Enable weave seed mode for kubespray (#1414)

* Enable weave seed mode for kubespray

* fix task Weave seed | Set peers if existing peers

* fix mac address variabilisation

* fix default values

* fix include seed condition

* change weave var to default values

* fix Set peers if existing peers
This commit is contained in:
timtoum 2017-07-26 18:09:34 +02:00 committed by Matthew Mosesohn
parent ee36763f9d
commit 3e457e4edf
8 changed files with 226 additions and 100 deletions

View file

@ -74,6 +74,22 @@ kube_users:
# Can also be set to 'cloud', which lets the cloud provider setup appropriate routing # Can also be set to 'cloud', which lets the cloud provider setup appropriate routing
kube_network_plugin: calico kube_network_plugin: calico
# weave's network password for encryption
# if null then no network encryption
# you can use --extra-vars to pass the password in command line
weave_password: EnterPasswordHere
# Weave uses consensus mode by default
# Enabling seed mode allow to dynamically add or remove hosts
# https://www.weave.works/docs/net/latest/ipam/
weave_mode_seed: false
# This two variable are automatically changed by the weave's role, do not manually change these values
# To reset values :
# weave_seed: uninitialized
# weave_peers: uninitialized
weave_seed: uninitialized
weave_peers: uninitialized
# Enable kubernetes network policies # Enable kubernetes network policies
enable_network_policy: false enable_network_policy: false
@ -136,8 +152,3 @@ efk_enabled: false
# Helm deployment # Helm deployment
helm_enabled: false helm_enabled: false
# dnsmasq
# dnsmasq_upstream_dns_servers:
# - /resolvethiszone.with/10.0.4.250
# - 8.8.8.8

View file

@ -28,4 +28,4 @@
# [k8s-cluster:children] # [k8s-cluster:children]
# kube-node # kube-node
# kube-master # kube-master

View file

@ -25,7 +25,7 @@ etcd_version: v3.0.17
calico_version: "v1.1.3" calico_version: "v1.1.3"
calico_cni_version: "v1.7.0" calico_cni_version: "v1.7.0"
calico_policy_version: "v0.5.4" calico_policy_version: "v0.5.4"
weave_version: 1.8.2 weave_version: 2.0.1
flannel_version: v0.6.2 flannel_version: v0.6.2
pod_infra_version: 3.0 pod_infra_version: 3.0

View file

@ -4,3 +4,13 @@ weave_memory_limit: 400M
weave_cpu_limit: 30m weave_cpu_limit: 30m
weave_memory_requests: 64M weave_memory_requests: 64M
weave_cpu_requests: 10m weave_cpu_requests: 10m
# This two variable are automatically changed by the weave's role, do not manually change these values
# To reset values :
# weave_seed: unset
# weave_peers: unset
weave_seed: uninitialized
weave_peers: uninitialized
# this variable is use in seed mode
weave_ip_current_cluster: "{% for host in groups['k8s-cluster'] %}{{ hostvars[host]['ip'] | default(hostvars[host]['ansible_default_ipv4']['address']) }}{% if not loop.last %} {% endif %}{% endfor %}"

View file

@ -1,6 +1,9 @@
--- ---
- include: pre-upgrade.yml - include: pre-upgrade.yml
- include: seed.yml
when: weave_mode_seed
- name: Weave | enable br_netfilter module - name: Weave | enable br_netfilter module
modprobe: modprobe:
name: br_netfilter name: br_netfilter

View file

@ -0,0 +1,50 @@
---
- name: Weave seed | Set seed if first time
set_fact:
seed: '{% for host in groups["k8s-cluster"] %}{{ hostvars[host]["ansible_default_ipv4"]["macaddress"] }}{% if not loop.last %},{% endif %}{% endfor %}'
when: "weave_seed == 'uninitialized'"
run_once: true
tags: confweave
- name: Weave seed | Set seed if not first time
set_fact:
seed: '{{ weave_seed }}'
when: "weave_seed != 'uninitialized'"
run_once: true
tags: confweave
- name: Weave seed | Set peers if fist time
set_fact:
peers: '{{ weave_ip_current_cluster }}'
when: "weave_peers == 'uninitialized'"
run_once: true
tags: confweave
- name: Weave seed | Set peers if existing peers
set_fact:
peers: '{{ weave_peers }}{% for ip in weave_ip_current_cluster.split(" ") %}{% if ip not in weave_peers.split(" ") %} {{ ip }}{% endif %}{% endfor %}'
when: "weave_peers != 'uninitialized'"
run_once: true
tags: confweave
- name: Weave seed | Save seed
lineinfile:
dest: "./inventory/group_vars/k8s-cluster.yml"
state: present
regexp: '^weave_seed:'
line: 'weave_seed: {{ seed }}'
become: no
delegate_to: 127.0.0.1
run_once: true
tags: confweave
- name: Weave seed | Save peers
lineinfile:
dest: "./inventory/group_vars/k8s-cluster.yml"
state: present
regexp: '^weave_peers:'
line: 'weave_peers: {{ peers }}'
become: no
delegate_to: 127.0.0.1
run_once: true
tags: confweave

View file

@ -1,104 +1,156 @@
--- ---
apiVersion: extensions/v1beta1 apiVersion: v1
kind: DaemonSet kind: List
metadata: items:
name: weave-net - apiVersion: v1
namespace: {{ system_namespace }} kind: ServiceAccount
labels:
version: {{ weave_version }}
spec:
template:
metadata: metadata:
name: weave-net
labels: labels:
name: weave-net name: weave-net
annotations: namespace: {{ system_namespace }}
scheduler.alpha.kubernetes.io/tolerations: | - apiVersion: rbac.authorization.k8s.io/v1beta1
[ kind: ClusterRole
{ metadata:
"key": "dedicated", name: weave-net
"operator": "Equal", labels:
"value": "master", name: weave-net
"effect": "NoSchedule" rules:
} - apiGroups:
] - ''
resources:
- pods
- namespaces
- nodes
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- networkpolicies
verbs:
- get
- list
- watch
- apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: weave-net
labels:
name: weave-net
roleRef:
kind: ClusterRole
name: weave-net
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: weave-net
namespace: kube-system
- apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
name: weave-net
labels:
name: weave-net
version: {{ weave_version }}
namespace: {{ system_namespace }}
spec: spec:
hostNetwork: true template:
hostPID: true metadata:
containers: labels:
- name: weave name: weave-net
image: {{ weave_kube_image_repo }}:{{ weave_kube_image_tag }} spec:
imagePullPolicy: Always containers:
command: - name: weave
- /home/weave/launch.sh command:
env: {% if weave_mode_seed == true %}
- name: IPALLOC_RANGE - /bin/sh
value: {{ kube_pods_subnet }} - -c
{% if weave_checkpoint_disable is defined %} - export EXTRA_ARGS=--name=$(cat /sys/class/net/{{ ansible_default_ipv4['interface'] }}/address) && /home/weave/launch.sh
- name: CHECKPOINT_DISABLE {% else %}
value: {{ weave_checkpoint_disable }} - /home/weave/launch.sh
{% endif %} {% endif %}
{% if weave_expect_npc is defined %} env:
- name: EXPECT_NPC - name: HOSTNAME
value: {{ weave_expect_npc }} valueFrom:
fieldRef:
apiVersion: v1
fieldPath: spec.nodeName
- name: IPALLOC_RANGE
value: {{ kube_pods_subnet }}
{% if weave_mode_seed == true %}
- name: KUBE_PEERS
value: {{ peers }}
- name: IPALLOC_INIT
value: seed={{ seed }}
{% endif %} {% endif %}
{% if weave_kube_peers is defined %} - name: WEAVE_PASSWORD
- name: KUBE_PEERS value: {{ weave_password }}
value: {{ weave_kube_peers }} image: {{ weave_kube_image_repo }}:{{ weave_kube_image_tag }}
{% endif %} imagePullPolicy: Always
{% if weave_ipalloc_init is defined %} livenessProbe:
- name: IPALLOC_INIT httpGet:
value: {{ weave_ipalloc_init }} host: 127.0.0.1
{% endif %} path: /status
{% if weave_expose_ip is defined %} port: 6784
- name: WEAVE_EXPOSE_IP initialDelaySeconds: 30
value: {{ weave_expose_ip }} resources:
{% endif %} requests:
livenessProbe: cpu: 10m
initialDelaySeconds: 60 securityContext:
httpGet: privileged: true
host: 127.0.0.1 volumeMounts:
path: /status - name: weavedb
port: 6784 mountPath: /weavedb
- name: cni-bin
mountPath: /host/opt
- name: cni-bin2
mountPath: /host/home
- name: cni-conf
mountPath: /host/etc
- name: dbus
mountPath: /host/var/lib/dbus
- name: lib-modules
mountPath: /lib/modules
- name: weave-npc
image: {{ weave_npc_image_repo }}:{{ weave_npc_image_tag }}
imagePullPolicy: Always
resources:
requests:
cpu: {{ weave_cpu_requests }}
memory: {{ weave_memory_requests }}
limits:
cpu: {{ weave_cpu_limit }}
memory: {{ weave_memory_limit }}
securityContext:
privileged: true
hostNetwork: true
hostPID: true
restartPolicy: Always
securityContext: securityContext:
privileged: true seLinuxOptions: {}
volumeMounts: serviceAccountName: weave-net
tolerations:
- effect: NoSchedule
operator: Exists
volumes:
- name: weavedb - name: weavedb
mountPath: /weavedb hostPath:
path: /var/lib/weave
- name: cni-bin - name: cni-bin
mountPath: /opt hostPath:
path: /opt
- name: cni-bin2 - name: cni-bin2
mountPath: /host_home hostPath:
path: /home
- name: cni-conf - name: cni-conf
mountPath: /etc hostPath:
resources: path: /etc
requests: - name: dbus
cpu: {{ weave_cpu_requests }} hostPath:
memory: {{ weave_memory_requests }} path: /var/lib/dbus
limits: - name: lib-modules
cpu: {{ weave_cpu_limit }} hostPath:
memory: {{ weave_memory_limit }} path: /lib/modules
- name: weave-npc
image: {{ weave_npc_image_repo }}:{{ weave_npc_image_tag }}
imagePullPolicy: Always
resources:
requests:
cpu: {{ weave_cpu_requests }}
memory: {{ weave_memory_requests }}
limits:
cpu: {{ weave_cpu_limit }}
memory: {{ weave_memory_limit }}
securityContext:
privileged: true
restartPolicy: Always
volumes:
- name: weavedb
emptyDir: {}
- name: cni-bin
hostPath:
path: /opt
- name: cni-bin2
hostPath:
path: /home
- name: cni-conf
hostPath:
path: /etc

View file

@ -5,7 +5,7 @@ local_release_dir: /tmp
etcd_version: v3.0.17 etcd_version: v3.0.17
calico_version: v0.23.0 calico_version: v0.23.0
calico_cni_version: v1.5.6 calico_cni_version: v1.5.6
weave_version: v1.8.2 weave_version: v2.0.1
# Download URL's # Download URL's
etcd_download_url: "https://github.com/coreos/etcd/releases/download/{{ etcd_version }}/etcd-{{ etcd_version }}-linux-amd64.tar.gz" etcd_download_url: "https://github.com/coreos/etcd/releases/download/{{ etcd_version }}/etcd-{{ etcd_version }}-linux-amd64.tar.gz"