Enable weave seed mode for kubespray (#1414)
* Enable weave seed mode for kubespray * fix task Weave seed | Set peers if existing peers * fix mac address variabilisation * fix default values * fix include seed condition * change weave var to default values * fix Set peers if existing peers
This commit is contained in:
parent
ee36763f9d
commit
3e457e4edf
8 changed files with 226 additions and 100 deletions
|
@ -74,6 +74,22 @@ kube_users:
|
||||||
# Can also be set to 'cloud', which lets the cloud provider setup appropriate routing
|
# Can also be set to 'cloud', which lets the cloud provider setup appropriate routing
|
||||||
kube_network_plugin: calico
|
kube_network_plugin: calico
|
||||||
|
|
||||||
|
# weave's network password for encryption
|
||||||
|
# if null then no network encryption
|
||||||
|
# you can use --extra-vars to pass the password in command line
|
||||||
|
weave_password: EnterPasswordHere
|
||||||
|
|
||||||
|
# Weave uses consensus mode by default
|
||||||
|
# Enabling seed mode allow to dynamically add or remove hosts
|
||||||
|
# https://www.weave.works/docs/net/latest/ipam/
|
||||||
|
weave_mode_seed: false
|
||||||
|
|
||||||
|
# This two variable are automatically changed by the weave's role, do not manually change these values
|
||||||
|
# To reset values :
|
||||||
|
# weave_seed: uninitialized
|
||||||
|
# weave_peers: uninitialized
|
||||||
|
weave_seed: uninitialized
|
||||||
|
weave_peers: uninitialized
|
||||||
|
|
||||||
# Enable kubernetes network policies
|
# Enable kubernetes network policies
|
||||||
enable_network_policy: false
|
enable_network_policy: false
|
||||||
|
@ -136,8 +152,3 @@ efk_enabled: false
|
||||||
|
|
||||||
# Helm deployment
|
# Helm deployment
|
||||||
helm_enabled: false
|
helm_enabled: false
|
||||||
|
|
||||||
# dnsmasq
|
|
||||||
# dnsmasq_upstream_dns_servers:
|
|
||||||
# - /resolvethiszone.with/10.0.4.250
|
|
||||||
# - 8.8.8.8
|
|
||||||
|
|
|
@ -28,4 +28,4 @@
|
||||||
|
|
||||||
# [k8s-cluster:children]
|
# [k8s-cluster:children]
|
||||||
# kube-node
|
# kube-node
|
||||||
# kube-master
|
# kube-master
|
|
@ -25,7 +25,7 @@ etcd_version: v3.0.17
|
||||||
calico_version: "v1.1.3"
|
calico_version: "v1.1.3"
|
||||||
calico_cni_version: "v1.7.0"
|
calico_cni_version: "v1.7.0"
|
||||||
calico_policy_version: "v0.5.4"
|
calico_policy_version: "v0.5.4"
|
||||||
weave_version: 1.8.2
|
weave_version: 2.0.1
|
||||||
flannel_version: v0.6.2
|
flannel_version: v0.6.2
|
||||||
pod_infra_version: 3.0
|
pod_infra_version: 3.0
|
||||||
|
|
||||||
|
|
|
@ -4,3 +4,13 @@ weave_memory_limit: 400M
|
||||||
weave_cpu_limit: 30m
|
weave_cpu_limit: 30m
|
||||||
weave_memory_requests: 64M
|
weave_memory_requests: 64M
|
||||||
weave_cpu_requests: 10m
|
weave_cpu_requests: 10m
|
||||||
|
|
||||||
|
# This two variable are automatically changed by the weave's role, do not manually change these values
|
||||||
|
# To reset values :
|
||||||
|
# weave_seed: unset
|
||||||
|
# weave_peers: unset
|
||||||
|
weave_seed: uninitialized
|
||||||
|
weave_peers: uninitialized
|
||||||
|
|
||||||
|
# this variable is use in seed mode
|
||||||
|
weave_ip_current_cluster: "{% for host in groups['k8s-cluster'] %}{{ hostvars[host]['ip'] | default(hostvars[host]['ansible_default_ipv4']['address']) }}{% if not loop.last %} {% endif %}{% endfor %}"
|
|
@ -1,6 +1,9 @@
|
||||||
---
|
---
|
||||||
- include: pre-upgrade.yml
|
- include: pre-upgrade.yml
|
||||||
|
|
||||||
|
- include: seed.yml
|
||||||
|
when: weave_mode_seed
|
||||||
|
|
||||||
- name: Weave | enable br_netfilter module
|
- name: Weave | enable br_netfilter module
|
||||||
modprobe:
|
modprobe:
|
||||||
name: br_netfilter
|
name: br_netfilter
|
||||||
|
|
50
roles/network_plugin/weave/tasks/seed.yml
Normal file
50
roles/network_plugin/weave/tasks/seed.yml
Normal file
|
@ -0,0 +1,50 @@
|
||||||
|
---
|
||||||
|
- name: Weave seed | Set seed if first time
|
||||||
|
set_fact:
|
||||||
|
seed: '{% for host in groups["k8s-cluster"] %}{{ hostvars[host]["ansible_default_ipv4"]["macaddress"] }}{% if not loop.last %},{% endif %}{% endfor %}'
|
||||||
|
when: "weave_seed == 'uninitialized'"
|
||||||
|
run_once: true
|
||||||
|
tags: confweave
|
||||||
|
|
||||||
|
- name: Weave seed | Set seed if not first time
|
||||||
|
set_fact:
|
||||||
|
seed: '{{ weave_seed }}'
|
||||||
|
when: "weave_seed != 'uninitialized'"
|
||||||
|
run_once: true
|
||||||
|
tags: confweave
|
||||||
|
|
||||||
|
- name: Weave seed | Set peers if fist time
|
||||||
|
set_fact:
|
||||||
|
peers: '{{ weave_ip_current_cluster }}'
|
||||||
|
when: "weave_peers == 'uninitialized'"
|
||||||
|
run_once: true
|
||||||
|
tags: confweave
|
||||||
|
|
||||||
|
- name: Weave seed | Set peers if existing peers
|
||||||
|
set_fact:
|
||||||
|
peers: '{{ weave_peers }}{% for ip in weave_ip_current_cluster.split(" ") %}{% if ip not in weave_peers.split(" ") %} {{ ip }}{% endif %}{% endfor %}'
|
||||||
|
when: "weave_peers != 'uninitialized'"
|
||||||
|
run_once: true
|
||||||
|
tags: confweave
|
||||||
|
|
||||||
|
- name: Weave seed | Save seed
|
||||||
|
lineinfile:
|
||||||
|
dest: "./inventory/group_vars/k8s-cluster.yml"
|
||||||
|
state: present
|
||||||
|
regexp: '^weave_seed:'
|
||||||
|
line: 'weave_seed: {{ seed }}'
|
||||||
|
become: no
|
||||||
|
delegate_to: 127.0.0.1
|
||||||
|
run_once: true
|
||||||
|
tags: confweave
|
||||||
|
|
||||||
|
- name: Weave seed | Save peers
|
||||||
|
lineinfile:
|
||||||
|
dest: "./inventory/group_vars/k8s-cluster.yml"
|
||||||
|
state: present
|
||||||
|
regexp: '^weave_peers:'
|
||||||
|
line: 'weave_peers: {{ peers }}'
|
||||||
|
become: no
|
||||||
|
delegate_to: 127.0.0.1
|
||||||
|
run_once: true
|
||||||
|
tags: confweave
|
|
@ -1,104 +1,156 @@
|
||||||
---
|
---
|
||||||
apiVersion: extensions/v1beta1
|
apiVersion: v1
|
||||||
kind: DaemonSet
|
kind: List
|
||||||
metadata:
|
items:
|
||||||
name: weave-net
|
- apiVersion: v1
|
||||||
namespace: {{ system_namespace }}
|
kind: ServiceAccount
|
||||||
labels:
|
|
||||||
version: {{ weave_version }}
|
|
||||||
spec:
|
|
||||||
template:
|
|
||||||
metadata:
|
metadata:
|
||||||
|
name: weave-net
|
||||||
labels:
|
labels:
|
||||||
name: weave-net
|
name: weave-net
|
||||||
annotations:
|
namespace: {{ system_namespace }}
|
||||||
scheduler.alpha.kubernetes.io/tolerations: |
|
- apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
[
|
kind: ClusterRole
|
||||||
{
|
metadata:
|
||||||
"key": "dedicated",
|
name: weave-net
|
||||||
"operator": "Equal",
|
labels:
|
||||||
"value": "master",
|
name: weave-net
|
||||||
"effect": "NoSchedule"
|
rules:
|
||||||
}
|
- apiGroups:
|
||||||
]
|
- ''
|
||||||
|
resources:
|
||||||
|
- pods
|
||||||
|
- namespaces
|
||||||
|
- nodes
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- extensions
|
||||||
|
resources:
|
||||||
|
- networkpolicies
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: weave-net
|
||||||
|
labels:
|
||||||
|
name: weave-net
|
||||||
|
roleRef:
|
||||||
|
kind: ClusterRole
|
||||||
|
name: weave-net
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: weave-net
|
||||||
|
namespace: kube-system
|
||||||
|
- apiVersion: extensions/v1beta1
|
||||||
|
kind: DaemonSet
|
||||||
|
metadata:
|
||||||
|
name: weave-net
|
||||||
|
labels:
|
||||||
|
name: weave-net
|
||||||
|
version: {{ weave_version }}
|
||||||
|
namespace: {{ system_namespace }}
|
||||||
spec:
|
spec:
|
||||||
hostNetwork: true
|
template:
|
||||||
hostPID: true
|
metadata:
|
||||||
containers:
|
labels:
|
||||||
- name: weave
|
name: weave-net
|
||||||
image: {{ weave_kube_image_repo }}:{{ weave_kube_image_tag }}
|
spec:
|
||||||
imagePullPolicy: Always
|
containers:
|
||||||
command:
|
- name: weave
|
||||||
- /home/weave/launch.sh
|
command:
|
||||||
env:
|
{% if weave_mode_seed == true %}
|
||||||
- name: IPALLOC_RANGE
|
- /bin/sh
|
||||||
value: {{ kube_pods_subnet }}
|
- -c
|
||||||
{% if weave_checkpoint_disable is defined %}
|
- export EXTRA_ARGS=--name=$(cat /sys/class/net/{{ ansible_default_ipv4['interface'] }}/address) && /home/weave/launch.sh
|
||||||
- name: CHECKPOINT_DISABLE
|
{% else %}
|
||||||
value: {{ weave_checkpoint_disable }}
|
- /home/weave/launch.sh
|
||||||
{% endif %}
|
{% endif %}
|
||||||
{% if weave_expect_npc is defined %}
|
env:
|
||||||
- name: EXPECT_NPC
|
- name: HOSTNAME
|
||||||
value: {{ weave_expect_npc }}
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
apiVersion: v1
|
||||||
|
fieldPath: spec.nodeName
|
||||||
|
- name: IPALLOC_RANGE
|
||||||
|
value: {{ kube_pods_subnet }}
|
||||||
|
{% if weave_mode_seed == true %}
|
||||||
|
- name: KUBE_PEERS
|
||||||
|
value: {{ peers }}
|
||||||
|
- name: IPALLOC_INIT
|
||||||
|
value: seed={{ seed }}
|
||||||
{% endif %}
|
{% endif %}
|
||||||
{% if weave_kube_peers is defined %}
|
- name: WEAVE_PASSWORD
|
||||||
- name: KUBE_PEERS
|
value: {{ weave_password }}
|
||||||
value: {{ weave_kube_peers }}
|
image: {{ weave_kube_image_repo }}:{{ weave_kube_image_tag }}
|
||||||
{% endif %}
|
imagePullPolicy: Always
|
||||||
{% if weave_ipalloc_init is defined %}
|
livenessProbe:
|
||||||
- name: IPALLOC_INIT
|
httpGet:
|
||||||
value: {{ weave_ipalloc_init }}
|
host: 127.0.0.1
|
||||||
{% endif %}
|
path: /status
|
||||||
{% if weave_expose_ip is defined %}
|
port: 6784
|
||||||
- name: WEAVE_EXPOSE_IP
|
initialDelaySeconds: 30
|
||||||
value: {{ weave_expose_ip }}
|
resources:
|
||||||
{% endif %}
|
requests:
|
||||||
livenessProbe:
|
cpu: 10m
|
||||||
initialDelaySeconds: 60
|
securityContext:
|
||||||
httpGet:
|
privileged: true
|
||||||
host: 127.0.0.1
|
volumeMounts:
|
||||||
path: /status
|
- name: weavedb
|
||||||
port: 6784
|
mountPath: /weavedb
|
||||||
|
- name: cni-bin
|
||||||
|
mountPath: /host/opt
|
||||||
|
- name: cni-bin2
|
||||||
|
mountPath: /host/home
|
||||||
|
- name: cni-conf
|
||||||
|
mountPath: /host/etc
|
||||||
|
- name: dbus
|
||||||
|
mountPath: /host/var/lib/dbus
|
||||||
|
- name: lib-modules
|
||||||
|
mountPath: /lib/modules
|
||||||
|
- name: weave-npc
|
||||||
|
image: {{ weave_npc_image_repo }}:{{ weave_npc_image_tag }}
|
||||||
|
imagePullPolicy: Always
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: {{ weave_cpu_requests }}
|
||||||
|
memory: {{ weave_memory_requests }}
|
||||||
|
limits:
|
||||||
|
cpu: {{ weave_cpu_limit }}
|
||||||
|
memory: {{ weave_memory_limit }}
|
||||||
|
securityContext:
|
||||||
|
privileged: true
|
||||||
|
hostNetwork: true
|
||||||
|
hostPID: true
|
||||||
|
restartPolicy: Always
|
||||||
securityContext:
|
securityContext:
|
||||||
privileged: true
|
seLinuxOptions: {}
|
||||||
volumeMounts:
|
serviceAccountName: weave-net
|
||||||
|
tolerations:
|
||||||
|
- effect: NoSchedule
|
||||||
|
operator: Exists
|
||||||
|
volumes:
|
||||||
- name: weavedb
|
- name: weavedb
|
||||||
mountPath: /weavedb
|
hostPath:
|
||||||
|
path: /var/lib/weave
|
||||||
- name: cni-bin
|
- name: cni-bin
|
||||||
mountPath: /opt
|
hostPath:
|
||||||
|
path: /opt
|
||||||
- name: cni-bin2
|
- name: cni-bin2
|
||||||
mountPath: /host_home
|
hostPath:
|
||||||
|
path: /home
|
||||||
- name: cni-conf
|
- name: cni-conf
|
||||||
mountPath: /etc
|
hostPath:
|
||||||
resources:
|
path: /etc
|
||||||
requests:
|
- name: dbus
|
||||||
cpu: {{ weave_cpu_requests }}
|
hostPath:
|
||||||
memory: {{ weave_memory_requests }}
|
path: /var/lib/dbus
|
||||||
limits:
|
- name: lib-modules
|
||||||
cpu: {{ weave_cpu_limit }}
|
hostPath:
|
||||||
memory: {{ weave_memory_limit }}
|
path: /lib/modules
|
||||||
- name: weave-npc
|
|
||||||
image: {{ weave_npc_image_repo }}:{{ weave_npc_image_tag }}
|
|
||||||
imagePullPolicy: Always
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
cpu: {{ weave_cpu_requests }}
|
|
||||||
memory: {{ weave_memory_requests }}
|
|
||||||
limits:
|
|
||||||
cpu: {{ weave_cpu_limit }}
|
|
||||||
memory: {{ weave_memory_limit }}
|
|
||||||
securityContext:
|
|
||||||
privileged: true
|
|
||||||
restartPolicy: Always
|
|
||||||
volumes:
|
|
||||||
- name: weavedb
|
|
||||||
emptyDir: {}
|
|
||||||
- name: cni-bin
|
|
||||||
hostPath:
|
|
||||||
path: /opt
|
|
||||||
- name: cni-bin2
|
|
||||||
hostPath:
|
|
||||||
path: /home
|
|
||||||
- name: cni-conf
|
|
||||||
hostPath:
|
|
||||||
path: /etc
|
|
|
@ -5,7 +5,7 @@ local_release_dir: /tmp
|
||||||
etcd_version: v3.0.17
|
etcd_version: v3.0.17
|
||||||
calico_version: v0.23.0
|
calico_version: v0.23.0
|
||||||
calico_cni_version: v1.5.6
|
calico_cni_version: v1.5.6
|
||||||
weave_version: v1.8.2
|
weave_version: v2.0.1
|
||||||
|
|
||||||
# Download URL's
|
# Download URL's
|
||||||
etcd_download_url: "https://github.com/coreos/etcd/releases/download/{{ etcd_version }}/etcd-{{ etcd_version }}-linux-amd64.tar.gz"
|
etcd_download_url: "https://github.com/coreos/etcd/releases/download/{{ etcd_version }}/etcd-{{ etcd_version }}-linux-amd64.tar.gz"
|
||||||
|
|
Loading…
Reference in a new issue