216bf2e867
Merge pull request #2422 from riverzhang/patch-5
...
Enable OOM killing for etcd-events
2018-03-07 23:15:19 -06:00
a086686e9f
Support multiple artifacts under individual inventory directory
2018-03-08 11:57:53 +08:00
6402004018
FIXUP #2424 : local_provisioner directory should be created only if enabled
2018-03-08 11:57:46 +08:00
955f833120
Merge pull request #2430 from huzhengchuan/fix/kube-reserve
...
fix the name of some variable
2018-03-07 21:25:32 -06:00
605738757d
Fix systemd version detection
...
Change "command" to "shell" in order for the pipe to work correctly
2018-03-07 11:32:47 -08:00
3f96b2da7a
Add Custom ConfigMap Support for ingress-nginx
2018-03-07 21:37:45 +08:00
dbf40bbbb8
docker-ce instead of docker-engine repo ( #2423 )
...
* Use docker-ce 17.03.2
* Docker-engine may be discarded
2018-03-07 15:11:20 +03:00
646d473e8e
fix the name of some variable
2018-03-07 18:30:34 +08:00
6975cd1622
Merge pull request #2419 from hswong3i/ingress_nginx_labels
...
Add labels for ingress_nginx_namespace
2018-03-06 08:01:13 +02:00
b7f9bf43c2
Merge pull request #2421 from ctlam/master
...
Adding ssh_private_key_file to ProxyCommand
2018-03-06 07:59:26 +02:00
388b627f72
Enable OOM killing for etcd-events
...
Enable OOM killing like docker run etcd
2018-03-05 20:46:39 -06:00
f9019ab116
Adding ssh_private_key_file to ProxyCommand
...
This is trying to match what the roles/bastion-ssh-config is trying to do. When the setup is going through bastion, we want to ssh private key to be used on the bastion instance.
2018-03-05 13:15:10 -08:00
07657aecf4
add support for azure vnetResourceGroup
2018-03-05 13:40:25 -06:00
e65904eee3
Add labels for ingress_nginx_namespace, also only setup serviceAccountName if rbac_enabled
2018-03-05 23:11:18 +08:00
89847d5684
Explicitly defines the --kubelet-preferred-address-types parameter
...
to the API server configuration.
This solves the problem where if you have non-resolvable node names,
and try to scale the server by adding new nodes, kubectl commands
start to fail for newly added nodes, giving a TCP timeout error when
trying to resolve the node hostname against a public DNS.
2018-03-05 15:25:14 +01:00
585303ad66
Start with three dashes for consistency
2018-03-03 10:05:05 +04:00
a800ed094b
Added support for webhook authentication/authorization on the secure kubelet endpoint
2018-03-03 10:00:09 +04:00
fd46442188
Integrate kubernetes/ingress-nginx 0.11.0 to Kubespray
2018-03-02 23:33:19 +08:00
9837b7926f
Use proper lookup of etcd host for calico ( #2408 )
...
Fixes #2397
2018-03-02 15:36:52 +03:00
b75b6b513b
Merge pull request #2406 from riverzhang/fedora
...
Delete unused fedora docker repo
2018-03-02 09:33:57 +02:00
2a3b48edaf
Delete unused fedora docker repo
2018-03-02 14:39:13 +08:00
5cc77eb6fd
Merge pull request #2294 from Nowaker/patch-1
...
Enable OOM killing
2018-03-01 14:56:26 +01:00
8b21034b31
Merge pull request #2344 from hswong3i/local_volume_provisioner_fixup
...
Upgrade Local Volume Provisioner Addon to v2.0.0
2018-03-01 13:12:44 +02:00
67ffd8e923
Add etcd-events cluster for kube-apiserver ( #2385 )
...
Add etcd-events cluster for kube-apiserver
2018-03-01 11:39:14 +03:00
af7edf4dff
Merge pull request #2369 from eviln1/fix-insecure-apiserver-port
...
fix apiserver manifest when disabling insecure_port
2018-02-28 17:48:08 -06:00
0fd3b9f7af
Merge pull request #2391 from Miouge1/latest-helm
...
Install latest version of Helm
2018-02-28 15:04:41 -05:00
7ef9f4dfdd
Revert "Add pre-upgrade task for moving credentials file" ( #2393 )
2018-02-28 22:41:52 +03:00
6ce507f39f
Merge pull request #2345 from mattymo/credentials_upgrade_fix
...
Add pre-upgrade task for moving credentials file
2018-02-28 12:39:02 -06:00
34cab91e86
Merge pull request #2366 from z1nkum/bump_dashboard_tag
...
Bump dashboard from 1.8.1 to 1.8.3 because of reload bug
2018-02-28 12:38:34 -06:00
63de9bdba3
Merge pull request #2363 from whereismyjetpack/default-kube-proxy
...
default kube_proxy_mode in kubernetes-defaults
2018-02-28 12:37:46 -06:00
afb6e7dfc3
Merge pull request #2362 from mattymo/calico_ignore_extra_pools_again
...
Use CNI to assign kube_pods_subnet for calico
2018-02-28 12:36:50 -06:00
ad89d1c876
Update pre_upgrade.yml
2018-02-28 19:07:44 +03:00
6b80ac6500
Fix indexing of supplementary DNS in openssl.conf
2018-02-28 16:04:52 +00:00
2257dc9baa
Install latest version of Helm
2018-02-28 16:29:38 +01:00
977e7ae105
remove obsolete init image, bump dashboard version 1.8.1 -> 1.8.3
2018-02-28 12:52:59 +03:00
bc0fc5df98
Use node cert for etcd tasks instead of delegating to first etcd ( #2386 )
...
For etcdctl commands, use admin cert instead of node because this file
doesn't exist on etcd only hosts.
2018-02-27 22:23:51 +03:00
bb469005b2
Add pre-upgrade task for moving credentials file
2018-02-27 17:35:15 +03:00
89ade65ad6
Fixing etcd certs for calico rr ( #2374 )
2018-02-27 17:34:07 +03:00
128d3ef94c
Fix run kubectl error ( #2199 )
...
* Fix run kubectl error
Fix run kubectl error when first master doesn't work
* if access_ip is define use first_kube_master
else different master use a different ip
* Delete set first_kube_master and use kube_apiserver_access_address
2018-02-27 16:32:20 +03:00
b7e06085c7
Upgrade to Kubernetes v1.9.3 ( #2323 )
...
Upgrade to Kubernetes v1.9.3
2018-02-27 14:31:59 +03:00
9e85a023c1
Merge pull request #2360 from mattymo/reset_fixes
...
retry unmount kubelet dirs
2018-02-26 18:30:38 -06:00
4b5f780ff0
Merge pull request #2357 from octarinesec/eyeofthefrog/set_TasksMax_infinity_for_ubuntu
...
Set TasksMax to infinity on any OS with systemd
2018-02-22 21:31:10 -06:00
31659efe13
Fixing cert name in calico/canal for etcd check ( #2358 )
2018-02-22 17:37:07 +03:00
2bd3776ddb
fix apiserver manifest when disabling insecure_port
2018-02-22 14:00:32 +01:00
c874f16c02
Fixing credential lookup for fe proxy and vault ( #2361 )
2018-02-22 15:09:26 +03:00
ba91304636
Fixed generate front proxy client certs with vault ( #2359 )
...
* Fixed generate front proxy client certs with vault
* fix vault cert management
* Distrebute etcd node certs to vault hosts
2018-02-22 15:08:50 +03:00
42a0f46268
Add health check to kube proxy ( #2356 )
...
Adding health checking to kube proxy. Fixes #2308
2018-02-21 23:14:45 +03:00
d84ff06f73
Set filemode to 0640 ( #2315 )
...
* Set filemode to 0640
weave-net.yml file is readable by all users on the host. It however contains the weave_password to encrypt all pod communication. It should only be readable by root.
* Set mode 0640 on users_file with basic auth
2018-02-21 23:13:46 +03:00
87f33a4644
Use CNI to assign kube_pods_subnet for calico
...
Now calico can be deployed if there are other existing pools
and not confuse IPAM and end up with pods in the wrong pools.
2018-02-21 20:32:28 +03:00
2d69b05c77
set local_release_dir in downloads to match others
2018-02-21 11:35:34 -05:00
2eb57ee5cd
default kube_proxy_mode in kubernetes-defaults
2018-02-21 11:33:25 -05:00
85c69c2a4a
Add check for atomic hosts in template
2018-02-21 08:26:18 -08:00
c20f38b89c
retry unmount kubelet dirs
2018-02-21 14:41:57 +03:00
d4c61d2628
Fixup for gce_centos7-flannel-addons
2018-02-21 13:41:25 +08:00
deef47c923
Upgrade Local Volume Provisioner Addon to v2.0.0
2018-02-21 13:41:25 +08:00
c19d8994b9
Set TasksMax to infinity on any OS with systemd
2018-02-20 11:55:13 -08:00
2de6da25a8
Merge pull request #2312 from woopstar/patch-7
...
Added iptables lock fix and ajusted oom-score
2018-02-19 22:47:07 -06:00
f13e76d022
Added cilium support ( #2236 )
...
* Added cilium support
* Fix typo in debian test config
* Remove empty lines
* Changed cilium version from <latest> to <v1.0.0-rc3>
* Add missing changes for cilium
* Add cilium to CI pipeline
* Fix wrong file name
* Check kernel version for cilium
* fixed ci error
* fixed cilium-ds.j2 template
* added waiting for cilium pods to run
* Fixed missing EOF
* Fixed trailing spaces
* Fixed trailing spaces
* Fixed trailing spaces
* Fixed too many blank lines
* Updated tolerations,annotations in cilium DS template
* Set cilium_version to iptables-1.9 to see if bug is fixed in CI
* Update cilium image tag to v1.0.0-rc4
* Update Cilium test case CI vars filenames
* Add optional prometheus flag, adjust initial readiness delay
* Update README.md with cilium info
2018-02-16 21:37:47 -06:00
95e2bde15b
set nodeName to "{{ inventory_hostname }}" in kubeadm-config
2018-02-16 16:20:08 -05:00
4c280e59d4
Use legacy policy config to apply the scheduler policy
2018-02-16 13:43:35 +01:00
76a89039ad
Merge pull request #2285 from jasdeep-hundal/do_not_install_python_apt
...
Remove redundant python-apt install
2018-02-15 17:04:08 +01:00
ba2107ea8c
is-default-class is case sensative so we must return a lowercase string
2018-02-15 10:51:42 +01:00
3f44a33738
allow for configurable openstack storage class
2018-02-14 11:32:56 +01:00
c0aad0a6d5
Fix install etcd by host service ( #2297 )
...
Fix bug issues #2289
2018-02-12 17:34:01 +01:00
41ca67bf54
Added iptables lock fix and ajusted oom-score
...
xtables lock was missing. Added new option for oom-score to make sure it's not killed in an OOM situation before regular pods.
2018-02-12 10:21:38 +01:00
d72232f15b
Increased timeout values for k8s API server restart
2018-02-12 07:35:29 +00:00
03c61685fb
Added apiserver extra args variable for kubeadm config ( #2291 )
2018-02-12 10:29:46 +03:00
46284198f8
Merge pull request #2298 from clkao/patch-2
...
Fix version comparison
2018-02-11 17:22:39 +01:00
bbb1da1a83
Fix default_resolver is undefined
...
fix issues #2265
2018-02-10 10:08:26 -06:00
07075add3d
Add optional StorageClass name with cephfs_provisioner_storage_class
2018-02-10 20:31:34 +08:00
338238d086
Fix version comparison
...
`FAILED! => {"changed": false, "msg": "AnsibleFilterError: Version comparison: unorderable types: str() < int()"}`
2018-02-10 03:49:49 +08:00
03bb729fea
Making status and detection mo betta
2018-02-09 12:30:46 -06:00
f8a59446e8
Enable OOM killing
...
When etcd exceeds its memory limit, it becomes useless but keeps running.
We should let OOM killer kill etcd process in the container, so systemd can spot
the problem and restart etcd according to "Restart" setting in etcd.service unit file.
If OOME problem keep repeating, i.e. it happens every single restart,
systemd will eventually back off and stop restarting it anyway.
--restart=on-failure:5 in this file has no effect because memory allocation error
doesn't by itself cause the process to die
Related: https://github.com/kubernetes-incubator/kubespray/blob/master/roles/etcd/templates/etcd-docker.service.j2
This kind of reverts a change introduced in #1860 .
2018-02-09 11:00:13 -06:00
4e61fb9cd3
Refactored kubeadm join process and fixed uncrodonng for master nodes
2018-02-09 15:51:47 +01:00
b472c2df98
Fix safe upgrade
...
Even though there it kubeadm_token_ttl=0 which means that kubeadm token never expires, it is not present in `kubeadm token list` after cluster is provisioned (at least after it is running for some time) and there is issue regarding this https://github.com/kubernetes/kubeadm/issues/335 , so we need to create a new temporary token during the cluster upgrade.
2018-02-09 15:51:47 +01:00
bc67deee78
Added missing cephfs_provisioner_enabled to kubespray-defaults vars
2018-02-09 17:03:38 +03:00
f57abae01e
Remove redundant python-apt install
...
Ansible automatically installs the python-apt package when using
the 'apt' Ansible module, if python-apt is not present. This patch
removes the (unneeded) explicit installation in the Kubespray
'preinstall' role.
2018-02-08 18:59:37 -08:00
275b1d6897
Merge pull request #2274 from mirwan/local_volume_provisioner_configmap_in_daemonset
...
Local volume provisioner fixes
2018-02-09 00:59:47 +01:00
e9a676951b
storageClass name template as suggested by @eyeofthefrog
2018-02-09 00:11:07 +01:00
b31d905704
Merge pull request #2230 from hswong3i/cephfs_provisioner
...
Add cephfs_provisioner Support for Kubespray
2018-02-08 16:52:15 +01:00
c70c44b07b
Merge pull request #2257 from rzenker/tb/baremetal-tweaks
...
baremetal tweaks
2018-02-08 15:48:55 +00:00
20583e3d15
Merge pull request #2067 from manics/sysctl-net-brfilter
...
Always set net.bridge.bridge-nf-call-* sysctl
2018-02-08 15:43:46 +00:00
9f4588cd0c
Merge pull request #2266 from riverzhang/epel-release
...
Disalbe install epel-release rpm on Centos/Redhat
2018-02-08 15:42:28 +00:00
b25e0f82b1
Add cephfs_provisioner Support for Kubespray
2018-02-08 22:27:54 +08:00
cae1c683aa
Merge pull request #2271 from leseb/retry-get-token
...
kubernetes-apps: retry get default token name
2018-02-08 16:46:32 +03:00
57e7a5a34a
Merge pull request #2233 from hswong3i/multiple_inventory_dir
...
Support multiple inventory files under individual inventory directory
2018-02-08 11:57:04 +01:00
7bce70339f
Merge pull request #2251 from woopstar/metrics-server-patch-2
...
Adding metrics-server support for K8s version 1.9
2018-02-08 11:16:44 +01:00
e1aaef7d4d
Removal of surnumerary slash
2018-02-08 09:06:17 +01:00
1a1d154e14
Support multiple inventory files under individual inventory directory
2018-02-08 08:08:15 +08:00
384e5dd4c4
Merge pull request #2160 from kongslund/disable-read-only-port
...
Make the Kubelet read-only port configurable and disable it by default
2018-02-07 13:06:32 -06:00
abfb147292
MountDir in configmap and daemonset must be the same
2018-02-07 18:42:42 +01:00
44eb03f78a
typo
2018-02-07 17:57:54 +01:00
857784747b
local-provisioner:v1.0.1 still expects json configmap
2018-02-07 17:47:05 +01:00
7a2cb5e41c
local-provisioner:v1.0.1 still uses VOLUME_CONFIG_NAME env to read ConfigMap
2018-02-07 17:01:19 +01:00
712bdfc82f
Merge pull request #2260 from mirwan/local_volume_provisioner_fixes
...
local_volume_provisioner_enabled replacement
2018-02-07 13:42:00 +01:00
34bd47de79
kubernetes-apps: retry get default token name
...
In some installation, it can take up to 3sec to get the value. Retrying
for 5 sec will ensure the command won't return 1.
Signed-off-by: Sébastien Han <seb@redhat.com>
2018-02-07 12:09:51 +01:00
fe57c13b51
Merge pull request #2172 from leseb/etcd-auth
...
etcd: ability to enable/disable ETCD_PEER_CLIENT_CERT_AUTH
2018-02-07 11:25:56 +01:00
f9df692056
Issue front proxy certs for vault
2018-02-07 11:03:10 +01:00
f193b12059
Kubeadm auto creates this
2018-02-07 10:50:34 +01:00
2cd254954c
Remove defaults of allowed names. Updated kubeadm
2018-02-07 10:07:55 +01:00
4dab92ce69
Rename from aggregator-proxy-client to front-proxy-client to match kubeadm design. Added kubeadm support too. Changed to use variables set and not hardcode paths. Still missing cert generation for Vault
2018-02-07 09:50:19 +01:00
ca08614641
yamllint fix
2018-02-07 09:12:28 +01:00
47adf4bce6
Disalbe install epel-release rpm on Centos/Redhat
...
1.Disalbe install epel-release rpm on Centos/Redhat
2.Use yum install epel-release
2018-02-07 14:58:50 +08:00
7928cd20fb
Merge pull request #2037 from tiewei/contiv-etcd-split
...
Split contiv etcd and etcd-proxy into two daemonsets
2018-02-06 15:37:16 -06:00
ad9049a49e
baremetal tweaks
...
* allow installs to not have hostname overriden with fqdn from inventory
* calico-config no longer requires local as and will default to global
* when cloudprovider is not defined, use the inventory_hostname for cni-calico
* allow reset to not restart network (buggy nodes die with this cmd)
* default kube_override_hostname to inventory_hostname instead of ansible_hostname
2018-02-06 13:52:22 -05:00
b4e264251f
JSON/YAML syntax fix
2018-02-06 17:17:10 +01:00
8006a6cd82
local_volumes_enabled replaced by local_volume_provisioner_enabled
2018-02-06 17:12:09 +01:00
5cd6b0c753
Adding missing defaults for weave
...
The PR #2203 add's missing defaults for weave, but no signed CLA. So this PR fixes it.
2018-02-06 14:25:07 +01:00
bb339265fc
Set default registry_enabled to false
...
In PR #2244 the `registry_enabled` is missing in defaults, causing a deployment to fail, if it is not set in k8s-cluster.yml
2018-02-06 14:17:06 +01:00
bb4446e94c
Merge pull request #2226 from manics/supplemental-addresses
...
Enable additional addresses to be added to certificates
2018-02-06 13:51:54 +01:00
d2102671cd
Merge pull request #2214 from woopstar/patch-3
...
Loadbalancer Apiserver Address is missing
2018-02-06 13:47:55 +01:00
138e0c2301
Merge pull request #2250 from woopstar/weave-mtu-patch
...
Added option to set MTU on Weave
2018-02-06 12:13:54 +01:00
37cfd289d8
Merge pull request #2248 from hswong3i/dashboard.yml.j2
...
Dashboard template should not suffix with .yml.j2
2018-02-06 11:25:02 +01:00
9f3081580a
Merge pull request #2249 from hswong3i/kubedns-deploy.yml.j2
...
KubeDNS template should not suffix with .yml.j2
2018-02-06 11:24:19 +01:00
a3248379db
Merge branch 'master' into local_volume_provisioner
2018-02-06 09:28:27 +01:00
0774c8385c
Merge pull request #2244 from hswong3i/registry
...
Migrate Kubernetes v1.9.1 cluster/addons/registry to Kubespray
2018-02-06 09:20:48 +01:00
b2d30d68e7
Rename CN for aggreator back. Add flags to apiserver when version is >= 1.9
2018-02-05 20:37:14 +01:00
82d10b882c
Added fixes from whereismyjetpack
2018-02-05 20:07:12 +01:00
95b8ac5f62
Added optional controller and scheduler extra args to kubeadm config ( #2205 )
2018-02-05 16:49:13 +03:00
0b4168cad4
WIP. Adding metrics-server support for K8s version 1.9
2018-02-05 10:37:41 +01:00
3289472e31
Added option to set MTU on Weave
2018-02-05 10:23:48 +01:00
4ad53339f6
KubeDNS template should not suffix with .yml.j2
2018-02-05 16:26:54 +08:00
a4d3da6a8e
Dashboard template should not suffix with .yml.j2
2018-02-05 16:18:21 +08:00
7954ea2525
Migrate Kubernetes v1.9.1 cluster/addons/registry to Kubespray
2018-02-05 12:21:09 +08:00
bd1f0bcfd7
Merge pull request #2201 from riverzhang/ipvs
...
Support ipvs mode for kube-proxy
2018-02-01 22:29:52 -06:00
bc2e26d7ef
update apiVersion
2018-02-01 14:16:32 +08:00
fd80013917
lint and cleanup local_volume_provisioner
2018-02-01 14:14:18 +08:00
f7d52564aa
Merge pull request #2084 from riverzhang/devicemapper
...
Fix can not use devicemapper driver
2018-01-31 20:52:22 -06:00
f7e8d1149a
Merge pull request #2229 from whereismyjetpack/etcd-quorum-read
...
--etcd-quorum-read is depricated in kube >= 1.9
2018-01-31 17:10:10 -05:00
bd091caaf9
Merge pull request #2200 from riverzhang/hyperkube
...
Upgrade to Kubernetes v1.9.2
2018-01-31 16:08:22 -05:00
b455a1bf76
Merge pull request #2212 from mattymo/missing_defaults
...
Add missing group var default values to kubespray-defaults
2018-01-31 16:07:53 -05:00
c0a3bcf9b3
Merge pull request #2221 from Xuxe/patch-vcp-v1.9.2
...
Updated vSphere cloud provider config for Kubernetes >= v1.9.2 and added resource pool deployment variable
2018-01-31 16:06:07 -05:00
dc6c703741
--etcd-quorum-read is depricated in kube >= 1.9
2018-01-31 15:49:52 -05:00
16629d0b8e
Vault should use cert auth for etcd
2018-01-31 20:37:14 +03:00
7f79210ed1
reworked vsphere-cloud-config template
2018-01-31 16:51:23 +01:00
27a1a697e7
supplementary_addresses_in_ssl_keys can be a hostname
2018-01-31 15:16:08 +00:00
c1267004ef
Merge pull request #2130 from ArchiFleKs/simplify_os_provider
...
Simplify and update OpenStack cloud provider
2018-01-31 12:02:02 +02:00
9cdd2214f9
render vsphere_resource_pool only if defined
2018-01-31 09:56:43 +01:00
989e9174c2
Added vSphere cloud provider config update for Kubernetes >= 1.9.2
2018-01-31 09:15:46 +01:00
3993e12335
Fix can not be used devicemapper driver
...
Fix can not be used devicemapper driver
2018-01-31 15:51:11 +08:00
ac4d782937
Merge pull request #2074 from fangzhen/fix-domains-split
...
Make spliting system_search_domains more robust
2018-01-30 21:01:19 -06:00
32d18ca992
remove trailing space
2018-01-31 09:50:41 +08:00
2df4b6c5d2
Rename default_resolver to cloud_resolver ( #2209 )
...
Cloud resolvers are mandatory for hosts on GCE and OpenStack
clouds. The 8.8.8.8 alternative resolver was dropped because
there is already a default nameserver. The new var name
reflects the purpose better.
Also restart apiserver when modifying dns settings.
2018-01-31 00:26:07 +03:00
088d36da09
Increase the idx counter
...
Fix the idx counter to increase too, or you will end up with two same indexes.
2018-01-30 21:48:13 +01:00
6f36faa4f9
Loadbalancer Apiserver Address is missing
...
If you configure your external loadbalancer to do a simple tcp pass-through to the api servers, and you do not use a DNS FQDN but just the ip, then you need to add the ip adress to the certificates too.
Example config:
```
## External LB example config
apiserver_loadbalancer_domain_name: "10.50.63.10"
loadbalancer_apiserver:
address: 10.50.63.10
port: 8383
```
2018-01-30 17:33:00 +01:00
3846384d56
Bump kube-dns to 1.14.8 ( #2204 )
...
Bump kube-dns to 1.14.8
2018-01-30 19:23:37 +03:00
331f141f63
Fix DNS entries in etcd's openssl.conf by adding a newline. ( #2208 )
...
DNS entries generated from 'etcd_cert_alt_names' variable in etcd's
openssl.conf are not terminated by a newline.
This fixes issue #2207 .
2018-01-30 16:26:58 +03:00
62dd3d2a9d
Add missing group var default values to kubespray-defaults
2018-01-30 16:04:00 +03:00
fa8a128e49
etcd: ability to enable/disable ETCD_PEER_CLIENT_CERT_AUTH
...
Some installation are failing to authenticate with peers due to
etcd picking up/resoling the wrong node.
By setting 'etcd_peer_client_auth' to "False" you can disable peer client cert
authentication.
Signed-off-by: Sébastien Han <seb@redhat.com>
2018-01-30 11:19:12 +01:00
b10c308a5a
Support ipvs mode for kube-proxy
...
Support ipvs mode for kube-proxy
2018-01-30 13:09:01 +08:00
e22c70e431
Upgrade to Kubernetes v1.9.2
2018-01-30 13:04:38 +08:00
f4fe9e3421
Merge pull request #2171 from ArchiFleKs/kubeproxy-lvs
...
Add lib/modules to kube-proxy to enable LVS
2018-01-29 22:58:02 -06:00
da173615e4
Merge pull request #2048 from xizhibei/master
...
Fix: always only one container got synced after download
2018-01-29 16:01:11 -06:00
dc6a17e092
Use include/import tasks ( #2192 )
...
import_tasks will consume far less memory, so it should be
used whenever it is compatible.
2018-01-29 14:37:48 +03:00
240d4193ae
Update information about network sizes
2018-01-26 15:23:21 +01:00
ac66e98ae9
Upgrade to Kubernetes v1.9.1 ( #2152 )
...
Raise drain timeout to 5m
2018-01-25 18:44:44 +03:00
d2935ffed0
Optionally ignore the presence of extra calico pools ( #2190 )
2018-01-25 18:44:20 +03:00
c6e0fcea31
Merge pull request #1948 from sgmitchell/secured-etcd
...
Enable etcd secure client to prevent etcdctl access without cert and key
2018-01-25 09:35:51 -06:00
5d014d986b
Merge pull request #1992 from manics/flannel-hairpin
...
Enable flannel hairpin mode
2018-01-24 21:20:03 -06:00
714994cad8
iptables: flush nat table as well as filter table upon reset ( #2174 )
...
* iptables: flush nat table as well as filter table upon reset
* Indentation fix
2018-01-24 20:22:49 -06:00
08fe61e058
Merge pull request #2071 from riverzhang/dashboard
...
Update dashboard version to v1.8.1
2018-01-24 20:10:05 -06:00
0c8bed21ee
Merge pull request #2019 from chadswen/disable-api-insecure-port
...
Support for disabling apiserver insecure port (the sequel)
2018-01-24 19:58:53 -06:00
98eb845f8c
Merge pull request #2173 from mirwan/hardcoded_dnsmasq-autoscaler_image
...
Dnsmasq autoscaler image should be a variable
2018-01-24 16:15:59 -06:00
98300e3165
Merge pull request #2155 from brutus333/fix/pvc
...
Fix for Issue #2141
2018-01-24 16:15:33 -06:00
e22759d8f0
fix nodePort for weave
2018-01-24 10:31:51 +01:00
bf1411060e
Add optional manual dns_mode ( #2178 )
2018-01-23 14:28:42 +01:00
a4d142368b
Renamed variable from disable_volume_zone_conflict to volume_cross_zone_attachment and removed cloud provider condition; fix identation
2018-01-23 13:14:00 +00:00
eb80f9b606
Merge pull request #2154 from tdihp/proxy-conf-restart-docker
...
Restart docker when http-proxy.conf changed.
2018-01-22 08:39:05 -06:00
ae47b617e3
Fix 'no such host' problem ( #2148 )
...
Fix 'no such host' problem reported by commands *kubectl logs* and *kubectl exec*
when cloud_provider is OpenStack
Closes : #2147
2018-01-22 16:08:24 +03:00
e5b4011aa4
move hardcoded dnsmasq autoscaler image to its own variable
2018-01-18 16:04:29 +01:00
3125f93b3f
Added disable_volume_zone_conflict variable
2018-01-18 10:55:23 +00:00
f19c8e8c1d
Merge pull request #2132 from PhilippeChepy/flex-volumes
...
Add support for flex volumes plugins.
2018-01-17 15:00:45 -05:00
637604d08f
Add lib/modules to kube-proxy to enable LVS
...
kube-proxy is complaining of missing modules at startup. There is a plan
to also support an LVS implementation of kube-proxy in additon to
userspace and iptables
2018-01-17 16:35:53 +01:00
11844c987c
Make the Kubelet read-only port configurable and disable it by default. Fixes #2159 .
2018-01-16 11:11:41 +04:00
8c45c88d15
Fix for Issue #2141 - added policy file
2018-01-12 07:15:35 +00:00
c87bb2f239
Fix for Issue #2141
2018-01-12 07:07:02 +00:00
32eeb9a0e0
Restart docker when http-proxy.conf changed.
2018-01-12 10:56:25 +08:00
df21fc8643
Remove initContainer
2018-01-10 12:17:17 +08:00
ccd9cc3dce
Merge pull request #2146 from abelgana/master
...
Manage deprecated kubelet option
2018-01-09 17:19:42 -05:00
81867402f6
Merge pull request #2145 from pslijkhuis/master
...
Add kubelet_custom_flags to kubelet.kubeadm.env.j2
2018-01-09 17:19:09 -05:00
4f5d61212b
Merge pull request #2144 from neith00/weave-2.1.3
...
updated weave to 2.1.3
2018-01-09 17:18:26 -05:00
ef96123482
Merge pull request #2068 from chadswen/remove-container-retries
...
Retry kube container removal during upgrade
2018-01-09 15:03:50 -05:00
ee27ab0052
Merge pull request #2124 from riverzhang/patch-3
...
Remove blank lines
2018-01-09 14:58:49 -05:00
57f87ba083
Merge pull request #2142 from trilogy-group/hotfix/fluentd-template
...
fix fluentd template
2018-01-09 14:44:50 -05:00
a9bb72c6fd
require-kubeconfig is depricated since k8s v1.8
2018-01-09 14:35:42 -05:00
9506c2e597
require-kubeconfig is deprecated since K8s v1.8
2018-01-09 14:33:05 -05:00
32884357ff
Add kubelet_custom_flags to kubelet.kubeadm.env.j2
2018-01-09 14:04:36 +01:00
88204642b7
updated weave to 2.1.3
2018-01-09 13:50:42 +01:00
1401286910
Add support for cert alt names for etcd ( #2139 )
...
* Add support for cert alt names for etcd
* Update gen_certs_vault.yml
2018-01-09 14:37:34 +03:00
12eb242224
fix fluentd template
2018-01-08 13:40:47 +00:00
df9faa1743
Add support for flex volumes plugins.
2018-01-05 17:56:36 +01:00
ce85bcaee7
Simplify and update OpenStack cloud provider
...
Simplify the number of variables necessary to "just" enable OpenStack
cloud provider. Also add the new options available in K8s 1.9.
2018-01-05 12:05:24 +01:00
6ed2a60978
fix run dashboard error
2018-01-04 13:13:36 +08:00
bac3bf1a5f
Fix auto-evaluated API access endpoint for bind IP ( #2086 )
...
Auto configure API access endpoint with a custom bind IP, if provided.
Fix HA docs' http URLs are https in fact, clarify the insecure vs secure
API access modes as well.
Closes: #issues/2051
Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
2018-01-03 17:40:21 +01:00
e3b684df21
Remove blank lines
...
Remove blank lines
2018-01-03 00:54:04 -06:00
e45b30d033
Add etcd key and cert environment variables for use with client auth
2018-01-02 13:52:17 -05:00
ad6fecefa8
Update Kubernetes to v1.9.0 ( #2100 )
...
Update checksum for kubeadm
Use v1.9.0 kubeadm params
Include hash of ca.crt for kubeadm join
Update tag for testing upgrades
Add workaround for testing upgrades
Remove scale CI scenarios because of slow inventory parsing
in ansible 2.4.x.
Change region for tests to us-central1 to
improve ansible performance
2017-12-25 08:57:45 +00:00
3fdb2ccf55
Revert back to using an empty var as default to exclude hostname ( #2110 )
2017-12-22 22:09:59 +00:00
29f5b55d42
remove unwanted whitespace for kube_override_hostname ( #2105 )
2017-12-22 11:31:18 +00:00
5aef52e8c0
fix dashboard certs secret
2017-12-22 11:17:05 +08:00
6bb46e3ecb
Fix param names in preparation for Kubernetes v1.9.0 ( #2098 )
...
This does not update v1.9.0, but fixes two incompatibilities
when trying to deploy v1.9.0.
2017-12-20 10:48:09 +00:00
127bc01857
Do not override kubelet hostname if cloud_provider is used ( #2095 )
...
Starting with Kubernetes v1.8.4, kubelet ignores the AWS cloud
provider string and uses the override hostname, which fails
Node admission checks.
Fixes #2094
2017-12-19 20:18:20 +00:00
a6975c1850
Rename runtime docker_version ( #2082 )
...
Renaming runtime docker_version to prevent setting that
value on the command line from breaking the play run.
This fixes #2081
2017-12-19 14:47:54 +00:00
b2cb0725ac
Default OpenStack Cinder Storage Class ( #2083 )
...
Add possibility to create default OpenStack Cinder Storage Class
Closes : #1609
2017-12-19 14:47:00 +00:00
b974b144a8
Add RBAC to binding Dahsboard UI
2017-12-18 23:07:19 +08:00
bfb25fa47b
Change vault cert ttl to 8y ( #2013 )
2017-12-15 13:34:00 +00:00
3bb505d43f
Remove unrequired mounts
2017-12-14 14:59:40 -08:00
b135bcb9d9
Split download container task for delegate and non-delegate modes ( #2077 )
...
Ansible cannot seem to handle omitting delegate_to since v2.4.0.0.
Possibly related: https://github.com/ansible/ansible/issues/30760
2017-12-14 16:45:54 +00:00
4e97225424
Add quote for etcd endpoints
2017-12-13 18:35:12 -08:00
0771cd8599
Remove dashboard_tls_key and dashboard_tls_cert
2017-12-13 15:42:20 +08:00
91d848f98a
Make spliting system_search_domains more robust
...
The search line in /etc/resolv.conf could have
multiple spaces or tabs between domains.
split(' ') will give wrong results in some case,
use split() without argument instead.
e.g.
>>> 'domain.tld cluster.tld '.split(' ')
['domain.tld\tcluster.tld', '']
>>> 'domain.tld cluster.tld '.split()
['domain.tld', 'cluster.tld']
2017-12-13 15:39:38 +08:00
40edf8c6f5
Update dashboard version to v1.8.0
...
Update dependencies to be compatible with Kubernetes v1.8
2017-12-13 12:50:44 +08:00
e78562830f
Retry kube container removal during upgrade
...
As we have seen with other containers, sometimes container removal fails on the first attempt due to some Docker bugs. Retrying typically corrects the issue.
2017-12-12 12:06:41 -06:00
bef259a6eb
Always set net.bridge.bridge-nf-call-* sysctl
2017-12-12 17:11:35 +00:00
39ce1bd8be
Merge pull request #2059 from bradbeam/vaultalt
...
Fixing alt_names for vault cert generation
2017-12-12 09:28:51 -06:00
6291881943
Merge pull request #2057 from rsmitty/master
...
set docker_version fact regardless of docker_dns in use
2017-12-12 10:28:14 -05:00
802fd94dad
Merge pull request #2054 from ArchiFleKs/os-cloud-provider-domain-fix
...
Fix domain id for OpenStack provider
2017-12-11 21:06:16 -06:00
66f38a1b31
fix: always only one docker image got synced after download
2017-12-12 09:51:03 +08:00
d3850a4da5
Fixing alt_names for vault cert generation
2017-12-11 17:28:18 -06:00
53a4355e60
set docker_version fact regardless of docker_dns in use
2017-12-11 17:48:11 -05:00
19def41fdf
Merge pull request #2047 from bradbeam/vaulttime
...
Adding retries for vault-temp to come online
2017-12-11 09:04:57 -06:00
44b9dce134
Fix domain id for OpenStack provider
...
OpenStack authentication does not support using a mix of DomainID and
DomainName, only one or the other should be used.
2017-12-11 15:57:33 +01:00
fa5a538fe5
Merge pull request #2050 from jbonachera/fix-vault-tls-validation
...
append newline char to vault generated certs
2017-12-11 08:41:34 -06:00
9643c2c1e3
Fixes to reset ( #2046 )
...
- adding additional directories to cleanup (rkt/vault)
- targeting kubespray ansible groups instead of all
2017-12-11 12:49:21 +00:00
93f3614382
Fixes #2039 - changing alt_names to be string instead of list ( #2043 )
2017-12-11 12:48:07 +00:00
cbc8a7d679
Merge pull request #1995 from b0r1sp/patch-1
...
Update main.yml
2017-12-10 21:45:02 -06:00
290bc993a5
append newline char to vault generated certs
2017-12-10 13:06:28 +01:00
3694657eb6
Adding retries for vault-init to come online
2017-12-09 17:40:44 -06:00
79417e07ca
Fix systemd service unit for docker >= 17.03 ( #1844 )
2017-12-08 13:12:45 +00:00
dad95c873b
Remove templating for etcd members
...
Use a etcd-initer init container to generate etcd args, it determines
etcd name by comparing its ip and etcd cluster ips. This way will
make etcd configuration independent to the ansible templating so
that could be easier on adding master nodes.
2017-12-07 23:33:29 -08:00
626b35e1b0
Merge pull request #2005 from riverzhang/patch-1
...
Delete helm home
2017-12-07 11:23:30 -05:00
5881ba43f8
Split contiv etcd and etcd-proxy into two daemonsets
...
Putting contiv etcd and etcd-proxy into the same daemonset and manage
the difference by a env file is not good for scaling (adding nodes).
This commit split them into two daemonsets so that when adding nodes,
k8s could automatically starting a etcd-proxy on new nodes without need
to run related play that putting env file.
2017-12-06 22:21:50 -08:00
fed7b97dcb
Merge pull request #2030 from mattymo/removerbaccheck
...
Remove RBAC from boolean checks
2017-12-06 23:41:13 -06:00
c4458c9d9a
Merge pull request #1997 from mrbobbytables/feature-keepalived-cloud-provider
...
Add minimal keepalived-cloud-provider support
2017-12-06 23:28:27 -05:00
aeb3e647d4
Remove the network device created by the flannel ( #2006 )
...
* Remove the network device created by the flannel
Remove the network device created by the flannel
* Modify flannel.1 device path
Modify flannel.1 device path
* remove trailing spaces
2017-12-06 14:15:39 +00:00
fe036cbe77
Adding changes to handle updation of yum Management cache in rhel. ( #2026 )
...
* Adding changes to handle updation of yum cache in rhel.
* Removed the redundant spaces
2017-12-06 09:00:41 +00:00
952ec65a40
Remove RBAC from boolean checks
2017-12-06 11:57:40 +03:00
b8788421d5
Support for disabling apiserver insecure port
...
This allows `kube_apiserver_insecure_port` to be set to 0 (disabled).
Rework of #1937 with kubeadm support
Also, fixed an issue in `kubeadm-migrate-certs` where the old apiserver cert was copied as the kubeadm key
2017-12-05 09:13:45 -06:00
c2347db934
Merge pull request #1953 from chadswen/dashboard-refactor
...
Kubernetes Dashboard v1.7.1 Refactor
2017-12-05 08:50:55 -06:00
27ead5d4fa
Merge pull request #2003 from abelgana/master
...
Change altnames to alt_names
2017-12-05 08:48:32 -06:00
6ade7c0a8d
Update k8s version to 1.8.4 ( #2015 )
...
* Update k8s version to 1.8.4
* Update main.yml
2017-12-04 16:23:04 +00:00
a0225507a0
Set helm deployment type to host ( #2012 )
2017-11-29 19:52:54 +00:00
d39a88d63f
Allow setting --bind-address for apiserver hyperkube ( #1985 )
...
* Allow setting --bind-address for apiserver hyperkube
This is required if you wish to configure a loadbalancer (e.g haproxy)
running on the master nodes without choosing a different port for the
vip from that used by the API - in this case you need the API to bind to
a specific interface, then haproxy can bind the same port on the VIP:
root@overcloud-controller-0 ~]# netstat -taupen | grep 6443
tcp 0 0 192.168.24.6:6443 0.0.0.0:* LISTEN 0 680613 134504/haproxy
tcp 0 0 192.168.24.16:6443 0.0.0.0:* LISTEN 0 653329 131423/hyperkube
tcp 0 0 192.168.24.16:6443 192.168.24.16:58404 ESTABLISHED 0 652991 131423/hyperkube
tcp 0 0 192.168.24.16:58404 192.168.24.16:6443 ESTABLISHED 0 652986 131423/hyperkube
This can be achieved e.g via:
kube_apiserver_bind_address: 192.168.24.16
* Address code review feedback
* Update kube-apiserver.manifest.j2
2017-11-29 15:24:02 +00:00
e5d353d0a7
contiv network support ( #1914 )
...
* Add Contiv support
Contiv is a network plugin for Kubernetes and Docker. It supports
vlan/vxlan/BGP/Cisco ACI technologies. It support firewall policies,
multiple networks and bridging pods onto physical networks.
* Update contiv version to 1.1.4
Update contiv version to 1.1.4 and added SVC_SUBNET in contiv-config.
* Load openvswitch module to workaround on CentOS7.4
* Set contiv cni version to 0.1.0
Correct contiv CNI version to 0.1.0.
* Use kube_apiserver_endpoint for K8S_API_SERVER
Use kube_apiserver_endpoint as K8S_API_SERVER to make contiv talks
to a available endpoint no matter if there's a loadbalancer or not.
* Make contiv use its own etcd
Before this commit, contiv is using a etcd proxy mode to k8s etcd,
this work fine when the etcd hosts are co-located with contiv etcd
proxy, however the k8s peering certs are only in etcd group, as a
result the etcd-proxy is not able to peering with the k8s etcd on
etcd group, plus the netplugin is always trying to find the etcd
endpoint on localhost, this will cause problem for all netplugins
not runnign on etcd group nodes.
This commit make contiv uses its own etcd, separate from k8s one.
on kube-master nodes (where net-master runs), it will run as leader
mode and on all rest nodes it will run as proxy mode.
* Use cp instead of rsync to copy cni binaries
Since rsync has been removed from hyperkube, this commit changes it
to use cp instead.
* Make contiv-etcd able to run on master nodes
* Add rbac_enabled flag for contiv pods
* Add contiv into CNI network plugin lists
* migrate contiv test to tests/files
Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com>
* Add required rules for contiv netplugin
* Better handling json return of fwdMode
* Make contiv etcd port configurable
* Use default var instead of templating
* roles/download/defaults/main.yml: use contiv 1.1.7
Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com>
2017-11-29 14:24:16 +00:00
de422c822d
update nginx tag to use multi-arch docker image ( #2009 )
2017-11-29 10:39:52 +00:00
4d3326b542
Raise default vault lease TTL to 10y ( #2008 )
2017-11-29 10:38:59 +00:00
1b82138142
Delete helm home
...
Delete helm home
2017-11-29 13:27:09 +08:00
208ff8e350
Allow for more customization of the tiller deploy ( #1946 )
2017-11-28 18:33:57 +00:00
ec54b36e05
add retries for calico/canal etcd commands ( #2007 )
2017-11-28 16:39:55 +00:00
38e8522cbf
Merge pull request #1983 from tomdee/bump-flannel-ver
...
Bump flannel version to v0.9.1
2017-11-28 11:38:55 -05:00
52f8687397
Merge pull request #1977 from mattymo/initializers
...
Disable initializers feature gate if istio is not used
2017-11-28 11:37:41 -05:00
43600ffcf8
Merge pull request #1972 from chadswen/master-static-pod-flush
...
Additional flush for static pod master upgrade
2017-11-28 11:36:38 -05:00
938d2d9e6e
update helm/tiller to v2.7.2 -- security bugfix ( #1986 )
2017-11-28 14:52:42 +00:00
9368dbe0e7
update calico to 2.6.2 ( #1874 )
...
Move RS to deployment so no need to take care of the revision history
limits :
- Delete the old RS
- Make Calico manifest a deployment
- move deployments to apps/v1beta2 API since Kubernetes 1.8
2017-11-28 12:01:30 +00:00
fe3290601a
The variable altnames is used by this task.
...
Since the value will change on the default. It needs to change here also.
2017-11-27 06:57:16 -05:00
e7173e1d62
Change altnames to alt_names
...
Hi,
Could you please check if it was a typo?
https://www.vaultproject.io/api/secret/pki/
Regards,
2017-11-25 17:29:21 -05:00
2ffcfdcd25
Update main.yml
2017-11-24 20:13:38 +01:00
8aafe64397
Defaults for apiserver_loadbalancer_domain_name ( #1993 )
...
* Defaults for apiserver_loadbalancer_domain_name
When loadbalancer_apiserver is defined, use the
apiserver_loadbalancer_domain_name with a given default value.
Fix unconsistencies for checking if apiserver_loadbalancer_domain_name
is defined AND using it with a default value provided at once.
Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
* Define defaults for LB modes in common defaults
Adjust the defaults for apiserver_loadbalancer_domain_name and
loadbalancer_apiserver_localhost to come from a single source, which is
kubespray-defaults. Removes some confusion and simplefies the code.
Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
2017-11-23 16:15:48 +00:00
2140303fcc
add minimal keepalived-cloud-provider support
2017-11-23 08:43:36 -05:00
b80ded63ca
Update main.yml
...
just a small spelling mistake
2017-11-21 22:37:52 +01:00
7be2521a31
Add flannel hairping mode
2017-11-21 10:43:50 +00:00
15b9d54a32
Bump flannel version to v0.9.1
2017-11-16 12:52:18 -07:00
bc1a4e12ad
fix broken variable in ansible 2.4.1.0 and ensure tasks for calico-rr ( #1982 )
2017-11-16 18:44:15 +00:00
67419e8d0a
Run rotate_tokens role only once ( #1970 )
2017-11-15 18:50:23 +00:00
849aaf7435
Update to k8s 1.8.3 ( #1971 )
2017-11-15 17:43:22 +00:00
a89ee8c406
Add ability to use custom cert secret instead of init container provisioned self-signed certs
2017-11-15 10:05:52 -06:00
0c6f172e75
Kubernetes Dashboard v1.7.1 Refactor
...
This version required changing the previous access model for dashboard completely but it's a change for the better. Docs were updated.
* New login/auth options that use apiserver auth proxying by default
* Requires RBAC in `authorization_modes`
* Only serves over https
* No longer available at https://first_master:6443/ui until apiserver is updated with the https proxy URL:
* Can access from https://first_master:6443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/#!/login you will be prompted for credentials
* Or you can run 'kubectl proxy' from your local machine to access dashboard in your browser from: http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/
* It is recommended to access dashboard from behind a gateway that enforces an authentication token, details and other access options here: https://github.com/kubernetes/dashboard/wiki/Accessing-Dashboard---1.7.X-and-above
2017-11-15 10:05:48 -06:00
a67349b076
Disable initializers feature gate if istio is not used
2017-11-15 12:56:36 +00:00
f9b68a5d17
Revert "Support for disabling apiserver insecure port" ( #1974 )
2017-11-14 13:41:28 +00:00
c7910b51a1
--peers DEPRECATED - --endpoints should be used instead ( #1943 )
2017-11-14 11:28:35 +00:00
1f99710b21
Additional flush for static pod master upgrade
...
Thought this wasn't required at first but I forgot there's no auto flush at the end of these tasks since the `kubernetes/master` role is not the end of the play.
2017-11-13 18:11:57 -06:00
5e558c361b
update weave-net to 2.0.5 version ( #1877 )
2017-11-13 16:11:47 +00:00
5f39efcdfd
adding mount for kubelet to enable rbd mounts ( #1957 )
...
* adding mount for kubelet to enable rbd mounts
* fix conditionnal variable name
2017-11-13 14:04:13 +00:00
037edf1215
Fix failed task of setting up bash completion for helm ( #1968 )
...
Closes : #1967
2017-11-13 10:15:53 +00:00
37125866ca
Make calico_node_ignorelooserpf have an effect ( #1945 )
2017-11-13 09:35:13 +00:00
421e73b87c
Add missing exclamation mark in shebang line ( #1966 )
2017-11-13 09:34:21 +00:00
c115e5677e
Merge pull request #1828 from hzamani/patch-1
...
Use etcd_access_addresses for vault_etcd_url
2017-11-10 10:56:37 -05:00
09d85631dc
Merge pull request #1944 from chadswen/reload-master-pods
...
Master component and kubelet container upgrade fixes
2017-11-08 22:23:12 -05:00
f25e4dc3ed
Merge pull request #1937 from chadswen/disable-api-insecure-port
...
Support for disabling apiserver insecure port
2017-11-08 18:13:49 -05:00
0126168472
provide environment for rkt trust and run with etcd
2017-11-08 12:57:22 -05:00
e9f795c5ce
Master component and kubelet container upgrade fixes
...
* Fixes an issue where apiserver and friends (controller manager, scheduler) were prevented from restarting after manifests/secrets are changed. This occurred when a replaced kubelet doesn't reconcile new master manifests, which caused old master component versions to linger during deployment. In my case this was causing upgrades from k8s 1.6/1.7 -> k8s 1.8 to fail
* Improves transitions from kubelet container to host kubelet by preventing issues where kubelet container reappeared during the deployment
2017-11-08 01:40:33 -06:00
0c7e1889e4
Support for disabling apiserver insecure port
...
This allows `kube_apiserver_insecure_port` to be set to 0 (disabled). It's working, but so far I have had to:
1. Make the `uri` module "Wait for apiserver up" checks use `kube_apiserver_port` (HTTPS)
2. Add apiserver client cert/key to the "Wait for apiserver up" checks
3. Update apiserver liveness probe to use HTTPS ports
4. Set `kube_api_anonymous_auth` to true to allow liveness probe to hit apiserver's /healthz over HTTPS (livenessProbes can't use client cert/key unfortunately)
5. RBAC has to be enabled. Anonymous requests are in the `system:unauthenticated` group which is granted access to /healthz by one of RBAC's default ClusterRoleBindings. An equivalent ABAC rule could allow this as well.
Changes 1 and 2 should work for everyone, but 3, 4, and 5 require new coupling of currently independent configuration settings. So I also added a new settings check.
Options:
1. The problem goes away if you have both anonymous-auth and RBAC enabled. This is how kubeadm does it. This may be the best way to go since RBAC is already on by default but anonymous auth is not.
2. Include conditional templates to set a different liveness probe for possible combinations of `kube_apiserver_insecure_port = 0`, RBAC, and `kube_api_anonymous_auth` (won't be possible to cover every case without a guaranteed authorizer for the secure port)
3. Use basic auth headers for the liveness probe (I really don't like this, it adds a new dependency on basic auth which I'd also like to leave independently configurable, and it requires encoded passwords in the apiserver manifest)
Option 1 seems like the clear winner to me, but is there a reason we wouldn't want anonymous-auth on by default? The apiserver binary defaults anonymous-auth to true, but kubespray's default was false.
2017-11-06 14:01:10 -06:00
0d55ed3600
Avoid that some read-only tasks cause an ansible-change ( #1910 )
2017-11-06 13:51:07 +00:00
ad0cd6939a
Add support cAdvisor ( #1908 )
...
Signed-off-by: Haiwei Liu <carllhw@gmail.com>
2017-11-06 13:50:28 +00:00
33adb334cd
Fix openstack tenant id variable name ( #1932 )
2017-11-05 08:40:41 +00:00
ef87a8a1f0
Merge pull request #1916 from vtomasr5/master
...
Fix bad handler directory name in kubeadm role
2017-11-03 18:14:48 -04:00
a595c84f7e
Merge pull request #1928 from chadswen/flannel-rbac-fix
...
Flannel RBAC Fix
2017-11-03 18:12:16 -04:00
b158dbcf79
Docker Version Update
...
Update default docker version to 17.03.1
2017-11-03 12:34:45 -05:00
ab3832f3e7
Set host IP for kubelet always ( #1924 )
...
* Set host IP for kubelet always
Use ansible default IP if ip var is not set.
* Update main.yml
2017-11-03 10:19:37 +00:00
9bf415f749
update helm to v2.7.0 ( #1875 )
...
* update helm to v2.7.0
* Update main.yml
2017-11-03 07:15:00 +00:00
a2bda9e5f1
Eliminate jinja2 template expression warning and rename coreos-python var ( #1911 )
...
* Change deprecated vagrant ansible flag 'sudo' to 'become'
* Emphasize, that the name of the pip_pyton_modules is only considered in coreos
* Remove useless unused variable
* Fix warning when jinja2 template-delimiters used in when statement
There is no need for jinja2 template-delimiters like {{ }} or {% %}
any more. They can just be omitted as described in https://github.com/ansible/ansible/issues/22397
* Fix broken link in getting-started guide
2017-11-03 07:11:36 +00:00
0195725563
Workaround ansible bug where access var via dict doesn't get real value ( #1912 )
...
* Change deprecated vagrant ansible flag 'sudo' to 'become'
* Workaround ansible bug where access var via dict doesn't get real value
When accessing a variable via it's name "{{ foo }}" its value is
retrieved. But when the variable value is retrieved via the vars-dict
"{{ vars['foo'] }}" this doesn't resolve the expression of the variable
any more due to a bug. So e.g. a expression foo="{{ 1 == 1 }}" isn't
longer resolved but just returned as string "1 == 1".
* Make file yamllint complient
2017-11-03 07:11:14 +00:00
ec1170bd37
only mount volumes if local_volumes_enabled is true. fix mount flags in rkt. ( #1923 )
2017-11-03 07:10:37 +00:00
66c67dbe73
Add optional helm deployment mode for host ( #1920 )
2017-11-03 07:09:24 +00:00
16ae2c1809
Flannel RBAC Fix
...
Fixes a bug that can occur if `cni-flannel-rbac.yml` was written but the playbook failed before it was applied. Uses the same approach as calico.
2017-11-02 23:20:23 -05:00
4771716ab2
Merge pull request #1907 from mattymo/disable_anon_auth
...
Block anonymous auth requests to kubelet
2017-11-02 12:01:39 -04:00
b156585739
Merge pull request #1917 from chadswen/docker-daemon-graph
...
Fix kubelet container with alternate Docker data paths
2017-11-02 11:58:55 -04:00
520103df78
Change namespace for provisioner account
2017-11-02 10:16:08 +00:00
3e3787de15
Fix local volume provisioner mount point for rkt
2017-11-02 09:45:26 +00:00
0c824d5ef1
Fix kubelet container with alternate Docker data paths
...
Some time ago I think the hardcoded `/var/lib/docker` was required, but kubelet running in a container has been aware of the Docker path since at least as far back as k8s 1.6.
Without this change, you see a large number of errors in the kubelet logs if you installed with a non-default `docker_daemon_graph`
2017-11-01 13:25:15 -05:00
c0e989b17c
New addon: local_volume_provisioner ( #1909 )
2017-11-01 14:25:35 +00:00
5218b3af82
Fix bad handler directory name in kubeadm role
2017-11-01 14:36:28 +01:00
ef0a91da27
Merge pull request #1891 from rsmitty/proxy-fixes
...
Improved proxy support
2017-10-31 14:32:12 -04:00
8412181746
Merge pull request #1899 from skyscooby/update_kube182
...
Update to Kubernetes 1.8.2
2017-10-31 14:30:56 -04:00
400ee2aa57
Merge pull request #1898 from skyscooby/update_kubedns
...
Update kubedns to 1.14.7 release
2017-10-31 14:30:36 -04:00
05b8466f87
Merge pull request #1890 from chadswen/apt-repo-params
...
Parameterize dockerproject apt repo endpoints
2017-10-31 14:29:19 -04:00
19962f6b6a
fix indentation for master template ( #1906 )
2017-10-31 06:43:54 +00:00
f7703dbca3
Block anonymous auth requests to kubelet
2017-10-30 19:06:54 +00:00
74a9eedb93
helm template check for http/https_proxy
2017-10-30 13:11:04 -04:00
6df104b275
don't check for no_proxy, only http/https_proxy. fix linting issues.
2017-10-30 11:42:14 -04:00
b27453d8d8
improved proxy support
2017-10-30 11:42:14 -04:00
4470ee4ccf
Merge pull request #1887 from mattymo/fix_indent_apiserver
...
fix indentation for network policy option
2017-10-30 11:33:13 -04:00
8a86acf75d
Update kubespray-defaults kubernetes to v1.8.2
2017-10-30 09:34:32 -04:00
d738acf638
Update kubelet.kubeadm.env.j2 ( #1901 )
2017-10-30 11:33:02 +00:00
84d92aa3c7
fix-bug ( #1900 )
2017-10-30 11:23:24 +00:00
dd01cabcdc
Update to kubernetes 1.8.2
2017-10-29 22:13:06 -04:00
c383c7e2c1
Update kubedns image to latest
2017-10-29 21:58:05 -04:00
958bb5285d
Update kubedns image to latest
2017-10-29 21:57:32 -04:00
f0317ae70b
Merge pull request #1876 from ArchiFleKs/update_flannel
...
update flannel
2017-10-27 15:22:54 -04:00
591941bd39
Merge pull request #1884 from abelgana/master
...
Sysctl reload if needed after IP forward enabling
2017-10-27 15:12:08 -04:00
e90769c869
Merge pull request #1888 from chapsuk/issue_1885
...
Disable swap in vagrant vms
2017-10-27 15:10:16 -04:00
256bbb1a8a
Parameterize apt repo endpoints
...
This allows overriding of apt repo endpoints when internet sources are not accessible. Additionally, switch to using the dockerproject.org gpg key url for apt instead of keyservers.net
2017-10-27 13:48:11 -05:00
2c7c956be9
Disable swap in vagrant vms
2017-10-27 19:57:54 +03:00
fe81bba08d
Force kubelet certificates to be generated as lowercase ( #1886 )
...
All nodes get converted to lowercase, so certs should set
CN with lowercase as well.
2017-10-27 15:58:25 +01:00
564de07963
fix indentation for network policy option
2017-10-27 14:56:22 +01:00
84cf6fbe83
change ssh_args/bastion configuration ( #1883 )
2017-10-27 12:18:39 +01:00
d9160f19c0
Sysctl reload if needed after IP forward enabling
...
Add reload yes to reload sysctl if the value of net.ipv4.ip_forward changes.
- name: Enable ip forwarding
sysctl:
sysctl_file: "{{sysctl_file_path}}"
name: net.ipv4.ip_forward
value: 1
state: present
reload: yes
tags:
- bootstrap-os
2017-10-26 13:06:21 -04:00
ba0a03a8ba
Merge pull request #1880 from mattymo/node_auth_fixes2
...
Move cluster roles and system namespace to new role
2017-10-26 10:02:24 -05:00
b0f04d925a
Update network policy setting for Kubernetes 1.8 ( #1879 )
...
It is now enabled by default in 1.8 with the api changed
to networking.k8s.io/v1 instead of extensions/v1beta1.
2017-10-26 15:35:26 +01:00
ec53b8b66a
Move cluster roles and system namespace to new role
...
This should be done after kubeconfig is set for admin and
before network plugins are up.
2017-10-26 14:36:05 +01:00
6e949bf951
update flannel
2017-10-26 11:18:06 +02:00
86fb669fd3
Idempotency fixes ( #1838 )
2017-10-25 21:19:40 +01:00
7123956ecd
update checksum for kubeadm ( #1869 )
2017-10-25 21:15:16 +01:00
46cf6b77cf
Merge pull request #1857 from pmontanari/patch-1
...
Use same kubedns_version: 1.14.5 in downloads and kubernetes-apps/ansible roles
2017-10-25 10:05:43 -04:00
a52bc44f5a
Fix broken CI jobs ( #1854 )
...
* Fix broken CI jobs
Adjust image and image_family scenarios for debian.
Checkout CI file for upgrades
* add debugging to file download
* Fix download for alternate playbooks
* Update ansible ssh args to force ssh user
* Update sync_container.yml
2017-10-25 11:45:54 +01:00
acb63a57fa
Only limit etcd memory on small hosts ( #1860 )
...
Also disable oom killer on etcd
2017-10-25 10:25:15 +01:00
5b08277ce4
Access dict item's value keys using .value ( #1865 )
2017-10-24 20:49:36 +01:00
5dc56df64e
Fix ordering of kube-apiserver admission control plug-ins ( #1841 )
2017-10-24 17:28:07 +01:00
33c4d64b62
Make ClusterRoleBinding to admit all nodes with right cert ( #1861 )
...
This is to work around #1856 which can occur when kubelet
hostname and resolvable hostname (or cloud instance name)
do not match.
2017-10-24 17:05:58 +01:00
25de6825df
Update Kubernetes to v1.8.1 ( #1858 )
2017-10-24 17:05:45 +01:00
0b60201a1e
fix etcd health check bug ( #1480 )
2017-10-24 16:10:56 +01:00
cfea99c4ee
Fix scale.yml to supoort kubeadm ( #1863 )
...
Signed-off-by: Haiwei Liu <carllhw@gmail.com>
2017-10-24 16:08:48 +01:00
cea41a544e
Use include instead of import tasks to support v2.3 ( #1855 )
...
Eventually 2.3 support will be dropped, so this is
a temporary change.
2017-10-23 13:56:03 +01:00
8371a060a0
Update main.yml
...
Match kubedns_version with roles/download/defaults/main.yml:kubedns_version: 1.14.5
2017-10-22 23:48:51 +02:00
7ed140cea7
Update refs to kubernetes version to v1.8.0 ( #1845 )
2017-10-20 08:29:28 +01:00
0b4fcc83bd
Fix up warnings and deprecations ( #1848 )
2017-10-20 08:25:57 +01:00
514359e556
Improve etcd scale up ( #1846 )
...
Now adding unjoined members to existing etcd cluster
occurs one at a time so that the cluster does not
lose quorum.
2017-10-20 08:02:31 +01:00
fc9a65be2b
Refactor downloads to use download role directly ( #1824 )
...
* Refactor downloads to use download role directly
Also disable fact delegation so download delegate works acros OSes.
* clean up bools and ansible_os_family conditionals
2017-10-19 09:17:11 +01:00
49dff97d9c
Relabel controler-manager to kube-controller-manager ( #1830 )
...
Fixes #1129
2017-10-18 17:29:18 +01:00
4efb0b78fa
Move CI vars out of gitlab and into var files ( #1808 )
2017-10-18 17:28:54 +01:00
c9fe8fde59
Use fail-swap-on flag only for kube_version >= 1.8 ( #1829 )
2017-10-18 16:32:38 +01:00
16462292e1
Properly skip extra SANs when not specified for kubeadm ( #1831 )
2017-10-18 12:04:13 +01:00
20d80311f0
Update main.yml ( #1822 )
...
* Update main.yml
Needs to set up resolv.conf before updating Yum cache otherwise no name resolution available (resolv.conf empty).
* Update main.yml
Removing trailing spaces
2017-10-18 11:42:00 +01:00
3acc42c5b3
Use etcd_access_addresses for vault_etcd_url
2017-10-17 19:27:36 +03:30
54320c5b09
set to 3 digit version number ( #1817 )
2017-10-17 11:14:29 +01:00
291b71ea3b
Changing default value string to boolean. ( #1669 )
...
When downloading containers or files, use boolean
as a default value.
2017-10-17 11:14:12 +01:00
356515222a
Add possibility to insert more ip adresses in certificates ( #1678 )
...
* Add possibility to insert more ip adresses in certificates
* Add newline at end of files
* Move supp ip parameters to k8s-cluster group file
* Add supplementary addresses in kubeadm master role
* Improve openssl indexes
2017-10-17 11:06:07 +01:00
688e589e0c
fix #1788 lock dashboard version to 1.6.3 version while 1.7.x is not working ( #1805 )
2017-10-17 11:04:55 +01:00
6c98201aa4
remove kube-dns versions and images in kubernetes-apps/ansible/defaults/main.yaml ( #1807 )
2017-10-17 11:03:53 +01:00
d4b10eb9f5
Fix path for calico get node names ( #1816 )
2017-10-17 10:54:48 +01:00
728d56e74d
Only write bastion ssh config when needed ( #1810 )
...
This will allow running Kubespray when the user who runs it doesn't
have write permissions to the Kubespray dir, at least when not using
bastion.
2017-10-17 10:28:45 +01:00
77f1d4b0f1
Revert "Update roadmap" ( #1809 )
...
* Revert "Debian jessie docs (#1806 )"
This reverts commit d78577c810#1800 )"
This reverts commit 5fb6b2eaf7#1799 )"
This reverts commit 404caa111a#1780 )"
This reverts commit b838468500#1779 )"
This reverts commit f2235be1d3#1763 )"
This reverts commit 6ec45b10f1#1795 )"
This reverts commit d9879d8026
2017-10-16 14:09:24 +01:00
b838468500
Fixed kubelet standard log environment ( #1780 )
...
Change KUBE_LOGGING to KUBE_LOGTOSTDERR, when installing kubelet
as host type.
2017-10-16 08:22:54 +01:00
f2235be1d3
Add support for fedora atomic host ( #1779 )
...
* don't try to install this rpm on fedora atomic
* add docker 1.13.1 for fedora
* built-in docker unit file is sufficient, as tested on both fedora and centos atomic
2017-10-16 08:03:33 +01:00
6ec45b10f1
Update network-plugins to use portmap plugin ( #1763 )
...
Portmap allow to use hostPort with CNI plugins. Should fix #1675
2017-10-16 07:11:38 +01:00
d9879d8026
Update roadmap ( #1795 )
2017-10-16 07:06:06 +01:00
d487b2f927
Security best practice fixes ( #1783 )
...
* Disable basic and token auth by default
* Add recommended security params
* allow basic auth to fail in tests
* Enable TLS authentication for kubelet
2017-10-15 20:41:17 +01:00
66e5e14bac
Restart kubelet on update in deployment-type host on update ( #1759 )
...
* Restart kubelet on update in deployment-type host on update
* Update install_host.yml
* Update install_host.yml
* Update install_host.yml
2017-10-15 20:22:17 +01:00
7e4668859b
Change file used to check kubeadm upgrade method ( #1784 )
...
* Change file used to check kubeadm upgrade method
Test for ca.crt instead of admin.conf because admin.conf
is created during normal deployment.
* more fixes for upgrade
2017-10-15 10:33:22 +01:00
92d038062e
Fix node authorization for cloudprovider installs ( #1794 )
...
In 1.8, the Node authorization mode should be listed first to
allow kubelet to access secrets. This seems to only impact
environments with cloudprovider enabled.
2017-10-14 11:28:46 +01:00
2972bceb90
Changre raw execution to use yum module ( #1785 )
...
* Changre raw execution to use yum module
Changed raw exection to use yum module provided by Ansible.
* Replace ansible_ssh_* by ansible_*
Ansible 2.0 has deprecated the “ssh” from ansible_ssh_user, ansible_ssh_host, and ansible_ssh_port to become ansible_user, ansible_host, and ansible_port. If you are using a version of Ansible prior to 2.0, you should continue using the older style variables (ansible_ssh_*). These shorter variables are ignored, without warning, in older versions of Ansible.
I am not sure about the broader impact of this change. But I have seen on the requirements the version required is ansible>=2.4.0.
http://docs.ansible.com/ansible/latest/intro_inventory.html
2017-10-14 09:52:40 +01:00
cb0a60a0fe
calico v2.5.0 should use calico/routereflector:v0.4.0 ( #1792 )
2017-10-14 09:51:48 +01:00
3ee91e15ff
Use commas in no_proxy ( #1782 )
2017-10-13 15:43:10 +01:00
ef47a73382
Add new addon Istio ( #1744 )
...
* add istio addon
* add addons to a ci job
2017-10-13 15:42:54 +01:00
dc515e5ac5
Remove kernel-upgrade role ( #1798 )
...
This role only support Red Hat type distros and is not maintained
or used by many users. It should be removed because it creates
feature disparity between supported OSes and is not maintained.
2017-10-13 15:36:21 +01:00
56763d4288
Persist br_netfilter module loading ( #1760 )
2017-10-13 10:50:29 +01:00
10dd049912
Revert "Security fixes for etcd ( #1778 )" ( #1786 )
...
This reverts commit 4209f1cbfd
2017-10-12 14:02:51 +01:00
4209f1cbfd
Security fixes for etcd ( #1778 )
...
* Security fixes for etcd
* Use certs when querying etcd
2017-10-12 13:32:54 +01:00
ee83e874a8
Clear admin kubeconfig when rotating certs ( #1772 )
...
* Clear admin kubeconfig when rotating certs
* Update main.yml
2017-10-12 09:55:46 +01:00
27ed73e3e3
Rename dns_server, add var for selinux. ( #1572 )
...
* Rename dns_server to dnsmasq_dns_server so that it includes role prefix
as the var name is generic and conflicts when integrating with existing ansible automation.
* Enable selinux state to be configurable with new var preinstall_selinux_state
2017-10-11 20:40:21 +01:00
e41c0532e3
add possibility to disable fail with swap ( #1773 )
2017-10-11 19:49:31 +01:00
eeb7274d65
Adjust memory reservation for master nodes ( #1769 )
2017-10-11 19:47:42 +01:00
eb0dcf6063
Improve proxy ( #1771 )
...
* Set no_proxy to all local ips
* Use proxy settings on all necessary tasks
2017-10-11 19:47:27 +01:00
83be0735cd
Fix setting etcd client cert serial ( #1775 )
2017-10-11 19:47:11 +01:00
fe4ba51d1a
Set node IP correctly ( #1770 )
...
Fixes #1741
2017-10-11 15:28:42 +01:00
adf575b75e
Set default value for disable_shared_pid ( #1710 )
...
PID namespace sharing is disabled only in Kubernetes 1.7.
Explicitily enabling it by default could help reduce unexpected
results when upgrading to or downgrading from 1.7.
2017-10-11 14:55:51 +01:00
e5426f74a8
Merge pull request #1762 from manics/bindir-helm
...
Include bin_dir when patching helm tiller with kubectl
2017-10-10 10:40:47 -04:00
f5212d3b79
Merge pull request #1752 from pmontanari/patch-1
...
Force synchronize to use ssh_args so it works when using bastion
2017-10-10 10:40:01 -04:00
3d09c4be75
Merge pull request #1756 from kubernetes-incubator/fix_bool_assert
...
Fix bool check assert
2017-10-10 10:38:53 -04:00
f2db15873d
Merge pull request #1754 from ArchiFleKs/rkt-kubelet-fix
...
add hosts to rkt kubelet
2017-10-10 10:37:36 -04:00
7c663de6c9
add /etc/hosts volume to rkt templates
2017-10-09 16:41:51 +02:00
c14bbcdbf2
Include bin_dir when patching helm tiller with kubectl
2017-10-09 15:17:52 +01:00
1be4c1935a
Fix bool check assert
2017-10-06 17:02:38 +00:00
764b1aa5f8
Force synchronize to use ssh_args so it works when using bastion
...
In case ssh.config is set to use bastion, synchronize needs to use it too.
2017-10-06 00:21:54 +02:00
d13b07ba59
Merge pull request #1751 from bradbeam/calicoprometheus
...
Adding calico/node env vars for prometheus configuration
2017-10-05 17:29:12 -04:00
55dfae2a52
Followup fix for CVE-2017-14491
2017-10-05 11:31:04 -05:00
b81c0d869c
Adding calico/node env vars for prometheus configuration
2017-10-05 08:46:01 -05:00
f14f04c5ea
Upgrade to kubernetes v1.8.0 ( #1730 )
...
* Upgrade to kubernetes v1.8.0
hyperkube no longer contains rsync, so now use cp
* Enable node authorization mode
* change kube-proxy cert group name
2017-10-05 10:51:21 +01:00
9c86da1403
Normalize tags in all places to prepare for tag fixing in future ( #1739 )
2017-10-05 08:43:04 +01:00
cb611b5ed0
Merge pull request #1742 from mattymo/facts_as_vars
...
Move set_facts to kubespray-defaults defaults
2017-10-04 15:46:39 -04:00
ab171a1d6d
don't delegate cert slurp
2017-10-04 13:06:51 -04:00
a56738324a
Move set_facts to kubespray-defaults defaults
...
These facts can be generated in defaults with a performance
boost.
Also cleaned up duplicate etcd var names.
2017-10-04 14:02:47 +01:00
e42cb43ca5
add bootstrap for debian ( #1726 )
2017-10-03 08:30:45 +01:00
ca541c7e4a
Ensuring vault service is stopped in reset tasks ( #1736 )
2017-10-03 08:30:28 +01:00
96e14424f0
Adding kubedns update for CVE-2017-14491 ( #1735 )
2017-10-03 08:30:14 +01:00
dae9f6d3c2
Test if tokens are expired from host instead of inside container ( #1727 )
...
* Test if tokens are expired from host instead of inside container
* Update main.yml
2017-10-02 13:14:50 +01:00
8e1210f96e
Fix cluster-network w/ prefix > 25 not possible with CNI ( #1713 )
2017-10-01 10:43:00 +01:00
1b9a6d7ad8
Merge pull request #1672 from manics/bastion-proxycommand-newline
...
Insert a newline in bastion ssh config after ProxyCommand conditional
2017-09-29 11:37:47 -05:00
371fa51e82
Make installation of EPEL optional ( #1721 )
2017-09-29 13:44:29 +01:00
a55675acf8
Enable RBAC with kubeadm always ( #1711 )
2017-09-29 09:18:24 +01:00
25dd3d476a
Fix error for azure+calico assert ( #1717 )
...
Fixes #1716
2017-09-29 08:17:18 +01:00
3ff5f40bdb
fix graceful upgrade ( #1704 )
...
Fix system namespace creation
Only rotate tokens when necessary
2017-09-27 14:49:20 +01:00
689ded0413
Enable kubeadm upgrades to any version ( #1709 )
2017-09-27 14:48:18 +01:00
327ed157ef
Verify valid settings before deploy ( #1705 )
...
Also fix yaml lint issues
Fixes #1703
2017-09-27 14:47:47 +01:00
477afa8711
when and run_once are reduplicative ( #1694 )
2017-09-26 14:48:05 +01:00
bd272e0b3c
Upgrade to kubeadm ( #1667 )
...
* Enable upgrade to kubeadm
* fix kubedns upgrade
* try upgrade route
* use init/upgrade strategy for kubeadm and ignore kubedns svc
* Use bin_dir for kubeadm
* delete more secrets
* fix waiting for terminating pods
* Manually enforce kube-proxy for kubeadm deploy
* remove proxy. update to kubeadm 1.8.0rc1
2017-09-26 10:38:58 +01:00
14c232e3c4
Merge pull request #1663 from foxyriver/fix-shell
...
use command module instead of shell module
2017-09-25 13:24:45 -05:00
57f5fb1f4f
Merge pull request #1661 from neith00/master
...
upgrading from weave version 2.0.1 to 2.0.4
2017-09-25 13:23:57 -05:00
bcddfb786d
Merge pull request #1692 from mattymo/old-etcd-logic
...
drop unused etcd logic
2017-09-25 17:44:33 +02:00
20db1738fa
feature: install project atomic CSS on RedHat family ( #1499 )
...
* feature: install project atomic CSS on RedHat family
* missing patch for this feature
* sub-role refactor
* Yamllint fix
2017-09-25 12:29:17 +01:00
b23d81f825
Add etcd_blkio_weight var ( #1690 )
2017-09-25 12:20:24 +01:00
a1cde03b20
Correct master manifest cleanup logic ( #1693 )
...
Fixes #1666
2017-09-25 12:19:04 +01:00
cfce23950a
Merge pull request #1687 from jistr/cgroup-driver-kubeadm
...
Set correct kubelet cgroup-driver also for kubeadm deployments
2017-09-25 11:16:40 +02:00
64740249ab
Adds tags for asserts ( #1639 )
2017-09-25 08:41:03 +01:00
126f42de06
drop unused etcd logic
...
Fixes #1660
2017-09-25 07:52:55 +01:00
d94e3a81eb
Use api lookup for kubelet hostname when using cloudprovider ( #1686 )
...
The value cannot be determined properly via local facts, so
checking k8s api is the most reliable way to look up what hostname
is used when using a cloudprovider.
2017-09-24 09:22:15 +01:00
70d0235770
Set correct kubelet cgroup-driver also for kubeadm deployments
...
This follows pull request #1677 , adding the cgroup-driver
autodetection also for kubeadm way of deploying.
Info about this and the possibility to override is added to the docs.
2017-09-22 13:19:04 +02:00
30b5493fd6
use command module instead of shell module
2017-09-22 15:47:03 +08:00
dbbe9419e5
Allow setting cgroup driver for kubelet
...
Red Hat family platforms run docker daemon with `--exec-opt
native.cgroupdriver=systemd`. When kubespray tried to start kubelet
service, it failed with:
Error: failed to run Kubelet: failed to create kubelet: misconfiguration: kubelet cgroup driver: "cgroupfs" is different from docker cgroup driver: "systemd"
Setting kubelet's cgroup driver to the correct value for the platform
fixes this issue. The code utilizes autodetection of docker's cgroup
driver, as different RPMs for the same distro may vary in that regard.
2017-09-21 11:58:11 +02:00
188bae142b
Fix wait for hosts in CI ( #1679 )
...
Also fix usage of failed_when and handling exit code.
2017-09-20 14:30:09 +01:00
7c2b12ebd7
Insert a newline in bastion after ProxyCommand conditional
2017-09-18 16:29:12 +01:00
ef8e35e39b
Create admin credential kubeconfig ( #1647 )
...
New files: /etc/kubernetes/admin.conf
/root/.kube/config
$GITDIR/artifacts/{kubectl,admin.conf}
Optional method to download kubectl and admin.conf if
kubeconfig_lcoalhost is set to true (default false)
2017-09-18 13:30:57 +01:00
aaa27d0a34
Adding quotes around parameters in cloud_config ( #1664 )
...
This is to help support escapes and special characters
2017-09-16 08:43:47 +01:00
9302ce0036
Enhanced OpenStack cloud provider ( #1627 )
...
- Enable Cinder API version for block storage
- Enable floating IP for LBaaS
2017-09-16 08:43:24 +01:00
8e731337ba
Enable HA deploy of kubeadm ( #1658 )
...
* Enable HA deploy of kubeadm
* raise delay to 60s for starting gce hosts
2017-09-15 22:28:15 +01:00
b294db5aed
fix apply for netchecker upgrade ( #1659 )
...
* fix apply for netchecker upgrade and graceful upgrade
* Speed up daemonset upgrades. Make check wait for ds upgrades.
2017-09-15 13:19:37 +01:00
f2ae16e71d
Merge pull request #1651 from bradbeam/vaultnocontent
...
Fixing condition where vault CA already exists
2017-09-14 17:04:15 -05:00
ac281476c8
Prune unnecessary certs from vault setup ( #1652 )
...
* Cleaning up cert checks for vault
* Removing all unnecessary etcd certs from each node
* Removing all unnecessary kube certs from each node
2017-09-14 12:28:11 +01:00
1b1c8d31a9
upgrading from weave version 2.0.1 to 2.0.4
...
This upgrade has been testing offline on a 1.7.5 cluster
2017-09-14 10:29:28 +02:00
4b587aaf99
Adding ability to specify altnames for vault cert ( #1640 )
2017-09-14 07:19:44 +01:00
016301508e
Update to Kubernetes v1.7.5 ( #1649 )
2017-09-14 07:18:03 +01:00
6744726089
kubeadm support ( #1631 )
...
* kubeadm support
* move k8s master to a subtask
* disable k8s secrets when using kubeadm
* fix etcd cert serial var
* move simple auth users to master role
* make a kubeadm-specific env file for kubelet
* add non-ha CI job
* change ci boolean vars to json format
* fixup
* Update create-gce.yml
* Update create-gce.yml
* Update create-gce.yml
2017-09-13 19:00:51 +01:00
0a89f88b89
Fixing condition where CA already exists
2017-09-13 03:40:46 +00:00
69fac8ea58
Merge pull request #1634 from bradbeam/calico_cni
...
fix for calico cni plugin node name
2017-09-11 22:18:06 -05:00
e8bde03a50
Setting kubectl bin directory ( #1635 )
2017-09-09 23:54:13 +03:00
75b13caf0b
Fix kube-apiserver status checks when changing insecure bind addr ( #1633 )
2017-09-09 23:41:48 +03:00
5d99fa0940
Purge old upgrade hooks and unused tasks ( #1641 )
2017-09-09 23:41:20 +03:00
649388188b
Fix netchecker update side effect ( #1644 )
...
* Fix netchecker update side effect
kubectl apply should only be used on resources created
with kubectl apply. To workaround this, we should apply
the old manifest before upgrading it.
* Update 030_check-network.yml
2017-09-09 23:38:38 +03:00
9fa1873a65
Add kube dashboard, enabled by default ( #1643 )
...
* Add kube dashboard, enabled by default
Also add rbac role for kube user
* Update main.yml
2017-09-09 23:38:03 +03:00
f2057dd43d
Refactor downloads ( #1642 )
...
* Refactor downloads
Add prefixes to tasks (file vs container)
Remove some delegates
Clean up some conditions
* Update ansible.cfg
2017-09-09 23:32:12 +03:00
eeffbbb43c
Updating calicocni.hostname to calicocni.nodename
2017-09-08 12:47:40 +00:00
aaa0105f75
Flexing calicocni.hostname based on cloud provider
2017-09-08 12:47:40 +00:00
079d317ade
Default is_atomic to false ( #1637 )
2017-09-08 15:00:57 +03:00
e16b57aa05
Store vault users passwords to credentials dir. Create vault and etcd roles after start vault cluster ( #1632 )
2017-09-07 23:30:16 +03:00
7117614ee5
Use a generated password for kube user ( #1624 )
...
Removed unnecessary root user
2017-09-06 20:20:25 +03:00
e26aec96b0
Consolidate kube-proxy module and sysctl loading ( #1586 )
...
This sets br_netfilter and net.bridge.bridge-nf-call-iptables sysctl from a single play before kube-proxy is first ran instead of from the flannel and weave network_plugin roles after kube-proxy is started
2017-09-06 15:11:51 +03:00
c60d104056
Update checksums (etcd calico calico-cni weave) to fix uploads.yml ( #1584 )
...
the uploads.yml playbook was broken with checksum mismatch errors in
various kubespray commits, for example, 3bfad5ca73
2017-09-06 15:11:13 +03:00
e6ff8c92a0
Using 'hostnamectl' to set unconfigured hostname on CoreOS ( #1600 )
2017-09-06 15:10:52 +03:00
cbaa2b5773
Retry Remove all Docker containers in reset ( #1623 )
...
Due to various occasional docker bugs, removing a container will sometimes fail. This can often be mitigated by trying again.
2017-09-06 14:23:16 +03:00
0453ed8235
Fix an error with Canal when RBAC are disabled ( #1619 )
...
* Fix an error with Canal when RBAC are disabled
* Update using same rbac strategy used elsewhere
2017-09-06 11:32:32 +03:00
a341adb7f3
Updating CN for node certs generated by vault ( #1622 )
...
This allows the node authorization plugin to function correctly
2017-09-06 10:55:08 +03:00
957b7115fe
Remove node name from kube-proxy and admin certificates
2017-09-05 14:40:26 +03:00
b930b0ef5a
Place vault role credentials only to vault group hosts
2017-09-05 11:16:18 +03:00
ad313c9d49
typo fix
2017-09-05 09:07:36 +03:00
e1384f6618
Using issue cert result var instead hostvars
2017-09-05 09:07:36 +03:00
3acb86805b
Rename vault_address to vault_bind_address
2017-09-05 09:07:35 +03:00
bf0af1cd3d
Vault role updates:
...
* using separated vault roles for generate certs with different `O` (Organization) subject field;
* configure vault roles for issuing certificates with different `CN` (Common name) subject field;
* set `CN` and `O` to `kubernetes` and `etcd` certificates;
* vault/defaults vars definition was simplified;
* vault dirs variables defined in kubernetes-defaults foles for using
shared tasks in etcd and kubernetes/secrets roles;
* upgrade vault to 0.8.1;
* generate random vault user password for each role by default;
* fix `serial` file name for vault certs;
* move vault auth request to issue_cert tasks;
* enable `RBAC` in vault CI;
2017-09-05 09:07:35 +03:00
c77d11f1c7
Bugfix ( #1616 )
...
lost executable path
2017-09-05 08:35:14 +03:00
d279d145d5
Fix non-rbac deployment of resources as a list ( #1613 )
...
* Use kubectl apply instead of create/replace
Disable checks for existing resources to speed up execution.
* Fix non-rbac deployment of resources as a list
* Fix autoscaler tolerations field
* set all kube resources to state=latest
* Update netchecker and weave
2017-09-05 08:23:12 +03:00
fc7905653e
Add socat for CoreOS when using host deploy kubelet ( #1575 )
2017-09-04 11:30:18 +03:00
660282e82f
Make daemonsets upgradeable ( #1606 )
...
Canal will be covered by a separate PR
2017-09-04 11:30:01 +03:00
77602dbb93
Move calico to daemonset ( #1605 )
...
* Drop legacy calico logic
* add calico as a daemonset
2017-09-04 11:29:51 +03:00
a3e6896a43
Add RBAC support for canal ( #1604 )
...
Refactored how rbac_enabled is set
Added RBAC to ubuntu-canal-ha CI job
Added rbac for calico policy controller
2017-09-04 11:29:40 +03:00
702ce446df
Apply ClusterRoleBinding to dnsmaq when rbac_enabled ( #1592 )
...
* Add RBAC policies to dnsmasq
* fix merge conflict
* yamllint
* use .j2 extension for dnsmasq autoscaler
2017-09-03 10:53:45 +03:00
8ae77e955e
Adding in certificate serial numbers to manifests ( #1392 )
2017-09-01 09:02:23 +03:00
783924e671
Change backup handler to only run v2 data backup if snap directory exists ( #1594 )
2017-08-31 18:23:24 +03:00
93304e5f58
Fix calico leaving service behind. ( #1599 )
2017-08-31 12:00:05 +03:00
917373ee55
Merge pull request #1595 from bradbeam/cacerts
...
Fixing CA certificate locations for k8s components
2017-08-30 21:31:19 -05:00
7a98ad50b4
Fixing CA certificate locations for k8s components
2017-08-30 15:30:40 -05:00
982058cc19
Merge pull request #1514 from vijaykatam/docker_systemd
...
Configurable docker yum repos, systemd fix
2017-08-30 11:50:23 -05:00
576beaa6a6
Include /opt/bin in PATH for host deployed kubelet on CoreOS ( #1591 )
...
* Include /opt/bin in PATH for host deployed kubelet on CoreOS
* Removing conditional check for CoreOS
2017-08-30 16:50:33 +03:00
6eb22c5db2
Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s ( #1552 )
...
* Added update CA trust step for etcd and kube/secrets roles
* Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os.
* Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube.
* Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd.
* Fixed different certificates set for vault cert_managment
* Update doc/vault.md
* Fixed condition create vault CA, wrong group
* Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts
* Removed wrong when condition in create etcd role vault tasks.
2017-08-30 16:03:22 +03:00
72a0d78b3c
Merge pull request #1585 from mattymo/canal_upgrade
...
Fix upgrade for canal and apiserver cert
2017-08-29 18:45:21 -05:00
13d08af054
Fix upgrade for canal and apiserver cert
...
Fixes #1573
2017-08-29 22:08:30 +01:00
6c30a7b2eb
update calico version
...
update calico releases link
2017-08-28 16:23:51 -07:00
76b72338da
Add CNI config for rkt kubelet ( #1579 )
2017-08-28 21:11:01 +03:00
a39e78d42d
Initial version of Flannel using CNI ( #1486 )
...
* Updates Controller Manager/Kubelet with Flannel's required configuration for CNI
* Removes old Flannel installation
* Install CNI enabled Flannel DaemonSet/ConfigMap/CNI bins and config (with portmap plugin) on host
* Uses RBAC if enabled
* Fixed an issue that could occur if br_netfilter is not a module and net.bridge.bridge-nf-call-iptables sysctl was not set
2017-08-25 10:07:50 +03:00
4550dccb84
Fixing reference to vault leader url ( #1569 )
2017-08-24 23:21:39 +03:00
01ce09f343
Add feature_gates var for customizing Kubernetes feature gates ( #1520 )
2017-08-24 23:18:38 +03:00
71dca67ca2
Merge pull request #1508 from tmjd/update-calico-2-4-0
...
Update Calico to 2.4.1 release.
2017-08-24 14:57:29 -05:00
a98b866a66
Verify if br_netfilter module exists ( #1492 )
2017-08-24 17:47:32 +03:00
3aabba7535
Remove discontinued option --reconcile-cidr if kube_network_plugin=="cloud" ( #1568 )
2017-08-24 17:01:30 +03:00
c22cfa255b
Added private key file to ssh bastion conf ( #1563 )
...
* Added private key file to ssh bastion conf
* Used regular if condition insted of inline conditional
2017-08-24 17:00:45 +03:00
6bb3463e7c
Enable scheduling of critical pods and network plugins on master
...
Added toleration to DNS, netchecker, fluentd, canal, and
calico policy.
Also small fixes to make yamllint pass.
2017-08-24 10:41:17 +01:00
8b151d12b9
Adding yamllinter to ci steps ( #1556 )
...
* Adding yaml linter to ci check
* Minor linting fixes from yamllint
* Changing CI to install python pkgs from requirements.txt
- adding in a secondary requirements.txt for tests
- moving yamllint to tests requirements
2017-08-24 12:09:52 +03:00
ecb6dc3679
Register standalone master w/ taints ( #1426 )
...
If Kubernetes > 1.6 register standalone master nodes w/ a
node-role.kubernetes.io/master=:NoSchedule taint to allow
for more flexible scheduling rather than just marking unschedulable.
2017-08-23 16:44:11 +03:00
49a223a17d
Update elrepo-release rpm version ( #1554 )
2017-08-23 09:54:51 +03:00
e5cfdc648c
Adding ability to override max ttl ( #1559 )
...
Prior this would fail because we didnt set max ttl for vault temp
2017-08-23 09:54:01 +03:00
9f9f70aade
Update Calico to 2.4.1 release.
...
- Switched Calico images to be pulled from quay.io
- Updated Canal too
2017-08-21 09:33:12 -05:00
ca3050ec3d
Update to Kubernetes v1.7.3 ( #1549 )
...
Change kubelet deploy mode to host
Enable cri and qos per cgroup for kubelet
Update CoreOS images
Add upgrade hook for switching from kubelet deployment from docker to host.
Bump machine type for ubuntu-rkt-sep
2017-08-21 10:53:49 +03:00
97031f9133
Make epel-release install configurable ( #1497 )
2017-08-20 14:03:10 +03:00
c92506e2e7
Add calico variable that enables ignoring Kernel's RPF Setting ( #1493 )
2017-08-20 14:01:09 +03:00
65a9772adf
Add OpenStack LBaaS support ( #1506 )
2017-08-20 13:59:15 +03:00
1e07ee6cc4
etcd_compaction_retention every 8 hour ( #1527 )
2017-08-20 13:55:48 +03:00
3c710219a1
Fix Some Typos in kubernetes master role ( #1547 )
...
* Fix Typo etc3 -> etcd3
* Fix typo in post-upgrade of master. stop -> start
2017-08-20 13:54:28 +03:00
2ba285a544
Fixed deploy cluster with vault cert manager ( #1548 )
...
* Added custom ips to etcd vault distributed certificates
* Added custom ips to kube-master vault distributed certificates
* Added comment about issue_cert_copy_ca var in vault/issue_cert role file
* Generate kube-proxy, controller-manager and scheduler certificates by vault
* Revert "Disable vault from CI (#1546 )"
This reverts commit 781f31d2b8
2017-08-20 13:53:58 +03:00
72ae7638bc
Merge pull request #1446 from matlockx/master
...
add possibility to ignore the hostname override
2017-08-18 17:03:40 +02:00
3bfad5ca73
Bump etcd to 3.2.4 ( #1468 )
2017-08-18 17:12:33 +03:00
df28db0066
Fix cert and netchecker upgrade issues ( #1543 )
...
* Bump tag for upgrade CI, fix netchecker upgrade
netchecker-server was changed from pod to deployment, so
we need an upgrade hook for it.
CI now uses v2.1.1 as a basis for upgrade.
* Fix upgrades for certs from non-rbac to rbac
2017-08-18 15:46:22 +03:00
20183f3860
Bump Calico CNI Plugin to 1.8.0 ( #1458 )
...
This aligns calico component versions with Calico release 2.1.5 and
fixes an issue with nodes being unable to schedule existing workloads
as per [#349 ](https://github.com/projectcalico/cni-plugin/issues/349 )
2017-08-18 15:40:14 +03:00
2645e88b0c
Fix vault setup partially ( #1531 )
...
This does not address per-node certs and scheduler/proxy/controller-manager
component certs which are now required. This should be handled in a
follow-up patch.
2017-08-18 15:09:45 +03:00
55ba81fee5
Add changed_when: false to rpm query
2017-08-14 12:31:44 -07:00
af007c7189
Fixing netchecker-server type - pod => deployment ( #1509 )
2017-08-14 18:43:56 +03:00
b22bef5cfb
Apply RBAC to efk and create fluentd.conf
...
Making fluentd.conf as configmap to change configuration.
Change elasticsearch rc to deployment.
Having installed previous elastaicsearch as rc, first should delete that.
2017-08-11 05:31:50 +00:00
7ad5523113
restrict rpm query to redhat
2017-08-10 13:49:14 -07:00
1155008719
Merge pull request #1481 from magnon-bliex/fluentd-template-fix-typo
...
fixed typo in fluentd-ds.yml.j2
2017-08-10 08:19:59 -05:00
5efda3eda9
Configurable docker yum repos, systemd fix
...
* Make yum repos used for installing docker rpms configurable
* TasksMax is only supported in systemd version >= 226
* Change to systemd file should restart docker
2017-08-09 15:49:53 -07:00
383d582b47
Merge pull request #1382 from jwfang/rbac
...
basic rbac support
2017-08-07 08:01:51 -05:00
6eacedc443
Merge pull request #1483 from delfer/patch-3
...
Update flannel from 0.6.2 to 0.8.0
2017-08-01 13:57:43 -04:00
e55f8a61cd
Merge pull request #1482 from bradbeam/fix1393
...
Removing run_once in these tasks so that etcd ca certs get propogated…
2017-07-31 13:47:18 -04:00
cb6892d2ed
Merge pull request #1469 from hzamani/etcd_metrics
...
Add etcd metrics flag
2017-07-31 09:04:07 -04:00
43eda8d878
Merge pull request #1471 from whereismyjetpack/fix_1447
...
add newline after expanding user information
2017-07-31 09:03:04 -04:00
cc9f3ea938
Fix enforce-node-allocatable option
...
Closes #1228
pods is default enforcement
see https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/
add
update
2017-07-31 10:06:53 +02:00
8bc717a55c
Update flannel from 0.6.2 to 0.8.0
2017-07-29 10:54:31 +03:00
d09222c900
Removing run_once in these tasks so that etcd ca certs get propogated properly to worker nodes
...
without this etcd ca certs dont exist on worker nodes causing calico to fail
2017-07-28 14:34:47 -05:00
38eb1d548a
fixed typo
2017-07-28 14:10:13 +09:00
e0960f6288
FIX: Unneded (extra) cycles in some tasks ( #1393 )
2017-07-27 20:46:21 +03:00
3e457e4edf
Enable weave seed mode for kubespray ( #1414 )
...
* Enable weave seed mode for kubespray
* fix task Weave seed | Set peers if existing peers
* fix mac address variabilisation
* fix default values
* fix include seed condition
* change weave var to default values
* fix Set peers if existing peers
2017-07-26 19:09:34 +03:00
c4894d6092
add newline after expanding user information
2017-07-25 12:59:10 -04:00
3fb0383df4
Add etcd metrics flag
2017-07-25 20:00:30 +04:30
ee36763f9d
Merge pull request #1464 from johnko/patch-4
...
set loadbalancer_apiserver_localhost default true
2017-07-25 10:00:56 -04:00
955c5549ae
Merge pull request #1402 from Lendico/fix_failed_when
...
"failed_when: false" and "|succeeded" checks for registered vars
2017-07-25 09:33:43 -04:00
4a34514b21
Merge pull request #1447 from whereismyjetpack/template_known_users
...
Template out known_users.csv, optionally add groups
2017-07-25 08:55:08 -04:00
20f29327e9
Merge pull request #1379 from gdmello/etcd_data_dir_fix
...
Custom `etcd_data_dir` saves etcd data to host, not container
2017-07-20 09:30:18 -05:00
018b5039e7
set loadbalancer_apiserver_localhost default true
...
to match this https://github.com/kubernetes-incubator/kubespray/blob/master/roles/kubernetes/node/tasks/main.yml#L20
and the documented behaviour in HA docs
related to #1456
@rsmitty
2017-07-20 10:27:05 -04:00
b5d3d4741f
Merge pull request #1454 from Abdelsalam-Abbas/higher_drain_timeout
...
higher the timeouts for draining nodes while upgrading kubernetes version
2017-07-19 10:39:33 -04:00
85c747d444
Merge pull request #1441 from bradbeam/1434
...
Adding recursive=true for rkt kubelet dir
2017-07-19 10:38:06 -04:00
927e6d89d7
Merge pull request #1435 from delfer/master
...
Kubernetes upgrade to 1.6.7
2017-07-19 05:23:38 -07:00
3d87f23bf5
uncomment unintended local changes
2017-07-19 12:11:47 +08:00
789910d8eb
remote unused netchecker-agent-hostnet-ds.j2
2017-07-17 19:29:59 +08:00
a8e6a0763d
run netchecker-server with list pods
2017-07-17 19:29:59 +08:00
e1386ba604
only patch system:kube-dns role for old dns
2017-07-17 19:29:59 +08:00
83deecb9e9
Revert "no need to patch system:kube-dns"
...
This reverts commit c2ea8c588aa5c3879f402811d3599a7bb3ccab24.
2017-07-17 19:29:59 +08:00
d8dcb8f6e0
no need to patch system:kube-dns
2017-07-17 19:29:59 +08:00
552b2f0635
change authorization_modes default value
2017-07-17 19:29:59 +08:00
0b3badf3d8
revert calico-related changes
2017-07-17 19:29:59 +08:00
cea3e224aa
change authorization_modes default value
2017-07-17 19:29:59 +08:00
1eaf0e1c63
rename task
2017-07-17 19:29:59 +08:00
2cda982345
binding group system:nodes to clusterrole calico-role
2017-07-17 19:29:59 +08:00
c9734b6d7b
run calico-policy-controller with proper sa/role/rolebinding
2017-07-17 19:29:59 +08:00
fd01377f12
remove more bins when reset
2017-07-17 19:29:59 +08:00
092bf07cbf
basic rbac support
2017-07-17 19:29:59 +08:00
5145a8e8be
higher draining timeouts
2017-07-16 20:52:13 +00:00
d1f58fed4c
Template out known_users.csv, optionally add groups
2017-07-14 09:27:20 -04:00
12e918bd31
add possibility to ignore the hostname override
2017-07-13 14:04:39 +00:00
637f445c3f
Merge pull request #1365 from AtzeDeVries/master
...
Give more control over IPIP, but with same default behaviour
2017-07-12 10:17:17 -05:00
e0bf8b2aab
Adding recursive=true for rkt kubelet dir
...
Fixes #1434
2017-07-12 09:28:54 -05:00
c75b21a510
Merge pull request #1408 from amitkumarj441/patch-1
...
Remove deprecated 'enable-cri' flag in kubernetes 1.7
2017-07-11 08:56:14 -04:00
9f45eba6f6
Kubernetes upgrade to 1.6.7
2017-07-11 09:11:55 +00:00
e160018826
Fixed conflicts, ipip:true as defualt and added ipip_mode
2017-07-08 14:36:44 +02:00
d1a02bd3e9
match kubespray-defaults dns mode with k8s-cluster setting
2017-07-07 13:13:12 -04:00
992023288f
Merge pull request #1319 from fieryvova/private-dns-server
...
Add private dns server for a specific zone
2017-07-06 15:02:54 -05:00
3ab90db6ee
Merge pull request #1411 from kevinjqiu/allow-calico-ipip-subnet-mode
...
Allow calico ipPool to be created with mode "cross-subnet"
2017-07-06 14:04:03 -04:00
e26be9cb8a
add private dns server for a specific zone
2017-07-06 16:30:47 +03:00
bba555bb08
Merge pull request #1346 from Starefossen/patch-1
...
Set kubedns minimum replicas to 2
2017-07-06 09:14:11 -04:00
4b0af73dd2
Merge pull request #1332 from gstorme/kube_apiserver_insecure_port
...
Use the kube_apiserver_insecure_port variable instead of static 8080
2017-07-06 09:06:50 -04:00
da72b8c385
Merge pull request #1391 from Abdelsalam-Abbas/master
...
Uncodron Masters which have scheduling Enabled
2017-07-06 09:06:02 -04:00
44079b7176
Merge pull request #1401 from Lendico/better_task_naming
...
Better naming for recurrent tasks
2017-07-06 09:01:07 -04:00
a742d10c54
Allow calico ipPool to be created with mode "cross-subnet"
2017-07-04 19:05:16 -04:00
38f5d1b18e
Set kubedns minimum replicas to 2
2017-07-04 16:58:16 +02:00
5f75d4c099
Uncodron Masters which have scheduling Enabled
2017-07-03 15:30:21 +02:00
319a0d65af
Update kubelet.j2
...
Updated with closing endif.
2017-07-03 16:23:35 +05:30
3d2680a102
Update kubelet.j2
...
Updated!
2017-07-03 15:58:50 +05:30
c36fb5919a
Update kubelet.j2
...
Updated!!
2017-07-03 15:55:04 +05:30
46d3f4369e
Updated K8s version
...
Signed-off-by: Amit Kumar Jaiswal <amitkumarj441@gmail.com>
2017-07-03 04:06:42 +05:30
c2b3920b50
added flag for not populating inventory entries to etc hosts file
2017-06-30 16:41:03 +00:00
6e7323e3e8
Merge pull request #1398 from tanshanshan/fix-reset
...
clean files in reset roles
2017-06-30 07:59:44 -04:00
f085419055
Merge pull request #1388 from vgkowski/master
...
add six package to bootstrap role
2017-06-30 07:30:36 -04:00
1fedbded62
ignore_errors instead of failed_when: false
2017-06-29 20:15:14 +02:00
c8258171ca
Better naming for recurrent tasks
2017-06-29 19:50:09 +02:00
007ee0da8e
fix reset
2017-06-29 14:45:15 +08:00
5e1ac9ce87
Merge pull request #1354 from chadswen/kubedns-var-fix
...
kubedns consistency fixes
2017-06-27 22:26:46 -05:00
a7cd08603e
Merge pull request #1384 from gdmello/etcd_backup_dir_fix
...
Make etcd_backup_prefix configurable.
2017-06-27 22:25:53 -05:00
854cd1a517
Merge pull request #1380 from jwfang/max-dns
...
docker_dns_servers_strict to control docker_dns_servers rtrim
2017-06-27 21:15:12 -05:00
23565ebe62
Merge pull request #1356 from rsmitty/rename
...
Rename project to kubespray
2017-06-27 11:40:03 -04:00
8467bce2a6
Fix inconsistent kubedns version and parameterize kubedns autoscaler image vars
2017-06-27 10:19:31 -05:00
649654207f
mount the etcd data directory in the container with the same path as on the host.
2017-06-27 09:29:47 -04:00
3123502f4c
move `etcd_backup_prefix` to new home.
2017-06-27 09:12:34 -04:00
17d54cffbb
add six package to bootstrap role
2017-06-27 10:08:57 +02:00
d5516a4ca9
Make kubedns up to date
...
Update kube-dns version to 1.14.2
https://github.com/kubernetes/kubernetes/pull/45684
2017-06-27 00:57:29 +00:00
4ba237c5d8
Make etcd_backup_prefix configurable. Ensures that backups can be stored on a different location other than ${HOST}/var/backups, say an EBS volume on AWS.
2017-06-26 09:42:30 -04:00
ec2255764a
docker_dns_servers_strict to control docker_dns_servers rtrim
2017-06-26 17:29:12 +08:00
1a8e92c922
Fixing cordoning condition that cause fail for upgrading the cluster
2017-06-23 20:41:47 +02:00
5c1891ec9f
In the etcd container, the etcd data directory is always /var/lib/etcd. Reverting to this value, since `etcd_data_dir` on the host maps to `/var/lib/etcd` in the container.
2017-06-23 13:49:31 -04:00
bae5ce0bfa
Merge branch 'master' into rename
2017-06-23 12:23:51 -04:00
61b74f9a5b
updated to direct control over ipip
2017-06-23 09:16:05 +02:00
7332679678
Give more control over IPIP, but with same default behaviour
2017-06-20 14:50:08 +02:00
91dff61008
Fixed helm bash complete
2017-06-19 15:33:50 +09:00
8203383c03
rename almost all mentions of kargo
2017-06-16 13:25:46 -04:00
fff0aec720
add configurable parameter for etcd_auto_compaction_retention
2017-06-14 10:39:38 +02:00
b73786c6d5
Merge pull request #1335 from bradbeam/imagerepo
...
Set default value for kube_hyperkube_image_repo
2017-06-12 09:46:17 -05:00
266ca9318d
Use the kube_apiserver_insecure_port variable instead of static 8080
2017-06-12 09:20:59 +02:00
db3e8edacd
Fixing up vault variables
2017-06-08 16:15:33 -05:00
6e41634295
Set default value for kube_hyperkube_image_repo
...
Fixes #1334
2017-06-08 12:22:16 -05:00
780308c194
Merge pull request #1174 from jlothian/atomic-docker-restart
...
Fix docker restart in atomic
2017-06-07 12:05:32 -05:00
696fd690ae
Merge pull request #1092 from bradbeam/rkt_docker
...
Adding flag for docker container in kubelet w/ rkt
2017-06-06 12:58:40 -05:00
01c0ab4f06
check if cloud_provider is defined
2017-05-31 08:24:24 -04:00
7220b09ff9
Merge pull request #1315 from rsmitty/hostnames-upgrade
...
Resolve upgrade issues
2017-05-30 11:40:19 -04:00
56b86bbfca
inventory hostname for cordoning/uncordoning
2017-05-26 17:47:25 -04:00
7e2aafcc76
add direct path for cert in AWS with RHEL family
2017-05-26 17:32:50 -04:00
af55e179c7
adding --skip-exists flag for peer_with_router
2017-05-25 14:29:18 -05:00
43408634bb
Merge branch 'master' into master
2017-05-23 09:32:28 +08:00
d47fce6ce7
upgrade k8s version to 1.6.4
2017-05-23 09:30:03 +08:00
9e64267867
Merge pull request #1293 from mattymo/kubelet_host_mode
...
Add host-based kubelet deployment
2017-05-19 18:07:39 +03:00
7ae5785447
Removed the other unused handler
...
With live-restore: true, we don't need a special docker restart
2017-05-19 09:50:10 -05:00
ef8d3f684f
Remove unused handler
...
Previous patch removed the step that sets live-restore
back to false, so don't try to notify that handler any more
2017-05-19 09:45:46 -05:00
cc6e3d14ce
Add host-based kubelet deployment
...
Kubelet gets copied from hyperkube container and run locally.
2017-05-19 16:54:07 +03:00
005b01bd9a
Merge pull request #1299 from bradbeam/kubelet
...
Minor kubelet updates
2017-05-18 12:52:43 -04:00
6f67367b57
Leave 'live-restore' false
...
Leave live-restore false to updates always pick
up new network configuration
2017-05-17 14:31:49 -05:00
9ee0600a7f
Update handler names and explanation
2017-05-17 14:31:49 -05:00
30cc7c847e
Reconfigure docker restart behavior on atomic
...
Before restarting docker, instruct it to kill running
containers when it restarts.
Needs a second docker restart after we restore the original
behavior, otherwise the next time docker is restarted by
an operator, it will unexpectedly bring down all running
containers.
2017-05-17 14:31:49 -05:00
a5bb24b886
Fix docker restart in atomic
...
In atomic, containers are left running when docker is restarted.
When docker is restarted after the flannel config is put in place,
the docker0 interface isn't re-IPed because docker sees the running
containers and won't update the previous config.
This patch kills all the running containers after docker is stopped.
We can't simply `docker stop` the running containers, as they respawn
before we've got a chance to stop the docker daemon, so we need to
use runc to do this after dockerd is stopped.
2017-05-17 14:31:49 -05:00
b999ee60aa
Fixing typo in kubelet cluster-dns and cluster-domain flags
2017-05-16 15:43:29 -05:00
85afd3ef14
Removing old sysv reference
2017-05-16 15:28:39 -05:00
1907030d89
issue raw yum command since we don't have facts in bootstrapping
2017-05-16 10:07:38 -04:00
71dabf9fb3
fix curl get calico status error ( error in tls version) : https://bugzilla.redhat.com/show_bug.cgi?id=1272504
2017-05-15 08:12:26 -04:00
efa2dff681
remove conditional
2017-05-12 17:16:49 -04:00
31a7b7d24e
default to kubedns and set nxdomain in kubedns deployment if that's the dns_mode
2017-05-12 15:57:24 -04:00
791ea89b88
Updated helm installation
...
Added full path for helm
2017-05-08 09:27:06 +02:00
c572760a66
Merge pull request #1254 from iJanki/cert_group
...
Adding /O=system:masters to admin certificate
2017-05-05 10:58:42 -04:00
69fc19f7e0
Merge pull request #1252 from adidenko/separate-tags-for-netcheck-containers
...
Add support for different tags for netcheck containers
2017-05-05 08:04:54 -05:00
b939c24b3d
Merge pull request #1250 from digitalrebar/master
...
bootstrap task on centos missing packages
2017-05-02 12:24:11 -04:00
3eb494dbe3
Merge pull request #1259 from bradbeam/calico214
...
Updating calico to v2.1.4
2017-05-02 12:20:47 -04:00
0afbc19ffb
ensure the /etc/os-release is mounted read only
2017-05-01 14:51:40 -04:00
ac9290f985
add for rkt as well
2017-04-28 17:45:10 -04:00
a133ba1998
Updating calico to v2.1.4
2017-04-28 14:04:25 -05:00
5657738f7e
mount os-release to ensure the node's OS is what's seen in k8s api
2017-04-28 13:40:54 -04:00
883ba7aa90
Add support for different tags for netcheck containers
...
Replace 'netcheck_tag' with 'netcheck_version' and add additional
'netcheck_server_tag' and 'netcheck_agent_tag' config options to
provide ability to use different tags for server and agent
containers.
2017-04-27 17:15:28 +02:00
674b71b535
Ansible 2.3 support
...
- Fix when clauses in various places
- Update requirements.txt
- Fix README.md
Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>
2017-04-26 15:22:10 +02:00
2638ab98ad
add MY_NODE_NAME variable into netchecker-agent environment
2017-04-24 17:19:42 +03:00
bc3068c2f9
Merge pull request #1251 from FengyunPan/fix-helm-home
...
Specify a dir and attach it to helm for HELM_HOME
2017-04-24 15:17:28 +03:00
2bde9bea1c
Specify a dir and attach it to helm for HELM_HOME
2017-04-21 10:51:27 +08:00
041d4d666e
Install required selinux-python bindings in bootstrap
...
on centos. The bootstrap tty fixup needs it.
2017-04-20 11:17:01 -05:00
88b5065e7d
fix stray 'in' and break into multiple lines for clarity
2017-04-20 09:53:01 -04:00
b690008192
allow for correct aws default resolver
2017-04-20 09:32:03 -04:00
2d6bc9536c
Merge pull request #1246 from holser/disable_dns_for_kube_services
...
Change DNS policy for kubernetes components
2017-04-20 16:12:52 +03:00
01dc6b2f0e
Add aws to default_resolver
...
When VPC is used, external DNS might not be available. This patch change
behavior to use metadata service instead of external DNS when
upstream_dns_servers is not specified.
Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>
2017-04-20 11:47:19 +02:00
d8aa2d0a9e
Change DNS policy for kubernetes components
...
According to code apiserver, scheduler, controller-manager, proxy don't
use resolution of objects they created. It's not harmful to change
policy to have external resolver.
Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>
2017-04-20 11:22:57 +02:00
19bb97d24d
Merge pull request #1238 from Starefossen/fix/namespace-template-file
...
Move namespace file to template directory
2017-04-20 12:19:55 +03:00
9f4f168804
Merge pull request #1241 from bradbeam/rktcnidir
...
Explicitly create cni bin dir
2017-04-20 12:19:26 +03:00
RongZhang
Wong Hoi Sing Edison
Chris Mildebrandt
zhengchuan hu
Aivars Sterns
Dominic Lam
Michael Beatty
Ayaz Ahmed Khan
Jonas Kongslund
Matthew Mosesohn
Antoine Legrand
Chad Swenson
Spencer Smith
Brad Beam
Simon Li
Miouge1
Dmitry Vlasov
Nedim Haveric
Maxim Krasilnikov
Andreas Krüger
Matthew Mosesohn
Dann Bohn
melkosoft
Sebastian Söderqvist
Virgil Chereches
Chia-liang Kao
Brad Beam
Damian Nowak
mlushpenko
mkrasilnikov
jasdeep-hundal
Erwan Miran
Sébastien Han
Ryan Zenker
Julian Hübenthal
Simon Li
Dmitri Rubinstein
mirwan
Cornelius Keller
Stanislav Makar
ArchiFleKs
heping
abelgana
Peter Slijkhuis
neith00
Lukasz Piatkowski
Philippe Chepy
Bogdan Dobrelya
Steve Mitchell
Jan Jungnickel
Evan Zeimet
Wei Tie
Fang Zhen
Xu Zhipei
Spencer Smith
Julien BONACHERA
Thomas Sarboni
Kuldip Madnani
Steven Hardy
unclejack
Di Xu
Christopher Randles
brx
Bob Killen
Tom Denham
chenhonggc
Hyunsun Moon
Günther Grill
Haiwei Liu
Matthew Mosesohn
Vicenç Juan Tomàs Montserrat
Andrew Greenwood
tanshanshan
Flavio Percoco Premoli
Chiang Fong Lee
Peter Lee
pmontanari
Hassan Zamani
Tennis Smith
Seungkyu Ahn
Rémi de Passmoilesel
刘旭
Jiří Stránský
Jason Brooks
Julian Poschmann
Vijay Katam
ant31
Martin Uddén
Deni Bertovic
Jiri Stransky
foxyriver
Kyle Bai
Sam Powers
Oliver Moser
Matthieu
ArthurMa
Dann
Eric Hoffmann
Yuki KIRII
Xavier Mehrenberger
Mohamed Mehany
Ian Lewis
Erik Stidham
Anton
Miad Abrin
Xavier Lange
nico
Alexander Chumakov
magnon-bliex
timtoum
John Ko
jwfang
Ubuntu
Martin Joehren
AtzeDeVries
Vladimir Kozyrev
Kevin Jing Qiu
Hans Kristian Flaatten
Amit Kumar Jaiswal
Anton Nerozya
gdmelloatpoints
vincent gromakowski
Gregory Storme
Justin Hunthrop
zoues
zouyee
Josh Lothian
xuhuilong
moss2k13
Aleksandr Didenko
Sergii Golovatiuk
Aleksey Kasatkin
FengyunPan
Greg Althaus