add CI test for auto_renew_certificates (#7472)
* add CI test for auto_renew_certificates
* change timer value
fix typo error in rotate cert script
(cherry picked from commit cce0940e1f
)
Conflicts:
roles/kubernetes/master/templates/k8s-certs-renew.timer.j2
This commit is contained in:
parent
383b2fcb4e
commit
7cf6f3f3e1
13 changed files with 24 additions and 2 deletions
|
@ -8,7 +8,7 @@ echo "## Renewing certificates managed by kubeadm ##"
|
|||
|
||||
echo "## Restarting control plane pods managed by kubeadm ##"
|
||||
{% if container_manager == "docker" %}
|
||||
{{ docker_bin_dir }}/docker ps -af 'name=k8s_POD_(kube-apiserver|kube-controller-manager|kube-scheduler|etcd)-*' -q | /usr/bin/xargs {{ docker_bin_dir }}/docker rm -f"
|
||||
{{ docker_bin_dir }}/docker ps -af 'name=k8s_POD_(kube-apiserver|kube-controller-manager|kube-scheduler|etcd)-*' -q | /usr/bin/xargs {{ docker_bin_dir }}/docker rm -f
|
||||
{% else %}
|
||||
{{ bin_dir }}/crictl pods --namespace kube-system --name 'kube-scheduler-*|kube-controller-manager-*|kube-apiserver-*|etcd-*' -q | /usr/bin/xargs {{ bin_dir }}/crictl rmp -f
|
||||
{% endif %}
|
||||
|
|
|
@ -3,7 +3,7 @@ Description=Timer to renew K8S control plane certificates
|
|||
|
||||
[Timer]
|
||||
# First Monday of each month
|
||||
OnCalendar=Mon *-*-1..7 03:{{ groups['kube-master'].index(inventory_hostname) }}0:00
|
||||
OnCalendar=Mon *-*-1,2,3,4,5,6,7 03:{{ groups['kube-master'].index(inventory_hostname) }}0:00
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
|
@ -13,3 +13,5 @@ typha_enabled: true
|
|||
calico_backend: kdd
|
||||
typha_secure: true
|
||||
disable_ipv6_dns: true
|
||||
|
||||
auto_renew_certificates: true
|
||||
|
|
|
@ -12,3 +12,5 @@ dns_min_replicas: 1
|
|||
typha_enabled: true
|
||||
calico_backend: kdd
|
||||
typha_secure: true
|
||||
|
||||
auto_renew_certificates: true
|
||||
|
|
|
@ -13,3 +13,5 @@ etcd_deployment_type: host
|
|||
|
||||
# required
|
||||
calico_iptables_backend: "Auto"
|
||||
|
||||
auto_renew_certificates: true
|
||||
|
|
|
@ -14,3 +14,5 @@ helm_enabled: true
|
|||
# https://gitlab.com/miouge/kubespray-ci/-/blob/a4fd5ed6857807f1c353cb60848aedebaf7d2c94/manifests/http-proxy.yml#L42
|
||||
http_proxy: http://172.30.30.30:8888
|
||||
https_proxy: http://172.30.30.30:8888
|
||||
|
||||
auto_renew_certificates: true
|
||||
|
|
|
@ -10,3 +10,5 @@ enable_nodelocaldns: false
|
|||
dns_min_replicas: 1
|
||||
kube_proxy_masquerade_all: true
|
||||
macvlan_interface: "eth0"
|
||||
|
||||
auto_renew_certificates: true
|
||||
|
|
|
@ -10,3 +10,5 @@ kube_network_plugin: calico
|
|||
|
||||
# Only docker package 20.10 for Fedora33
|
||||
docker_version: '20.10'
|
||||
|
||||
auto_renew_certificates: true
|
||||
|
|
|
@ -11,3 +11,5 @@ dns_min_replicas: 1
|
|||
|
||||
# test Ambassador
|
||||
ingress_ambassador_enabled: true
|
||||
|
||||
auto_renew_certificates: true
|
||||
|
|
|
@ -9,3 +9,5 @@ kube_network_plugin: canal
|
|||
dynamic_kubelet_configuration: true
|
||||
deploy_netchecker: true
|
||||
dns_min_replicas: 1
|
||||
|
||||
auto_renew_certificates: true
|
||||
|
|
|
@ -7,3 +7,5 @@ mode: separate
|
|||
kube_network_plugin: weave
|
||||
deploy_netchecker: true
|
||||
dns_min_replicas: 1
|
||||
|
||||
auto_renew_certificates: true
|
||||
|
|
|
@ -8,3 +8,5 @@ kube_network_plugin: cilium
|
|||
deploy_netchecker: true
|
||||
enable_network_policy: true
|
||||
dns_min_replicas: 1
|
||||
|
||||
auto_renew_certificates: true
|
||||
|
|
|
@ -12,3 +12,5 @@ dns_min_replicas: 1
|
|||
# Currently ipvs not available on KVM: https://packages.ubuntu.com/search?suite=focal&arch=amd64&mode=exactfilename&searchon=contents&keywords=ip_vs_sh.ko
|
||||
kube_proxy_mode: iptables
|
||||
enable_nodelocaldns: False
|
||||
|
||||
auto_renew_certificates: true
|
||||
|
|
Loading…
Reference in a new issue