C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
c12s-kubespray/roles/kubernetes/master/defaults/main.yml

86 lines
2.5 KiB
YAML
Raw Normal View History

Adding yamllinter to ci steps (#1556) * Adding yaml linter to ci check * Minor linting fixes from yamllint * Changing CI to install python pkgs from requirements.txt - adding in a secondary requirements.txt for tests - moving yamllint to tests requirements
2017-08-24 09:09:52 +00:00
---
Refactor roles and hosts Shorten deployment time with: - Remove redundand roles if duplicated by a dependency and vice versa - When a member of k8s-cluster, always install docker as a dependency of the etcd role and drop the docker role from cluster.yaml. - Drop etcd and node role dependencies from master role as they are covered by the node role in k8s-cluster group as well. Copy defaults for master from node role. - Decouple master, node, secrets roles handlers and vars to be used w/o cross references. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-08-25 09:16:14 +00:00
# An experimental dev/test only dynamic volumes provisioner,
# for PetSets. Works for kube>=v1.3 only.
kube_hostpath_dynamic_provisioner: "false"
Fix idempotency/recurrence of download and preinstall * Don't push containers if not changed * Do preinstall role only once and redistribute defaults to corresponding roles Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-10-24 13:11:52 +00:00
# change to 0.0.0.0 to enable insecure access from anywhere (not recommended)
kube_apiserver_insecure_bind_address: 127.0.0.1
Allow setting --bind-address for apiserver hyperkube (#1985) * Allow setting --bind-address for apiserver hyperkube This is required if you wish to configure a loadbalancer (e.g haproxy) running on the master nodes without choosing a different port for the vip from that used by the API - in this case you need the API to bind to a specific interface, then haproxy can bind the same port on the VIP: root@overcloud-controller-0 ~]# netstat -taupen | grep 6443 tcp 0 0 192.168.24.6:6443 0.0.0.0:* LISTEN 0 680613 134504/haproxy tcp 0 0 192.168.24.16:6443 0.0.0.0:* LISTEN 0 653329 131423/hyperkube tcp 0 0 192.168.24.16:6443 192.168.24.16:58404 ESTABLISHED 0 652991 131423/hyperkube tcp 0 0 192.168.24.16:58404 192.168.24.16:6443 ESTABLISHED 0 652986 131423/hyperkube This can be achieved e.g via: kube_apiserver_bind_address: 192.168.24.16 * Address code review feedback * Update kube-apiserver.manifest.j2
2017-11-29 15:24:02 +00:00
# By default the external API listens on all interfaces, this can be changed to
# listen on a specific address/interface.
kube_apiserver_bind_address: 0.0.0.0
Add service-node-port-range parameter for kube-apiserver
2016-11-18 12:56:55 +00:00
# A port range to reserve for services with NodePort visibility.
# Inclusive at both ends of the range.
kube_apiserver_node_port_range: "30000-32767"
Add etcd TLS support
2016-11-09 10:44:41 +00:00
# ETCD cert dir for connecting apiserver to etcd
etcd_config_dir: /etc/ssl/etcd
etcd_cert_dir: "{{ etcd_config_dir }}/ssl"
Migrate k8s data to etcd3 api store Default backend is now etcd3 (was etcd2). The migration process consists of the following steps: * check if migration is necessary * stop etcd on first etcd server * run migration script * start etcd on first etcd server * stop kube-apiserver until configuration is updated * update kube-apiserver * purge old etcdv2 data
2017-03-06 10:22:13 +00:00
# ETCD backend for k8s data
kube_apiserver_storage_backend: etcd3
use etcd2 when upgrading unless forced
2017-03-30 13:08:13 +00:00
# By default, force back to etcd2. Set to true to force etcd3 (experimental!)
force_etcd3: false
Systemd units, limits, and bin path fixes * Add restart for weave service unit * Reuse docker_bin_dir everythere * Limit systemd managed docker containers by CPU/RAM. Do not configure native systemd limits due to the lack of consensus in the kernel community requires out-of-tree kernel patches. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-12-23 14:44:44 +00:00
# Limits for kube components
kube_controller_memory_limit: 512M
kube_controller_cpu_limit: 250m
Significantly reduce memory requirements Canal runs more pods and upgrades need a bit of extra room to load new pods in and get the old ones out.
2017-03-23 09:11:30 +00:00
kube_controller_memory_requests: 100M
Systemd units, limits, and bin path fixes * Add restart for weave service unit * Reuse docker_bin_dir everythere * Limit systemd managed docker containers by CPU/RAM. Do not configure native systemd limits due to the lack of consensus in the kernel community requires out-of-tree kernel patches. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-12-23 14:44:44 +00:00
kube_controller_cpu_requests: 100m
Kubernetes Reliability Improvements - Exclude kubelet CPU/RAM (kube-reserved) from cgroup. It decreases a chance of overcommitment - Add a possibility to modify Kubelet node-status-update-frequency - Add a posibility to configure node-monitor-grace-period, node-monitor-period, pod-eviction-timeout for Kubernetes controller manager - Add Kubernetes Relaibility Documentation with recomendations for various scenarios. Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>
2017-02-07 14:01:02 +00:00
kube_controller_node_monitor_grace_period: 40s
kube_controller_node_monitor_period: 5s
kube_controller_pod_eviction_timeout: 5m0s
Systemd units, limits, and bin path fixes * Add restart for weave service unit * Reuse docker_bin_dir everythere * Limit systemd managed docker containers by CPU/RAM. Do not configure native systemd limits due to the lack of consensus in the kernel community requires out-of-tree kernel patches. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-12-23 14:44:44 +00:00
kube_scheduler_memory_limit: 512M
kube_scheduler_cpu_limit: 250m
kube_scheduler_memory_requests: 170M
Significantly reduce memory requirements Canal runs more pods and upgrades need a bit of extra room to load new pods in and get the old ones out.
2017-03-23 09:11:30 +00:00
kube_scheduler_cpu_requests: 80m
Systemd units, limits, and bin path fixes * Add restart for weave service unit * Reuse docker_bin_dir everythere * Limit systemd managed docker containers by CPU/RAM. Do not configure native systemd limits due to the lack of consensus in the kernel community requires out-of-tree kernel patches. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-12-23 14:44:44 +00:00
kube_apiserver_memory_limit: 2000M
kube_apiserver_cpu_limit: 800m
kube_apiserver_memory_requests: 256M
Significantly reduce memory requirements Canal runs more pods and upgrades need a bit of extra room to load new pods in and get the old ones out.
2017-03-23 09:11:30 +00:00
kube_apiserver_cpu_requests: 100m
Added Support for OpenID Connect Authentication To use OpenID Connect Authentication beside deploying an OpenID Connect Identity Provider it is necesarry to pass additional arguments to the Kube API Server. These required arguments were added to the kube apiserver manifest.
2017-02-27 12:24:21 +00:00
allow admission control plug-ins to be easily customized
2017-04-17 02:03:45 +00:00
# Admission control plug-ins
kube_apiserver_admission_control:
Fix ordering of kube-apiserver admission control plug-ins (#1841)
2017-10-24 16:28:07 +00:00
- Initializers
allow admission control plug-ins to be easily customized
2017-04-17 02:03:45 +00:00
- NamespaceLifecycle
- LimitRanger
- ServiceAccount
- DefaultStorageClass
Add new addon Istio (#1744) * add istio addon * add addons to a ci job
2017-10-13 14:42:54 +00:00
- GenericAdmissionWebhook
Fix ordering of kube-apiserver admission control plug-ins (#1841)
2017-10-24 16:28:07 +00:00
- ResourceQuota
Add new addon Istio (#1744) * add istio addon * add addons to a ci job
2017-10-13 14:42:54 +00:00
# extra runtime config
kube_api_runtime_config:
- admissionregistration.k8s.io/v1alpha1
Granular authentication Control It is now possible to deactivate selected authentication methods (basic auth, token auth) inside the cluster by adding removing the required arguments to the Kube API Server and generating the secrets accordingly. The x509 authentification is currently not optional because disabling it would affect the kubectl clients deployed on the master nodes.
2017-02-27 13:15:50 +00:00
## Enable/Disable Kube API Server Authentication Methods
Security best practice fixes (#1783) * Disable basic and token auth by default * Add recommended security params * allow basic auth to fail in tests * Enable TLS authentication for kubelet
2017-10-15 19:41:17 +00:00
kube_basic_auth: false
kube_token_auth: false
Granular authentication Control It is now possible to deactivate selected authentication methods (basic auth, token auth) inside the cluster by adding removing the required arguments to the Kube API Server and generating the secrets accordingly. The x509 authentification is currently not optional because disabling it would affect the kubectl clients deployed on the master nodes.
2017-02-27 13:15:50 +00:00
kube_oidc_auth: false
Added Support for OpenID Connect Authentication To use OpenID Connect Authentication beside deploying an OpenID Connect Identity Provider it is necesarry to pass additional arguments to the Kube API Server. These required arguments were added to the kube apiserver manifest.
2017-02-27 12:24:21 +00:00
## Variables for OpenID Connect Configuration https://kubernetes.io/docs/admin/authentication/
## To use OpenID you have to deploy additional an OpenID Provider (e.g Dex, Keycloak, ...)
Granular authentication Control It is now possible to deactivate selected authentication methods (basic auth, token auth) inside the cluster by adding removing the required arguments to the Kube API Server and generating the secrets accordingly. The x509 authentification is currently not optional because disabling it would affect the kubectl clients deployed on the master nodes.
2017-02-27 13:15:50 +00:00
Adding yamllinter to ci steps (#1556) * Adding yaml linter to ci check * Minor linting fixes from yamllint * Changing CI to install python pkgs from requirements.txt - adding in a secondary requirements.txt for tests - moving yamllint to tests requirements
2017-08-24 09:09:52 +00:00
# kube_oidc_url: https:// ...
Added Support for OpenID Connect Authentication To use OpenID Connect Authentication beside deploying an OpenID Connect Identity Provider it is necesarry to pass additional arguments to the Kube API Server. These required arguments were added to the kube apiserver manifest.
2017-02-27 12:24:21 +00:00
# kube_oidc_client_id: kubernetes
## Optional settings for OIDC
# kube_oidc_ca_file: {{ kube_cert_dir }}/ca.pem
# kube_oidc_username_claim: sub
# kube_oidc_groups_claim: groups
add ability for custom flags
2017-04-14 21:33:04 +00:00
Adding yamllinter to ci steps (#1556) * Adding yaml linter to ci check * Minor linting fixes from yamllint * Changing CI to install python pkgs from requirements.txt - adding in a secondary requirements.txt for tests - moving yamllint to tests requirements
2017-08-24 09:09:52 +00:00
## Variables for custom flags
add ability for custom flags
2017-04-14 21:33:04 +00:00
apiserver_custom_flags: []
controller_mgr_custom_flags: []
basic rbac support
2017-06-27 04:27:25 +00:00
scheduler_custom_flags: []
kubeadm support (#1631) * kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml
2017-09-13 18:00:51 +00:00
# kubeadm settings
# Value of 0 means it never expires
kubeadm_token_ttl: 0
Added disable_volume_zone_conflict variable
2018-01-18 10:55:23 +00:00
## Variable for influencing kube-scheduler behaviour
disable_volume_zone_conflict: false
Reference in a new issue Copy permalink