.com
```
the rendered /etc/containerd/config.toml contains
```
[plugins."io.containerd.grpc.v1.cri".registry.configs."docker.io".tls]
insecure_skip_verify = true
```
but it needs to be
```
[plugins."io.containerd.grpc.v1.cri".registry.configs."dockerhubcache.example.com".tls]
insecure_skip_verify = true
```
2022-08-22 23:13:23 -07:00
386c739d5b
🌱 Enable cri-dockerd service ( #9201 )
...
* 🌱 Enable cri-dockerd service
* 🔨 Fix the task name in order to pass the CI tests
2022-08-22 07:17:43 -07:00
fddff783c8
Update vsphere-csi.md ( #9170 )
2022-08-22 07:13:43 -07:00
bbd1161147
9035: Make Cilium rolling-restart delay/timeout configurable ( #9176 )
...
See #9035
2022-08-22 02:37:44 -07:00
ab938602a9
[kubernetes] Add hashes for 1.24.4, 1.22.13, 1.23.10 and make v1.24.4 default ( #9191 )
2022-08-21 23:11:44 -07:00
e31890806c
Add 'avoid-buggy-ips' support of MetalLB ( #9166 )
2022-08-18 21:49:51 -07:00
30c77ea4c1
Add the option to enable default Pod Security Configuration ( #9017 )
...
* Add the option to enable default Pod Security Configuration
Enable Pod Security in all namespaces by default with the option to
exempt some namespaces. Without the change only namespaces explicitly
configured will receive the admission plugin treatment.
* Fix the PR according to code review comments
* Revert the latest changes
- leave the empty file when kube_pod_security_use_default, but add comment explaining the empty file
- don't attempt magic at conditionally adding PodSecurity to kube_apiserver_admission_plugins_needs_configuration
2022-08-18 01:16:36 -07:00
175cdba9b1
Add 'flush ip6tables' task in reset role ( #9168 )
...
* Add 'flush ip6tables' task in reset role
If enable_dual_stack_networks is set to true and ip6 is defined，ip6tables will be created. But when reset the kubernetes cluster, kubespray doesn't flush ip6tables.
* [CI] fix molecule tests on opensuse by upgrading to 15.4 (#9175 )
* [CI] fix molecule tests on opensuse by upgrading to 15.4
* [opensuse] use correct python crytography package name depending on distribution version
Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
2022-08-18 01:12:37 -07:00
ea29cd0890
add list nodes rules to cilium-operator clusterrole ( #9178 )
2022-08-18 01:02:36 -07:00
68653c31c0
docs(kube-vip): fix broken links ( #9165 )
...
Signed-off-by: Massimiliano Giovagnoli <me@maxgio.it>
Signed-off-by: Massimiliano Giovagnoli <me@maxgio.it>
2022-08-18 00:56:55 -07:00
be5fdab3aa
Disable DNSStubListener for Flatcar Linux ( #9160 )
...
* Disable DNSStubListener for Flatcar Linux
* Fix missing "Flatcar" condition of os_family
2022-08-18 00:56:49 -07:00
f4daf5856e
Subnet setup order fix & Number of master nodes syntax fix ( #9159 )
...
* Subnet setup order fix & Number of master nodes syntax fix
* Mistake fix!
* Formatting
2022-08-18 00:56:43 -07:00
49d869f662
Fix CSI drivers issues on Azure ( #9153 )
...
* Include missing azuredisk rbac manifest
* Remove missing azure csi manifest
* Remove invalid reference mount to waagent settings
* Use cloud-config secret instead of /etc/kubernetes/cloud_config file
2022-08-18 00:56:36 -07:00
b36bb9115a
[calico] calico rr supports multiple groups ( #9134 )
...
* update calico rr
* fix bgppeer conf
* fix yamllint
* fix ansible lint
* fix calico deploy
* fix yamllint
* fix some typo
2022-08-18 00:52:37 -07:00
9ad2d24ad8
Add unsafe_show_logs switch ( #9164 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-08-16 18:52:48 -07:00
0088fe0ab7
add-tar-in-common-package ( #9184 )
2022-08-16 05:17:18 -07:00
ab93b17a7e
[containerd] upgrade to 1.6.8 , add hashes, containerd now supports ppc64le from v1.6.7 ( #9181 )
2022-08-16 05:17:07 -07:00
9f1b980844
Update dashboard to 2.6.1 ( #9185 )
2022-08-16 04:57:08 -07:00
86d05ac180
fix: remove condition for user creation ( #9125 )
...
This condition blocks the creation of the `etcd` user in certain conditions.
Specifically, when you have a `etcd_deployment_type: kubeadm` and `kube_owner: root`.
Being the `root` user already present on the system, this will not be a problem (due to the idempotency of ansible).
2022-08-15 23:55:07 -07:00
bf6fcf6347
Upgrade nerdctl from 0.20.0 to 0.22.2 ( #9180 )
2022-08-15 22:39:07 -07:00
b9e4e27195
[CI] fix molecule tests on opensuse by upgrading to 15.4 ( #9175 )
...
* [CI] fix molecule tests on opensuse by upgrading to 15.4
* [opensuse] use correct python crytography package name depending on distribution version
2022-08-14 19:02:13 -07:00
8585134db4
when ingress-nginx is deployes without a class, we need to use 'ingress-controller-leader' resource instead of the default 'ingress-controller-leader-nginx' ( #9156 )
2022-08-09 04:52:50 -07:00
7e862939db
Add kube-vip check to check_readme_versions.sh ( #9155 )
...
To check the kube-vip version between readme.md and the default value
on the role, this updates check_readme_versions.sh
2022-08-06 08:26:20 -07:00
0d3bd69a17
add-kube-vip-in-readme ( #9149 )
2022-08-05 08:13:47 -07:00
2b97b661d8
Move old etcd backup removal after etcd restart ( #9147 )
2022-08-05 08:09:59 -07:00
24f12b024d
Argument jsonpath must be single-quoted in "See if node is schedulable" task ( #9146 )
2022-08-05 08:09:47 -07:00
f7d363dc96
Fix crio version in README ( #9148 )
2022-08-04 08:53:46 -07:00
47050003a0
Add docker support for Kylin V10 ( #9144 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-08-03 15:03:46 -07:00
4df6e35270
Move oracle7-canal to centos7-canal
2022-08-02 16:55:52 -07:00
307f598bc8
Move flannel to etcd datastore
2022-08-02 16:55:52 -07:00
eb10249a75
Align canal templates with calico official ones (k8s datastore)
2022-08-02 16:55:52 -07:00
b4318e9967
Update to latest local path provisioner version ( #9132 )
2022-08-01 14:56:28 -07:00
c53561c9a0
Update to latest registry version ( #9133 )
2022-08-01 14:52:28 -07:00
Florian Ruynat
蒋航
Alessio Greggi
tasekida
lijin-union
kakkotetsu
Kay Yan
Chad Swenson
Cristian Calin
Krystian Młynek
Sergey
Shelming.Song
Bishal das
Pavel Chekin
Mostafa Ghadimi
Tristan
Mohamed Zaian
Ho Kim
Tomas Zvala
GreatLazyMan
Thearas
maxgio92
Robin Ramquist
Piotr Kowalczyk
Samuel Liu
ERIK
Jin Li
Peter Pan
Kenichi Omichi
emiran-orange
Marco Fortina