c12s-kubespray/cluster.yml

---
- hosts: localhost
  gather_facts: False
  roles:
    - { role: kargo-defaults}
    - { role: bastion-ssh-config, tags: ["localhost", "bastion"]}

- hosts: k8s-cluster:etcd:calico-rr
  any_errors_fatal: true
  gather_facts: false
  vars:
    # Need to disable pipelining for bootstrap-os as some systems have requiretty in sudoers set, which makes pipelining
    # fail. bootstrap-os fixes this on these systems, so in later plays it can be enabled.
    ansible_ssh_pipelining: false
  roles:
    - { role: kargo-defaults}
    - { role: bootstrap-os, tags: bootstrap-os}

- hosts: k8s-cluster:etcd:calico-rr
  any_errors_fatal: true
  vars:
    ansible_ssh_pipelining: true
  gather_facts: true

- hosts: k8s-cluster:etcd:calico-rr
  any_errors_fatal: true
  roles:
    - { role: kargo-defaults}
    - { role: kernel-upgrade, tags: kernel-upgrade, when: kernel_upgrade is defined and kernel_upgrade }
    - { role: kubernetes/preinstall, tags: preinstall }
    - { role: docker, tags: docker }
    - role: rkt
      tags: rkt
      when: "'rkt' in [etcd_deployment_type, kubelet_deployment_type, vault_deployment_type]"

- hosts: etcd:k8s-cluster:vault
  any_errors_fatal: true
  roles:
    - { role: kargo-defaults, when: "cert_management == 'vault'" }
    - { role: vault, tags: vault, vault_bootstrap: true, when: "cert_management == 'vault'" }

- hosts: etcd:!k8s-cluster
  any_errors_fatal: true
  roles:
    - { role: kargo-defaults}
    - { role: etcd, tags: etcd }

- hosts: k8s-cluster
  any_errors_fatal: true
  roles:
    - { role: kargo-defaults}
    - { role: etcd, tags: etcd }

- hosts: etcd:k8s-cluster:vault
  any_errors_fatal: true
  roles:
    - { role: kargo-defaults}
    - { role: vault, tags: vault, when: "cert_management == 'vault'"}

- hosts: k8s-cluster
  any_errors_fatal: true
  roles:
    - { role: kargo-defaults}
    - { role: kubernetes/node, tags: node }
    - { role: network_plugin, tags: network }

- hosts: kube-master
  any_errors_fatal: true
  roles:
    - { role: kargo-defaults}
    - { role: kubernetes/master, tags: master }
    - { role: kubernetes-apps/network_plugin, tags: network }

- hosts: calico-rr
  any_errors_fatal: true
  roles:
    - { role: kargo-defaults}
    - { role: network_plugin/calico/rr, tags: network }

- hosts: k8s-cluster
  any_errors_fatal: true
  roles:
    - { role: kargo-defaults}
    - { role: dnsmasq, when: "dns_mode == 'dnsmasq_kubedns'", tags: dnsmasq }
    - { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf }

- hosts: kube-master[0]
  any_errors_fatal: true
  roles:
    - { role: kargo-defaults}
    - { role: kubernetes-apps, tags: apps }
Initial commit 2015-10-03 20:19:50 +00:00			`---`
Add support for bastion hosts 2016-12-09 09:38:17 +00:00			`- hosts: localhost`
			`gather_facts: False`
			`roles:`
Add default var role 2017-02-23 11:07:17 +00:00			`- { role: kargo-defaults}`
			`- { role: bastion-ssh-config, tags: ["localhost", "bastion"]}`
Add support for bastion hosts 2016-12-09 09:38:17 +00:00
Rework wildcards matching all nodes * Re-enable ansible_ssh_pipelining as expected for the cluster.yml * Do not use 'all' wildcasts for hosts, limit only to k8s-cluster, etcd, calico-rr groups instead. Other nodes in inventory are out of Kargo scope and it's up to users how to manage them. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru> 2016-12-27 15:00:02 +00:00			`- hosts: k8s-cluster:etcd:calico-rr`
Fail all nodes on error 2016-12-02 11:37:22 +00:00			`any_errors_fatal: true`
combine bootstrap options, add xenial support 2016-09-06 14:04:41 +00:00			`gather_facts: false`
Remove requiretty from sudoers to actually make pipelining work Some systems (e.g. CentOS on Azure) have requiretty in sudoers which makes pipelining fail. 2016-12-09 09:38:45 +00:00			`vars:`
Add comment about why ansible_ssh_pipelining is set to false in bootstrap-os 2016-12-09 10:04:42 +00:00			`# Need to disable pipelining for bootstrap-os as some systems have requiretty in sudoers set, which makes pipelining`
			`# fail. bootstrap-os fixes this on these systems, so in later plays it can be enabled.`
Remove requiretty from sudoers to actually make pipelining work Some systems (e.g. CentOS on Azure) have requiretty in sudoers which makes pipelining fail. 2016-12-09 09:38:45 +00:00			`ansible_ssh_pipelining: false`
combine bootstrap options, add xenial support 2016-09-06 14:04:41 +00:00			`roles:`
Add default var role 2017-02-23 11:07:17 +00:00			`- { role: kargo-defaults}`
			`- { role: bootstrap-os, tags: bootstrap-os}`
force fact check of all nodes first thing 2016-08-12 14:06:31 +00:00
Rework wildcards matching all nodes * Re-enable ansible_ssh_pipelining as expected for the cluster.yml * Do not use 'all' wildcasts for hosts, limit only to k8s-cluster, etcd, calico-rr groups instead. Other nodes in inventory are out of Kargo scope and it's up to users how to manage them. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru> 2016-12-27 15:00:02 +00:00			`- hosts: k8s-cluster:etcd:calico-rr`
Fail all nodes on error 2016-12-02 11:37:22 +00:00			`any_errors_fatal: true`
Rework wildcards matching all nodes * Re-enable ansible_ssh_pipelining as expected for the cluster.yml * Do not use 'all' wildcasts for hosts, limit only to k8s-cluster, etcd, calico-rr groups instead. Other nodes in inventory are out of Kargo scope and it's up to users how to manage them. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru> 2016-12-27 15:00:02 +00:00			`vars:`
			`ansible_ssh_pipelining: true`
combine bootstrap options, add xenial support 2016-09-06 14:04:41 +00:00			`gather_facts: true`
restored gather facts on all hosts 2016-09-19 19:12:42 +00:00
Rework wildcards matching all nodes * Re-enable ansible_ssh_pipelining as expected for the cluster.yml * Do not use 'all' wildcasts for hosts, limit only to k8s-cluster, etcd, calico-rr groups instead. Other nodes in inventory are out of Kargo scope and it's up to users how to manage them. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru> 2016-12-27 15:00:02 +00:00			`- hosts: k8s-cluster:etcd:calico-rr`
Fail all nodes on error 2016-12-02 11:37:22 +00:00			`any_errors_fatal: true`
Use 0755 mode for binaries 2015-12-17 21:46:50 +00:00			`roles:`
Add default var role 2017-02-23 11:07:17 +00:00			`- { role: kargo-defaults}`
Add kernel upgrade for CentOS 2017-01-10 15:11:42 +00:00			`- { role: kernel-upgrade, tags: kernel-upgrade, when: kernel_upgrade is defined and kernel_upgrade }`
rename role common to kubernetes/preinstall 2015-12-31 09:03:22 +00:00			`- { role: kubernetes/preinstall, tags: preinstall }`
Preconfigure DNS stack and docker early In order to enable offline/intranet installation cases: * Move DNS/resolvconf configuration to preinstall role. Remove skip_dnsmasq_k8s var as not needed anymore. * Preconfigure DNS stack early, which may be the case when downloading artifacts from intranet repositories. Do not configure K8s DNS resolvers for hosts /etc/resolv.conf yet early (as they may be not existing). * Reconfigure K8s DNS resolvers for hosts only after kubedns/dnsmasq was set up and before K8s apps to be created. * Move docker install task to early stage as well and unbind it from the etcd role's specific install path. Fix external flannel dependency on docker role handlers. Also fix the docker restart handlers' steps ordering to match the expected sequence (the socket then the service). * Add default resolver fact, which is the cloud provider specific and remove hardcoded GCE resolver. * Reduce default ndots for hosts /etc/resolv.conf to 2. Multiple search domains combined with high ndots values lead to poor performance of DNS stack and make ansible workers to fail very often with the "Timeout (12s) waiting for privilege escalation prompt:" error. * Update docs. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> 2016-12-07 15:57:05 +00:00			`- { role: docker, tags: docker }`
Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00			`- role: rkt`
			`tags: rkt`
			`when: "'rkt' in [etcd_deployment_type, kubelet_deployment_type, vault_deployment_type]"`
Fix idempotency/recurrence of download and preinstall * Don't push containers if not changed * Do preinstall role only once and redistribute defaults to corresponding roles Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> 2016-10-24 13:11:52 +00:00
Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00			`- hosts: etcd:k8s-cluster:vault`
Adding the Vault role 2017-01-13 20:31:10 +00:00			`any_errors_fatal: true`
			`roles:`
Add default var role 2017-02-23 11:07:17 +00:00			`- { role: kargo-defaults, when: "cert_management == 'vault'" }`
Adding the Vault role 2017-01-13 20:31:10 +00:00			`- { role: vault, tags: vault, vault_bootstrap: true, when: "cert_management == 'vault'" }`

Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00			`- hosts: etcd:!k8s-cluster`
			`any_errors_fatal: true`
			`roles:`
Add default var role 2017-02-23 11:07:17 +00:00			`- { role: kargo-defaults}`
Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00			`- { role: etcd, tags: etcd }`

			`- hosts: k8s-cluster`
Fail all nodes on error 2016-12-02 11:37:22 +00:00			`any_errors_fatal: true`
Fix idempotency/recurrence of download and preinstall * Don't push containers if not changed * Do preinstall role only once and redistribute defaults to corresponding roles Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> 2016-10-24 13:11:52 +00:00			`roles:`
Add default var role 2017-02-23 11:07:17 +00:00			`- { role: kargo-defaults}`
Fix etcd play to only run on non-k8s-cluster nodes This decreases the time required to deploy a cluster with 3 nodes, but none are standalone etcd roles. 2016-08-11 19:14:11 +00:00			`- { role: etcd, tags: etcd }`
Fix etcd standalone deployment etcd facts are generated in kubernetes/preinstall, so etcd nodes need to be evaluated first before the rest of the deployment. Moved several directory facts from kubernetes/node to kubernetes/preinstall because they are not backward dependent. 2016-07-26 13:18:47 +00:00
Adding the Vault role 2017-01-13 20:31:10 +00:00			`- hosts: etcd:k8s-cluster:vault`
			`any_errors_fatal: true`
			`roles:`
Add default var role 2017-02-23 11:07:17 +00:00			`- { role: kargo-defaults}`
Adding the Vault role 2017-01-13 20:31:10 +00:00			`- { role: vault, tags: vault, when: "cert_management == 'vault'"}`

Fix etcd standalone deployment etcd facts are generated in kubernetes/preinstall, so etcd nodes need to be evaluated first before the rest of the deployment. Moved several directory facts from kubernetes/node to kubernetes/preinstall because they are not backward dependent. 2016-07-26 13:18:47 +00:00			`- hosts: k8s-cluster`
Fail all nodes on error 2016-12-02 11:37:22 +00:00			`any_errors_fatal: true`
Fix etcd standalone deployment etcd facts are generated in kubernetes/preinstall, so etcd nodes need to be evaluated first before the rest of the deployment. Moved several directory facts from kubernetes/node to kubernetes/preinstall because they are not backward dependent. 2016-07-26 13:18:47 +00:00			`roles:`
Add default var role 2017-02-23 11:07:17 +00:00			`- { role: kargo-defaults}`
Run etcd as pod 2015-12-23 22:27:40 +00:00			`- { role: kubernetes/node, tags: node }`
split network plugins into distinct roles 2016-01-30 15:04:47 +00:00			`- { role: network_plugin, tags: network }`
Initial commit 2015-10-03 20:19:50 +00:00
review roles order 2015-12-11 10:40:56 +00:00			`- hosts: kube-master`
Fail all nodes on error 2016-12-02 11:37:22 +00:00			`any_errors_fatal: true`
review roles order 2015-12-11 10:40:56 +00:00			`roles:`
Add default var role 2017-02-23 11:07:17 +00:00			`- { role: kargo-defaults}`
review roles order 2015-12-11 10:40:56 +00:00			`- { role: kubernetes/master, tags: master }`
Adding support for canal network plugin This patch provides support for Canal network plugin installation as a self-hosted app, see the following link for details: https://github.com/tigera/canal/tree/master/k8s-install 2016-11-03 15:57:11 +00:00			`- { role: kubernetes-apps/network_plugin, tags: network }`
Use dnsmasq inside pods 2016-03-18 14:07:33 +00:00
Add calico/routereflector support Add BGP route reflectors support in order to optimize BGP topology for deployments with Calico network plugin. Also bump version of calico/ctl for some bug fixes. 2016-12-08 16:48:54 +00:00			`- hosts: calico-rr`
			`any_errors_fatal: true`
			`roles:`
Add default var role 2017-02-23 11:07:17 +00:00			`- { role: kargo-defaults}`
Add calico/routereflector support Add BGP route reflectors support in order to optimize BGP topology for deployments with Calico network plugin. Also bump version of calico/ctl for some bug fixes. 2016-12-08 16:48:54 +00:00			`- { role: network_plugin/calico/rr, tags: network }`

Dnsmasq runs on all nodes 2016-03-21 10:37:35 +00:00			`- hosts: k8s-cluster`
Fail all nodes on error 2016-12-02 11:37:22 +00:00			`any_errors_fatal: true`
Use dnsmasq inside pods 2016-03-18 14:07:33 +00:00			`roles:`
Add default var role 2017-02-23 11:07:17 +00:00			`- { role: kargo-defaults}`
Introduce dns_mode and resolvconf_mode and implement docker_dns mode Also update reset.yml to do more dns/network related cleanup. 2016-12-21 16:18:11 +00:00			`- { role: dnsmasq, when: "dns_mode == 'dnsmasq_kubedns'", tags: dnsmasq }`
			`- { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf }`
Add kubedns as default package to install 2016-05-04 16:00:46 +00:00
			`- hosts: kube-master[0]`
Fail all nodes on error 2016-12-02 11:37:22 +00:00			`any_errors_fatal: true`
Add kubedns as default package to install 2016-05-04 16:00:46 +00:00			`roles:`
Add default var role 2017-02-23 11:07:17 +00:00			`- { role: kargo-defaults}`
restored gather facts on all hosts 2016-09-19 19:12:42 +00:00			`- { role: kubernetes-apps, tags: apps }`