c12s-kubespray/roles/kubernetes-apps/ansible/tasks/calico-policy-controller.yml

---
- set_fact:
    calico_cert_dir: "{{ canal_cert_dir }}"
  when: kube_network_plugin == 'canal'
  tags: facts

- name: Write calico-policy-controller yaml
  template: src=calico-policy-controller.yml.j2 dest={{kube_config_dir}}/calico-policy-controller.yml
  when: inventory_hostname == groups['kube-master'][0]

- name: Start of Calico policy controller
  kube:
    name: "calico-policy-controller"
    kubectl: "{{bin_dir}}/kubectl"
    filename: "{{kube_config_dir}}/calico-policy-controller.yml"
    namespace: "{{system_namespace}}"
    resource: "rs"
  when: inventory_hostname == groups['kube-master'][0]
Fix cert paths for flannel/calico policy apps Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru> 2016-12-30 12:47:12 +00:00			`---`
			`- set_fact:`
			`calico_cert_dir: "{{ canal_cert_dir }}"`
			`when: kube_network_plugin == 'canal'`
			`tags: facts`

Add possibility to enable network policy via Calico network controller The requirements for network policy feature are described here [1]. In order to enable it, appropriate configuration must be provided to the CNI plug in and Calico policy controller must be set up. Beside that corresponding extensions needed to be enabled in k8s API. Now to turn on the feature user can define `enable_network_policy` customization variable for Ansible. [1] http://kubernetes.io/docs/user-guide/networkpolicies/ 2016-10-10 14:09:50 +00:00			`- name: Write calico-policy-controller yaml`
Add advanced net check for DNS K8s app * Add an option to deploy K8s app to test e2e network connectivity and cluster DNS resolve via Kubedns for nethost/simple pods (defaults to false). * Parametrize existing k8s apps templates with kube_namespace and kube_config_dir instead of hardcode. * For CoreOS, ensure nameservers from inventory to be put in the first place to allow hostnet pods connectivity via short names or FQDN and hostnet agents to pass as well, if netchecker deployed. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> 2016-09-30 15:23:47 +00:00			`template: src=calico-policy-controller.yml.j2 dest={{kube_config_dir}}/calico-policy-controller.yml`
Add possibility to enable network policy via Calico network controller The requirements for network policy feature are described here [1]. In order to enable it, appropriate configuration must be provided to the CNI plug in and Calico policy controller must be set up. Beside that corresponding extensions needed to be enabled in k8s API. Now to turn on the feature user can define `enable_network_policy` customization variable for Ansible. [1] http://kubernetes.io/docs/user-guide/networkpolicies/ 2016-10-10 14:09:50 +00:00			`when: inventory_hostname == groups['kube-master'][0]`

			`- name: Start of Calico policy controller`
			`kube:`
Fix idempotency of calico-policy-controller rs We need to specify kube resource type and name in order to avoid playbook errors related to k8s resource duplication. 2016-11-08 11:20:55 +00:00			`name: "calico-policy-controller"`
Add possibility to enable network policy via Calico network controller The requirements for network policy feature are described here [1]. In order to enable it, appropriate configuration must be provided to the CNI plug in and Calico policy controller must be set up. Beside that corresponding extensions needed to be enabled in k8s API. Now to turn on the feature user can define `enable_network_policy` customization variable for Ansible. [1] http://kubernetes.io/docs/user-guide/networkpolicies/ 2016-10-10 14:09:50 +00:00			`kubectl: "{{bin_dir}}/kubectl"`
Add advanced net check for DNS K8s app * Add an option to deploy K8s app to test e2e network connectivity and cluster DNS resolve via Kubedns for nethost/simple pods (defaults to false). * Parametrize existing k8s apps templates with kube_namespace and kube_config_dir instead of hardcode. * For CoreOS, ensure nameservers from inventory to be put in the first place to allow hostnet pods connectivity via short names or FQDN and hostnet agents to pass as well, if netchecker deployed. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> 2016-09-30 15:23:47 +00:00			`filename: "{{kube_config_dir}}/calico-policy-controller.yml"`
Address standalone kubelet config case Also place in global vars and do not repeat the kube_*_config_dir and kube_namespace vars for better code maintainability and UX. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> 2016-12-13 10:43:06 +00:00			`namespace: "{{system_namespace}}"`
Fix idempotency of calico-policy-controller rs We need to specify kube resource type and name in order to avoid playbook errors related to k8s resource duplication. 2016-11-08 11:20:55 +00:00			`resource: "rs"`
Add possibility to enable network policy via Calico network controller The requirements for network policy feature are described here [1]. In order to enable it, appropriate configuration must be provided to the CNI plug in and Calico policy controller must be set up. Beside that corresponding extensions needed to be enabled in k8s API. Now to turn on the feature user can define `enable_network_policy` customization variable for Ansible. [1] http://kubernetes.io/docs/user-guide/networkpolicies/ 2016-10-10 14:09:50 +00:00			`when: inventory_hostname == groups['kube-master'][0]`