826282fe89
Add k8s hashes for k8s version. ( #9685 )
...
Signed-off-by: yanggang <gang.yang@daocloud.io>
Signed-off-by: yanggang <gang.yang@daocloud.io>
2023-01-19 05:30:35 -08:00
374438a3d6
feat(calico): add possibility to enable calico floatingIPs feature ( #9680 )
...
Add a variable `calico_felix_floatingIPs` which permit to enable calico feature `floatingIPs`
(disabled per default).
Signed-off-by: MatthieuFin <matthieu2717@gmail.com>
#9679
2023-01-18 15:42:34 -08:00
fd80ef1ff1
[argocd] update argocd to v2.5.7 ( #9682 )
...
Signed-off-by: yanggang <gang.yang@daocloud.io>
Signed-off-by: yanggang <gang.yang@daocloud.io>
2023-01-18 15:38:34 -08:00
235173bb5f
[flannel] update to v0.20.2 & make it default ( #9675 )
2023-01-18 15:26:34 -08:00
db94812163
bump cni-plugins to v1.2.0 ( #9671 )
...
Signed-off-by: cyclinder qifeng.guo@daocloud.io
Signed-off-by: cyclinder qifeng.guo@daocloud.io
2023-01-17 00:12:32 -08:00
4a6eb7eaa2
enable back kubelet_authorization_mode_webhook by default ( #9662 )
...
In 6db6c8678c
2023-01-16 23:56:32 -08:00
8a03bb1bb4
add containerd config_path ( #9566 )
...
Signed-off-by: rongfu.leng <rongfu.leng@daocloud.io>
Signed-off-by: rongfu.leng <rongfu.leng@daocloud.io>
2023-01-16 23:42:32 -08:00
d919c58e21
[multus] added support for mixed type of container engine ( #9224 )
...
* [multus] added support for mixed type of container engine
* [multus] fixed for using with cluster/upgrade-cluster/scale playbooks
2023-01-16 23:30:33 -08:00
19bc610f44
Update pause image version to v3.8 ( #9668 )
...
Signed-off-by: Mohamed Zaian <mohamedzaian@gmail.com>
Signed-off-by: Mohamed Zaian <mohamedzaian@gmail.com>
2023-01-16 15:30:10 -08:00
c7cffb14a7
[cert-manager] update cert-manager to v1.11.0 ( #9661 )
2023-01-16 02:36:51 -08:00
6f61f3d9cb
Support OVN Interconnect ( #9599 )
...
Mostly taken from: https://raw.githubusercontent.com/kubeovn/kube-ovn/master/yamls/ovn-ic.yaml.j2
2023-01-16 00:08:52 -08:00
6b4bb2a121
[argocd] update argocd to v2.5.6 ( #9654 )
...
Signed-off-by: yanggang <gang.yang@daocloud.io>
Signed-off-by: yanggang <gang.yang@daocloud.io>
2023-01-15 21:16:50 -08:00
e288449c5d
Update cri-dockerd version ( #9659 )
...
* Skip retry operation with containerd when etcd installed on host VM (#9560 )
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
* Update cri-dockerd version
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Co-authored-by: Eugene Artemenko <artemenko.evgeniy@gmail.com>
2023-01-15 21:12:51 -08:00
ea35021c96
Add defaults for external_vsphere_user and external_vsphere_password in the vsphere csi_driver ( #9664 )
2023-01-14 14:24:14 -08:00
6f1352eb53
Skip retry operation with containerd when etcd installed on host VM ( #9560 )
2023-01-10 15:53:20 -08:00
6549bb12fc
follow containerd1 1.16.15 ( #9644 )
...
Signed-off-by: yanggang <gang.yang@daocloud.io>
Signed-off-by: yanggang <gang.yang@daocloud.io>
2023-01-08 17:59:28 -08:00
843e908fa4
update-calico-VXLAN-docs ( #9639 )
2023-01-06 00:00:00 -08:00
0ff883afeb
streamline ansible_default_ipv4 gathering loop ( #9281 )
2023-01-05 11:59:58 -08:00
0d5bcd3e20
feat(coredns): Forward extra domains to coredns kubernetes plugin ( #9635 )
2023-01-05 06:57:58 -08:00
a8cef962e2
Add retry to avoid 'unknown' state for calicoctl ( #9633 )
...
Signed-off-by: tu1h <lihai.tu@daocloud.io>
Signed-off-by: tu1h <lihai.tu@daocloud.io>
2023-01-05 05:09:58 -08:00
b50890172b
calico: add vxlan-v6.calico to the list of NM unmanaged interfaces ( #9631 )
...
Signed-off-by: cyclinder qifeng.guo@daocloud.io
Signed-off-by: cyclinder qifeng.guo@daocloud.io
2023-01-05 04:29:58 -08:00
6674438849
fix-ci-issue ( #9640 )
2023-01-05 00:11:58 -08:00
4bc5e8d912
Skip removing nodes if cluster is not set ( #9430 )
2023-01-03 05:03:32 -08:00
050fde6327
Add enableServicesElection env variable. ( #9595 )
2023-01-02 18:35:33 -08:00
4d3104b334
Reset role: Remove kube-ovn log directories ( #9625 )
2023-01-02 18:29:30 -08:00
85fa6af313
cleanup: replace node-role.kubernetes.io/master ( #9627 )
...
Signed-off-by: xin.li <xin.li@daocloud.io>
Signed-off-by: xin.li <xin.li@daocloud.io>
2023-01-01 13:59:32 -08:00
1c4db6132d
optimize cgroups settings for node reserved ( #9209 )
...
* optimize cgroups settings for node reserved
* fix
* set cgroup slice for multi container engine
* set cgroup slice for crio
* add reserved cgroups variables to sample files
* Compatible with cgroup path for different container managers
* add cgroups doc
* fix markdown
2022-12-30 08:05:30 -08:00
744c81d451
Remove ovn.kubernetes.io/ovs_dp_type from nodeSelector ( #9594 )
...
Remove extra tag requirement preventing openvswitch container to start.
2022-12-29 01:37:29 -08:00
61be93b173
Drop calico v3.21 support ( #9515 )
...
At the upstream calico development, the v3.21 branch is not updated
over 2 monthes. In addition, unnecessary error message is output at
Kubespray deployment due to different URLs for calico v3.21 or v3.22+
This drops the v3.21 support to solve the issue.
2022-12-29 01:29:31 -08:00
406fbdb4e7
Update the tag of the flannel image ( #9528 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-12-28 00:55:27 -08:00
136f14dec4
Cluster support for ovn-central. ( #9596 )
...
Without minimal cluster configuration, even on a one node control plane,
the health check of the ovn-cental container always fails as it queries the
cluster/status.
2022-12-27 20:51:27 -08:00
ab80342750
[feat] Add custom options to coredns kubernets plugin ( #9608 )
2022-12-27 18:21:27 -08:00
2c2e608eac
fix(k8s-certs-renew): Use kube_apiserver_port instead of hard-coding ( #9620 )
...
Signed-off-by: Kevin Huang <git@kevin.huang.to>
Signed-off-by: Kevin Huang <git@kevin.huang.to>
2022-12-27 18:17:35 -08:00
93f71df628
Remove CNI BIN dependency for cilium ( #9563 )
...
* remove-cni-denpendeny-for-cilium
* remove-cni-denpendeny-for-cilium
2022-12-27 01:31:28 -08:00
791064a3d9
Allow custom timeout for kubeadm init ( #9617 )
...
Signed-off-by: tu1h <lihai.tu@daocloud.io>
Signed-off-by: tu1h <lihai.tu@daocloud.io>
2022-12-27 00:53:28 -08:00
e90f32bdee
Fix checksum of ciliumcli v0.12.5 ( #9614 )
...
The checksum was different and the download was failed.
This update the checksum by getting valid checksum from [1] to
fix the issue.
[1]: https://github.com/cilium/cilium-cli/releases/download/v0.12.5/cilium-linux-arm64.tar.gz.sha256sum
2022-12-27 00:49:28 -08:00
9fe89a0641
fix(apps): cinder: wrong rbac for csi-snapshotter-role ( #9610 )
2022-12-27 00:45:28 -08:00
14699f5e98
[helm] upgrade to 3.10.3 ( #9605 )
2022-12-25 16:01:26 -08:00
438da0c8e6
[argocd] update argocd to v2.5.5 ( #9604 )
2022-12-22 00:53:25 -08:00
25f317233c
Remove immutable flag from /var/lib/kubelet subdirs ( #9597 )
...
* Remove immutable flag from /var/lib/kubelet subdirs
* Find files before changing attributes
2022-12-21 18:55:25 -08:00
5e4d68b848
fix kube token dir permissions ( #9590 )
2022-12-21 15:45:25 -08:00
4728739597
follow containerd1.16.13 and 1.16.14 ( #9585 )
...
Signed-off-by: yanggang <gang.yang@daocloud.io>
Signed-off-by: yanggang <gang.yang@daocloud.io>
2022-12-21 00:35:28 -08:00
fc0d58ff48
fix-missing-control-plane-taint ( #9592 )
2022-12-19 15:57:43 -08:00
491e260d20
Feature/add flannel wireguard encryption backend as option ( #9583 )
...
* feat(): Add wireguard backend to flannel cni
As described in the flannel docs:
https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md#wireguard
This does not support optional configuration methods like:
- setting a psk (will be autogenerated by default)
- chang listening ports
- change mode (defaults to 'separate')
- change PersistentKeepaliveInterval (defaults to 0)
* Add supported backends to flannel docs
* Fix markdown in docs
2022-12-18 15:39:43 -08:00
c4d753c931
Fix annotation typo
...
Signed-off-by: Xieql <xieqianglong@huawei.com>
2022-12-15 18:40:30 +08:00
ee3b7c5da5
Use the correct api version and resourcer type. The current values work but do not match the documentation, which can be confusing. ( #9575 )
2022-12-15 01:21:35 -08:00
ccf60fc9ca
upcloud: Delete default reclaim policy ( #9574 )
2022-12-14 16:15:34 -08:00
a38a3e7ddf
upgrade-calico-v3.24.5 ( #9580 )
2022-12-14 09:21:36 -08:00
ff331f4eba
support flannel dual stack ( #9564 )
2022-12-13 20:47:35 -08:00
94eae6a8dc
adjust calico-kube-controller to use hostNetwork when using etcd as datastore ( #9573 )
2022-12-13 20:41:34 -08:00
f8d6b54dbb
Add hashes for 1.25.5, 1.24.9, 1.23.15 and make v1.25.5 default ( #9557 )
...
Signed-off-by: yanggang <gang.yang@daocloud.io>
Signed-off-by: yanggang <gang.yang@daocloud.io>
2022-12-11 16:45:33 -08:00
67c4f2d95e
Add XDG related Helm paths to be removed ( #9561 )
2022-12-10 03:59:40 -08:00
03fefa8933
[feat] Upgrade metrics server to v0.6.2 ( #9554 )
2022-12-10 03:55:40 -08:00
c8ec77a734
[containerd] Add config for unpriviledged ports and icmp ( #9517 )
...
* [containerd] Add config for unpriviledged ports and icmp
* Updated to match true false variables of other setting
2022-12-09 06:16:12 -08:00
4f32f94a51
Fix drain rescue task when `kube_override_hostname` is set ( #9556 )
...
This fixes a task failure in the rescue block that uncordons nodes after an unsuccessful drain. The issue occurs when `kube_override_hostname` is set and does not match `inventory_hostname`.
2022-12-08 16:02:11 -08:00
3dc384a17a
Allow `containerd-common` to execute multiple times per play ( #9543 )
...
The `containerd-common` role is responsible for gathering OS specific variables from the vars directory of the roles that include or import it. `containerd-common` is imported via role dependency by a total of two roles, `container-engine/docker`, and `container-engine/containerd`.
containerd-common is needed by both the docker and containerd roles as a dependency when:
- containerd is selected as the container engine
- a docker install is detected and needs to be removed
- apt is the package manager
However, by default, roles can not be invoked more than once in the same play, unless `allow_duplicates: true` is set for that role. This results in the failure of the `containerd | Remove containerd repository` task, since only the docker vars will be loaded in the play, and `containerd_repo_info.repos`, normally populated by containerd/vars, is left empty.
This change sets `allow_duplicates: true` for `containerd-common` which fixes the currently failing containerd tasks if docker was detected and removed in the same play.
2022-12-08 15:58:18 -08:00
f1d0d1a9fe
[kube-ovn]: update version v1.10.7 ( #9527 )
...
* [kube-ovn]: update version
* update readme
2022-12-08 15:58:11 -08:00
c036a7d871
Disable 'Check that IP range is enough for the nodes' when calico is used ( #9491 )
2022-12-08 10:44:23 -08:00
6e63f3d2b4
follow containerd1.16.12 ( #9551 )
...
Signed-off-by: yanggang <gang.yang@daocloud.io>
Signed-off-by: yanggang <gang.yang@daocloud.io>
2022-12-08 07:36:24 -08:00
09748e80e9
support containerd 1.6.11 ( #9544 )
2022-12-06 19:08:37 -08:00
a0f41bf82a
[metrics_server]: Enabled HA mode by adding 'metrics_server_replicas'… ( #9539 )
...
* [metrics_server]: Enabled HA mode by adding 'metrics_server_replicas' variable and adding podAntiAffinity rule
Signed-off-by: Ugur Can Ozturk <57688057+ugur99@users.noreply.github.com>
* [metrics_server]: added namespaces selector
Signed-off-by: Ugur Can Ozturk <57688057+ugur99@users.noreply.github.com>
Signed-off-by: Ugur Can Ozturk <57688057+ugur99@users.noreply.github.com>
2022-12-06 18:22:38 -08:00
1a0b81ac64
reset: RedHat based distro with major version >=8 ( #9537 )
...
During the reset, restart network was not completing in distros
like RHEL/CentOS/AlmaLinux with major version higher than 8.
Example:
kubespray> ansible-playbook -i inventory/mydomain/hosts.yml reset.yml -b -v
fatal: [mynode]: FAILED! => {"changed": false, "msg": "Could not find the requested service network: host"}
Signed-off-by: Douglas Schilling Landgraf <dlandgra@redhat.com>
Signed-off-by: Douglas Schilling Landgraf <dlandgra@redhat.com>
2022-12-05 08:57:03 -08:00
20d99886ca
Update etcd log-level parameter name ( #9540 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-12-05 01:05:03 -08:00
b9fe301036
add-check-for-resolv-to-avoid-coredns-crash ( #9502 )
2022-12-01 22:37:54 -08:00
30508502d3
update-nginx-version ( #9506 )
2022-12-01 21:51:55 -08:00
bca601d377
[ingress-nginx] upgrade to 1.5.1 ( #9532 )
2022-12-01 21:45:54 -08:00
65191375b8
[etcd] make etcd 3.5.6 default ( #9520 )
2022-12-01 14:41:53 -08:00
a534eb45ce
Update calico image tag ( #9529 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-12-01 03:18:27 -08:00
e796f08184
update dashboard image repo to remove arch flag ( #9530 )
...
Signed-off-by: lihai.tu <lihai.tu@daocloud.io>
Signed-off-by: lihai.tu <lihai.tu@daocloud.io>
2022-12-01 01:42:26 -08:00
ed38d8d3a1
Add ingress-nginx check for updating README ( #9533 )
...
To detect the version mismatch.
2022-12-01 01:16:27 -08:00
4db5e663c3
fix-mistake-regex-for-resolv-conf ( #9523 )
2022-11-30 03:48:56 -08:00
529faeea9e
[cert-manager] Upgrade to v1.10.1 ( #9512 )
2022-11-29 07:17:26 -08:00
47510899c7
Update the number of nofile limits in containerd ( #9507 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-11-25 15:12:04 -08:00
7c1ee142dd
update envoy image to v1.22.5 ( #9513 )
...
Signed-off-by: hang.jiang <hang.jiang@daocloud.io>
Signed-off-by: hang.jiang <hang.jiang@daocloud.io>
2022-11-23 19:26:05 -08:00
25e86c5ca9
Update etcd image tag ( #9516 )
...
Signed-off-by: hang.jiang <hang.jiang@daocloud.io>
Signed-off-by: hang.jiang <hang.jiang@daocloud.io>
2022-11-23 18:22:04 -08:00
c41dd92007
Clean up cilium-init image ( #9508 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-11-23 09:06:20 -08:00
a564d89d46
Update the tag of cilium hubble related images ( #9509 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-11-21 20:14:14 -08:00
6c6a6e85da
update-coredns-version ( #9503 )
2022-11-18 20:16:29 -08:00
ed0acd8027
[openstack cloud controller] bump to v1.25.3 ( #9500 )
2022-11-18 04:26:31 -08:00
b9a690463d
Add docker support for openEuler linux ( #9498 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-11-17 18:18:30 -08:00
c3986957c4
Update runsc checksum ( #9493 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-11-16 00:52:48 -08:00
8795cf6494
Add support for the OpenEuler Linux ( #9494 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-11-16 00:48:49 -08:00
80af8a5e79
upgrade containerd_version to 1.6.10 ( #9492 )
...
Signed-off-by: yanggang <gang.yang@daocloud.io>
Signed-off-by: yanggang <gang.yang@daocloud.io>
2022-11-15 03:58:41 -08:00
943107115a
disable Centos Extras repo creation for OL9 ( #9483 )
...
Centos 9 doesn't exists, and Centos 9-stream also doesn't have extras repo.
2022-11-14 16:28:41 -08:00
f007c77641
[etcd] make etcd 3.5.5 default for k8s 1.23 , 1.24 ( #9482 )
2022-11-12 03:39:56 -08:00
9439487219
Add hashes for 1.25.4, 1.24.8, 1.23.14 and make v1.25.4 default ( #9479 )
...
Signed-off-by: yanggang <gang.yang@daocloud.io>
Signed-off-by: yanggang <gang.yang@daocloud.io>
2022-11-10 20:00:09 -08:00
df6da52195
Enable check mode in DNS Cleanup tasks ( #9472 )
2022-11-10 19:58:09 -08:00
8a654b6955
Add cni bin when installing calico ( #9367 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-11-08 17:46:13 -08:00
5a8cf824f6
[containerd] Simplify limiting number of open files per container ( #9319 )
...
by setting a default runtime spec with a patch for RLIMIT_NOFILE.
- Introduces containerd_base_runtime_spec_rlimit_nofile.
- Generates base_runtime_spec on-the-fly, to use the containerd version
of the node.
2022-11-08 06:44:32 -08:00
5c25b57989
Ability to define options for DNS upstream servers ( #9311 )
...
* Ability to define options for DNS upstream servers
* Doc and sample inventory vars
2022-11-08 06:44:25 -08:00
5d1fe64bc8
Update local-volume-provisioner ( #9463 )
...
- Update and re-work the documentation:
- Update links
- Fix formatting (especially for lists)
- Remove documentation about `useAlphaApi`,
a flag only for k8s versions < v1.10
- Attempt to clarify the doc
- Update to version 1.5.0
- Remove PodSecurityPolicy (deprecated in k8s v1.21+)
- Update ClusterRole following upstream
(cf https://github.com/kubernetes-sigs/sig-storage-local-static-provisioner/pull/292 )
- Add nodeSelector to DaemonSet (following upstream)
2022-11-07 15:28:17 -08:00
0d6dc08578
upgrade argocd version 2.4.16 ( #9467 )
2022-11-06 18:04:16 -08:00
40261fdf14
Fix iputils install failure in Kylin OS ( #9453 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-11-06 17:54:16 -08:00
590b4aa240
adjust calico-kube-controller to non-hostnetwork pod ( #9465 )
...
Signed-off-by: cyclinder qifeng.guo@daocloud.io
Signed-off-by: cyclinder qifeng.guo@daocloud.io
2022-11-06 17:34:17 -08:00
2a696ddb34
Adding metrics server to use host network ( #9444 )
...
* Adding metrics server to use host network
* EXternalize value to a variable
2022-11-06 02:38:15 -08:00
d7f08d1b0c
remove the set_fact action which raise error in the CI ( #9462 )
2022-11-03 04:43:38 -07:00
4aa1ef28ea
Don't use coredns_server in dhclient.conf if nodelocaldns is enabled ( #9392 )
2022-11-03 02:45:36 -07:00
58faef6ff6
Flannel: fix init container image arch ( #9461 )
...
The install-cni-plugin image was not updated to the corresponding
arch when building the different DS.
Fixes issue #9460
Signed-off-by: Fred Rolland <frolland@nvidia.com>
Signed-off-by: Fred Rolland <frolland@nvidia.com>
2022-11-03 02:41:36 -07:00
ce751cb89d
add variable condition snapshot in vSphere CSI ( #9429 )
2022-11-02 00:22:46 -07:00
5cf2883444
add retry for start calico kube controller ( #9450 )
...
Signed-off-by: cleverhu <shouping.hu@daocloud.io>
Signed-off-by: cleverhu <shouping.hu@daocloud.io>
2022-11-02 00:18:45 -07:00
6bff338bad
fix: hubble relay tls error ( #9457 )
2022-11-02 00:14:46 -07:00
1f54cef71c
Add variable to set direct routing on flannel VXLAN ( #9438 )
2022-10-31 13:16:45 -07:00
d00508105b
Removed PodSecurityPolicy from ingress-nginx ( #9448 )
2022-10-30 20:08:44 -07:00
c272421910
Add UOS linux support ( #9432 )
2022-10-30 17:16:43 -07:00
78624c5bcb
When using cilium CNI, install Cilium CLI ( #9436 )
...
Signed-off-by: dcwbq <biqiang.wu@daocloud.io>
Signed-off-by: dcwbq <biqiang.wu@daocloud.io>
2022-10-30 17:02:45 -07:00
c681435432
Add switch cilium_enable_bandwidth_manager ( #9441 )
...
Signed-off-by: dcwbq <biqiang.wu@daocloud.io>
Signed-off-by: dcwbq <biqiang.wu@daocloud.io>
2022-10-28 03:08:31 -07:00
4d3f637684
Remove PodSecurityPolicies in Metallb for kubernetes 1.25 ( #9442 )
2022-10-27 21:46:30 -07:00
990f87acc8
Update kube-vip to v0.5.5 ( #9437 )
...
Signed-off-by: hang.jiang <hang.jiang@daocloud.io>
Signed-off-by: hang.jiang <hang.jiang@daocloud.io>
2022-10-26 19:28:32 -07:00
eeb376460d
Fix inconsistent handling of admission plugin list ( #9407 )
...
* Fix inconsistent handling of admission plugin list
* Adjust hardening doc with the normalized admission plugin list
* Add pre-check for admission plugins format change
* Ignore checking admission plugins value when variable is not defined
2022-10-26 00:28:37 -07:00
ef707b3461
update-containerd-1.6.9 ( #9427 )
2022-10-25 16:34:37 -07:00
2af918132e
Update kubernetes dashboard to 2.7.0 (k8s 1.25 support) ( #9425 )
2022-10-24 18:32:36 -07:00
b9b654714e
[nerdctl] upgrade to version 1.0.0 ( #9424 )
2022-10-24 18:28:35 -07:00
fe399e0e0c
[etcd] add 3.5.5 hashes, make it default for k8s 1.25 ( #9419 )
2022-10-24 00:06:26 -07:00
b192053e28
as argocd 2.4.15 is releasesd , update the version ( #9420 )
2022-10-23 20:34:24 -07:00
1901b512d2
Make the port of kube-vip dynamic based on the kube_apiserver_port ( #9414 )
...
variable
Fix wrong referenced variable on bgp_peers
Fix bgp_peeras field to be a string
Set default value for bgp_peeras
2022-10-23 18:00:24 -07:00
9fdda7eca8
Fix iputils install failure in Kylin OS ( #9416 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-10-21 04:53:51 -07:00
a68ed897f0
Update kubelet checksum ( #9413 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-10-21 04:21:50 -07:00
582ff96d19
Update docker version to 20.10.20 ( #9410 )
2022-10-20 18:45:15 -07:00
0374a55eb3
Specify securityContext for cert-manager ( #9404 )
...
On hardening environments, cert-manager pods could not be created
from the corresponding deployments. This adds the securityContext
to solve the issue.
2022-10-20 00:57:08 -07:00
ccbe38f78c
make-kube-1.25-default ( #9364 )
2022-10-20 00:56:57 -07:00
958840da89
Add var for control initialDelaySeconds in nginx ingress probe ( #9405 )
...
Signed-off-by: Zemtsov Vladimir <vl.zemtsov@gmail.com>
Signed-off-by: Zemtsov Vladimir <vl.zemtsov@gmail.com>
2022-10-19 21:20:56 -07:00
1530411218
use cri-o from upstream instead of kubic/OBS ( #9374 )
...
* [cri-o] use cri-o from upstream instead of kubic/OBS
* [cri-o] add proper molecule coverage
* [skopeo] download skopeo from upstream build
* [cri-o] clean up legacy deployments
* disable cri-o per-distribution variables
2022-10-19 05:47:05 -07:00
0f44e8c812
[ingress-nginx] upgrade to 1.4.0 ( #9403 )
2022-10-18 16:53:00 -07:00
d9c39c274e
fix(defaults): wrong cri_socket path for containerd ( #9401 )
2022-10-18 00:15:18 -07:00
c38fb866b7
Update securityContext of netchecker ( #9398 )
...
To run netchecker with necessary privilege,
this updates the securityContext.
2022-10-17 19:11:18 -07:00
5ad1d9db5e
[kubernetes] Add hashes for 1.25.3, 1.24.7, 1.23.13 and make v1.24.7 default ( #9397 )
2022-10-17 05:59:07 -07:00
32f3d92d6b
Remove PodSecurityPolicies in Calico ( #9395 )
2022-10-17 05:51:07 -07:00
23716b0eff
don't define kubeadm_patches by default ( #9372 )
2022-10-14 01:20:46 -07:00
859df84b45
remove-psp-in-flannel ( #9365 )
2022-10-14 00:16:47 -07:00
131bd933a6
Fix ensure ping package error in fedora CoreOS & Flatcar ( #9370 )
...
* fix-ensure-package-in-coreos
* clean blank line
2022-10-13 16:54:46 -07:00
52904ee6ad
Avoid MetalLB speaker image download when MetalLB speaker is disabled ( #9248 )
...
* Avoid MetalLB speaker image download when metallb_speaker_enabled is set to
* Move metallb_speaker_enabled var to allow outside metalLB role references
* Move metallb_speaker_enabled var to allow outside metalLB role references
* Improve metallb_speaker_enabled default values
2022-10-13 16:50:47 -07:00
547ef747da
fix helm install with password authentication ( #9343 )
2022-10-12 23:55:01 -07:00
bc5881b70a
Add the cilium hubble images to download role ( #9376 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-10-12 23:45:00 -07:00
f4b95d42a6
Add note for containerd oom_score ( #9384 )
...
When we saw 0 as the default value of containerd_oom_score, we had
a question why the value was not -999.
This adds the note to explain it.
2022-10-11 21:49:00 -07:00
ef76a578a4
Change dns upstream condition for nodelocaldns ( #9378 )
2022-10-11 00:47:02 -07:00
3b99d24ceb
Fix: install calico-kube-controller on kdd ( #9358 )
...
* Fix: install policy controller on kdd too
* Remove the calico_policy_version condition altogether
* Install policy controller both on canal and calico under same condition
2022-10-10 19:45:01 -07:00
4701abff4c
upgrade-api-version-for-PodDisruptionBudget ( #9369 )
2022-10-10 17:51:02 -07:00
717b8daafe
Download coredns image to all hosts in k8s_cluster ( #9316 )
...
Coredns image must be available everywhere as it
may be rescheduled to a non-control-plane-node.
2022-10-08 05:03:19 -07:00
c346e46022
fix(cinder-csi-nodeplugin): Remove the pods-cloud-data volume ( #9362 )
2022-10-08 01:23:19 -07:00
24632ae81b
Add check_typo job ( #9361 )
...
To block merging pull requests which contain typo automatically.
2022-10-07 02:21:53 -07:00
befde271eb
Use hostname override in post-remove role, just as pre-remove role does ( #9360 )
2022-10-06 15:03:52 -07:00
d689f57c94
Features/support kubeadm patches v1beta3 ( #9326 )
...
* Support kubeadm patches in v1beta3
* Update kubeadm patches sample files in inventory
* Fix pre-commit syntax
* Set kubeadm_patches enabled to false in sample inventory
2022-10-06 00:39:52 -07:00
ad3f503c0c
Fix default value for kubelet_secure_addresses ( #9355 )
2022-10-06 00:35:51 -07:00
8b9cd3959a
Add possibility to skip adding load balancer name in the hosts file ( #9331 )
2022-10-04 06:26:16 -07:00
dffeab320e
feat: add a paramater to disable host nameservers ( #9357 )
...
Signed-off-by: eminaktas <eminaktas34@gmail.com>
Signed-off-by: eminaktas <eminaktas34@gmail.com>
2022-10-04 06:22:17 -07:00
999586a110
sysctl_additional ( #9351 )
2022-10-02 23:06:14 -07:00
44115d7d7a
support-kube-1.25 ( #9260 )
...
Co-authored-by: Rene Luria <rene.luria@infomaniak.com>
2022-09-29 23:34:30 -07:00
841e2f44c0
Remove references to 1.22 ( #9342 )
2022-09-28 14:10:29 -07:00
a8e4984cf7
Add missing permissions to openstack cc ( #9335 )
...
Add missing permissions to Openstack cloud controller to make sure controller runs as intended
2022-09-27 22:19:35 -07:00
3646dc0bd2
fix: remove trailing backslash and yaml indent ( #9339 )
...
* fix: remove trailing backslash
* fixed indent in cilium config template
2022-09-27 19:45:35 -07:00
31caab5f92
Fix: The Hubble certificate is faulty because the cluster name is hard coded ( #9340 )
...
Signed-off-by: dcwbq <biqiang.wu@daocloud.io>
Signed-off-by: dcwbq <biqiang.wu@daocloud.io>
2022-09-27 05:57:52 -07:00
472996c8b3
update pause image version ( #9337 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-09-27 00:49:52 -07:00
d62c67a5f5
allow user to set env: FELIX_MTUIFACEPATTERN in calico-node.yml ( #9330 )
2022-09-26 21:57:45 -07:00
e486151aea
cloud-provider-openstack: upgrade 1.22.0 to 1.23.4 ( #9332 )
2022-09-26 17:35:46 -07:00
18efdc2c51
Fix typos in calico ( #9327 )
2022-09-26 00:11:44 -07:00
6dff39344b
preinstall: Add nodelocaldns to supersede_nameserver if enabled ( #9282 )
...
When a machine that use dhclient and resolvconf reboots, this will make /etc/resolv.conf
remain close to the one before reboot
2022-09-25 20:19:44 -07:00
c4de3df492
upcloud csi driver: bump version to v0.3.3 ( #9317 )
2022-09-24 13:18:04 -07:00
f2e11f088b
Hotfix containerd restart ( #9322 )
2022-09-24 13:14:04 -07:00
782f0511b9
Define ostree variable for runc ( #9321 )
...
The ostree variable is not defined previously raising an error when
the runtime tries to read it.
2022-09-24 13:00:11 -07:00
4ad67acedd
Move back vsphere csi to kube-system ns ( #9312 )
2022-09-23 10:46:26 -07:00
467dc19cbd
support removing options in resolvconf with tab separator ( #9304 )
2022-09-23 10:42:27 -07:00
726711513f
[containerd] Allow configuring base_runtime_spec per containerd runtime ( #9302 )
...
and supply a default runtime spec.
2022-09-23 10:38:27 -07:00
9468642269
feat: allows users to have more control on DNS ( #9270 )
...
Signed-off-by: eminaktas <eminaktas34@gmail.com>
Signed-off-by: eminaktas <eminaktas34@gmail.com>
2022-09-23 10:28:26 -07:00
d387d4811f
replace createhome ( #9314 )
2022-09-23 00:26:39 -07:00
1b3c2dab2e
add_max_concurrent_in_coredns ( #9307 )
2022-09-22 04:27:03 -07:00
76573bf293
[kubernetes] Add hashes for 1.24.6, 1.22.15, 1.23.12 and make v1.24.6 default ( #9308 )
2022-09-22 04:13:03 -07:00
5d3326b93f
add-ping-package ( #9284 )
2022-09-21 23:55:05 -07:00
68dac4e181
[flannel] update to v1.19.2 & make it default ( #9296 )
2022-09-21 23:51:04 -07:00
262c96ec0b
Remove duplication in template ( #9301 )
...
by concatenating default and additional runtimes
2022-09-21 08:33:15 -07:00
2acdc33aa1
[helm] upgrade to 3.9.4 ( #9298 )
2022-09-20 04:37:20 -07:00
8acd33d0df
Calico: add wireguard support for Rocky Linux 9 ( #9287 )
2022-09-20 00:29:20 -07:00
a2e23c1a71
vsphere-csi: add nodeAffinity to daemonset ( #9293 )
2022-09-19 17:47:22 -07:00
1b5cc175b9
[cert-manager] Upgrade to v1.9.1 ( #9295 )
2022-09-19 17:43:22 -07:00
a71da25b57
[argocd] update argocd to v2.4.12 ( #9297 )
2022-09-19 17:37:22 -07:00
5ac614f97d
fix duplicate field in ingress-nginx template ( #9285 )
2022-09-19 03:03:22 -07:00
b8b8b82ff4
Adds support for multiple architectures to yq ( #9288 )
2022-09-19 02:14:38 -07:00
7da3dbcb39
Cilium 1.12 Upgrade ( #9225 )
...
* Drop support for Cilium < 1.10
Signed-off-by: necatican <necaticanyildirim@gmail.com>
* Synchronize Cilium templates for 1.11.7
Signed-off-by: necatican <contact@necatican.com>
* Set Cilium v1.12.1 as the default version
Signed-off-by: necatican <contact@necatican.com>
Signed-off-by: necatican <necaticanyildirim@gmail.com>
Signed-off-by: necatican <contact@necatican.com>
2022-09-19 02:14:31 -07:00
680293e79c
[kubernetes] Add hashes for 1.24.5, 1.22.14, 1.23.11 and make v1.24.5 default ( #9286 )
2022-09-19 02:10:31 -07:00
023b16349e
Add variable for the vsphere-csi namespace ( #9278 )
2022-09-15 02:01:23 -07:00
97ca2f3c78
add-timezone-support ( #9263 )
2022-09-14 21:11:22 -07:00
7c2fb227f4
Add LimitMEMLOCK parameter configuration in containerd.service ( #9269 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-09-13 02:51:06 -07:00
08bfa0b18f
Upgrade ingress nginx webhook to 1.3.0 ( #9271 )
2022-09-13 01:47:05 -07:00
952cad8d63
Remove mutual exclusivity in calico: NAT and router mode ( #9255 )
...
* Add optional NAT support in calico router mode
* Add a blank line in front of lists
* Remove mutual exclusivity: NAT and router mode
* Ignore router mode from NAT
* Update calico doc
2022-09-13 00:19:07 -07:00
fc57c0b27e
fix number node name can't be added ( #9266 )
...
Signed-off-by: cleverhu <shouping.hu@daocloud.io>
Signed-off-by: cleverhu <shouping.hu@daocloud.io>
2022-09-13 00:09:05 -07:00
dd4bc5fbfe
[etcd] Sometimes, we do not need to run etcd role on all nodes. ( #9173 )
...
* WIP: sometimes,we not run etcd
* fix ansible lint
* like calico(kdd) cni, no need run etcd
2022-09-09 01:29:22 -07:00
d2a7434c67
[ingress-nginx] upgrade to 1.3.1 ( #9264 )
2022-09-09 00:37:23 -07:00
f3fb758f0c
Remove useless file ( #9258 )
2022-09-07 17:10:49 -07:00
6386ec029c
add retries for restart of kube-apiserver ( #9256 )
...
* add retries for restart of kube-apiserver
* change var name
2022-09-07 16:48:49 -07:00
ad7cefa352
Ignore deleting nodes that are not in cluster ( #9244 )
2022-09-05 19:50:54 -07:00
09d9bc910e
Fix typos in calico comments ( #9254 )
2022-09-05 18:46:54 -07:00
be2bfd867c
Add Support for Rewrite Plugin to CoreDNS/NodelocalDNS ( #9245 )
2022-09-03 16:16:35 -07:00
133a7a0e1b
Add featureDetectOverride configration of calico ( #9249 )
2022-09-02 04:58:05 -07:00
6db6c8678c
disable kubelet_authorization_mode_webhook by default ( #9238 )
2022-08-31 04:53:00 -07:00
7ebb8c3f2e
make calico installation more stable ( #9227 )
...
Signed-off-by: hang.jiang <hang.jiang@daocloud.io>
Signed-off-by: hang.jiang <hang.jiang@daocloud.io>
2022-08-30 21:13:01 -07:00
acb6f243fd
feat: add kubelet systemd service hardening option ( #9194 )
...
* feat: add kubelet systemd service hardening option
* refactor: move variable name to kubelet_secure_addresses
Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
* docs: add diagram about kubelet_secure_addresses variable
Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
2022-08-30 11:18:55 -07:00
220f149299
Fix abort because calicoctl.sh is not a full path ( #9217 )
2022-08-30 08:07:02 -07:00
617b17ad46
Fix kube_ovn_hw_offload value ( #9218 )
2022-08-30 03:21:01 -07:00
9dc9a670a5
add runc v1.1.4 ( #9230 )
2022-08-30 02:01:01 -07:00
b46ddf35fc
kube-vip shoud fail if kube_proxy_strict_arp is false in arp mod ( #9223 )
...
* fix-kube-vip-strict-arp
* fix-kube-vip-strict-arp
2022-08-30 00:21:02 -07:00
de762400ad
Fixes for calico_datastore: etcd ( #9228 )
...
It seems that PR #8839 broke `calico_datastore: etcd` when it removed ipamconfig support for etcd mode.
This PR fixes some failing tasks when `calico_datastore == etcd`, but it does not restore ipamconfig support for calico in etcd mode. If someone wants to restore ipamconfig support for `calico_datastore: etcd` please submit a follow up PR for that.
2022-08-29 22:41:00 -07:00
e60ece2b5e
[CI] remove opensuse Leap from molecule test blocking CI ( #9229 )
2022-08-29 11:44:49 -07:00
64daaf1887
cri-dockerd: add restart of docker.service ( #9205 )
...
* cri-dockerd: add restart of docker.service
* remove enabling of cri-dockerd.socket
2022-08-24 05:50:02 -07:00
c8a61ec98c
optimize the format of evictionHard in kubelet-config.yaml template ( #9204 )
2022-08-23 01:55:24 -07:00
8f899a1101
Fix containerd (<1.7) configuration for insecure registries ( #9207 )
...
For the following configuration
```
containerd_insecure_registries:
docker.io:
- dockerhubcache.example.com
```
the rendered /etc/containerd/config.toml contains
```
[plugins."io.containerd.grpc.v1.cri".registry.configs."docker.io".tls]
insecure_skip_verify = true
```
but it needs to be
```
[plugins."io.containerd.grpc.v1.cri".registry.configs."dockerhubcache.example.com".tls]
insecure_skip_verify = true
```
2022-08-22 23:13:23 -07:00
386c739d5b
🌱 Enable cri-dockerd service ( #9201 )
...
* 🌱 Enable cri-dockerd service
* 🔨 Fix the task name in order to pass the CI tests
2022-08-22 07:17:43 -07:00
bbd1161147
9035: Make Cilium rolling-restart delay/timeout configurable ( #9176 )
...
See #9035
2022-08-22 02:37:44 -07:00
ab938602a9
[kubernetes] Add hashes for 1.24.4, 1.22.13, 1.23.10 and make v1.24.4 default ( #9191 )
2022-08-21 23:11:44 -07:00
e31890806c
Add 'avoid-buggy-ips' support of MetalLB ( #9166 )
2022-08-18 21:49:51 -07:00
30c77ea4c1
Add the option to enable default Pod Security Configuration ( #9017 )
...
* Add the option to enable default Pod Security Configuration
Enable Pod Security in all namespaces by default with the option to
exempt some namespaces. Without the change only namespaces explicitly
configured will receive the admission plugin treatment.
* Fix the PR according to code review comments
* Revert the latest changes
- leave the empty file when kube_pod_security_use_default, but add comment explaining the empty file
- don't attempt magic at conditionally adding PodSecurity to kube_apiserver_admission_plugins_needs_configuration
2022-08-18 01:16:36 -07:00
175cdba9b1
Add 'flush ip6tables' task in reset role ( #9168 )
...
* Add 'flush ip6tables' task in reset role
If enable_dual_stack_networks is set to true and ip6 is defined，ip6tables will be created. But when reset the kubernetes cluster, kubespray doesn't flush ip6tables.
* [CI] fix molecule tests on opensuse by upgrading to 15.4 (#9175 )
* [CI] fix molecule tests on opensuse by upgrading to 15.4
* [opensuse] use correct python crytography package name depending on distribution version
Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
2022-08-18 01:12:37 -07:00
ea29cd0890
add list nodes rules to cilium-operator clusterrole ( #9178 )
2022-08-18 01:02:36 -07:00
be5fdab3aa
Disable DNSStubListener for Flatcar Linux ( #9160 )
...
* Disable DNSStubListener for Flatcar Linux
* Fix missing "Flatcar" condition of os_family
2022-08-18 00:56:49 -07:00
49d869f662
Fix CSI drivers issues on Azure ( #9153 )
...
* Include missing azuredisk rbac manifest
* Remove missing azure csi manifest
* Remove invalid reference mount to waagent settings
* Use cloud-config secret instead of /etc/kubernetes/cloud_config file
2022-08-18 00:56:36 -07:00
b36bb9115a
[calico] calico rr supports multiple groups ( #9134 )
...
* update calico rr
* fix bgppeer conf
* fix yamllint
* fix ansible lint
* fix calico deploy
* fix yamllint
* fix some typo
2022-08-18 00:52:37 -07:00
9ad2d24ad8
Add unsafe_show_logs switch ( #9164 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-08-16 18:52:48 -07:00
0088fe0ab7
add-tar-in-common-package ( #9184 )
2022-08-16 05:17:18 -07:00
ab93b17a7e
[containerd] upgrade to 1.6.8 , add hashes, containerd now supports ppc64le from v1.6.7 ( #9181 )
2022-08-16 05:17:07 -07:00
9f1b980844
Update dashboard to 2.6.1 ( #9185 )
2022-08-16 04:57:08 -07:00
86d05ac180
fix: remove condition for user creation ( #9125 )
...
This condition blocks the creation of the `etcd` user in certain conditions.
Specifically, when you have a `etcd_deployment_type: kubeadm` and `kube_owner: root`.
Being the `root` user already present on the system, this will not be a problem (due to the idempotency of ansible).
2022-08-15 23:55:07 -07:00
bf6fcf6347
Upgrade nerdctl from 0.20.0 to 0.22.2 ( #9180 )
2022-08-15 22:39:07 -07:00
b9e4e27195
[CI] fix molecule tests on opensuse by upgrading to 15.4 ( #9175 )
...
* [CI] fix molecule tests on opensuse by upgrading to 15.4
* [opensuse] use correct python crytography package name depending on distribution version
2022-08-14 19:02:13 -07:00
8585134db4
when ingress-nginx is deployes without a class, we need to use 'ingress-controller-leader' resource instead of the default 'ingress-controller-leader-nginx' ( #9156 )
2022-08-09 04:52:50 -07:00
2b97b661d8
Move old etcd backup removal after etcd restart ( #9147 )
2022-08-05 08:09:59 -07:00
24f12b024d
Argument jsonpath must be single-quoted in "See if node is schedulable" task ( #9146 )
2022-08-05 08:09:47 -07:00
47050003a0
Add docker support for Kylin V10 ( #9144 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-08-03 15:03:46 -07:00
307f598bc8
Move flannel to etcd datastore
2022-08-02 16:55:52 -07:00
eb10249a75
Align canal templates with calico official ones (k8s datastore)
2022-08-02 16:55:52 -07:00
b4318e9967
Update to latest local path provisioner version ( #9132 )
2022-08-01 14:56:28 -07:00
c53561c9a0
Update to latest registry version ( #9133 )
2022-08-01 14:52:28 -07:00
f2f9f1d377
Add kylin OS support ( #9078 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-08-01 10:44:29 -07:00
4487a374b1
Update Kube-router version to 1.5.1 ( #9136 )
...
https://github.com/cloudnativelabs/kube-router/releases/tag/v1.5.1
2022-08-01 00:16:28 -07:00
06f8368ce6
Fix Hetzner CCM cluster-cidr ( #9127 )
2022-07-30 20:18:27 -07:00
5b976a8d80
[calico] add hashes for v3.22.4 & v3.21.6 ( #9129 )
2022-07-30 20:14:38 -07:00
e73803c72c
pid reserved must be str ( #9124 )
2022-07-30 20:14:27 -07:00
b3876142d2
[cert-manager] Upgrade to v1.9.0 ( #9117 )
2022-07-29 00:11:11 -07:00
9f11946f8a
[argocd] update argocd to v2.4.7 ( #9105 )
2022-07-27 09:32:29 -07:00
09291bbdd2
Use a variable for roles of remove-node/post-remove ( #9096 )
...
Signed-off-by: ydFu <ader.ydfu@gmail.com>
2022-07-26 10:51:09 -07:00
65d95d767a
[helm] upgrade to 3.9.2 ( #9115 )
2022-07-26 10:41:09 -07:00
8306adb102
update cilium to v1.11.7 ( #9119 )
2022-07-26 10:33:11 -07:00
4b3db07cdb
Fix calicoctl version to v3.23.3 ( #9121 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-07-26 10:29:10 -07:00
c24a3a3b15
Keep the style consistent ( #9116 )
2022-07-24 23:46:59 -07:00
aca6be3adf
[calico] add v3.23.3 and make it default ( #9112 )
2022-07-22 00:01:39 -07:00
a608a048ad
Update kube-ovn to v1.9.7
2022-07-21 23:03:38 -07:00
0cfa03fa8a
[flannel] update to v1.18.1 & make it default ( #9104 )
2022-07-21 00:19:55 -07:00
6525461d97
Add reset tasks specific to calico network_plugin ( #9103 )
2022-07-19 13:15:27 -07:00
f592fa1235
add kube-vip sans ( #9099 )
2022-07-19 13:11:28 -07:00
2e1863af78
feat: change default blockSize for calico ( #9055 )
...
Signed-off-by: cyclinder qifeng.guo@daocloud.io
2022-07-19 13:05:27 -07:00
2a282711df
update-loadbalancers-versions ( #9100 )
2022-07-19 13:01:28 -07:00
91073d7379
[kubernetes] make v1.24.3 default ( #9101 )
2022-07-19 02:58:06 -07:00
3ce5458f32
hardening: Add `SeccompDefault` admission plugin for kubelet ( #9074 )
...
* docs(hardening): add SeccompDefault admission plugin to kubelet feature gates
* fix(kubelet-config): enable config through kubelet_feature_gates
* feat(kubelet): add kubelet_seccomp_default variable
2022-07-19 00:50:07 -07:00
98c194735c
[kubernetes] add hashes for v1.22.12, v1.23.9 & v1.24.3 ( #9092 )
2022-07-19 00:30:19 -07:00
626ea64f66
9052 crio add dpkg hold ( #9075 )
...
* Update main.yaml
* remove version in dpkg_selection name
* make lint happy
* Fix typo
* add comment / remove useless contition
* remove dpkg hold in reset tasks
2022-07-19 00:30:07 -07:00
ce04fdde72
[ingress-nginx] upgrade to 1.3.0 ( #9088 )
...
* This release removes support for Kubernetes v1.19.0
* This release adds support for Kubernetes v1.24.0
* Starting with this release, we will need permissions on the coordination.k8s.io/leases resource for leaderelection lock
2022-07-14 18:46:25 -07:00
4ed3c85a88
Fix calicoctl checksums for v3.23.2 ( #9087 )
...
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2022-07-13 14:02:57 -07:00
14063b023c
Extend DNS memory limit. 170Mi tents to OOM ( #9084 )
2022-07-13 00:03:37 -07:00
d821bed2ea
Fix some typo ( #9056 )
...
* fix ingress controller task name
* fix calico word
* add check typo
2022-07-11 09:49:48 -07:00
a7ba7cdcd5
[calico] add v3.23.2 and make it default ( #9041 )
2022-07-08 10:41:48 -07:00
c01656b1e3
Allow "openSUSE Tumbleweed" to be run ( #9072 )
...
The commit 1ce2f04c16efc9
2022-07-08 04:55:47 -07:00
5071529a74
feat: upgrade cilium and add default variables ( #9065 )
...
Signed-off-by: eminaktas <eminaktas34@gmail.com>
Signed-off-by: Emin Aktas <emin.aktas@trendyol.com>
2022-07-07 10:35:34 -07:00
6d543b830a
Fix vcloud-csi bug related to #9046 ( #9066 )
...
* Fix vcloud-csi bug related to #9046
Signed-off-by: yasintahaerol <yasintahaerol@gmail.com>
* add supervisor-fss-namespace=kube-system flag to vsphere-csi-controller-deployment
Signed-off-by: yasintahaerol <yasintahaerol@gmail.com>
2022-07-07 10:31:35 -07:00
4607ac2e93
fix(vsphere-csi): remove namespace env variable and set namespace as kube-system ( #9046 )
...
Signed-off-by: eminaktas <eminaktas34@gmail.com>
Co-authored-by: Yasin Taha Erol <yasintahaerol@gmail.com>
Co-authored-by: Yasin Taha Erol <yasintahaerol@gmail.com>
2022-07-06 01:00:50 -07:00
9ca5632582
fix-docker-option-in-centos-arm64 ( #9047 )
2022-07-05 08:26:47 -07:00
51195212b4
[argocd] update argocd to v2.4.3 ( #9050 )
2022-07-05 08:22:47 -07:00
7414409aa0
Add target components on check_readme_versions.sh ( #9045 )
...
This adds target components on check_readme_versions.sh after
merging https://github.com/kubernetes-sigs/kubespray/pull/9044
In addition, this fixes typo on check_readme_versions.sh
This adds `foo_version` variables for some components because
check_readme_versions.sh verifies the corresponding version for
`<component name>_version` from main.yml. This change also makes
consistency in the main.yml. In long-term, we will be able to
remove the existing `foo_image_tag` variables, but that is not now
for backwards compatibility for users.
2022-07-05 08:02:47 -07:00
3bb9542606
Adding support for node & pod pid limit ( #9038 )
2022-07-05 00:20:48 -07:00
1d0b3829ed
remove-etcd-unsupported-arch ( #9049 )
2022-07-04 05:39:24 -07:00
cbef8ea407
[etcd] drop hashes for 3.5.2
2022-06-29 09:44:06 -07:00
2ff4ae1f08
[etcd] drop hashes for 3.5.1
2022-06-29 09:44:06 -07:00
edf7f53f76
[etcd] add etcd 3.5.4 and make it the default for 1.24.x
2022-06-29 09:44:06 -07:00
f58816c33c
[krew] update krew ( #9043 )
2022-06-29 09:02:06 -07:00
1562a9c2ec
add missing verbs ( #9032 )
2022-06-29 00:18:05 -07:00
4b03f6c20f
add-managed-ntp-support ( #9027 )
2022-06-28 13:15:34 -07:00
e8ccbebd6f
add ingress nginx webhook ( #9033 )
...
* add ingress nginx webhook
* fix ingress nginx template
2022-06-28 11:55:35 -07:00
d4de9d096f
fix-the-issue-of-miss-the-etcd-user ( #9016 )
2022-06-28 09:13:58 -07:00
e1f06dd406
Add support for the updated (startup|liveness|readiness)Probe.Port numbers in Cilium ( #9031 )
2022-06-27 11:00:59 -07:00
6f82cf12f5
let containerd_default_runtime be undefined by default ( #9026 )
2022-06-27 10:56:59 -07:00
ca8080a695
[crun] drop old crun versions 1.2 and 1.3
2022-06-27 10:36:59 -07:00
55d14090d0
[crun] add 1.4.5 and make it the default
2022-06-27 10:36:59 -07:00
da8498bb6f
[cert-manager] Upgrade to v1.8.2 ( #9029 )
2022-06-24 23:50:58 -07:00
b33896844e
apply calico bgp peer definition task to all nodes, but delegate to ( #8974 )
...
first control plane node
2022-06-24 19:42:57 -07:00
ca212c08de
[runc] drop hashes for 1.0.2 and 1.0.3
2022-06-23 09:23:43 -07:00
784439dccf
[runc] make 1.1.3 the new default
2022-06-23 09:23:43 -07:00
d818c1c6d9
[runc] add hashes for 1.1.3
2022-06-23 09:23:43 -07:00
b9384ad913
[runc] add hashes for 1.1.2
2022-06-23 09:23:43 -07:00
76b0cbcb4e
bump pause container to 3.6 ( #9024 )
...
* [pod-infra] bump pod infra container version to 3.6
* [cri-dockerd] align pod infra container image with other CRIs
2022-06-23 01:43:44 -07:00
6bf3306401
Fixed concatenate str & int in auto_renew_certificates_systemd_calendar var ( #8979 )
2022-06-22 11:55:43 -07:00
79f6cd774a
create snapshot-controller only if needed
2022-06-22 00:37:44 -07:00
c3c9a42502
support multus multi-architecture installation ( #9012 )
...
Signed-off-by: cyclinder qifeng.guo@daocloud.io
2022-06-21 10:56:26 -07:00
9d5d945bdb
[MASTER] Add missing configuration for extra tolerations ( #8908 )
...
* Added new configuration item for extra tolerations in policy controllers
Signed-off-by: Sébastien Masset <smt.masset@gmail.com>
* Added new configuration item for extra tolerations in DNS autoscaler
Signed-off-by: Sébastien Masset <smt.masset@gmail.com>
* Aligned existing handling of extra DNS tolerations
Signed-off-by: Sébastien Masset <smt.masset@gmail.com>
2022-06-20 01:36:06 -07:00
475ce05979
Fix kubectl download for v1.23.8 amd64 ( #9002 )
...
kubectl_checksums for amd64 v1.23.8 was missing the last digit
2022-06-20 01:28:06 -07:00
e4fe679916
[kubernetes] make v1.24.2 default
2022-06-17 11:08:33 -07:00
123632f5ed
[kubernetes] add hashes for v1.22.11, v1.23.8 & v1.24.2
2022-06-17 11:08:33 -07:00
a1ec0571b2
[nerdctl] upgrade to 0.20.0
2022-06-17 08:00:32 -07:00
2db39d4856
[containerd] add hashes for 1.5.12, 1.5.13, 1.6.5 and 1.6.6 and make 1.6.6 the new default
2022-06-17 08:00:32 -07:00
e7729daefc
Add assertion for IPv6 in verify settings
...
Co-authored-by: Kenichi Omichi <ken1ohmichi@gmail.com>
2022-06-17 10:36:43 +02:00
97b4d79ed5
feat: make kubernetes owner parametrized ( #8952 )
...
* feat: make kubernetes owner parametrized
* docs: update hardening guide with configuration for CIS 1.1.19
* fix: set etcd data directory permissions to be compliant to CIS 1.1.12
2022-06-17 01:34:32 -07:00
9e7f89d2a2
Remove forgotten 1.21 references
2022-06-16 08:55:38 +02:00
24c8ba832a
[kubernetes] drop support for configuring insecure apiserver
2022-06-15 00:57:20 -07:00
c2700266b0
[download] fix dependencies for downloads
2022-06-15 00:57:20 -07:00
2cd8c51a07
[kubeadm] use v1beta3 configuration version
...
* extra admission controls now don't have a version in their file names
eventratelimit.v1beta2.yaml.j2 -> eventratelimit.yaml.j2
* cri_socket variable includes the unix:// prefix to be conformat with
upstream
2022-06-15 00:57:20 -07:00
589823bdc1
[CI] remove docker stand-alone molecule test
2022-06-15 00:57:20 -07:00
fad296616c
[docker] use cri-dockerd instead of dockershim for any kubernetes version deployed with docker as the container_manager
2022-06-15 00:57:20 -07:00
ec01b40e85
[cri_dockerd] upgrade cri_dockerd to 0.2.2 for 1.24 compatibility
...
* use new artifact release name
* enable cri-dockerd dual setack support if enable_dual_stack_networks
2022-06-15 00:57:20 -07:00
2de5c4821c
[calico] clean up workarounds for older versions
2022-06-15 00:57:20 -07:00
9efe145688
[calico] make 3.23.1 the default and drop 3.20.x and 3.19.x
2022-06-15 00:57:20 -07:00
51bc64fb35
[cri-o] support cri-o 1.24 with kube 1.24
2022-06-15 00:57:20 -07:00
6380483e8b
[kubeconfig] generate admin kube config from /etc/kubernetes/admin.conf instead of the workaround of using kubeadm init phase kubeadm admin which fails with cri-dockerd
2022-06-15 00:57:20 -07:00
ae1dcb031f
[kubernetes] drop pre 1.22.0 workarounds
2022-06-15 00:57:20 -07:00
9535a41187
[kubernetes] make 1.22.0 the minimum version
2022-06-15 00:57:20 -07:00
47495c336b
[kubernetes] drop hashes for 1.21.x
2022-06-15 00:57:20 -07:00
d69d4a8303
[kubernetes] make 1.24.1 the new default
2022-06-15 00:57:20 -07:00
668b9b026c
[cert-manager] Upgrade to v1.8.1 ( #8976 )
2022-06-14 15:11:34 -07:00
77de7cb785
Expose calico-typha metrics port ( #8855 )
2022-06-14 07:17:33 -07:00
e5d6c042a9
Fix regex for replacing http_proxy ( #8957 )
2022-06-14 07:07:34 -07:00
3ae397019c
Add arm64 Flatcar OS's pypy bootstrapping ( #8959 )
...
- Upgrade pypy's python version to `3.9`
- Upgrade pypy`s version to `7.3.9`
2022-06-14 07:03:35 -07:00
7d3e59cf2e
Remove unneeded socat installation for Flatcar ( #8970 )
2022-06-14 02:23:34 -07:00
4eb83bb7f6
fixes for docker reset ( #8966 )
2022-06-14 02:15:34 -07:00
1429ba9a07
Update docker version to 20.10.17 ( #8965 )
2022-06-14 02:11:33 -07:00
889454f2bc
Fix typo in calico check ( #8969 )
2022-06-13 14:10:12 -07:00
2fba94c5e5
fix a typo in the "matallb_auto_assign" variable name ( #8949 )
...
* fix a typo in the "matallb_auto_assign" variable name
* add metallb check to fail when deprecated "matallb_auto_assign" variable is defined
2022-06-13 09:40:12 -07:00
6b43d6aff2
Proposed fix to Issue 8667 ( #8944 )
...
Proposed fix to Issue 8667
Proposed fix to Issue 8667
2022-06-09 23:37:46 -07:00
024a3ee551
Replace callback_whitelist with callbacks_enabled ( #8759 )
...
When running molecule jobs, we saw the folloing warning message:
[DEPRECATION WARNING]: [defaults]callback_whitelist option, normalizing names
to new standard, use callbacks_enabled instead. This feature will be removed
from ansible-core in version 2.15. Deprecation warnings can be disabled by
setting deprecation_warnings=False in ansible.cfg.
callbacks_enabled has been added since Ansible 2.11 and Kubespray is using
Ansible 2.12 at master branch. So we can use callbacks_enabled safely to
avoid the warning message.
2022-06-09 13:15:45 -07:00
cd7381d8de
Drop Ansible support for v2.9 and v2.10 ( #8925 )
...
Ansible v2.9 and v2.10 are EOL as [1].
This drops those version supports by following the upstream Ansible.
This sets use_ssh_args true always because that is required to use
ssh_args on ansible.cfg on Ansible v2.11 or later[2].
ansible_ssh_host is replaced with ansible_host because ansible_ssh_host
has been deprecated already and cenots7 jobs were failed due to the
deprecated ansible_ssh_host.
[1]: https://docs.ansible.com/ansible/devel/reference_appendices/release_and_maintenance.html#ansible-core-changelogs
[2]: https://docs.ansible.com/ansible/latest/collections/ansible/posix/synchronize_module.html#parameter-use_ssh_args
2022-06-09 07:07:42 -07:00
f53764f949
calicoctl repo has been merged in calico ( #8920 )
2022-06-09 07:01:42 -07:00
bb530da5c2
[registry] Switch registry to use registry.k8s.io
...
Please see the conversation here: https://groups.google.com/a/kubernetes.io/g/dev/c/DYZYNQ_A6_c
2022-06-08 14:12:22 +02:00
cc6cbfbe71
Allow disabling calico CNI logs with calico_cni_log_file_path ( #8921 )
...
* Allow disabling calico CNI logs with calico_cni_log_file_path
Calico CNI logs up to 1G if it log a lot with current default settings:
log_file_max_size 100 Max file size in MB log files can reach before they are rotated.
log_file_max_age 30 Max age in days that old log files will be kept on the host before they are removed.
log_file_max_count 10 Max number of rotated log files allowed on the host before they are cleaned up.
See https://projectcalico.docs.tigera.io/reference/cni-plugin/configuration#logging
To save disk space, make the path configurable and allow disabling this log by setting
`calico_cni_log_file_path: false`
* Fix markdown
* Update roles/network_plugin/canal/templates/cni-canal.conflist.j2
Co-authored-by: Kenichi Omichi <ken1ohmichi@gmail.com>
Co-authored-by: Kenichi Omichi <ken1ohmichi@gmail.com>
2022-06-07 09:22:56 -07:00
8030e6f76c
fix 8893#issuecomment-1147154353 ( #8933 )
...
Signed-off-by: mahjonp <junpeng.man@gmail.com>
2022-06-06 12:40:21 -07:00
77f436fa39
Fix: set fallback value of kubelet ip6 ( #8858 ) ( #8926 )
...
* Fix: set fallback value of kubelet ip6 (#8858 )
* Prune the spurious comma in the end of kubelet_address
- Update `roles/kubernetes/node/defaults/main.yml`
Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
* Fix: set fallback value of kubelet ip6 (#8858 )
- Apply the lint: 132606368e
2022-06-06 10:08:21 -07:00
814760ba25
Use blocks for macvlan tasks for each distribution ( #8918 )
...
For the code readability, this adds blocks for each distribution.
2022-06-06 07:50:24 -07:00
0761659a43
Update Kube-router version to 1.5.0 ( #8928 )
...
https://github.com/cloudnativelabs/kube-router/releases/tag/v1.5.0
2022-06-06 07:38:34 -07:00
a4f752fb02
Add subjectAltName to calico-apiserver certificate ( #8907 )
...
* Add AltName to calico-apiserver certificate
* fix support for centos7 openssl
2022-06-06 07:38:23 -07:00
b2346cdaec
[feat] Upgrade metrics server to v0.6.1 ( #8909 )
...
* Metrics Server now requires access to nodes/metrics RBAC resource instead of nodes/stats. See: https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.0
* Minimize rbac permissions.
2022-06-06 07:34:37 -07:00
01ca7293f5
support reserve ephemeral-storage ( #8895 )
2022-06-06 07:34:26 -07:00
4dfce51ded
Update dashboard to 2.6.0 (k8s 1.24 support) ( #8906 )
2022-06-06 16:47:33 +03:00
1f65e6d3b5
[ingress-nginx] upgrade to 1.2.1 ( #8904 )
2022-06-01 00:23:10 -07:00
5512465b34
Revert "Set exact user for Kubelet services" ( #8872 )
...
This reverts commit e375678674
2022-06-01 00:19:02 -07:00
2f30ab558a
Add 1.24 mappings for etcd and snapshot_controller ( #8903 )
...
Map appropriate versions of etcd and snapshot_controller containers with
k8s 1.24
2022-06-01 00:09:02 -07:00
5c136ae3af
[calico] add 3.22.3 and 3.23.1 ( #8897 )
...
* [calico]
* add 3.22.3 and 3.23.1
* set 3.22.3 default
* fix download crd for calico 3.22.3 and upper
* update calico README.md
2022-05-31 13:27:23 -07:00
c927da00e0
Support cilium ip-masq-agent configuration ( #8893 )
...
* fix deploy Cilium with eBPF-based Masquerading failed
Signed-off-by: mahjonp <junpeng.man@gmail.com>
* forget to add the enable-ip-masq-agent flag
Signed-off-by: mahjonp <junpeng.man@gmail.com>
2022-05-31 09:26:53 -07:00
1600fd9082
clean up tags ( #8880 )
2022-05-31 07:52:53 -07:00
14acd124bc
fix containerd images downalod bugs ( #8894 )
2022-05-31 00:22:53 -07:00
78aacee21b
[kubernetes] add hashes for 1.24.1 and other versions. ( #8876 )
...
* [kubernetes] add hashes for 1.24.1 and other versions.
versions: v1.21.13, v1.22.10, v1.23.7 & v1.24.1
* [kubernetes] make v1.23.7 default1
2022-05-27 12:00:42 -07:00
f47aca3558
Added |bool for rhel_enable_repos ( #8871 )
2022-05-26 18:51:55 -07:00
73fc70dbe8
Delete kube_version v1.20- related code ( #8869 )
...
Current Kubespray supports the Kubernetes version 1.21 or upper with
`kube_version_min_required: v1.21.0`
Then kube_version v1.20- related code is not used at all.
This deletes those code for cleanup.
2022-05-25 21:31:22 -07:00
dc2a18e436
Merge pull request #8815 from simplekube-ro/dont_clobber_calico
...
[calico] don't clobber calico options set by the user
2022-05-24 10:25:48 -07:00
82590eb087
fix remove `docker-ce.repo` failed ( #8856 )
2022-05-24 05:44:06 -07:00
4c97ce747c
Adding support for the kube-router flag --cluster-asn flag ( #8837 )
2022-05-23 16:39:10 -07:00
dc1af5a9c5
[etcd] Add support for setting the request size limit ( #8849 )
...
* [etcd] Add extra documentation for `etcd_memory_limit` and `etcd_quota_backend_bytes`
Signed-off-by: necatican <necaticanyildirim@gmail.com>
* [etcd] Add support for setting ETCD_MAX_REQUEST_BYTES
Signed-off-by: necatican <necaticanyildirim@gmail.com>
2022-05-23 09:36:03 -07:00
85bd1eea27
fix(calico): add missing "get" verb ( #8847 )
...
Signed-off-by: irizzant <i.rizzante@gmail.com>
2022-05-21 01:20:00 -07:00
2b151c6aa2
cni-plugins: upgrade to 1.1.1 ( #8852 )
...
Signed-off-by: necatican <necaticanyildirim@gmail.com>
2022-05-21 11:14:16 +03:00
yanggang
MatthieuFin
Mohamed Zaian
Cyclinder
Arthur Outhenin-Chalandre
rongfu.leng
Vitaly Yakovenko
Jochen Friedrich
ERIK
László Rafael
Eugene Artemenko
Kay Yan
R. P. Taylor
Marijn van der Giesen
tu1h
Ho Kim
mKlaris
my-git9
Shelming.Song
Kenichi Omichi
Kevin Huang
Maxime Leroy
emiran-orange
C-Romeo
janaurka
Xieql
Lukas Najman
Robin Wallace
Book shu
JSpon
Fredrik Liv
Chad Swenson
Samuel Liu
Ugur Can Ozturk
Douglas Landgraf
rtsp
蒋航
Sergey Putko
Ilya Margolin
Olivier Lemasle
ausias-armesto
lijin-union
Jiffs Maverick
Fred Rolland
cleverhu
charlychiu
William Turner
biqiang Wu
Wouter Goedhart
Florian Ruynat
Vladimir
Cristian Calin
Unai Arríen
ghostloda
Piotr Kowalczyk
Joe Siponen
Huang Chen-Yi
William Turner
Emin AKTAS
Hugo Blom
Rene Luria
Federico Cucinella
Zhong Jianxin
Victor Morales
Kei Kori
Krystian Młynek
pingrulkin
Vadim
ErmalKristo
Necatican Yıldırım
Mahdi Abbasi
cleverhu
Michael Schmitz
lou-lan
Alessio Greggi
tasekida
kakkotetsu
Pavel Chekin
Mostafa Ghadimi
Tristan
Tomas Zvala
GreatLazyMan
Thearas
Jin Li
Peter Pan
Marco Fortina
Boris Barnier
Aveline
Ader Fu
Denis Khachyan
gssjl2008
pil57852
yasintahaerol
h9-HSFRQDH
Calin Cristian Andrei
Tom Stian Berget
orange-llajeanne
Sébastien Masset
Christoffer Anselm
Citrullin
Viktor Jacynycz
Dickson Tung
Steffen Becker
Mathieu Parent
mahjonp
vanyasvl
Max Gautier
Chris Ricker
Daniil Muidinov
Gleb Galkin
Ross Kusler
Necatican Yıldırım
irizzant