From 8b270f8e2b4b5ef2383fe6acce035865c1397372 Mon Sep 17 00:00:00 2001 From: Maciej Filipiak Date: Fri, 18 Nov 2016 13:56:55 +0100 Subject: [PATCH] Add service-node-port-range parameter for kube-apiserver --- roles/kubernetes/master/defaults/main.yml | 4 ++++ .../master/templates/manifests/kube-apiserver.manifest.j2 | 1 + 2 files changed, 5 insertions(+) diff --git a/roles/kubernetes/master/defaults/main.yml b/roles/kubernetes/master/defaults/main.yml index 269ed3714..c33fa788f 100644 --- a/roles/kubernetes/master/defaults/main.yml +++ b/roles/kubernetes/master/defaults/main.yml @@ -26,6 +26,10 @@ kube_config_dir: /etc/kubernetes # change to 0.0.0.0 to enable insecure access from anywhere (not recommended) kube_apiserver_insecure_bind_address: 127.0.0.1 +# A port range to reserve for services with NodePort visibility. +# Inclusive at both ends of the range. +kube_apiserver_node_port_range: "30000-32767" + # Logging directory (sysvinit systems) kube_log_dir: "/var/log/kubernetes" diff --git a/roles/kubernetes/master/templates/manifests/kube-apiserver.manifest.j2 b/roles/kubernetes/master/templates/manifests/kube-apiserver.manifest.j2 index 97e71716a..a52d2d7ab 100644 --- a/roles/kubernetes/master/templates/manifests/kube-apiserver.manifest.j2 +++ b/roles/kubernetes/master/templates/manifests/kube-apiserver.manifest.j2 @@ -23,6 +23,7 @@ spec: - --apiserver-count={{ kube_apiserver_count }} - --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota - --service-cluster-ip-range={{ kube_service_addresses }} + - --service-node-port-range={{ kube_apiserver_node_port_range }} - --client-ca-file={{ kube_cert_dir }}/ca.pem - --basic-auth-file={{ kube_users_dir }}/known_users.csv - --tls-cert-file={{ kube_cert_dir }}/apiserver.pem