c12s-kubespray/roles/kubernetes-apps/policy_controller/calico/tasks/main.yml

---
- set_fact:
    calico_cert_dir: "{{ canal_cert_dir }}"
  when: kube_network_plugin == 'canal'
  tags: [facts, canal]

- name: Write calico-policy-controller yaml
  template:
    src: calico-policy-controller.yml.j2
    dest: "{{kube_config_dir}}/calico-policy-controller.yml"
  when: inventory_hostname == groups['kube-master'][0]
  tags: canal

- name: Start of Calico policy controller
  kube:
    name: "calico-policy-controller"
    kubectl: "{{bin_dir}}/kubectl"
    filename: "{{kube_config_dir}}/calico-policy-controller.yml"
    namespace: "{{system_namespace}}"
    resource: "rs"
  when: inventory_hostname == groups['kube-master'][0]
  tags: canal
Adding yamllinter to ci steps (#1556) * Adding yaml linter to ci check * Minor linting fixes from yamllint * Changing CI to install python pkgs from requirements.txt - adding in a secondary requirements.txt for tests - moving yamllint to tests requirements 2017-08-24 09:09:52 +00:00			`---`
Fix cert paths for flannel/calico policy apps Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru> 2016-12-30 12:47:12 +00:00			`- set_fact:`
			`calico_cert_dir: "{{ canal_cert_dir }}"`
			`when: kube_network_plugin == 'canal'`
Move calico-policy-controller into separate role By default Calico CNI does not create any network access policies or profiles if 'policy' is enabled in CNI config. And without any policies/profiles network access to/from PODs is blocked. K8s related policies are created by calico-policy-controller in such case. So we need to start it as soon as possible, before any real workloads. This patch also fixes kube-api port in calico-policy-controller yaml template. Closes #1132 2017-03-13 15:04:31 +00:00			`tags: [facts, canal]`
Fix cert paths for flannel/calico policy apps Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru> 2016-12-30 12:47:12 +00:00
Add possibility to enable network policy via Calico network controller The requirements for network policy feature are described here [1]. In order to enable it, appropriate configuration must be provided to the CNI plug in and Calico policy controller must be set up. Beside that corresponding extensions needed to be enabled in k8s API. Now to turn on the feature user can define `enable_network_policy` customization variable for Ansible. [1] http://kubernetes.io/docs/user-guide/networkpolicies/ 2016-10-10 14:09:50 +00:00			`- name: Write calico-policy-controller yaml`
Cleanup legacy syntax, spacing, files all to yml Migrate older inline= syntax to pure yml syntax for module args as to be consistant with most of the rest of the tasks Cleanup some spacing in various files Rename some files named yaml to yml for consistancy 2017-02-17 21:22:34 +00:00			`template:`
			`src: calico-policy-controller.yml.j2`
			`dest: "{{kube_config_dir}}/calico-policy-controller.yml"`
Add possibility to enable network policy via Calico network controller The requirements for network policy feature are described here [1]. In order to enable it, appropriate configuration must be provided to the CNI plug in and Calico policy controller must be set up. Beside that corresponding extensions needed to be enabled in k8s API. Now to turn on the feature user can define `enable_network_policy` customization variable for Ansible. [1] http://kubernetes.io/docs/user-guide/networkpolicies/ 2016-10-10 14:09:50 +00:00			`when: inventory_hostname == groups['kube-master'][0]`
Move calico-policy-controller into separate role By default Calico CNI does not create any network access policies or profiles if 'policy' is enabled in CNI config. And without any policies/profiles network access to/from PODs is blocked. K8s related policies are created by calico-policy-controller in such case. So we need to start it as soon as possible, before any real workloads. This patch also fixes kube-api port in calico-policy-controller yaml template. Closes #1132 2017-03-13 15:04:31 +00:00			`tags: canal`
Add possibility to enable network policy via Calico network controller The requirements for network policy feature are described here [1]. In order to enable it, appropriate configuration must be provided to the CNI plug in and Calico policy controller must be set up. Beside that corresponding extensions needed to be enabled in k8s API. Now to turn on the feature user can define `enable_network_policy` customization variable for Ansible. [1] http://kubernetes.io/docs/user-guide/networkpolicies/ 2016-10-10 14:09:50 +00:00
			`- name: Start of Calico policy controller`
			`kube:`
Fix idempotency of calico-policy-controller rs We need to specify kube resource type and name in order to avoid playbook errors related to k8s resource duplication. 2016-11-08 11:20:55 +00:00			`name: "calico-policy-controller"`
Add possibility to enable network policy via Calico network controller The requirements for network policy feature are described here [1]. In order to enable it, appropriate configuration must be provided to the CNI plug in and Calico policy controller must be set up. Beside that corresponding extensions needed to be enabled in k8s API. Now to turn on the feature user can define `enable_network_policy` customization variable for Ansible. [1] http://kubernetes.io/docs/user-guide/networkpolicies/ 2016-10-10 14:09:50 +00:00			`kubectl: "{{bin_dir}}/kubectl"`
Add advanced net check for DNS K8s app * Add an option to deploy K8s app to test e2e network connectivity and cluster DNS resolve via Kubedns for nethost/simple pods (defaults to false). * Parametrize existing k8s apps templates with kube_namespace and kube_config_dir instead of hardcode. * For CoreOS, ensure nameservers from inventory to be put in the first place to allow hostnet pods connectivity via short names or FQDN and hostnet agents to pass as well, if netchecker deployed. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> 2016-09-30 15:23:47 +00:00			`filename: "{{kube_config_dir}}/calico-policy-controller.yml"`
Address standalone kubelet config case Also place in global vars and do not repeat the kube_*_config_dir and kube_namespace vars for better code maintainability and UX. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> 2016-12-13 10:43:06 +00:00			`namespace: "{{system_namespace}}"`
Fix idempotency of calico-policy-controller rs We need to specify kube resource type and name in order to avoid playbook errors related to k8s resource duplication. 2016-11-08 11:20:55 +00:00			`resource: "rs"`
Add possibility to enable network policy via Calico network controller The requirements for network policy feature are described here [1]. In order to enable it, appropriate configuration must be provided to the CNI plug in and Calico policy controller must be set up. Beside that corresponding extensions needed to be enabled in k8s API. Now to turn on the feature user can define `enable_network_policy` customization variable for Ansible. [1] http://kubernetes.io/docs/user-guide/networkpolicies/ 2016-10-10 14:09:50 +00:00			`when: inventory_hostname == groups['kube-master'][0]`
Move calico-policy-controller into separate role By default Calico CNI does not create any network access policies or profiles if 'policy' is enabled in CNI config. And without any policies/profiles network access to/from PODs is blocked. K8s related policies are created by calico-policy-controller in such case. So we need to start it as soon as possible, before any real workloads. This patch also fixes kube-api port in calico-policy-controller yaml template. Closes #1132 2017-03-13 15:04:31 +00:00			`tags: canal`