f453567cce
Merge pull request #3144 from riverzhang/fix-audit-log
...
Fix install audit failed
2018-08-23 14:41:37 +08:00
5a4352657d
Fix install audit failed
...
1.fix audit log not write
2.fix Parameter not recognized
3.delete kubedm futuregates auditing and use apiServerExtraArgs
2018-08-23 01:47:15 +08:00
f13bc796d9
added nodePortAddresses on kubeadm conf v1alpha2 (not present on v1alpha1)
2018-08-22 18:43:03 +02:00
80cfeea957
psp, roles and rbs for PodSecurityPolicy when podsecuritypolicy_enabled is true
2018-08-22 18:16:13 +02:00
5d9908c2c3
--nodeport-addresses added on kube-proxy.manifest.j2
...
Changed author
2018-08-22 15:32:07 +02:00
a7b0c454db
Localhost in hosts files should be updated (if necessary), not overriden
2018-08-22 12:10:49 +02:00
94df70be98
Cloud provider support for OCI (Oracle Cloud Infrastructure)
...
Signed-off-by: Jeff Bornemann <jeff.bornemann@oracle.com>
2018-08-21 17:36:42 -04:00
0c0a2138d9
allow '.' in hostnames
...
we use FQDN as inventory_hostname
2018-08-21 08:24:33 +02:00
5bf152886b
add support for openstack trust to cloud provider config
2018-08-20 12:51:25 -04:00
497db69c9f
Merge pull request #3130 from riverzhang/add-control-plane
...
Add kubeadm controlplaneEndpoint
2018-08-20 10:43:50 +02:00
c7de737551
Merge pull request #3133 from mirwan/auditlog_to_stdout_w_kubeadm
...
Audit log to stdout with kubeadm
2018-08-20 10:43:22 +02:00
fc38b6d0ca
Ability to define custom audit polcy rules
2018-08-20 07:04:56 +02:00
c34900e569
Define apiserver flags directly instead of relying on auditPolicy section in order to have the ability to redirect audit log to stdout with kubeadm
2018-08-20 07:00:53 +02:00
855f2a55cb
Merge pull request #3135 from ishitatsuyuki/patch-1
...
Add bad hostname preflight check
2018-08-20 12:08:02 +08:00
fd16f77e20
Merge pull request #3017 from seungkyua/fix_kubeadm_client_conf
...
Fix kubeadm client conf
2018-08-20 10:51:02 +08:00
3eef8dc8d0
Add bad hostname preflight check
...
Hostname must be a valid DNS name, which is checked as https://github.com/kubernetes/apimachinery/blob/master/pkg/util/validation/validation.go#L115
The situation I have encountered is that my hostname contained underscore which is disallowed and apiserver refused to start.
2018-08-20 09:09:00 +09:00
59176ebbb9
Add kubeadm controlplaneEndpoint
...
Nginx LB(default)
Other LB by kubeadm controlplane
2018-08-20 00:57:13 +08:00
b421d0ed5b
Fix install nss
2018-08-20 00:07:31 +08:00
fb309ca446
Merge pull request #3128 from riverzhang/delete-kubeadm
...
Remove unused configuration
2018-08-19 10:01:33 +08:00
095ccef8bd
Remove unused configuration
2018-08-19 01:23:20 +08:00
0df969ad19
Merge pull request #3117 from mirwan/audit_usecases
...
Audit support improvement
2018-08-19 01:13:22 +08:00
ac49bbb336
Merge pull request #2168 from xd007/docker_arm64
...
fix docker opts incompatible running on aarch64 Redhat/Centos
2018-08-17 16:24:07 +02:00
7a0f0126f7
Merge pull request #1295 from xuhuilong/master
...
fix curl get calico status error ( error in tls version, centos 7.3 1611)
2018-08-17 14:29:01 +02:00
29894293eb
Fix kubeadm client conf
...
Fix DiscoveryTokenCACertHashes key to discoveryTokenCACertHashes in kubeadm-client.conf
2018-08-17 04:40:08 +00:00
4d783fff0d
resolve issues with new cacert feature
2018-08-16 23:31:21 -04:00
58ee5f1cc9
Merge pull request #3089 from mattymo/cloudconfig
...
Remove erroneous cloud-config task
2018-08-16 16:17:01 +02:00
54548d3b95
kubeadm mounts the hostpaths itself
2018-08-16 13:17:30 +02:00
58d4d65fab
minor variable fix and reuse + handle auditlog redirected to stdout
2018-08-16 12:51:09 +02:00
2ffc1afe40
Support audit
2018-08-16 14:38:07 +08:00
70b28288a3
Use delegate_to: localhost instead of local_action
...
Allow to use `ansible_become: true` (#2969 )
And set it to `false` for `localhost` with an `host_var`
2018-08-14 10:08:43 -04:00
a11e1eba9e
Upgrade kubernetes to V1.11.x ( #3078 )
...
Upgrade Kubernetes to V1.11.2
The kubeadm configuration file version has been upgraded from v1alpha1 to v1alpha2
Add bootstrap kubeadm-config.yaml with external etcd
2018-08-14 15:13:44 +03:00
581a30fdec
Remove erroneous cloud-config task
2018-08-10 15:59:18 +03:00
d8e77600e2
Merge pull request #3066 from luisyonaldo/fix-conditional
...
fix bad conditional
2018-08-10 10:38:52 +02:00
fd380615a0
fix bad conditional
2018-08-09 10:20:45 +02:00
4eadf3228e
Only add admission plugins if defined
2018-08-07 11:25:03 -07:00
99c5aa5a02
Use k8s default plugin list
2018-08-07 11:25:03 -07:00
6ed65d762b
Separate out plugins into 2 variables
2018-08-07 11:25:03 -07:00
ac18f6cf8b
Add support for admission controllers in 1.10 and above
2018-08-07 11:25:03 -07:00
e71f261935
Merge pull request #3068 from riverzhang/swap
...
Enable swap
2018-08-07 21:29:41 +08:00
b902602d16
Enable swap
2018-08-07 21:13:12 +08:00
c288ffc55d
Merge pull request #2342 from southquist/add-ca-cert
...
allow for setting the cacert on openstack cloud provider
2018-08-07 17:46:01 +08:00
9075dbdd3c
Merge pull request #2875 from bradbeam/movault
...
Adding cluster_name to api cert alt name for vault
2018-08-07 17:36:04 +08:00
3d19e03294
Merge pull request #3015 from podnov/kube_proxy_healthz_bind_address
...
Variablize kube_proxy_healthz_bind_address
2018-08-07 17:10:33 +08:00
ac644ed049
Fix yaml roles error
2018-08-05 18:48:07 +08:00
72074f283b
set local for growpart part 2
2018-07-31 06:56:09 +08:00
a5db3dbea9
set locale for growpart
2018-07-31 06:52:56 +08:00
0366600b45
Remove double slash
...
Even without this PR, the operation works well.
However, it is better to use a single slash rather than
a double slash in the path.
2018-07-20 07:34:33 +00:00
6a4ce96b7d
Variablize kube_proxy_healthz_bind_address
...
This fixes #3014
2018-07-19 14:19:09 -05:00
37ccf7e405
Fixed kubectl path.
2018-07-13 15:32:08 +00:00
97e0de7e29
Fix vault file owner issues and k8s apiserver cert creation ( #2985 )
...
apiserver cert should be created only once
2018-07-11 14:58:02 +03:00
cf445fd4fe
Merge pull request #2930 from alvistack/ingress-nginx-0.16.1
...
ingress-nginx: Upgrade to 0.16.2
2018-07-10 14:42:37 +08:00
72f053d9bb
Merge pull request #2972 from mattymo/force_cni_cp
...
Force copy cni files
2018-07-10 09:40:10 +03:00
a0defefb3f
ingress-nginx: Upgrade to 0.16.2
...
ingress-nginx 0.16.2 (https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.16.2 )
This patch simplify ingress-nginx deployment by default deploy on
master, with customizable options; on the other hand, remove the
additional Ansible group "kube-ingress" and its k8s node label
injection.
Reference to https://kubernetes.io/docs/concepts/services-networking/ingress/#prerequisites :
GCE/Google Kubernetes Engine deploys an ingress controller on the master.
By changing `ingress_nginx_nodeselector` plus custom k8s node
label, user could customize the DaemonSet deployment target.
If `ingress_nginx_nodeselector` is empty, will deploy DaemonSet on
every k8s node.
2018-07-10 12:26:06 +08:00
d306c9708c
Remove step that force disable `kube_basic_auth`.
...
The referenced issue (https://github.com/kubernetes/kubeadm/issues/441 ) has already been fixed.
2018-07-08 16:57:43 +07:00
1a3b9dd864
Force copy cni files
2018-07-06 16:39:42 +03:00
5c617c5a8b
Add tags to deploy components by --tags option ( #2960 )
...
* Add tags for cert serial tasks
This will help facilitate tag-based deployment of specific components.
* fixup kubernetes node
2018-07-06 09:12:13 +03:00
4092f96dd8
Merge pull request #2946 from Miouge1/remove-pid-predicate
...
CheckNodePIDPressure is not supported in v1.10
2018-07-04 18:30:19 +03:00
c20196f9a0
Remove modprobe binary from kubelet rkt deployment ( #2917 )
2018-07-02 15:37:24 +03:00
2a279e30b0
CheckNodePIDPressure is not supported in v1.10
2018-06-28 20:10:38 +02:00
c685dc493f
allow for setting the cacert on openstack cloud provider
2018-06-28 16:00:13 +02:00
6c2f169ea2
update test-pr2 ( #2911 )
2018-06-22 13:22:26 +03:00
1aee6ec371
Merge pull request #2903 from riverzhang/swap
...
Add manage swap on the worker node
2018-06-21 22:20:23 +08:00
3232e2743e
Add manage swap on the worker node
2018-06-21 08:15:01 +00:00
cbb959151c
Merge pull request #2737 from Miouge1/update-scheduler
...
Update kube-scheduler policy
2018-06-19 14:53:22 +02:00
c3d8b131db
Merge pull request #2801 from dvazar/bugfix/undefined__network_plugin__variable
...
Fixed "network_plugin" variable
2018-06-19 10:01:06 +02:00
61e97251a5
Improve variable handling for disabling etcd events cluster
2018-06-18 16:58:29 +03:00
3ad9e9c5eb
Fix #2261 by supporting Red Hat's limited PATH
...
Red Hat has this theory that binaries in sbin are too dangerous to be on
the default path, but we need them anyway.
RH7 has /sbin and /usr/sbin as symlinks, so that is no longer important.
I'm adding it to the `PATH` instead of making the path to `modinfo`
absolute because I am worried about breaking support for other
distributions.
2018-06-15 12:49:22 -07:00
3a569c9dcb
Merge pull request #2750 from w-leads/feature/add-vmname-to-vcp-config
...
Add vm_name option to vsphere cloud provider config
2018-06-14 22:22:34 +02:00
3d819a6edd
Adding cluster_name to api cert alt name for vault
2018-06-12 14:15:07 -05:00
20bd656975
Reconfigure kube-proxy to access kube-apiserver via the LB(kubeadm)
2018-06-12 12:53:50 +00:00
10c9fe96b0
Merge pull request #2859 from riverzhang/nginx
...
Fix nginx-proxy HA when kubeadm enable
2018-06-08 01:10:01 +08:00
f9ccb93825
Fix nginx-proxy HA when kubeadm enable
2018-06-07 14:27:19 +00:00
daeea75fbb
Merge pull request #2835 from oracle/bm_fix-apiserver-access-ip
...
roles/kubernetes/client: kubeconfig template should use access_ip
2018-06-07 11:50:57 +03:00
59be578842
Revert "wip pr for improved cert sync" ( #2849 )
2018-06-06 17:22:25 +03:00
cb0a257349
Merge pull request #2819 from oleh-ozimok/fix-cidr-assert
...
Fix enough network address space assert
2018-06-06 07:32:16 +03:00
f4d762bb95
fix docker opts incompatible running on aarch64 Redhat/Centos
...
On Aarch64, the default cgroup driver for docker is systemd
instead of cgroupfs. Should conform kubelet to use systemd
as cgroup driver as well to keep it consistent with docker.
Without this change, below exception will be raised.
/usr/bin/docker-current: Error response from daemon: shim
error: docker-runc not installed on system.
Change-Id: Id496ec9eaac6580e4da2f3ef1a386c9abc2a5129
2018-06-05 16:17:16 +08:00
69ea28e187
Merge pull request #2827 from mattymo/testpr
...
wip pr for improved cert sync
2018-06-04 12:43:00 +03:00
2f5a9e180c
kubernetes/client: kubeconfig template should use the access_ip for the chosen master node
2018-06-04 09:51:05 +01:00
f912a4ece5
Fix compare AnsibleUnsafeText with int ( #2828 )
2018-06-04 11:34:10 +03:00
d1e66f9cc8
Add label to kubelet env for kubeadm deploy cluster ( #2841 )
2018-06-04 11:26:47 +03:00
7433348aae
wip pr for improved cert sync
2018-05-30 12:15:11 +03:00
38f7ba2584
Fix enough network address space assert
2018-05-27 18:01:17 +03:00
b3f9cae820
fixed a check unknown networks (cilium & contiv)
2018-05-22 16:43:19 +07:00
a67bdff28c
Merge pull request #2743 from mrostecki/opensuse-tumbleweed-openssl
...
opensuse: Fix OpenSSL package name
2018-05-22 11:21:04 +02:00
4b8daa22f6
Fixes #2800
2018-05-19 00:57:09 +07:00
e60a63ea51
Merge pull request #2577 from woopstar/etcd-fix-4
...
Makeover of etcd- and etcd-cluster setup.
2018-05-16 20:49:54 +02:00
c1bc4615fe
assert that number of pods on node does not exceed CIDR address range
...
The number of pods on a given node is determined by the --max-pods=k
directive. When the address space is exhausted, no more pods can be
scheduled even if from the --max-pods-perspective, the node still has
capacity.
The special case that a pod is scheduled and uses the node IP in the
host network namespace is too "soft" to derive a guarantee.
Comparing kubelet_max_pods with kube_network_node_prefix when given
allows to assert that pod limits match the CIDR address space.
2018-05-16 11:55:46 +00:00
7c93e71801
Upgrade k8s to 1.10.2 ( #2748 )
...
* Upgrade k8s to 1.10.2
Bumped etcd version to 3.2.16 as recommended
* Add ipvs fix for v1.10
* change flannel addons test to ha
2018-05-15 16:00:29 +03:00
73800ef111
make certificates non-executable
2018-05-15 07:54:32 +00:00
49d106f615
make admin.conf -> .kube/config non-executable
...
Almost certainly, the .kube/config file (YAML) should not be executable.
2018-05-14 09:29:48 +00:00
ad48606e4e
Restart scheduler when policy changes
2018-05-14 10:09:30 +02:00
07cc981971
refactor vault role ( #2733 )
...
* Move front-proxy-client certs back to kube mount
We want the same CA for all k8s certs
* Refactor vault to use a third party module
The module adds idempotency and reduces some of the repetitive
logic in the vault role
Requires ansible-modules-hashivault on ansible node and hvac
on the vault hosts themselves
Add upgrade test scenario
Remove bootstrap-os tags from tasks
* fix upgrade issues
* improve unseal logic
* specify ca and fix etcd check
* Fix initialization check
bump machine size
2018-05-11 19:11:38 +03:00
51a9379d3c
Add vm_name option to vsphere cloud provider config
2018-05-08 12:23:58 -07:00
d73d60c9b0
Merge pull request #2600 from maximegaillard/master
...
Add Openstack tenant name
2018-05-08 12:03:01 +02:00
066016cd3e
opensuse: Fix OpenSSL package name
...
OpenSSL 1.1 package in openSUSE Tumbleweed is named openssl-1_1,
not openssl-1_1_0.
2018-05-08 10:03:30 +02:00
28d6eb6af1
Merge pull request #2644 from cp3hu/master
...
Fix apiserver manifest and kubelet for kube version < 1.9
2018-05-08 09:22:36 +02:00
70e0998a70
Update kube-scheduler policy
2018-05-03 21:56:51 +02:00
595e96ebf1
Merge pull request #2693 from romaindequidt/sync-certs-tasks-fix
...
sync certs tasks (fix #2596 #2667 )
2018-05-02 12:17:23 -05:00
4c81cd2a71
Merge branch 'master' of https://github.com/kubernetes-incubator/kubespray into etcd-fix-4
2018-05-02 14:45:58 +02:00
00db751646
Add Openstack tenant name
2018-05-01 09:21:37 +02:00
59789ae02a
ISSUE-2706: Provide consistent usage of supplementary_addresses_in_ssl_keys across vault and script mode ( #2707 )
2018-04-30 14:48:17 +03:00
03de4c0806
Merge pull request #2695 from suzutan/add-oidc-prefix-args
...
Add oidc-user-prefix and oidc-group-prefix args
2018-04-30 09:17:02 +02:00
06cdb260f6
labelvalue must be formatted to handle non string values ( #2722 )
2018-04-29 19:02:14 +03:00
c3c5817af6
sysctl file should be in defaults so that it can be overriden ( #2475 )
...
* sysctl file should be in defaults so that it can be overriden
* Change sysctl_file_path to be consistent with roles/kubernetes/preinstall/defaults/main.yml
2018-04-27 18:50:58 +03:00
9168c71359
Revert "Revert "Add openSUSE support" ( #2697 )" ( #2699 )
...
This reverts commit 51f4e6585a
2018-04-26 12:52:06 +03:00
1a14f1ecc1
Fix vol format for local volume provisioner in rkt ( #2698 )
2018-04-24 20:32:08 +03:00
51f4e6585a
Revert "Add openSUSE support" ( #2697 )
2018-04-23 14:28:24 +03:00
f81e6d2ccf
Add oidc-user-prefix and oidc-group-prefix args
2018-04-23 12:23:59 +09:00
80dd230a65
sync certs tasks ( fix #2596 #2667 )
2018-04-22 10:00:31 +02:00
75950344fb
run_once pre_upgrade tasks which are executing in localhost
2018-04-19 11:38:13 -05:00
f73717ea35
Mount local volume provisioner dirs for containerized kubelet ( #2648 )
2018-04-12 22:55:13 +03:00
1967963702
Merge pull request #2380 from hwoarang/add-opensuse-support
...
Add openSUSE support
2018-04-12 20:28:50 +03:00
d87b6fd9f3
Use dedicated front-proxy-ca for front-proxy-client
2018-04-12 11:03:22 -05:00
a6a47dbc96
Merge pull request #2617 from bradbeam/savaultcert
...
Adding missing service-account certificate for vault
2018-04-12 11:02:24 -05:00
298c6cb790
Merge pull request #2633 from grebois/patch-3
...
Enabling MutatingAdmissionWebhook for Istio Automatic sidecar injection
2018-04-12 11:53:58 +03:00
d07f75b389
roles: kubernetes: secrets: Add SUSE support
...
Add path for certificate location for SUSE distributions. Also make sure
the 'update-ca-certificates' command is executed on SUSE hosts as well.
2018-04-11 20:55:02 +01:00
45eac53ec7
roles: kubernetes: preinstall: Install openssl-1.1.0 on Tumbleweed
...
The openssl package on Tumbleweed is actually a virtual package covering
openssl-1.0.0 and openssl-1.1.0 implementations. It defaults to 1.1.0 so
when trying to install it and openssl-1.0.0 is installed, zypper fails
with conflicts. As such, lets explicitly pull the package that we need
which also updates the virtual one.
Co-authored-by: Markos Chandras <mchandras@suse.de>
2018-04-11 17:46:14 +01:00
e42203a13e
roles: kubernetes: preinstall: Add SUSE support
...
Add support for installing package dependencies and refreshing metadata
on SUSE distributions
Co-authored-by: Nirmoy Das <ndas@suse.de>
2018-04-11 17:46:14 +01:00
3535c29e59
Fix apiserver manifest for kube version < 1.9
2018-04-10 18:17:56 +02:00
88765f62e6
Updating order
...
https://kubernetes.io/docs/admin/admission-controllers/#is-there-a-recommended-set-of-admission-controllers-to-use
2018-04-10 17:17:39 +02:00
0f35e17e23
Fix new envvar for setting openstack_tenant_id ( #2641 )
...
Changed from OS_PROJECT_ID to OS_PROJECT_NAME.
2018-04-10 17:23:31 +03:00
77b3f9bb97
Removing default for volume-plugins mountpoint ( #2618 )
...
All checks test if this is defined meaning there is no way to undefine it.
2018-04-10 17:19:25 +03:00
45f15bf753
Revert "Fix new envvar for setting openstack_tenant_id" ( #2640 )
2018-04-10 14:37:24 +03:00
913cc5a9af
Merge pull request #2639 from ironhouzi/openstack_tenant_id_fix
...
Fix new envvar for setting openstack_tenant_id
2018-04-10 14:35:28 +03:00
a46acfcdd8
Merge pull request #2627 from mattymo/no_more_do_do
...
Remove jinja2 dependency of do
2018-04-10 14:32:29 +03:00
0c0f6b755d
Fix new envvar for setting openstack_tenant_id
...
Changed from OS_PROJECT_ID to OS_PROJECT_NAME.
2018-04-10 13:30:48 +02:00
4c12b273ac
Enabling MutatingAdmissionWebhook for Istio Automatic sidecar injection
...
https://istio.io/docs/setup/kubernetes/sidecar-injection.html#automatic-sidecar-injection
2018-04-09 12:49:05 +02:00
b68854f79d
fix kubectl download location and kubectl.sh helper owner/group remove
2018-04-09 13:19:26 +03:00
f954bc0a5a
Remove jinja2 dependency of do
...
While `do` looks cleaner, forcing this extra option in ansible.cfg
seems to be more invasive. It would be better to keep the traditional
approach of `set dummy = ` instead.
2018-04-09 12:27:53 +03:00
dfc46f02d7
Adding missing service-account certificate for vault
...
Missed in #2554
2018-04-06 15:29:52 -05:00
ca40d51bc6
Fix typos (no logic changes)
2018-04-05 15:54:58 -07:00
973e7372b4
content: |
2018-04-04 23:05:27 +08:00
b54e091886
Persist ip_vs modules
2018-04-04 18:18:51 +08:00
2511e14289
Merge pull request #2346 from Miouge1/kube-scheduler-mode
...
Use legacy policy config to apply the scheduler policy
2018-04-04 10:20:51 +02:00
76bb5f8d75
check if dedicated service account token signing key exists
2018-04-02 10:57:24 -05:00
ba24fe3226
Merge pull request #2570 from avoidik/transfer-cloud-configs
...
Move cloud config configurations to proper location
2018-04-02 10:31:38 +02:00
3004791c64
Add pre-upgrade task for moving credentials file ( #2394 )
...
* Add pre-upgrade task for moving credentials file
This reverts commit 7ef9f4dfdd
2018-04-02 11:19:23 +03:00
86e3506ae6
Etcd cluster setup makeover
...
The current way to setup the etc cluster is messy and buggy.
- It checks for cluster is healthy before the cluster is even created.
- The unit files are started on handlers, not in the task, so you mess with "flush handlers".
- The join_member.yml is not used.
- etcd events cluster is not configured for kubeadm
- remove duplicate runs between running the role on etcd nodes and k8s nodes
2018-04-01 21:38:33 +02:00
5fe144aa0f
ingress-nginx: container download related things should defined in the download role
2018-04-01 00:22:33 +08:00
5b0da4279f
Merge pull request #2543 from hswong3i/cert-manager-0.2.3
...
Integrate jetstack/cert-manager 0.2.3 to Kubespray
2018-03-31 18:15:25 +02:00
1ac978b8fa
Merge pull request #2567 from mirwan/node_labels_doc_plus_kube_ingress_handling
...
node_labels documentation and kube-ingress label definition as role_node_label
2018-03-31 18:05:52 +02:00
195d6d791a
Integrate jetstack/cert-manager 0.2.3 to Kubespray
2018-03-31 19:29:11 +08:00
aa301c31d1
Move credential checks into proper folder
2018-03-31 13:29:00 +03:00
d9418b1dc4
Merge pull request #2554 from georgejdli/fix-sa-token-signing
...
Fix kubespray's ServiceAccount token signing keys
2018-03-31 09:59:22 +02:00
15efdf0c16
Move credential checks
2018-03-31 03:26:37 +03:00
ab8760cc83
Move credentials pre-check
2018-03-31 03:24:57 +03:00
b6da596ec1
Move default configuration parameters for cloud-config
2018-03-31 03:18:23 +03:00
3c12c6beb3
Move cloud config configurations to proper location
2018-03-31 02:59:59 +03:00
8ece922ef0
node_labels documentation + kube-ingress label handling as role_node_label
2018-03-31 00:36:11 +02:00
887a468d32
Merge pull request #2562 from avoidik/fix-indexes-pr-2251
...
Fix kubecert_node.results indexes
2018-03-31 00:16:11 +02:00
76cb37d6b5
Merge pull request #2544 from woopstar/cert-fix-2
...
Update openssl.conf to count better and work with Jinja 2.9
2018-03-30 21:57:17 +02:00
572ab650db
copy dedicated service account token signing key for kubeadm migration
2018-03-30 13:03:32 -05:00
72c2a8982b
Fix kubecert_node.results indexes
2018-03-30 17:24:50 +03:00
03bcfa7ff5
Stop templating kube-system namespace and creating it ( #2545 )
...
Kubernetes makes this namespace automatically, so there is
no need for kubespray to manage it.
2018-03-30 14:29:13 +03:00
af5f376163
Revert
2018-03-30 11:42:20 +02:00
004b0a3fcf
Fix merge conflict
2018-03-30 11:38:59 +02:00
4bb7d2b566
Merge branch 'master' of https://github.com/kubernetes-incubator/kubespray into cert-fix-2
2018-03-30 11:34:05 +02:00
f619eb08b1
Merge pull request #2350 from whereismyjetpack/kubeadm-nodename
...
set nodeName to "{{ inventory_hostname }}" in kubeadm-config
2018-03-30 11:15:52 +02:00
5711074c5a
Merge pull request #2290 from mirwan/node_labels_from_inventory
...
Node labels definition in kubelet params from inventory
2018-03-30 03:42:52 -05:00
4d85e3765e
remove redundancy code
2018-03-30 09:19:00 +08:00
daeeae1a91
Added retries in pre-upgrade.yml and retries while applying kube-dns.yml ( #2553 )
...
* Added retries in pre-upgrade.yml and retries while applying kube-dns.yml
* Removed trailing spaces
2018-03-29 11:37:32 -05:00
c8f857eae4
configure kubespray to sign service account tokens with a dedicated and stable key
2018-03-29 09:50:31 -05:00
270d21f5c1
Merge pull request #2540 from mattymo/cloud_config_timing
...
Write cloud-config during kubelet configuration
2018-03-29 09:12:18 +02:00
bf29198efd
Fix merge conflict
2018-03-29 09:11:13 +02:00
9ebbf1c3cd
Added a fix in openssl.conf template to check if IP of loadbalncer is available or not.
2018-03-28 16:34:26 -05:00
0b5404b2b7
Fix
2018-03-28 20:28:04 +02:00
0df32b03ca
Update openssl.conf to count better and work with Jinja 2.9
2018-03-28 17:48:56 +02:00
72a4223884
Write cloud-config during kubelet configuration
...
This file should only be updated during kubelet upgrade so that
master components are not accidentally restarted first during
preinstall stage.
2018-03-28 16:26:36 +03:00
03117d9572
Merge pull request #2488 from LuckySB/ingress-nginx-node-role
...
Dedicated node for ingress nginx controller
2018-03-28 14:07:40 +02:00
e375678674
Set exact user for Kubelet services
2018-03-27 11:13:52 +03:00
1d0415a6cf
fixes typo in kube_override_hostname for kubeadm
2018-03-24 13:29:07 -04:00
9fa995ac9d
only sets nodeName in kubeadm-config when kube_override_hostname is set
2018-03-23 08:33:25 -04:00
30e4b89837
Merge pull request #2504 from brtknr/patch-1
...
Update kube-apiserver.manifest.j2 and kubeadm-config.yaml.j2 to incorporate `endpoint-reconciler-type: lease`
2018-03-22 09:15:55 +01:00
9949782e96
Merge pull request #2489 from woopstar/token-fix-1
...
Only copy tokens if tokens_list contains any
2018-03-21 20:28:06 -05:00
ff2b8e5e60
Merge pull request #2503 from woopstar/kubelet-fix-1
...
Fix duplicate --proxy-client-cert-file and --proxy-client-key-file
2018-03-21 10:03:31 +01:00
8b71ef8ceb
Labels from role (node-role.k8s.io/node) and labels from inventory are merged into node-labels parameter in kubelet
2018-03-21 09:19:05 +01:00
ee8f678010
Addition of the .creds extension to the credentials files generated by password lookup in order for Ansible not to consider them as inventory files with inventory_ignore_extensions set accordingly ( #2446 )
2018-03-21 10:50:32 +03:00
13e47e73c8
Update kubeadm-config.yaml.j2
...
As requested
2018-03-20 13:33:36 +00:00
d2fd7b7462
Update kube-apiserver.manifest.j2
2018-03-20 12:19:53 +00:00
d9453f323b
Update kube-apiserver.manifest.j2
2018-03-20 12:16:35 +00:00
b787b76c6c
Update kube-apiserver.manifest.j2
...
Ensure that kube-apiserver will respond even if one of the nodes are down.
2018-03-20 12:06:34 +00:00
a94a407a43
Fix duplicate --proxy-client-cert-file and --proxy-client-key-file
2018-03-20 12:08:36 +01:00
f253691a68
Merge pull request #2347 from hswong3i/multiple_artifacts_dir
...
Support multiple artifacts under individual inventory directory
2018-03-19 12:45:55 +01:00
b9a949820a
Only copy tokens if tokens_list contains any
2018-03-18 08:42:38 +01:00
50e5f0d28b
Merge pull request #2468 from LuckySB/master
...
change expirations period for generated certificate from 10y to 100 years
2018-03-17 19:43:40 +01:00
1481f7d64b
Dedicated node for ingress nginx controller
...
The ability to create dedicated node for ingress nginx controller
host type network for nginx controller
and add from example https://github.com/kubernetes/ingress-nginx/blob/master/docs/examples/static-ip/nginx-ingress-controller.yaml
terminationGracePeriodSeconds: 60
2018-03-17 02:54:46 +03:00
7d33650019
Merge pull request #2462 from woopstar/coredns-patch
...
Add CoreDNS support
2018-03-16 18:33:36 -05:00
e40368ae2b
Add CoreDNS support with various fixes
...
Added CoreDNS to downloads
Updated with labels. Should now work without RBAC too
Fix DNS settings on hosts
Rename CoreDNS service from kube-dns to coredns
Add rotate based on http://edgeofsanity.net/rant/2017/12/20/systemd-resolved-is-broken.html
Updated docs with CoreDNS info
Added labels and fixed minor settings from official yaml file: https://github.com/kubernetes/kubernetes/blob/release-1.9/cluster/addons/dns/coredns.yaml.sed
Added a secondary deployment and secondary service ip. This is to mitigate dns timeouts and create high resitency for failures. See discussion at 'https://github.com/coreos/coreos-kubernetes/issues/641#issuecomment-281174806 '
Set dns list correct. Thanks to @whereismyjetpack
Only download KubeDNS or CoreDNS if selected
Move dns cleanup to its own file and import tasks based on dns mode
Fix install of KubeDNS when dnsmask_kubedns mode is selected
Add new dns option coredns_dual for dual stack deployment. Added variable to configure replicas deployed. Updated docs for dual stack deployment. Removed rotate option in resolv.conf.
Run DNS manifests for CoreDNS and KubeDNS
Set skydns servers on dual stack deployment
Use only one template for CoreDNS dual deployment
Set correct cluster ip for the dns server
2018-03-16 21:51:37 +01:00
3fac550090
Merge remote-tracking branch 'upstream/master'
2018-03-16 14:09:54 +03:00
d29a1db134
Merge pull request #2461 from woopstar/patch-11
...
Add support to kubeadm too
2018-03-16 08:24:31 +01:00
653d97dda4
Merge pull request #2472 from woopstar/patch-12
...
Make sure output from extra args is strings
2018-03-16 08:23:50 +01:00
40c0f3756b
Encapsulate item instead of casting to string
2018-03-15 20:27:21 +01:00
3d6fd49179
Added option for encrypting secrets to etcd v.2 ( #2428 )
...
* Added option for encrypting secrets to etcd
* Fix keylength to 32
* Forgot the default
* Rename secrets.yaml to secrets_encryption.yaml
* Fix static path for secrets file to use ansible variable
* Rename secrets.yaml.j2 to secrets_encryption.yaml.j2
* Base64 encode the token
* Fixed merge error
* Changed path to credentials dir
* Update path to secrets file which is now readable inside the apiserver container. Set better file permissions
* Add encryption option to k8s-cluster.yml
2018-03-15 22:20:05 +03:00
788e41a315
Make sure output from extra args is strings
...
Setting the following:
```
kube_kubeadm_controller_extra_args:
address: 0.0.0.0
terminated-pod-gc-threshold: "100"
```
Results in `terminated-pod-gc-threshold: 100` in the kubeadm config file. But it has to be a string to work.
2018-03-14 19:23:43 +01:00
f8fed0f308
change expirations period for generated certificate from 10 years to 100 years
2018-03-14 13:33:36 +03:00
d1e6632e6a
Fix err in kubelet.kubeadm.env.j2
...
1. 404 link url
2. kubelet_authentication_token_webhook is not work
3. kube_reserved variable set twice
2018-03-14 17:25:21 +08:00
710295bd2f
Merge pull request #2434 from protomech/feature/azure-vnet-resource-group
...
add support for azure vnetResourceGroup
2018-03-13 17:42:09 +02:00
39d247a238
Add support to kubeadm too
...
Explicitly defines the --kubelet-preferred-address-types parameter #2418
Fixes #2453
2018-03-13 10:31:15 +01:00
50e3ccfa2b
uses new kube_memory_reserved/kube_cpu_reserved variables in kubelt
2018-03-12 12:46:14 -04:00
436de45dd4
Merge pull request #2295 from manics/supplementary-bugfix
...
Fix indexing of supplementary DNS in openssl.conf
2018-03-12 10:54:56 +02:00
5f186a2835
Merge pull request #2418 from kubernetes-incubator/1439br
...
Explicitly defines the --kubelet-preferred-address-types parameter
2018-03-12 10:53:48 +02:00
3a714fd4ac
Merge pull request #2427 from hswong3i/local_volume_provisioner_default
...
FIXUP #2424 : local_provisioner directory should be created only if enabled
2018-03-10 09:00:35 -05:00
c47fdc9aa0
Merge pull request #2445 from chadswen/kube-cert-directory-fix
...
Fix kubernetes cert permission sync
2018-03-09 15:10:35 -05:00
cd153a1fb3
Fix kubernetes cert permission sync
...
Add `state: directory` to `file` task so that `recurse: yes` will actually take effect and ensure
certs/keys have the right file mode and owner
2018-03-09 00:11:10 -06:00
a086686e9f
Support multiple artifacts under individual inventory directory
2018-03-08 11:57:53 +08:00
6402004018
FIXUP #2424 : local_provisioner directory should be created only if enabled
2018-03-08 11:57:46 +08:00
646d473e8e
fix the name of some variable
2018-03-07 18:30:34 +08:00
07657aecf4
add support for azure vnetResourceGroup
2018-03-05 13:40:25 -06:00
89847d5684
Explicitly defines the --kubelet-preferred-address-types parameter
...
to the API server configuration.
This solves the problem where if you have non-resolvable node names,
and try to scale the server by adding new nodes, kubectl commands
start to fail for newly added nodes, giving a TCP timeout error when
trying to resolve the node hostname against a public DNS.
2018-03-05 15:25:14 +01:00
a800ed094b
Added support for webhook authentication/authorization on the secure kubelet endpoint
2018-03-03 10:00:09 +04:00
8b21034b31
Merge pull request #2344 from hswong3i/local_volume_provisioner_fixup
...
Upgrade Local Volume Provisioner Addon to v2.0.0
2018-03-01 13:12:44 +02:00
67ffd8e923
Add etcd-events cluster for kube-apiserver ( #2385 )
...
Add etcd-events cluster for kube-apiserver
2018-03-01 11:39:14 +03:00
af7edf4dff
Merge pull request #2369 from eviln1/fix-insecure-apiserver-port
...
fix apiserver manifest when disabling insecure_port
2018-02-28 17:48:08 -06:00
7ef9f4dfdd
Revert "Add pre-upgrade task for moving credentials file" ( #2393 )
2018-02-28 22:41:52 +03:00
ad89d1c876
Update pre_upgrade.yml
2018-02-28 19:07:44 +03:00
6b80ac6500
Fix indexing of supplementary DNS in openssl.conf
2018-02-28 16:04:52 +00:00
bb469005b2
Add pre-upgrade task for moving credentials file
2018-02-27 17:35:15 +03:00
128d3ef94c
Fix run kubectl error ( #2199 )
...
* Fix run kubectl error
Fix run kubectl error when first master doesn't work
* if access_ip is define use first_kube_master
else different master use a different ip
* Delete set first_kube_master and use kube_apiserver_access_address
2018-02-27 16:32:20 +03:00
2bd3776ddb
fix apiserver manifest when disabling insecure_port
2018-02-22 14:00:32 +01:00
ba91304636
Fixed generate front proxy client certs with vault ( #2359 )
...
* Fixed generate front proxy client certs with vault
* fix vault cert management
* Distrebute etcd node certs to vault hosts
2018-02-22 15:08:50 +03:00
42a0f46268
Add health check to kube proxy ( #2356 )
...
Adding health checking to kube proxy. Fixes #2308
2018-02-21 23:14:45 +03:00
d84ff06f73
Set filemode to 0640 ( #2315 )
...
* Set filemode to 0640
weave-net.yml file is readable by all users on the host. It however contains the weave_password to encrypt all pod communication. It should only be readable by root.
* Set mode 0640 on users_file with basic auth
2018-02-21 23:13:46 +03:00
d4c61d2628
Fixup for gce_centos7-flannel-addons
2018-02-21 13:41:25 +08:00
deef47c923
Upgrade Local Volume Provisioner Addon to v2.0.0
2018-02-21 13:41:25 +08:00
2de6da25a8
Merge pull request #2312 from woopstar/patch-7
...
Added iptables lock fix and ajusted oom-score
2018-02-19 22:47:07 -06:00
f13e76d022
Added cilium support ( #2236 )
...
* Added cilium support
* Fix typo in debian test config
* Remove empty lines
* Changed cilium version from <latest> to <v1.0.0-rc3>
* Add missing changes for cilium
* Add cilium to CI pipeline
* Fix wrong file name
* Check kernel version for cilium
* fixed ci error
* fixed cilium-ds.j2 template
* added waiting for cilium pods to run
* Fixed missing EOF
* Fixed trailing spaces
* Fixed trailing spaces
* Fixed trailing spaces
* Fixed too many blank lines
* Updated tolerations,annotations in cilium DS template
* Set cilium_version to iptables-1.9 to see if bug is fixed in CI
* Update cilium image tag to v1.0.0-rc4
* Update Cilium test case CI vars filenames
* Add optional prometheus flag, adjust initial readiness delay
* Update README.md with cilium info
2018-02-16 21:37:47 -06:00
95e2bde15b
set nodeName to "{{ inventory_hostname }}" in kubeadm-config
2018-02-16 16:20:08 -05:00
4c280e59d4
Use legacy policy config to apply the scheduler policy
2018-02-16 13:43:35 +01:00
76a89039ad
Merge pull request #2285 from jasdeep-hundal/do_not_install_python_apt
...
Remove redundant python-apt install
2018-02-15 17:04:08 +01:00
41ca67bf54
Added iptables lock fix and ajusted oom-score
...
xtables lock was missing. Added new option for oom-score to make sure it's not killed in an OOM situation before regular pods.
2018-02-12 10:21:38 +01:00
d72232f15b
Increased timeout values for k8s API server restart
2018-02-12 07:35:29 +00:00
03c61685fb
Added apiserver extra args variable for kubeadm config ( #2291 )
2018-02-12 10:29:46 +03:00
338238d086
Fix version comparison
...
`FAILED! => {"changed": false, "msg": "AnsibleFilterError: Version comparison: unorderable types: str() < int()"}`
2018-02-10 03:49:49 +08:00
4e61fb9cd3
Refactored kubeadm join process and fixed uncrodonng for master nodes
2018-02-09 15:51:47 +01:00
b472c2df98
Fix safe upgrade
...
Even though there it kubeadm_token_ttl=0 which means that kubeadm token never expires, it is not present in `kubeadm token list` after cluster is provisioned (at least after it is running for some time) and there is issue regarding this https://github.com/kubernetes/kubeadm/issues/335 , so we need to create a new temporary token during the cluster upgrade.
2018-02-09 15:51:47 +01:00
f57abae01e
Remove redundant python-apt install
...
Ansible automatically installs the python-apt package when using
the 'apt' Ansible module, if python-apt is not present. This patch
removes the (unneeded) explicit installation in the Kubespray
'preinstall' role.
2018-02-08 18:59:37 -08:00
c70c44b07b
Merge pull request #2257 from rzenker/tb/baremetal-tweaks
...
baremetal tweaks
2018-02-08 15:48:55 +00:00
20583e3d15
Merge pull request #2067 from manics/sysctl-net-brfilter
...
Always set net.bridge.bridge-nf-call-* sysctl
2018-02-08 15:43:46 +00:00
9f4588cd0c
Merge pull request #2266 from riverzhang/epel-release
...
Disalbe install epel-release rpm on Centos/Redhat
2018-02-08 15:42:28 +00:00
7bce70339f
Merge pull request #2251 from woopstar/metrics-server-patch-2
...
Adding metrics-server support for K8s version 1.9
2018-02-08 11:16:44 +01:00
384e5dd4c4
Merge pull request #2160 from kongslund/disable-read-only-port
...
Make the Kubelet read-only port configurable and disable it by default
2018-02-07 13:06:32 -06:00
f9df692056
Issue front proxy certs for vault
2018-02-07 11:03:10 +01:00
f193b12059
Kubeadm auto creates this
2018-02-07 10:50:34 +01:00
2cd254954c
Remove defaults of allowed names. Updated kubeadm
2018-02-07 10:07:55 +01:00
4dab92ce69
Rename from aggregator-proxy-client to front-proxy-client to match kubeadm design. Added kubeadm support too. Changed to use variables set and not hardcode paths. Still missing cert generation for Vault
2018-02-07 09:50:19 +01:00
47adf4bce6
Disalbe install epel-release rpm on Centos/Redhat
...
1.Disalbe install epel-release rpm on Centos/Redhat
2.Use yum install epel-release
2018-02-07 14:58:50 +08:00
ad9049a49e
baremetal tweaks
...
* allow installs to not have hostname overriden with fqdn from inventory
* calico-config no longer requires local as and will default to global
* when cloudprovider is not defined, use the inventory_hostname for cni-calico
* allow reset to not restart network (buggy nodes die with this cmd)
* default kube_override_hostname to inventory_hostname instead of ansible_hostname
2018-02-06 13:52:22 -05:00
8006a6cd82
local_volumes_enabled replaced by local_volume_provisioner_enabled
2018-02-06 17:12:09 +01:00
bb4446e94c
Merge pull request #2226 from manics/supplemental-addresses
...
Enable additional addresses to be added to certificates
2018-02-06 13:51:54 +01:00
d2102671cd
Merge pull request #2214 from woopstar/patch-3
...
Loadbalancer Apiserver Address is missing
2018-02-06 13:47:55 +01:00
Rong Zhang
Samuele Chiocca
Erwan Miran
Jeff Bornemann
Mark Eisenblaetter
Jonathan Craig
Andreas Krüger
Tatsuyuki Ishi
Antoine Legrand
Seungkyu Ahn
Maxime Brunet
Matthew Mosesohn
Luis Nuñez
Robert Everson
woosley.xu
Evan Zeimet
Takashi Okamoto
Aivars Sterns
Wong Hoi Sing Edison
Dao Hoang Son
Matthew Mosesohn
Miouge1
southquist
Yumo Yang
Henry Finucane
Brad Beam
Di Xu
Ben Meier
Dmitry
Oleg Ozimok
dvazar
Christopher J. Ruwe
Ryo Nishikawa
Michal Rostecki
Chad Swenson
Maxime Gaillard
Tomasz Majchrowski
mirwan
Markos Chandras
Suzuka Asagiri
Romain DEQUIDT
Paul Montero
Markos Chandras
Nirmoy Das
Christian Phu
Marcelo Grebois
Robin Skahjem-Eriksen
Brad Beam
Atoms
Daniel Hoherd
Chen Hong
georgejdli
avoidik
RongZhang
Kuldip Madnani
Dann Bohn
Bharat Kunwar
Sergey Bondarev
zhengchuan hu
Spencer Smith
Michael Beatty
Ayaz Ahmed Khan
Jonas Kongslund
Simon Li
Nedim Haveric
Maxim Krasilnikov
melkosoft
Antoine Legrand
Virgil Chereches
Chia-liang Kao
mlushpenko
jasdeep-hundal
Ryan Zenker