C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
c12s-kubespray/roles/kubernetes/master/handlers/main.yml

92 lines
2.5 KiB
YAML
Raw Normal View History

Initial commit
2015-10-03 20:19:50 +00:00
---
Wait for static pods when setting up Fixes #390
2016-08-01 13:12:23 +00:00
- name: Master | restart kubelet
command: /bin/true
notify:
Refactor roles and hosts Shorten deployment time with: - Remove redundand roles if duplicated by a dependency and vice versa - When a member of k8s-cluster, always install docker as a dependency of the etcd role and drop the docker role from cluster.yaml. - Drop etcd and node role dependencies from master role as they are covered by the node role in k8s-cluster group as well. Copy defaults for master from node role. - Decouple master, node, secrets roles handlers and vars to be used w/o cross references. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-08-25 09:16:14 +00:00
- Master | reload systemd
- Master | reload kubelet
Allow subdomains of dns_domain and fix kubelet restarts * Add a var for ndots (default 5) and put it hosts' /etc/resolv.conf. * Poke kube dns container image to v1.7 * In order to apply changes to kubelet, notify it to be restarted on changes made to /etc/resolv.conf. Ignore errors as the kubelet may yet to be present up to the moment of the notification being processed. * Remove unnecessary kubelet restart for master role as the node role ensures it is up and running. Notify master static pods waiters for apiserver, scheduler, controller-manager instead. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-27 09:54:12 +00:00
- Master | wait for master static pods
Wait for static pods when setting up Fixes #390
2016-08-01 13:12:23 +00:00
Allow subdomains of dns_domain and fix kubelet restarts * Add a var for ndots (default 5) and put it hosts' /etc/resolv.conf. * Poke kube dns container image to v1.7 * In order to apply changes to kubelet, notify it to be restarted on changes made to /etc/resolv.conf. Ignore errors as the kubelet may yet to be present up to the moment of the notification being processed. * Remove unnecessary kubelet restart for master role as the node role ensures it is up and running. Notify master static pods waiters for apiserver, scheduler, controller-manager instead. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-27 09:54:12 +00:00
- name: Master | wait for master static pods
Wait for static pods when setting up Fixes #390
2016-08-01 13:12:23 +00:00
command: /bin/true
notify:
Allow subdomains of dns_domain and fix kubelet restarts * Add a var for ndots (default 5) and put it hosts' /etc/resolv.conf. * Poke kube dns container image to v1.7 * In order to apply changes to kubelet, notify it to be restarted on changes made to /etc/resolv.conf. Ignore errors as the kubelet may yet to be present up to the moment of the notification being processed. * Remove unnecessary kubelet restart for master role as the node role ensures it is up and running. Notify master static pods waiters for apiserver, scheduler, controller-manager instead. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-27 09:54:12 +00:00
- Master | wait for the apiserver to be running
- Master | wait for kube-scheduler
- Master | wait for kube-controller-manager
Wait for static pods when setting up Fixes #390
2016-08-01 13:12:23 +00:00
Master component and kubelet container upgrade fixes * Fixes an issue where apiserver and friends (controller manager, scheduler) were prevented from restarting after manifests/secrets are changed. This occurred when a replaced kubelet doesn't reconcile new master manifests, which caused old master component versions to linger during deployment. In my case this was causing upgrades from k8s 1.6/1.7 -> k8s 1.8 to fail * Improves transitions from kubelet container to host kubelet by preventing issues where kubelet container reappeared during the deployment
2017-11-08 07:40:33 +00:00
- name: Master | Restart apiserver
command: /bin/true
notify:
- Master | Remove apiserver container
- Master | wait for the apiserver to be running
- name: Master | Restart kube-scheduler
command: /bin/true
notify:
- Master | Remove scheduler container
- Master | wait for kube-scheduler
- name: Master | Restart kube-controller-manager
command: /bin/true
notify:
- Master | Remove controller manager container
- Master | wait for kube-controller-manager
Wait for static pods when setting up Fixes #390
2016-08-01 13:12:23 +00:00
- name: Master | reload systemd
command: systemctl daemon-reload
- name: Master | reload kubelet
service:
name: kubelet
state: restarted
Master component and kubelet container upgrade fixes * Fixes an issue where apiserver and friends (controller manager, scheduler) were prevented from restarting after manifests/secrets are changed. This occurred when a replaced kubelet doesn't reconcile new master manifests, which caused old master component versions to linger during deployment. In my case this was causing upgrades from k8s 1.6/1.7 -> k8s 1.8 to fail * Improves transitions from kubelet container to host kubelet by preventing issues where kubelet container reappeared during the deployment
2017-11-08 07:40:33 +00:00
- name: Master | Remove apiserver container
shell: "docker ps -af name=k8s_kube-apiserver* -q | xargs --no-run-if-empty docker rm -f"
- name: Master | Remove scheduler container
shell: "docker ps -af name=k8s_kube-scheduler* -q | xargs --no-run-if-empty docker rm -f"
- name: Master | Remove controller manager container
shell: "docker ps -af name=k8s_kube-controller-manager* -q | xargs --no-run-if-empty docker rm -f"
Allow subdomains of dns_domain and fix kubelet restarts * Add a var for ndots (default 5) and put it hosts' /etc/resolv.conf. * Poke kube dns container image to v1.7 * In order to apply changes to kubelet, notify it to be restarted on changes made to /etc/resolv.conf. Ignore errors as the kubelet may yet to be present up to the moment of the notification being processed. * Remove unnecessary kubelet restart for master role as the node role ensures it is up and running. Notify master static pods waiters for apiserver, scheduler, controller-manager instead. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-27 09:54:12 +00:00
- name: Master | wait for kube-scheduler
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-17 21:22:34 +00:00
uri:
url: http://localhost:10251/healthz
Wait for static pods when setting up Fixes #390
2016-08-01 13:12:23 +00:00
register: scheduler_result
until: scheduler_result.status == 200
delete master containers forcefully
2017-03-27 11:44:21 +00:00
retries: 60
Wait for static pods when setting up Fixes #390
2016-08-01 13:12:23 +00:00
delay: 5
Allow subdomains of dns_domain and fix kubelet restarts * Add a var for ndots (default 5) and put it hosts' /etc/resolv.conf. * Poke kube dns container image to v1.7 * In order to apply changes to kubelet, notify it to be restarted on changes made to /etc/resolv.conf. Ignore errors as the kubelet may yet to be present up to the moment of the notification being processed. * Remove unnecessary kubelet restart for master role as the node role ensures it is up and running. Notify master static pods waiters for apiserver, scheduler, controller-manager instead. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-27 09:54:12 +00:00
- name: Master | wait for kube-controller-manager
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-17 21:22:34 +00:00
uri:
url: http://localhost:10252/healthz
Wait for static pods when setting up Fixes #390
2016-08-01 13:12:23 +00:00
register: controller_manager_result
until: controller_manager_result.status == 200
retries: 15
delay: 5
Allow subdomains of dns_domain and fix kubelet restarts * Add a var for ndots (default 5) and put it hosts' /etc/resolv.conf. * Poke kube dns container image to v1.7 * In order to apply changes to kubelet, notify it to be restarted on changes made to /etc/resolv.conf. Ignore errors as the kubelet may yet to be present up to the moment of the notification being processed. * Remove unnecessary kubelet restart for master role as the node role ensures it is up and running. Notify master static pods waiters for apiserver, scheduler, controller-manager instead. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-27 09:54:12 +00:00
- name: Master | wait for the apiserver to be running
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy
2017-02-17 21:22:34 +00:00
uri:
Support for disabling apiserver insecure port This allows `kube_apiserver_insecure_port` to be set to 0 (disabled). It's working, but so far I have had to: 1. Make the `uri` module "Wait for apiserver up" checks use `kube_apiserver_port` (HTTPS) 2. Add apiserver client cert/key to the "Wait for apiserver up" checks 3. Update apiserver liveness probe to use HTTPS ports 4. Set `kube_api_anonymous_auth` to true to allow liveness probe to hit apiserver's /healthz over HTTPS (livenessProbes can't use client cert/key unfortunately) 5. RBAC has to be enabled. Anonymous requests are in the `system:unauthenticated` group which is granted access to /healthz by one of RBAC's default ClusterRoleBindings. An equivalent ABAC rule could allow this as well. Changes 1 and 2 should work for everyone, but 3, 4, and 5 require new coupling of currently independent configuration settings. So I also added a new settings check. Options: 1. The problem goes away if you have both anonymous-auth and RBAC enabled. This is how kubeadm does it. This may be the best way to go since RBAC is already on by default but anonymous auth is not. 2. Include conditional templates to set a different liveness probe for possible combinations of `kube_apiserver_insecure_port = 0`, RBAC, and `kube_api_anonymous_auth` (won't be possible to cover every case without a guaranteed authorizer for the secure port) 3. Use basic auth headers for the liveness probe (I really don't like this, it adds a new dependency on basic auth which I'd also like to leave independently configurable, and it requires encoded passwords in the apiserver manifest) Option 1 seems like the clear winner to me, but is there a reason we wouldn't want anonymous-auth on by default? The apiserver binary defaults anonymous-auth to true, but kubespray's default was false.
2017-11-06 20:01:10 +00:00
url: "{{ kube_apiserver_endpoint }}/healthz"
validate_certs: no
client_cert: "{{ kube_cert_dir }}/apiserver.pem"
client_key: "{{ kube_cert_dir }}/apiserver-key.pem"
Allow subdomains of dns_domain and fix kubelet restarts * Add a var for ndots (default 5) and put it hosts' /etc/resolv.conf. * Poke kube dns container image to v1.7 * In order to apply changes to kubelet, notify it to be restarted on changes made to /etc/resolv.conf. Ignore errors as the kubelet may yet to be present up to the moment of the notification being processed. * Remove unnecessary kubelet restart for master role as the node role ensures it is up and running. Notify master static pods waiters for apiserver, scheduler, controller-manager instead. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-27 09:54:12 +00:00
register: result
until: result.status == 200
use etcd2 when upgrading unless forced
2017-03-30 13:08:13 +00:00
retries: 20
Allow subdomains of dns_domain and fix kubelet restarts * Add a var for ndots (default 5) and put it hosts' /etc/resolv.conf. * Poke kube dns container image to v1.7 * In order to apply changes to kubelet, notify it to be restarted on changes made to /etc/resolv.conf. Ignore errors as the kubelet may yet to be present up to the moment of the notification being processed. * Remove unnecessary kubelet restart for master role as the node role ensures it is up and running. Notify master static pods waiters for apiserver, scheduler, controller-manager instead. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-27 09:54:12 +00:00
delay: 6
kubeadm support (#1631) * kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml
2017-09-13 18:00:51 +00:00
- name: Master | set secret_changed
Clear admin kubeconfig when rotating certs (#1772) * Clear admin kubeconfig when rotating certs * Update main.yml
2017-10-12 08:55:46 +00:00
command: /bin/true
notify:
- Master | set secret_changed to true
- Master | clear kubeconfig for root user
- name: Master | set secret_changed to true
kubeadm support (#1631) * kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml
2017-09-13 18:00:51 +00:00
set_fact:
secret_changed: true
Clear admin kubeconfig when rotating certs (#1772) * Clear admin kubeconfig when rotating certs * Update main.yml
2017-10-12 08:55:46 +00:00
- name: Master | clear kubeconfig for root user
file:
path: /root/.kube/config
state: absent
Reference in a new issue Copy permalink