c12s-kubespray/roles/kubernetes/node/tasks/main.yml

---
- set_fact:
    standalone_kubelet: >-
      {%- if inventory_hostname in groups['kube-master'] and inventory_hostname not in groups['kube-node'] -%}true{%- else -%}false{%- endif -%}
  tags: facts

- include: pre-upgrade.yml
  tags: k8s-pre-upgrade

- include: install.yml
  tags: kubelet

- include: nginx-proxy.yml
  when: is_kube_master == false and loadbalancer_apiserver_localhost|default(false)
  tags: nginx

- name: Write kubelet config file
  template: src=kubelet.j2 dest={{ kube_config_dir }}/kubelet.env backup=yes
  notify: restart kubelet
  tags: kubelet

- name: write the kubecfg (auth) file for kubelet
  template: src=node-kubeconfig.yaml.j2 dest={{ kube_config_dir }}/node-kubeconfig.yaml backup=yes
  notify: restart kubelet
  tags: kubelet

- name: Write proxy manifest
  template:
    src: manifests/kube-proxy.manifest.j2
    dest: "{{ kube_manifest_dir }}/kube-proxy.manifest"
  tags: kube-proxy

# reload-systemd
- meta: flush_handlers

- name: Enable kubelet
  service:
    name: kubelet
    enabled: yes
    state: started
  tags: kubelet
Initial commit 2015-10-03 20:19:50 +00:00			`---`
Address standalone kubelet config case Also place in global vars and do not repeat the kube_*_config_dir and kube_namespace vars for better code maintainability and UX. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> 2016-12-13 10:43:06 +00:00			`- set_fact:`
			`standalone_kubelet: >-`
			`{%- if inventory_hostname in groups['kube-master'] and inventory_hostname not in groups['kube-node'] -%}true{%- else -%}false{%- endif -%}`
			`tags: facts`

Drop linux capabilities and rework users/groups * Drop linux capabilities for unprivileged containerized worlkoads Kargo configures for deployments. * Configure required securityContext/user/group/groups for kube components' static manifests, etcd, calico-rr and k8s apps, like dnsmasq daemonset. * Rework cloud-init (etcd) users creation for CoreOS. * Fix nologin paths, adjust defaults for addusers role and ensure supplementary groups membership added for users. * Add netplug user for network plugins (yet unused by privileged networking containers though). * Grant the kube and netplug users read access for etcd certs via the etcd certs group. * Grant group read access to kube certs via the kube cert group. * Remove priveleged mode for calico-rr and run it under its uid/gid and supplementary etcd_cert group. * Adjust docs. * Align cpu/memory limits and dropped caps with added rkt support for control plane. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru> 2016-12-28 13:58:37 +00:00			`- include: pre-upgrade.yml`
			`tags: k8s-pre-upgrade`

generate secrets on deployment machine test travis with sudo=true instead of required 2016-02-11 22:08:16 +00:00			`- include: install.yml`
Add tags Add tags to allow more granular tasks filtering. Add generator script for MD formatted tags found. Add docs for tags how-to. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> 2016-12-08 13:36:00 +00:00			`tags: kubelet`
generate secrets on deployment machine test travis with sudo=true instead of required 2016-02-11 22:08:16 +00:00
use nginx proxy on non-master nodes to proxy apiserver traffic Also adds all masters by hostname and localhost/127.0.0.1 to apiserver SSL certificate. Includes documentation update on how localhost loadbalancer works. 2016-09-28 11:05:08 +00:00			`- include: nginx-proxy.yml`
			`when: is_kube_master == false and loadbalancer_apiserver_localhost\|default(false)`
Add tags Add tags to allow more granular tasks filtering. Add generator script for MD formatted tags found. Add docs for tags how-to. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> 2016-12-08 13:36:00 +00:00			`tags: nginx`
use nginx proxy on non-master nodes to proxy apiserver traffic Also adds all masters by hostname and localhost/127.0.0.1 to apiserver SSL certificate. Includes documentation update on how localhost loadbalancer works. 2016-09-28 11:05:08 +00:00
Master and nodes will run the 'node' role, kube-proxy is run under a container, new script for ssl certs 2015-12-11 10:32:13 +00:00			`- name: Write kubelet config file`
run apiserver as a service reorder master handlers typo for sysvinit 2016-01-22 13:25:33 +00:00			`template: src=kubelet.j2 dest={{ kube_config_dir }}/kubelet.env backup=yes`
Add tags Add tags to allow more granular tasks filtering. Add generator script for MD formatted tags found. Add docs for tags how-to. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> 2016-12-08 13:36:00 +00:00			`notify: restart kubelet`
			`tags: kubelet`
Master and nodes will run the 'node' role, kube-proxy is run under a container, new script for ssl certs 2015-12-11 10:32:13 +00:00
			`- name: write the kubecfg (auth) file for kubelet`
			`template: src=node-kubeconfig.yaml.j2 dest={{ kube_config_dir }}/node-kubeconfig.yaml backup=yes`
Add tags Add tags to allow more granular tasks filtering. Add generator script for MD formatted tags found. Add docs for tags how-to. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> 2016-12-08 13:36:00 +00:00			`notify: restart kubelet`
			`tags: kubelet`
Master and nodes will run the 'node' role, kube-proxy is run under a container, new script for ssl certs 2015-12-11 10:32:13 +00:00
			`- name: Write proxy manifest`
Fix systemd reload and calico unit 2016-01-25 01:01:25 +00:00			`template:`
Master and nodes will run the 'node' role, kube-proxy is run under a container, new script for ssl certs 2015-12-11 10:32:13 +00:00			`src: manifests/kube-proxy.manifest.j2`
			`dest: "{{ kube_manifest_dir }}/kube-proxy.manifest"`
Add tags Add tags to allow more granular tasks filtering. Add generator script for MD formatted tags found. Add docs for tags how-to. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> 2016-12-08 13:36:00 +00:00			`tags: kube-proxy`
Master and nodes will run the 'node' role, kube-proxy is run under a container, new script for ssl certs 2015-12-11 10:32:13 +00:00
Fix systemd reload and calico unit 2016-01-25 01:01:25 +00:00			`# reload-systemd`
			`- meta: flush_handlers`

Master and nodes will run the 'node' role, kube-proxy is run under a container, new script for ssl certs 2015-12-11 10:32:13 +00:00			`- name: Enable kubelet`
			`service:`
			`name: kubelet`
			`enabled: yes`
			`state: started`
Add tags Add tags to allow more granular tasks filtering. Add generator script for MD formatted tags found. Add docs for tags how-to. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> 2016-12-08 13:36:00 +00:00			`tags: kubelet`