8b3481f511
Add molecule tests for roles ( #8080 )
...
* Add molecule tests for bastion-ssh-config
* Add molecule tests for adduser
* Update .gitignore
2021-10-14 18:46:54 -07:00
7019c2685d
Increase cpu limit to prevent throttling ( #8076 )
2021-10-14 11:03:36 -07:00
d18cc38586
Replcae deprecated --delete-local-data in pre-remove/pre-upgrade tasks ( #8081 )
2021-10-14 02:25:19 -07:00
cee481f63d
cert-manager: upgrade to 1.5.4 ( #8069 )
...
* cert-manager: update to 1.5.4
* cert-manager: remove outdated guidelines on creating an initial ClusterIssuer
2021-10-12 09:17:47 -07:00
e4c8c7188e
etcd: deploy container engine if needed ( #7532 )
...
If the etcd cluster is separate and the etcd_deployment_type is "host",
there is no need for a container engine on the etcd nodes
Do not rely on a 'default(true)' filter, but define a proper default in
kubespray-defaults depending on etcd deployment method and if internal
or external etcd is used
2021-10-12 00:31:47 -07:00
6c004efd5f
cert_manager: Remove deprecated ClusterIssuer and its Secret ( #8064 )
2021-10-11 09:40:40 -07:00
1a57780a75
Add kubeadm_join_phases_skip variable ( #8067 )
...
* Add kubeadm_join_phases_skip variable
* Update kubeadm_join_phases_skip comment
Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
* Add kubeadm_join_phases_skip_default variable to follow the same logic with kubeadm_init_phases_skip
Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
2021-10-11 09:36:41 -07:00
ce25e4aa21
MetalLB: update to v0.10.3 ( #8071 )
...
Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>
2021-10-11 08:54:40 -07:00
ef4044b62f
csi_driver / cinder: implement rescan-on-resize variable via ( #8057 )
...
cinder_csi_rescan_on_resize
2021-10-11 02:14:40 -07:00
c8d9afce1a
Update a bunch of tools ( #8061 )
2021-10-08 09:00:59 -07:00
285983a555
Update docker version to 20.10.9 - CVE fixes ( #8060 )
2021-10-08 08:56:58 -07:00
ab4356aa69
Calico: bump default version to 3.20.2 ( #8058 )
2021-10-07 12:59:33 -07:00
5fcf047191
local-volume-provisioner quay.io -> k8s.gcr.io ( #8054 )
2021-10-06 17:08:41 -07:00
e707f78899
After upgrade, allow cilium to be back before uncordoning ( #7978 )
...
* After upgrade, allow cilium to be back before uncordoning
* add eol
* use kube_config_dir variable
resolves https://github.com/kubernetes-sigs/kubespray/pull/7978#discussion_r721685549
2021-10-05 12:56:58 -07:00
41e0ca3f85
Move kube_feature_gates to kubelet config ( #8048 )
...
to remove deprecation warning:
> Flag --feature-gates has been deprecated, This parameter should be set via the config file specified by the Kubelet's --config flag.
2021-10-05 06:07:10 -07:00
43958614e3
Fix kubespray flatcar ansible_os_family and ansible_distribution ( #8029 )
...
Closes https://github.com/kubernetes-sigs/kubespray/issues/8028
Signed-off-by: Iago Santos <iago.santos.pardo@adfinis.com>
2021-10-01 09:11:23 -07:00
af04906b51
Ensure apparmor is installed ( #8036 )
...
Kubespray deployment failed when using containerd backend on nodes that apparmor was not installed or previously removed. This PR ensure apparmor is installed by adding it into required_pkgs var.
2021-09-29 23:52:08 -07:00
c7e17688b9
gVisor: bump release to 20210921 version ( #8015 )
...
* gVisor: bump release to 20210921 version
* gVisor: drop support for 20210518.0 version
2021-09-29 11:35:20 -07:00
f5885d05ea
In CentOS 8.x Docker install Step: remove podman when existing ( #8016 )
2021-09-29 06:32:48 -07:00
eee2eb11d8
Update weave template to match source for 2.8.1 ( #8013 )
2021-09-28 09:16:43 -07:00
8d3961edbe
Add metrics_server_resizer option ( #8018 )
...
The addon-resizer container can reduce resource limits of cpu and
memory of metrics-server container in the pod, and that caused
OOMKilled.
In addition, the original metrics-server manifest doesn't contain
the addon-resizer container as [1].
So this adds metrics_server_resizer option to control the addon-resizer
container deployment and the default value is false to make it stable
for most environments.
[1]: 527679e5e8/manifests/base/deployment.yaml
2021-09-28 00:02:42 -07:00
4c5328fd1f
Determine root filesistem device and partition before running growpart ( #8024 )
2021-09-27 23:58:42 -07:00
1472528f6d
check if 'plugins' key exists in calico_cni_config object ( #7717 )
...
* check if 'plugins' key exists in calico_cni_config object
* fix whitespace linting error
* fixed when list indentation
2021-09-27 11:04:20 -07:00
9416c9aa86
Enable stable and edge Docker CLI versions ( #8019 )
2021-09-27 10:44:19 -07:00
da92c7e215
Add proxy for subscription-manager ( #8012 )
...
If using proxy, it is necessary to configure it before running
"subscription-manager status" command.
This adds the step.
2021-09-27 08:47:35 -07:00
d27cf375af
Remove allowPrivilegeEscalation from metrics-server ( #8014 )
...
"allowPrivilegeEscalation: false" blocks deploying metrics-server
on CentOS7. In addition, the original metrics-server manifest doesn't
contain it as [1]. This removes it.
[1]: 527679e5e8/manifests/base/deployment.yaml
2021-09-27 08:43:36 -07:00
432a312a35
Enable stable and edge containerd versions ( #8020 )
2021-09-27 08:11:35 -07:00
3a6230af6b
Kata-Containers: update versions 2.2.0 (default) and 2.1.1 ( #8017 )
...
* Kata-Containers: add 2.2.0 hashes and make default
* Kata-Containers: replace 2.1.0 with bugfix version 2.1.1
* Kata-Containers: move to q35 a more modern VM architecture as 'pc' is removed in 2.2.0
2021-09-27 08:07:35 -07:00
ecd267854b
Move ovn4nvf crd from v1beta1 to v1 ( #8006 )
2021-09-27 01:18:22 -07:00
ac846667b7
Check if openstack application credentials are empty since they always exists ( #8021 )
2021-09-27 01:14:22 -07:00
4bace2491d
Ensure apparmor is installed ( #8011 )
...
Kubespray deployment failed when using containerd backend on nodes that apparmor was not installed or previously removed. This PR ensure apparmor is installed by adding it into required_pkgs var.
2021-09-24 07:55:23 -07:00
22017b7ff0
kube-router 1.3.0 -> 1.3.1 ( #8007 )
2021-09-23 13:42:55 -07:00
88c11b5946
Revert "etcd: enable v2 api only if needed ( #8001 )" ( #8008 )
...
This reverts commit c0e1211abe
2021-09-23 10:43:14 -07:00
843252c968
Use kube_config_dir for kubeconfig ( #7996 )
...
The path of kubeconfig should be configurable, and its default value
is /etc/kubernetes/admin.conf. Most paths of the file are configurable
but some were not. This make those configurable.
2021-09-23 10:19:13 -07:00
ddea79f0f0
Issue 8004: Fix typha prometheus ( #8005 )
...
The typha prometheus settings were in the `volumeMounts` section of the
spec and not in the `envs` section. This was cauing the deployment to
fail because it was looking for a volumeMount.
```
failed: [controller-001.a2.da.dev.logdna.net] (item=calico-typha.yml) => {"ansible_loop_var": "item", "changed": false, "item": {"ansible_loop_var": "item", "changed": true, "checksum": "598ac79530749e8e2110793b53fc49ac208e7130", "dest": "/etc/kubernetes/calico-typha.yml", "diff": [], "failed": false, "gid": 0, "group": "root", "invocation": {"module_args": {"_original_basename": "calico-typha.yml.j2", "attributes": null, "backup": false, "checksum": "598ac79530749e8e2110793b53fc49ac208e7130", "content": null, "delimiter": null, "dest": "/etc/kubernetes/calico-typha.yml", "directory_mode": null, "follow": false, "force": true, "group": null, "local_follow": null, "mode": null, "owner": null, "regexp": null, "remote_src": null, "selevel": null, "serole": null, "setype": null, "seuser": null, "src": "/home/core/.ansible/tmp/ansible-tmp-1632349768.56-75434-32452975679246/source", "unsafe_writes": null, "validate": null}}, "item": {"file": "calico-typha.yml", "name": "calico", "type": "typha"}, "md5sum": "53c00ac7f562cf9ecbbfd27899ea066d", "mode": "0644", "owner": "root", "size": 5378, "src": "/home/core/.ansible/tmp/ansible-tmp-1632349768.56-75434-32452975679246/source", "state": "file", "uid": 0}, "msg": "error running kubectl (/opt/bin/kubectl --namespace=kube-system apply --force --filename=/etc/kubernetes/calico-typha.yml) command (rc=1), out='service/calico-typha unchanged\n', err='error: error validating \"/etc/kubernetes/calico-typha.yml\": error validating data: [ValidationError(Deployment.spec.template.spec.containers[0].volumeMounts[2]): unknown field \"value\" in io.k8s.api.core.v1.VolumeMount, ValidationError(Deployment.spec.template.spec.containers[0].volumeMounts[2]): missing required field \"mountPath\" in io.k8s.api.core.v1.VolumeMount, ValidationError(Deployment.spec.template.spec.containers[0].volumeMounts[3]): unknown field \"value\" in io.k8s.api.core.v1.VolumeMount, ValidationError(Deployment.spec.template.spec.containers[0].volumeMounts[3]): missing required field \"mountPath\" in io.k8s.api.core.v1.VolumeMount]; if you choose to ignore these errors, turn validation off with --validate=false\n'"}
```
2021-09-23 08:37:22 -07:00
c0e1211abe
etcd: enable v2 api only if needed ( #8001 )
...
* etcd: enable v2 api only if needed
Only enable v2 API if we have a consumer (flannel)
This reduce the exposed surface for etcd.
* Fix bad group name
2021-09-22 12:36:32 -07:00
c8d7f000c9
Remove k8s hooks for versions prior to 1.20 ( #7998 )
2021-09-22 10:32:01 -07:00
598f178054
Fix cilium operator metrics activation ( #8000 )
2021-09-22 10:00:02 -07:00
5d1b34bdcd
Move min k8s version to 1.20
2021-09-22 09:50:01 -07:00
8efde799e1
Update kubernetes version to 1.22.2
2021-09-22 09:50:01 -07:00
a517a8db01
Drop chech for kubelet_shutdown_grace_period ( #7993 )
...
and kubelet_shutdown_grace_period_critical_pods as ansible cannot do
sane time interval calculations
2021-09-21 18:34:00 -07:00
2211504790
Fix k8s-certs-renew cp path ( #7992 )
...
Signed-off-by: Wang Zhen <lazybetrayer@gmail.com>
2021-09-21 00:36:22 -07:00
fb8662ec19
Calico: update versions 3.20.1, 3.19.3 ( #7984 )
...
* make Calico 3.20.1 the default version
* drop Calico 3.17.x support
2021-09-20 17:40:23 -07:00
6f7911264f
Calico: make calico_min_version check relevant ( #7939 )
...
* Calico: make calico_min_version check relevant
* Calico: only check currently installed version against the oldest supported version by the previous release
2021-09-20 07:58:09 -07:00
ae44aff330
Calico: increase calico node probe timeouts and allow tunning ( #7981 )
2021-09-17 16:08:07 -07:00
b83e8b020a
Fix default version ( #7977 )
2021-09-17 07:31:00 -07:00
30cd91dc6b
Add option to kubeadm upgrade command to control certificates renewal during control plane upgrade ( #7976 )
...
* Add option to kubeadm upgrade command to control certificates renewal during control plane upgrade
* Remove training whitespace
2021-09-17 04:31:00 -07:00
f2fa9c3b31
Update hashes with new versions
2021-09-17 00:39:02 -07:00
30a7dfa4f8
Fix ubuntu16/centos8 CI jobs ( #7972 )
2021-09-16 23:39:01 -07:00
62ab477838
remove kube_proxy_conntrack_max var ( #7971 )
2021-09-15 08:22:31 -07:00
f8a57f7598
Fix iptables missing on Debian 11 if APT::Install-Recommends=0 ( #7964 )
...
On Debian 11, `ipset` just recommend `iptables` so on the system that apt is configured with `APT::Install-Recommends "0";` iptables will not install automatically.
2021-09-14 08:19:09 -07:00
35c928798d
Fix missing file mode (risky-file-permissions) ( #7959 )
...
* Fix missing file mode (risky-file-permissions)
Found this using ansible-lint.
Signed-off-by: Bryan Hundven <bryanhundven@gmail.com>
* Fix another missing file mode (risky-file-permissions)
This one fixes `/etc/crio/config.json`
Signed-off-by: Bryan Hundven <bryanhundven@gmail.com>
2021-09-09 23:35:59 -07:00
83f64a7ff9
Bugfix/cinder csi cloud config template ( #7955 )
...
* Fix invalid condition for username and password inclusion
* Use length filter to test variable conditions
2021-09-09 10:04:11 -07:00
60853fa682
Update kube-ovn to 1.7.2
2021-09-09 08:14:10 -07:00
b66356be65
Update cilium to 1.9.10
2021-09-09 08:14:10 -07:00
efae2dbad6
Update snapshot-controller repository and image versions ( #7957 )
2021-09-09 08:10:11 -07:00
bd8b8916a8
Remove invalid spec - deployment.spec.serviceName ( #7949 )
2021-09-08 13:05:56 -07:00
57063b6828
Replace incorrect {% end %} tags with {% endif %} in csi_crd templates ( #7947 )
2021-09-08 12:59:57 -07:00
69b67a293a
Calico: Add kube_service_addresses_ipv6 to serviceClusterIPs ( #7889 ) ( #7944 )
...
Add IPv6 Service Addresses to BGP advertisement when
calico_advertise_cluster_ips is true.
2021-09-08 00:37:20 -07:00
d57ddf0be8
Feature DynamicKubeletConfig is deprecated in 1.22 and will not move to GA ( #7938 )
...
* Feature DynamicKubeletConfig is deprecated in 1.22 and will not move to GA
* Add check for dynamic_kubelet_configuration with kube >= 1.22
2021-09-07 10:47:16 -07:00
43e7e2d663
nginx-ingress: bump to 1.0.0 to support kube 1.22 ( #7942 )
2021-09-06 04:50:36 -07:00
d355b43dce
ContainerD: bump containerd version to 1.4.9 ( #7940 )
2021-09-06 04:50:29 -07:00
5d52025266
crictl: add hashes for 1.22 ( #7936 )
2021-09-06 04:46:29 -07:00
db470f8529
Update CSI snaphotter and make it independent ( #7943 )
...
* CSI: update CSI snapshot CRDs
* CSI: update snapshot controller tag version with kubernetes specific versions
* CSI: allow enabling csi_snapshot_controller independent of Cinder CSI
* CSI: Align csi-snapshot-controller with upstream and use a Deployment instead of a StatefulSet
2021-09-06 04:24:29 -07:00
81bf4f9304
cri-o registry auth support ( #7837 )
...
* cri-o registry auth support
* yaml lint for comments
* crio_registry_auth from registry_auth
* crio_registry_auth as defaults
2021-09-01 10:20:59 -07:00
e1967b0700
MetalLB: keep nodeSelector in one place ( #7931 )
...
Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>
2021-09-01 09:05:00 -07:00
507091ec8b
Replace cluster_name by dns_domain ( #7923 )
...
`cluster_name` defaults to `dns_domain` value (see [here][1] and [here][2])
but they could have different values.
`dns_domain` should be used here instead of `cluster_name` because the DNS
resolution is configured to use `dns_domain`.
[1]: 0ef7af76bc/roles/kubespray-defaults/defaults/main.yaml (L104)1afdb05ea9/inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml (L196)
2021-09-01 08:18:59 -07:00
48ceca4919
MetalLB: update to v0.10.2 ( #7925 )
...
Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>
2021-09-01 03:00:59 -07:00
426ad81db0
Calico: replace hashes for latest 3.17 and 3.18 to the .5 minor versions ( #7924 )
2021-08-31 13:38:21 -07:00
497d2ca306
Fix Calico's FelixConfiguration when "IP in IP" is disabled ( #7926 )
...
When using Calico with:
- `calico_network_backend: vxlan`,
- `calico_ipip_mode: "Never"`,
- `calico_vxlan_mode: "Always"`,
the `FelixConfiguration` object has `ipipEnabled: true`, when it should be false:
This is caused by an error in the `| bool` conversion in the install task:
when `calico_ipip_mode` is `Never`,
`{{ calico_ipip_mode != 'Never' | bool }}` evaluates to `true`:
2021-08-31 13:14:21 -07:00
9d3888a756
During pre-upgrade add a flag to always cordon ( #7892 )
...
* During pre-upgrade add a flag to always cordon
* empty
* empty
* empty
* Better default val
2021-08-30 10:56:09 -07:00
c8e090c17f
Add preliminary Debian 11 (bullseye) support ( #7853 )
...
- Use python3-apt instead because python-apt was removed in Debian 11
- Add gnupg (fix "container-engine/containerd : ensure containerd repository public key is installed" task failed)
- Remove aufs-tools
Signed-off-by: rtsp <git@rtsp.us>
2021-08-30 09:53:06 -07:00
1ccf32e08f
Update docker to 20.10.8 ( #7918 )
2021-08-30 08:25:06 -07:00
17af348be8
Add bunch of Kubernetes versions missing
2021-08-30 08:17:05 -07:00
1afdb05ea9
Fedora and RHEL use etc_t and the convention is <type_name>_t ( #7891 )
...
* Fedora and RHEL use etc_t and the convention is <type_name>_t
* Docs: specify all values for preinstall_selinux_state
* CI: Add Fedora 34 with SELinux in enforcing mode
2021-08-27 14:20:53 -07:00
89993e4833
fix error metrics server capabilities name ( #7905 )
2021-08-25 12:06:15 -07:00
1c3d33e146
Calico: 3.20.0 policy update to allow access to endpointslices ( #7899 )
2021-08-25 12:06:01 -07:00
f66c49bf42
Calico: replace version 3.19.1 with 3.19.2 and set as default ( #7867 )
...
Bump calico version to 3.19.2 due to adding 3.20.0 earlier
2021-08-25 07:32:41 -07:00
4c9d7dedb3
addons/cert_manager: retries until webhook pods has been created ( #7850 )
...
Fix task 'Cert Manager | Wait for Webhook pods become ready' failed due to webhook pods don't exist yet by using `retries..until` trick like kubernetes-sigs/kubespray#7842
This fix should be removed in the future if the kubernetes/kubernetes#83242 is resolved.
Signed-off-by: rtsp <git@rtsp.us>
2021-08-25 07:16:41 -07:00
5336943a8c
add cilium_operator_api_serve_addr to cilium operator config ( #7901 )
2021-08-24 03:49:13 -07:00
a040e521b4
feat(containerd): auth support ( #7868 )
...
* feat(containerd): auth support
* fix(registry-auth): rename variable
2021-08-23 06:40:00 -07:00
0ac364dfae
Calico: use --allow-version-mismatch in calicoctl.sh to allow upgrades ( #7873 )
2021-08-20 14:30:48 -07:00
79166496f3
debian: Fix test failed after bullseye release ( #7888 )
2021-08-19 15:37:24 -07:00
1f09229740
Update cilium to 1.9.9 ( #7871 )
...
Now that 1.10 is out this is to make 1.9.9 the default. I am running
this version successfully.
2021-08-16 13:34:22 -07:00
c06896a352
Update metrics-server to 0.5.0 ( #7864 )
2021-08-12 08:19:48 -07:00
c119620f7c
Calico: add v3.20.0 hashes ( #7855 )
2021-08-11 07:50:46 -07:00
7f309bb092
fix parameters for module replace in 0060-resolvconf ( #7858 )
2021-08-10 17:13:26 -07:00
e2b67b5700
Add suport of Vsphere CSI driver 2.2.X versions ( #7848 )
2021-08-09 08:19:38 -07:00
82a9064d8d
addons/cert_manager: fix kubernetes-sigs#7085 by adding retries..until ( #7842 )
...
Fix task 'Cert Manager | Apply ClusterIssuer manifest' failed due to service/endpoints updating delayed even though the wekhook pod status is ready.
Signed-off-by: rtsp <git@rtsp.us>
2021-08-09 08:19:31 -07:00
a70fab2249
Bump crun to 0.21 version ( #7854 )
2021-08-09 08:11:31 -07:00
31a5a4e808
retry to fetch binary if it fails first time ( #7839 )
2021-07-30 00:17:38 -07:00
5db86f4c2b
Update vSphere CPI ( #7838 )
...
Changes:
* ClusterRole updated according to the latest manifests from
https://github.com/kubernetes/cloud-provider-vsphere
* vSphere CPI/CSI default versions bumped and
tested successfully on K8S 1.21.1
* vSphere documentation updated
Signed-off-by: Vitaliy D <vi7alya@gmail.com>
2021-07-29 18:17:37 -07:00
627a06e30d
CRI-O: Install libseccomp2 from backports on Debian 10 ( #7816 )
...
* CRI-O: Install libseccomp2 from backports on Debian 10
libseccomp2 is a required dependency of cri-o-runc package
The one provided in Debian 10 repositories is outdated
* 7816: Remove useless when condition
As this condition is handled by block
2021-07-23 07:07:16 -07:00
56e230863a
Separate gvisor_download_url for runsc and shim ( #7760 )
...
To download necessary files in advance for offline deployment,
we can see all file URLs with contrib/offline/generate_list.sh
Most URLs are downloadable, but gvisor's one is not because the
URL is a part of full URLs for gvisor.
To download gvisor's files from the URLs directory, this separates
into two URLs for runsc and the shim.
2021-07-22 07:51:51 -07:00
f21a707e99
Add containerd on Flatcar Container Linux ( #7681 )
2021-07-21 06:28:07 -07:00
0ef7af76bc
Fixup label for oracle linux bootstrap
2021-07-20 01:29:31 -07:00
18666b3e2d
Update multus to 3.7.2 (and move to ghcr.io)
2021-07-20 01:29:31 -07:00
ed87386d7b
Set default k8s version to 1.21.3
2021-07-20 01:29:31 -07:00
1ad9b33b08
Add hashes for k8s 1.20.8/.9 and 1.19.12/.13 and 1.21.3
2021-07-20 01:29:31 -07:00
000b4565c2
Fix erroneous ansible args
2021-07-20 01:29:31 -07:00
efrikin
Olivier Levitt
Mohamed Zaian
Cristian Calin
Max Gautier
rtsp
Necatican Yıldırım
Maciej Wereski
Rene Luria
Florian Ruynat
Maxim Pogozhiy
Rene Luria
Ilya Margolin
Iago Santos
Peter Pan
Frank Filippone
Kenichi Omichi
Marcos Lorenzo
David Louks
Victor Morales
Hugo Blom
Eric Lake
Max Gautier
Léopold Jacquot
Wang Zhen
Hari Hud
Samuel Liu
Bryan Hundven
jhchong92
Ole Mathias Aa. Heggem
kranthi guttikonda
Olivier Lemasle
Calvin Park
Sergey
Samuel
Frank Ritchie
Léopold Jacquot
Daniil Muidinov
Eugene Artemenko
rtsp
Smita Srivastava
Vitaliy D
AnatomicJC
cola-zero