2017-08-24 09:09:52 +00:00
---
2017-10-27 11:18:39 +00:00
# Use proxycommand if bastion host is in group all
2019-09-26 11:25:08 +00:00
# This change obseletes editing ansible.cfg file depending on bastion existence
2021-03-26 07:48:43 +00:00
ansible_ssh_common_args : "{% if 'bastion' in groups['all'] %} -o ProxyCommand='ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -W %h:%p -p {{ hostvars['bastion']['ansible_port'] | default(22) }} {{ hostvars['bastion']['ansible_user'] }}@{{ hostvars['bastion']['ansible_host'] }} {% if ansible_ssh_private_key_file is defined %}-i {{ ansible_ssh_private_key_file }}{% endif %} ' {% endif %}"
2017-10-27 11:18:39 +00:00
2020-03-10 14:45:35 +00:00
# selinux state
preinstall_selinux_state : permissive
2018-12-18 14:53:58 +00:00
kube_api_anonymous_auth : true
2017-02-23 11:07:17 +00:00
2017-09-08 12:00:57 +00:00
# Default value, but will be set to true automatically if detected
2020-03-17 10:12:21 +00:00
is_fedora_coreos : false
2017-09-08 12:00:57 +00:00
2018-06-21 06:17:03 +00:00
# optional disable the swap
2018-08-07 13:12:27 +00:00
disable_swap : true
2018-02-21 16:33:25 +00:00
2017-02-23 11:07:17 +00:00
## Change this to use another Kubernetes version, e.g. a current beta release
2021-04-15 15:27:14 +00:00
kube_version : v1.20.6
2017-02-23 11:07:17 +00:00
2019-06-11 06:18:15 +00:00
## The minimum version working
2021-04-20 22:34:33 +00:00
kube_version_min_required : v1.19.0
2019-06-11 06:18:15 +00:00
2018-02-21 16:33:25 +00:00
## Kube Proxy mode One of ['iptables','ipvs']
2018-11-26 23:36:39 +00:00
kube_proxy_mode : ipvs
2018-02-21 16:33:25 +00:00
2020-09-17 11:30:45 +00:00
## List of kubeadm init phases that should be skipped during control plane setup
## By default 'addon/coredns' is skipped
## 'addon/kube-proxy' gets skipped for some network plugins
kubeadm_init_phases_skip_default : [ "addon/coredns" ]
kubeadm_init_phases_skip : >-
{%- if kube_network_plugin == 'kube-router' and (kube_router_run_service_proxy is defined and kube_router_run_service_proxy) -%}
{{ kubeadm_init_phases_skip_default }} + [ "addon/kube-proxy" ]
{%- elif kube_network_plugin == 'cilium' and (cilium_kube_proxy_replacement is defined and cilium_kube_proxy_replacement == 'strict') -%}
{{ kubeadm_init_phases_skip_default }} + [ "addon/kube-proxy" ]
{%- elif kube_proxy_remove is defined and kube_proxy_remove -%}
{{ kubeadm_init_phases_skip_default }} + [ "addon/kube-proxy" ]
2020-07-30 09:46:31 +00:00
{%- else -%}
2020-09-17 11:30:45 +00:00
{{ kubeadm_init_phases_skip_default }}
2020-07-30 09:46:31 +00:00
{%- endif -%}
2019-02-25 08:08:06 +00:00
2019-01-03 08:04:26 +00:00
# A string slice of values which specify the addresses to use for NodePorts.
# Values may be valid IP blocks (e.g. 1.2.3.0/24, 1.2.3.4/32).
# The default empty string slice ([]) means to use all local addresses.
# kube_proxy_nodeport_addresses_cidr is retained for legacy config
kube_proxy_nodeport_addresses : >-
{%- if kube_proxy_nodeport_addresses_cidr is defined -%}
[ {{ kube_proxy_nodeport_addresses_cidr }}]
{%- else -%}
[ ]
{%- endif -%}
2018-09-06 10:36:17 +00:00
2017-09-27 13:47:47 +00:00
# Set to true to allow pre-checks to fail and continue deployment
ignore_assert_errors : false
2018-10-15 08:46:55 +00:00
# nginx-proxy configure
nginx_config_dir : "/etc/nginx"
2019-04-10 12:56:18 +00:00
# haproxy configure
haproxy_config_dir : "/etc/haproxy"
2017-02-23 11:07:17 +00:00
# Directory where the binaries will be installed
bin_dir : /usr/local/bin
docker_bin_dir : /usr/bin
2019-06-29 21:09:20 +00:00
containerd_bin_dir : /usr/bin
2017-03-23 09:05:34 +00:00
etcd_data_dir : /var/lib/etcd
2017-02-23 11:07:17 +00:00
# Where the binaries will be downloaded.
# Note: ensure that you've enough disk space (about 1G)
local_release_dir : "/tmp/releases"
# Random shifts for retrying failed ops like pushing/downloading
retry_stagger : 5
2019-01-22 21:44:11 +00:00
# Install epel repo on Centos/RHEL
epel_enabled : false
2017-02-23 11:07:17 +00:00
# DNS configuration.
# Kubernetes cluster name, also will be used as DNS domain
cluster_name : cluster.local
# Subdomains of DNS domain to be resolved via /etc/resolv.conf for hostnet pods
ndots : 2
2020-08-01 07:29:41 +00:00
# Default resolv.conf options
docker_dns_options :
- ndots:{{ ndots }}
- timeout:2
- attempts:2
2019-04-01 19:32:34 +00:00
# Can be coredns, coredns_dual, manual, or none
2018-11-26 23:36:39 +00:00
dns_mode : coredns
2018-01-23 13:28:42 +00:00
2018-12-11 01:28:03 +00:00
# Enable nodelocal dns cache
2019-04-11 07:24:08 +00:00
enable_nodelocaldns : true
2019-01-29 07:39:27 +00:00
nodelocaldns_ip : 169.254 .25 .10
2019-07-09 07:52:01 +00:00
nodelocaldns_health_port : 9254
2018-12-11 01:28:03 +00:00
2018-01-23 13:28:42 +00:00
# Should be set to a cluster IP if using a custom cluster DNS
2019-03-28 13:22:44 +00:00
manual_dns_server : ""
2018-01-23 13:28:42 +00:00
2017-02-23 11:07:17 +00:00
# Can be docker_dns, host_resolvconf or none
resolvconf_mode : docker_dns
# Deploy netchecker app to verify DNS resolve as an HTTP service
deploy_netchecker : false
2019-04-01 19:32:34 +00:00
# Ip address of the kubernetes DNS service (called skydns for historical reasons)
2017-02-23 11:07:17 +00:00
skydns_server : "{{ kube_service_addresses|ipaddr('net')|ipaddr(3)|ipaddr('address') }}"
2018-03-13 11:00:05 +00:00
skydns_server_secondary : "{{ kube_service_addresses|ipaddr('net')|ipaddr(4)|ipaddr('address') }}"
2017-02-23 11:07:17 +00:00
dns_domain : "{{ cluster_name }}"
2020-08-01 07:29:41 +00:00
docker_dns_search_domains :
- 'default.svc.{{ dns_domain }}'
- 'svc.{{ dns_domain }}'
2019-04-01 19:32:34 +00:00
2018-10-10 02:14:33 +00:00
kube_dns_servers :
coredns : [ "{{skydns_server}}" ]
coredns_dual : "{{[skydns_server] + [ skydns_server_secondary ]}}"
manual : [ "{{manual_dns_server}}" ]
dns_servers : "{{kube_dns_servers[dns_mode]}}"
2017-02-23 11:07:17 +00:00
2019-07-16 07:53:23 +00:00
enable_coredns_k8s_external : false
coredns_k8s_external_zone : k8s_external.local
2019-04-01 19:32:34 +00:00
2019-07-31 18:26:15 +00:00
enable_coredns_k8s_endpoint_pod_names : false
2017-02-23 11:07:17 +00:00
# Kubernetes configuration dirs and system namespace.
# Those are where all the additional config stuff goes
2018-10-30 08:51:36 +00:00
# the kubernetes normally puts in /srv/kubernetes.
2017-02-23 11:07:17 +00:00
# This puts them in a sane location and namespace.
2018-10-30 08:51:36 +00:00
# Editing those values will almost surely break something.
2017-02-23 11:07:17 +00:00
kube_config_dir : /etc/kubernetes
kube_script_dir : "{{ bin_dir }}/kubernetes-scripts"
kube_manifest_dir : "{{ kube_config_dir }}/manifests"
# This is where all the cert scripts and certs will be located
2019-03-20 12:56:57 +00:00
kube_cert_dir : "{{ kube_config_dir }}/ssl"
2017-02-23 11:07:17 +00:00
2019-04-19 13:01:54 +00:00
# compatibility directory for kubeadm
kube_cert_compat_dir : "/etc/kubernetes/pki"
2017-02-23 11:07:17 +00:00
# This is where all of the bearer tokens will be stored
kube_token_dir : "{{ kube_config_dir }}/tokens"
# This is the group that the cert creation scripts chgrp the
2018-10-30 08:51:36 +00:00
# cert files to. Not really changeable...
2017-02-23 11:07:17 +00:00
kube_cert_group : kube-cert
# Cluster Loglevel configuration
kube_log_level : 2
2018-02-17 03:37:47 +00:00
# Choose network plugin (cilium, calico, weave or flannel)
2017-02-23 11:07:17 +00:00
# Can also be set to 'cloud', which lets the cloud provider setup appropriate routing
kube_network_plugin : calico
2018-11-04 09:07:38 +00:00
kube_network_plugin_multus : false
2017-02-23 11:07:17 +00:00
2021-04-29 12:20:50 +00:00
# Determines if calico_rr group exists
peer_with_calico_rr : "{{ 'calico_rr' in groups and groups['calico_rr']|length > 0 }}"
2017-10-04 12:27:55 +00:00
2019-10-17 12:58:38 +00:00
# Choose data store type for calico: "etcd" or "kdd" (kubernetes datastore)
2020-09-23 15:38:09 +00:00
calico_datastore : "kdd"
2019-10-17 12:58:38 +00:00
2017-02-23 11:07:17 +00:00
# Kubernetes internal network for services, unused block of space.
kube_service_addresses : 10.233 .0 .0 /18
# internal network. When used, it will assign IP
# addresses from this range to individual pods.
# This network must be unused in your network infrastructure!
kube_pods_subnet : 10.233 .64 .0 /18
# internal network node size allocation (optional). This is the size allocated
2020-09-10 10:49:44 +00:00
# to each node for pod IP address allocation. Note that the number of pods per node is
# also limited by the kubelet_max_pods variable which defaults to 110.
#
# Example:
# Up to 64 nodes and up to 254 or kubelet_max_pods (the lowest of the two) pods per node:
# - kube_pods_subnet: 10.233.64.0/18
# - kube_network_node_prefix: 24
# - kubelet_max_pods: 110
#
# Example:
# Up to 128 nodes and up to 126 or kubelet_max_pods (the lowest of the two) pods per node:
# - kube_pods_subnet: 10.233.64.0/18
2018-01-26 14:13:21 +00:00
# - kube_network_node_prefix: 25
2020-09-10 10:49:44 +00:00
# - kubelet_max_pods: 110
2017-02-23 11:07:17 +00:00
kube_network_node_prefix : 24
2020-10-26 07:10:53 +00:00
# Configure Dual Stack networking (i.e. both IPv4 and IPv6)
enable_dual_stack_networks : false
# Kubernetes internal network for IPv6 services, unused block of space.
# This is only used if enable_dual_stack_networks is set to true
# This provides 4096 IPv6 IPs
kube_service_addresses_ipv6 : fd85:ee78:d8a6:8607::1000/116
# Internal network. When used, it will assign IPv6 addresses from this range to individual pods.
# This network must not already be in your network infrastructure!
# This is only used if enable_dual_stack_networks is set to true.
# This provides room for 256 nodes with 254 pods per node.
kube_pods_subnet_ipv6 : fd85:ee78:d8a6:8607::1:0000/112
# IPv6 subnet size allocated to each for pods.
# This is only used if enable_dual_stack_networks is set to true
# This provides room for 254 pods per node.
kube_network_node_prefix_ipv6 : 120
2018-01-03 16:40:21 +00:00
# The virtual cluster IP, real host IPs and ports the API Server will be
# listening on.
# NOTE: loadbalancer_apiserver_localhost somewhat alters the final API enpdoint
# access IP value (automatically evaluated below)
2017-02-23 11:07:17 +00:00
kube_apiserver_ip : "{{ kube_service_addresses|ipaddr('net')|ipaddr(1)|ipaddr('address') }}"
2018-01-03 16:40:21 +00:00
kube_apiserver_bind_address : 0.0 .0 .0
2017-08-24 09:09:52 +00:00
# https
kube_apiserver_port : 6443
# http
2017-09-09 20:41:48 +00:00
kube_apiserver_insecure_bind_address : 127.0 .0 .1
2018-11-26 23:36:39 +00:00
kube_apiserver_insecure_port : 0
2017-02-23 11:07:17 +00:00
2019-02-07 06:20:11 +00:00
# If non-empty, will use this string as identification instead of the actual hostname
kube_override_hostname : >-
{%- if cloud_provider is defined and cloud_provider in [ 'aws' ] -%}
{%- else -%}
{{ inventory_hostname }}
{%- endif -%}
2018-09-16 17:40:20 +00:00
# dynamic kubelet configuration
dynamic_kubelet_configuration : false
# define kubelet config dir for dynamic kubelet
2018-09-25 14:50:22 +00:00
# kubelet_config_dir:
2018-09-16 17:40:20 +00:00
default_kubelet_config_dir : "{{ kube_config_dir }}/dynamic_kubelet_dir"
dynamic_kubelet_configuration_dir : "{{ kubelet_config_dir | default(default_kubelet_config_dir) }}"
2018-02-07 09:07:46 +00:00
# Aggregator
2018-03-20 15:28:01 +00:00
kube_api_aggregator_routing : false
2018-02-07 08:50:08 +00:00
2018-09-19 08:01:45 +00:00
# Profiling
kube_profiling : false
2018-08-28 06:23:38 +00:00
# Container for runtime
container_manager : docker
2018-08-04 10:01:35 +00:00
2020-06-22 07:28:39 +00:00
# Enable Kata Containers as additional container runtime
2020-10-23 10:07:46 +00:00
# When enabled, it requires `container_manager` different than Docker
2020-06-22 07:28:39 +00:00
kata_containers_enabled : false
2020-12-01 19:00:50 +00:00
# Enable crun as additional container runtime
# When enabled, it requires container_manager=crio
crun_enabled : false
2020-03-05 15:31:39 +00:00
# Container on localhost (download images when download_localhost is true)
container_manager_on_localhost : "{{ container_manager }}"
2019-09-10 19:30:55 +00:00
# CRI socket path
cri_socket : >-
{%- if container_manager == 'crio' -%}
/var/run/crio/crio.sock
{%- elif container_manager == 'containerd' -%}
/var/run/containerd/containerd.sock
{%- else -%}
/var/run/dockershim.sock
{%- endif -%}
2018-09-09 02:15:33 +00:00
## Uncomment this if you want to force overlay/overlay2 as docker storage driver
## Please note that overlay2 is only supported on newer kernels
2018-09-09 02:51:35 +00:00
# docker_storage_options: -s overlay2
2018-09-09 02:15:33 +00:00
## Enable docker_container_storage_setup, it will configure devicemapper driver on Centos7 or RedHat7.
docker_container_storage_setup : false
## It must be define a disk path for docker_container_storage_setup_devs.
## Otherwise docker-storage-setup will be executed incorrectly.
2018-09-09 02:51:35 +00:00
# docker_container_storage_setup_devs: /dev/vdb
2018-09-09 02:15:33 +00:00
2021-04-14 22:13:07 +00:00
## Only set this if you have more than 3 nameservers:
## If true Kubespray will only use the first 3, otherwise it will fail
2018-09-09 02:15:33 +00:00
docker_dns_servers_strict : false
2017-02-23 11:07:17 +00:00
# Path used to store Docker data
docker_daemon_graph : "/var/lib/docker"
2018-09-09 02:15:33 +00:00
## Used to set docker daemon iptables options to true
docker_iptables_enabled : "false"
2017-03-22 13:40:10 +00:00
# Docker log options
# Rotate container stderr/stdout logs at 50m and keep last 5
docker_log_opts : "--log-opt max-size=50m --log-opt max-file=5"
2019-07-21 07:12:53 +00:00
## A list of insecure docker registries (IP address or domain name), for example
## to allow insecure-registry access to self-hosted registries. Empty by default.
2018-09-10 10:05:49 +00:00
# docker_insecure_registries:
2018-09-09 02:15:33 +00:00
# - mirror.registry.io
# - 172.19.16.11
2019-07-21 07:12:53 +00:00
docker_insecure_registries : [ ]
2018-09-09 02:15:33 +00:00
2019-07-21 07:12:53 +00:00
## A list of additional registry mirrors, for example China registry mirror. Empty by default.
2018-09-10 10:05:49 +00:00
# docker_registry_mirrors:
2018-09-09 02:15:33 +00:00
# - https://registry.docker-cn.com
# - https://mirror.aliyuncs.com
2019-07-21 07:12:53 +00:00
docker_registry_mirrors : [ ]
2017-02-23 11:07:17 +00:00
2018-04-15 13:20:02 +00:00
## If non-empty will override default system MounFlags value.
## This option takes a mount propagation flag: shared, slave
## or private, which control whether mounts in the file system
## namespace set up for docker will receive or propagate mounts
## and unmounts. Leave empty for system default
2018-09-09 02:51:35 +00:00
# docker_mount_flags:
2018-09-09 02:15:33 +00:00
## A string of extra options to pass to the docker daemon.
2019-07-21 07:12:53 +00:00
# docker_options: ""
2018-04-15 13:20:02 +00:00
2019-07-08 13:44:35 +00:00
## A list of plugins to install using 'docker plugin install --grant-all-permissions'
## Empty by default so no plugins will be installed.
docker_plugins : [ ]
2019-06-20 18:12:51 +00:00
# Experimental kubeadm etcd deployment mode. Available only for new deployment
etcd_kubeadm_enabled : false
2019-06-29 21:09:20 +00:00
# Containerd options
2021-04-02 06:20:11 +00:00
containerd_version : >-
{%- if ansible_os_family == "Debian" and ansible_distribution_release == "stretch" -%}
1.4 .3
{%- else -%}
1.4 .4
{%- endif -%}
containerd_use_systemd_cgroup : true
2019-06-29 21:09:20 +00:00
2017-02-23 11:07:17 +00:00
# Settings for containerized control plane (etcd/kubelet/secrets)
2019-06-20 18:12:51 +00:00
# deployment type for legacy etcd mode
2017-02-23 11:07:17 +00:00
etcd_deployment_type : docker
cert_management : script
2018-11-10 16:51:24 +00:00
2018-02-16 12:53:35 +00:00
# Make a copy of kubeconfig on the host that runs Ansible in {{ inventory_dir }}/artifacts
2017-09-18 12:30:57 +00:00
kubeconfig_localhost : false
2018-02-16 12:53:35 +00:00
# Download kubectl onto the host that runs Ansible in {{ bin_dir }}
2017-09-18 12:30:57 +00:00
kubectl_localhost : false
2018-10-30 08:51:36 +00:00
# Define credentials_dir here so it can be overridden
2018-09-03 16:04:50 +00:00
credentials_dir : "{{ inventory_dir }}/credentials"
2017-02-23 11:07:17 +00:00
# K8s image pull policy (imagePullPolicy)
k8s_image_pull_policy : IfNotPresent
2017-11-01 14:25:35 +00:00
2018-01-30 13:03:48 +00:00
# Kubernetes dashboard
# RBAC required. see docs/getting-started.md for access details.
2020-10-11 15:06:47 +00:00
dashboard_enabled : false
2018-01-30 13:03:48 +00:00
2017-11-01 14:25:35 +00:00
# Addons which can be enabled
2017-10-19 08:17:11 +00:00
helm_enabled : false
2018-02-06 13:17:06 +00:00
registry_enabled : false
2018-11-23 08:36:21 +00:00
metrics_server_enabled : false
2018-08-23 14:17:18 +00:00
enable_network_policy : true
2020-05-28 13:56:02 +00:00
local_path_provisioner_enabled : false
local_volume_provisioner_enabled : false
2019-06-06 11:36:14 +00:00
local_volume_provisioner_directory_mode : 0700
2019-11-01 07:59:24 +00:00
cinder_csi_enabled : false
2020-03-25 20:10:25 +00:00
aws_ebs_csi_enabled : false
2020-04-01 07:53:27 +00:00
azure_csi_enabled : false
2020-03-31 07:06:40 +00:00
gcp_pd_csi_enabled : false
2020-04-20 15:47:39 +00:00
vsphere_csi_enabled : false
2017-12-19 14:47:00 +00:00
persistent_volumes_enabled : false
2018-02-09 14:03:38 +00:00
cephfs_provisioner_enabled : false
2019-04-17 06:14:02 +00:00
rbd_provisioner_enabled : false
2018-02-13 01:08:44 +00:00
ingress_nginx_enabled : false
2020-06-24 14:39:17 +00:00
ingress_ambassador_enabled : false
2020-03-16 09:58:35 +00:00
ingress_alb_enabled : false
2018-03-28 14:30:00 +00:00
cert_manager_enabled : false
2019-04-04 09:36:50 +00:00
expand_persistent_volumes : false
2020-06-29 22:11:59 +00:00
metallb_enabled : false
2017-11-01 14:25:35 +00:00
2021-04-26 06:47:01 +00:00
# containerd official CLI tool
nerdctl_enabled : false
2018-01-05 11:05:24 +00:00
## When OpenStack is used, Cinder version can be explicitly specified if autodetection fails (Fixed in 1.9: https://github.com/kubernetes/kubernetes/issues/50461)
2017-09-27 13:47:47 +00:00
# openstack_blockstorage_version: "v1/v2/auto (default)"
2018-09-28 05:15:47 +00:00
openstack_blockstorage_ignore_volume_az : "{{ volume_cross_zone_attachment | default('false') }}"
2020-03-02 11:30:43 +00:00
# set max volumes per node (cinder-csi), default not set
# node_volume_attach_limit: 25
2020-02-26 13:12:25 +00:00
# Cinder CSI topology, when false volumes can be cross-mounted between availability zones
# cinder_topology: false
# Set Cinder topology zones (can be multiple zones, default not set)
# cinder_topology_zones:
# - nova
2018-01-05 11:05:24 +00:00
## When OpenStack is used, if LBaaSv2 is available you can enable it with the following 2 variables.
2017-08-20 10:59:15 +00:00
openstack_lbaas_enabled : false
2017-09-27 13:47:47 +00:00
# openstack_lbaas_subnet_id: "Neutron subnet ID (not network ID) to create LBaaS VIP"
2018-01-05 11:05:24 +00:00
## To enable automatic floating ip provisioning, specify a subnet.
2017-09-27 13:47:47 +00:00
# openstack_lbaas_floating_network_id: "Neutron network ID (not subnet ID) to get floating IP from, disabled by default"
2018-01-05 11:05:24 +00:00
## Override default LBaaS behavior
# openstack_lbaas_use_octavia: False
# openstack_lbaas_method: "ROUND_ROBIN"
# openstack_lbaas_provider: "haproxy"
openstack_lbaas_create_monitor : "yes"
openstack_lbaas_monitor_delay : "1m"
openstack_lbaas_monitor_timeout : "30s"
openstack_lbaas_monitor_max_retries : "3"
2018-10-12 13:39:58 +00:00
openstack_cacert : "{{ lookup('env','OS_CACERT') }}"
2017-08-20 10:59:15 +00:00
2020-02-18 12:47:28 +00:00
# Default values for the external OpenStack Cloud Controller
external_openstack_lbaas_create_monitor : false
external_openstack_lbaas_monitor_delay : "1m"
external_openstack_lbaas_monitor_timeout : "30s"
external_openstack_lbaas_monitor_max_retries : "3"
2020-05-18 09:31:36 +00:00
external_openstack_network_ipv6_disabled : false
2021-02-25 19:25:25 +00:00
external_openstack_lbaas_use_octavia : false
2021-03-18 23:52:36 +00:00
external_openstack_network_internal_networks : [ ]
external_openstack_network_public_networks : [ ]
2020-02-18 12:47:28 +00:00
2017-06-27 04:27:25 +00:00
## List of authorization modes that must be configured for
2017-10-05 09:51:21 +00:00
## the k8s cluster. Only 'AlwaysAllow', 'AlwaysDeny', 'Node' and
2017-10-14 10:28:46 +00:00
## 'RBAC' modes are tested. Order is important.
authorization_modes : [ 'Node' , 'RBAC' ]
2018-12-06 10:33:38 +00:00
rbac_enabled : "{{ 'RBAC' in authorization_modes }}"
2017-08-24 20:18:38 +00:00
2020-12-17 07:43:09 +00:00
# When enabled, API bearer tokens (including service account tokens) can be used to authenticate to the kubelet's HTTPS endpoint
2018-06-18 12:20:05 +00:00
kubelet_authentication_token_webhook : true
2018-01-21 10:34:37 +00:00
# When enabled, access to the kubelet API requires authorization by delegation to the API server
2019-05-08 20:38:36 +00:00
kubelet_authorization_mode_webhook : true
2018-01-21 10:34:37 +00:00
2019-04-03 08:35:44 +00:00
# kubelet uses certificates for authenticating to the Kubernetes API
# Automatically generate a new key and request a new certificate from the Kubernetes API as the current certificate approaches expiration
kubelet_rotate_certificates : true
2020-09-03 14:25:41 +00:00
# kubelet can also request a new server certificate from the Kubernetes API
kubelet_rotate_server_certificates : false
2019-04-03 08:35:44 +00:00
2020-09-03 14:41:41 +00:00
# If set to true, kubelet errors if any of kernel tunables is different than kubelet defaults
kubelet_protect_kernel_defaults : true
2018-10-04 09:05:55 +00:00
## List of key=value pairs that describe feature gates for
## the k8s cluster.
2020-02-14 10:24:17 +00:00
kube_feature_gates : [ ]
2021-04-12 08:05:59 +00:00
kubeadm_feature_gates : [ ]
2018-10-04 09:05:55 +00:00
2018-10-05 12:52:25 +00:00
# Local volume provisioner storage classes
2019-01-08 20:36:44 +00:00
# Levarages Ansibles string to Python datatype casting. Otherwise the dict_key isn't substituted
# see https://github.com/ansible/ansible/issues/17324
local_volume_provisioner_storage_classes : |
{
"{{ local_volume_provisioner_storage_class | default('local-storage') }}": {
2019-07-16 12:27:26 +00:00
"host_dir": "{{ local_volume_provisioner_base_dir | default ('/mnt/disks') }}" ,
"mount_dir": "{{ local_volume_provisioner_mount_dir | default('/mnt/disks') }}" ,
"volume_mode": "Filesystem" ,
"fs_type": "ext4"
2019-01-08 20:36:44 +00:00
}
}
2018-04-13 14:23:10 +00:00
2018-01-30 13:03:48 +00:00
# weave's network password for encryption
# if null then no network encryption
# you can use --extra-vars to pass the password in command line
weave_password : EnterPasswordHere
2020-09-23 08:20:09 +00:00
ssl_ca_dirs : |-
2018-07-06 06:12:13 +00:00
[
2020-08-28 09:28:53 +00:00
{% if ansible_os_family in ['Flatcar Container Linux by Kinvolk'] -%}
2018-07-06 06:12:13 +00:00
'/usr/share/ca-certificates' ,
{% elif ansible_os_family == 'RedHat' -%}
'/etc/pki/tls' ,
'/etc/pki/ca-trust' ,
{% elif ansible_os_family == 'Debian' -%}
'/usr/share/ca-certificates' ,
{% endif -%}
]
2017-10-04 12:27:55 +00:00
# Vars for pointing to kubernetes api endpoints
2021-03-24 00:26:05 +00:00
is_kube_master : "{{ inventory_hostname in groups['kube_control_plane'] }}"
kube_apiserver_count : "{{ groups['kube_control_plane'] | length }}"
2019-03-05 11:04:39 +00:00
kube_apiserver_address : "{{ ip | default(fallback_ips[inventory_hostname]) }}"
2017-10-04 12:27:55 +00:00
kube_apiserver_access_address : "{{ access_ip | default(kube_apiserver_address) }}"
2021-03-24 00:26:05 +00:00
first_kube_master : "{{ hostvars[groups['kube_control_plane'][0]]['access_ip'] | default(hostvars[groups['kube_control_plane'][0]]['ip'] | default(fallback_ips[groups['kube_control_plane'][0]])) }}"
2017-10-04 12:27:55 +00:00
loadbalancer_apiserver_localhost : "{{ loadbalancer_apiserver is not defined }}"
2019-04-10 12:56:18 +00:00
loadbalancer_apiserver_type : "nginx"
2017-11-23 16:15:48 +00:00
# applied if only external loadbalancer_apiserver is defined, otherwise ignored
apiserver_loadbalancer_domain_name : "lb-apiserver.kubernetes.local"
2020-08-06 07:14:55 +00:00
kube_apiserver_global_endpoint : |-
{% if loadbalancer_apiserver is defined -%}
https://{{ apiserver_loadbalancer_domain_name }}:{{ loadbalancer_apiserver.port|default(kube_apiserver_port) }}
2021-03-01 19:53:36 +00:00
{%- elif use_localhost_as_kubeapi_loadbalancer|default(False)|bool -%}
2021-02-16 13:19:05 +00:00
https://127.0.0.1:{{ kube_apiserver_port }}
2020-08-06 07:14:55 +00:00
{%- else -%}
https://{{ first_kube_master }}:{{ kube_apiserver_port }}
{%- endif %}
2017-10-04 12:27:55 +00:00
kube_apiserver_endpoint : |-
2020-02-11 09:40:01 +00:00
{% if loadbalancer_apiserver is defined -%}
2020-06-29 19:39:59 +00:00
https://{{ apiserver_loadbalancer_domain_name }}:{{ loadbalancer_apiserver.port|default(kube_apiserver_port) }}
2019-01-07 22:06:52 +00:00
{%- elif not is_kube_master and loadbalancer_apiserver_localhost -%}
2020-06-29 19:39:59 +00:00
https://localhost:{{ loadbalancer_apiserver_port|default(kube_apiserver_port) }}
2017-10-04 12:27:55 +00:00
{%- elif is_kube_master -%}
2020-06-29 19:39:59 +00:00
https://{{ kube_apiserver_bind_address | regex_replace('0\.0\.0\.0','127.0.0.1') }}:{{ kube_apiserver_port }}
2017-10-04 12:27:55 +00:00
{%- else -%}
2020-06-29 19:39:59 +00:00
https://{{ first_kube_master }}:{{ kube_apiserver_port }}
2017-10-04 12:27:55 +00:00
{%- endif %}
kube_apiserver_insecure_endpoint : >-
http://{{ kube_apiserver_insecure_bind_address | regex_replace('0\.0\.0\.0','127.0.0.1') }}:{{ kube_apiserver_insecure_port }}
2018-12-06 10:33:38 +00:00
kube_apiserver_client_cert : "{{ kube_cert_dir }}/ca.crt"
kube_apiserver_client_key : "{{ kube_cert_dir }}/ca.key"
2017-10-04 12:27:55 +00:00
2018-03-01 08:39:14 +00:00
# Set to true to deploy etcd-events cluster
2018-06-18 13:19:12 +00:00
etcd_events_cluster_enabled : false
2018-03-01 08:39:14 +00:00
2020-10-21 14:32:20 +00:00
# etcd group can be empty when kubeadm manages etcd
2021-03-24 00:26:05 +00:00
etcd_hosts : "{{ groups['etcd'] | default(groups['kube_control_plane']) }}"
2020-10-21 14:32:20 +00:00
2017-10-04 12:27:55 +00:00
# Vars for pointing to etcd endpoints
is_etcd_master : "{{ inventory_hostname in groups['etcd'] }}"
2019-03-05 11:04:39 +00:00
etcd_address : "{{ ip | default(fallback_ips[inventory_hostname]) }}"
2017-10-04 12:27:55 +00:00
etcd_access_address : "{{ access_ip | default(etcd_address) }}"
2018-06-29 23:32:29 +00:00
etcd_events_access_address : "{{ access_ip | default(etcd_address) }}"
2017-10-04 12:27:55 +00:00
etcd_peer_url : "https://{{ etcd_access_address }}:2380"
etcd_client_url : "https://{{ etcd_access_address }}:2379"
2018-08-31 13:03:07 +00:00
etcd_events_peer_url : "https://{{ etcd_events_access_address }}:2382"
etcd_events_client_url : "https://{{ etcd_events_access_address }}:2381"
2017-10-04 12:27:55 +00:00
etcd_access_addresses : |-
2020-10-21 14:32:20 +00:00
{% for item in etcd_hosts -%}
2020-12-02 21:55:00 +00:00
https://{{ hostvars[item]['etcd_access_address'] | default(hostvars[item]['ip'] | default(fallback_ips[item])) }}:2379{% if not loop.last %},{% endif %}
2017-10-04 12:27:55 +00:00
{%- endfor %}
2018-10-16 14:25:03 +00:00
etcd_events_access_addresses_list : |-
[
2020-10-21 14:32:20 +00:00
{% for item in etcd_hosts -%}
2020-12-02 21:55:00 +00:00
'https://{{ hostvars[item][' etcd_events_access_address'] | default(hostvars[item]['ip'] | default(fallback_ips[item])) }}:2381'{% if not loop.last %},{% endif %}
2018-03-01 08:39:14 +00:00
{%- endfor %}
2018-10-16 14:25:03 +00:00
]
etcd_events_access_addresses : "{{etcd_events_access_addresses_list | join(',')}}"
etcd_events_access_addresses_semicolon : "{{etcd_events_access_addresses_list | join(';')}}"
2018-07-03 14:02:44 +00:00
# user should set etcd_member_name in inventory/mycluster/hosts.ini
2017-10-04 12:27:55 +00:00
etcd_member_name : |-
{% for host in groups['etcd'] %}
2018-07-04 16:06:37 +00:00
{% if inventory_hostname == host %}{{ hostvars[host].etcd_member_name | default("etcd" + loop.index|string) }}{% endif %}
2017-10-04 12:27:55 +00:00
{% endfor %}
etcd_peer_addresses : |-
{% for item in groups['etcd'] -%}
2020-12-02 21:55:00 +00:00
{{ hostvars[item].etcd_member_name | default("etcd" + loop.index|string) }}=https://{{ hostvars[item].etcd_access_address | default(hostvars[item].ip | default(fallback_ips[item])) }}:2380{% if not loop.last %},{% endif %}
2017-10-04 12:27:55 +00:00
{%- endfor %}
2018-03-01 08:39:14 +00:00
etcd_events_peer_addresses : |-
{% for item in groups['etcd'] -%}
2020-12-02 21:55:00 +00:00
{{ hostvars[item].etcd_member_name | default("etcd" + loop.index|string) }}-events=https://{{ hostvars[item].etcd_events_access_address | default(hostvars[item].ip | default(fallback_ips[item])) }}:2382{% if not loop.last %},{% endif %}
2018-03-01 08:39:14 +00:00
{%- endfor %}
2018-08-22 16:16:13 +00:00
podsecuritypolicy_enabled : false
2018-08-08 15:25:23 +00:00
etcd_heartbeat_interval : "250"
etcd_election_timeout : "5000"
etcd_snapshot_count : "10000"
2018-10-09 11:43:30 +00:00
certificates_key_size : 2048
certificates_duration : 36500
2018-10-24 05:22:09 +00:00
2018-12-07 07:11:53 +00:00
etcd_config_dir : /etc/ssl/etcd
2020-07-22 06:58:05 +00:00
etcd_events_data_dir : "/var/lib/etcd-events"
2018-12-07 07:11:53 +00:00
etcd_cert_dir : "{{ etcd_config_dir }}/ssl"
2019-04-25 12:00:48 +00:00
typha_enabled : false
2020-03-25 19:58:25 +00:00
_host_architecture_groups :
x86_64 : amd64
aarch64 : arm64
armv7l : arm
host_architecture : >-
{%- if ansible_architecture in _host_architecture_groups -%}
{{ _host_architecture_groups[ansible_architecture] }}
{%- else -%}
{{ ansible_architecture }}
{%- endif -%}
2020-11-03 08:42:15 +00:00
# Sets the eventRecordQPS parameter in kubelet-config.yaml. The default value is 5 (see types.go)
# Setting it to 0 allows unlimited requests per second.
kubelet_event_record_qps : 5
2021-02-16 16:44:58 +00:00
proxy_env :
http_proxy : "{{ http_proxy | default ('') }}"
HTTP_PROXY : "{{ http_proxy | default ('') }}"
https_proxy : "{{ https_proxy | default ('') }}"
HTTPS_PROXY : "{{ https_proxy | default ('') }}"
no_proxy : "{{ no_proxy | default ('') }}"
NO_PROXY : "{{ no_proxy | default ('') }}"
proxy_disable_env :
ALL_PROXY : ''
FTP_PROXY : ''
HTTPS_PROXY : ''
HTTP_PROXY : ''
NO_PROXY : ''
all_proxy : ''
ftp_proxy : ''
http_proxy : ''
https_proxy : ''
no_proxy : ''