From 8d898778f582872770f69dabd98a2c3e4569a467 Mon Sep 17 00:00:00 2001 From: Boris Zanetti Date: Sat, 15 Apr 2017 12:04:00 +0200 Subject: [PATCH] move to specific role --- cluster.yml | 6 ++++ roles/dnsmasq/tasks/main.yml | 3 -- .../efk/fluentd/templates/fluentd-ds.yml.j2 | 1 + roles/rbac/tasks/main.yml | 34 +++++++++++++++++++ .../calico-cni-plugin-clusterrole.yml | 13 +++++++ .../calico-cni-plugin-clusterrolebinding.yml | 13 +++++++ .../calico-cni-plugin-serviceaccount.yml | 6 ++++ .../calico-policy-controller-clusterrole.yml | 17 ++++++++++ ...o-policy-controller-clusterrolebinding.yml | 13 +++++++ ...alico-policy-controller-serviceaccount.yml | 6 ++++ ...r-proportional-autoscaler-clusterrole.yml} | 1 + ...rtional-autoscaler-clusterrolebinding.yml} | 1 + ...roportional-autoscaler-serviceaccount.yml} | 1 + .../custom:system:kube-dns-clusterrole.yml | 15 ++++++++ ...tom:system:kube-dns-clusterrolebinding.yml | 13 +++++++ roles/rbac/templates/fluentd-clusterrole.yml | 9 +++++ .../templates/fluentd-clusterrolebinding.yml | 13 +++++++ 17 files changed, 162 insertions(+), 3 deletions(-) create mode 100644 roles/rbac/tasks/main.yml create mode 100644 roles/rbac/templates/calico-cni-plugin-clusterrole.yml create mode 100644 roles/rbac/templates/calico-cni-plugin-clusterrolebinding.yml create mode 100644 roles/rbac/templates/calico-cni-plugin-serviceaccount.yml create mode 100644 roles/rbac/templates/calico-policy-controller-clusterrole.yml create mode 100644 roles/rbac/templates/calico-policy-controller-clusterrolebinding.yml create mode 100644 roles/rbac/templates/calico-policy-controller-serviceaccount.yml rename roles/{dnsmasq/templates/dnsmasq-clusterrole.yml => rbac/templates/cluster-proportional-autoscaler-clusterrole.yml} (99%) rename roles/{dnsmasq/templates/dnsmasq-clusterrolebinding.yml => rbac/templates/cluster-proportional-autoscaler-clusterrolebinding.yml} (98%) rename roles/{dnsmasq/templates/dnsmasq-serviceaccount.yml => rbac/templates/cluster-proportional-autoscaler-serviceaccount.yml} (96%) create mode 100644 roles/rbac/templates/custom:system:kube-dns-clusterrole.yml create mode 100644 roles/rbac/templates/custom:system:kube-dns-clusterrolebinding.yml create mode 100644 roles/rbac/templates/fluentd-clusterrole.yml create mode 100644 roles/rbac/templates/fluentd-clusterrolebinding.yml diff --git a/cluster.yml b/cluster.yml index 75296646a..2d992614a 100644 --- a/cluster.yml +++ b/cluster.yml @@ -78,6 +78,12 @@ - { role: kargo-defaults} - { role: network_plugin/calico/rr, tags: network } +- hosts: k8s-cluster + any_errors_fatal: "{{ any_errors_fatal | default(true) }}" + roles: + - { role: kargo-defaults} + - { role: rbac, tags: rbac } + - hosts: k8s-cluster any_errors_fatal: "{{ any_errors_fatal | default(true) }}" roles: diff --git a/roles/dnsmasq/tasks/main.yml b/roles/dnsmasq/tasks/main.yml index 3e59cc81e..edc50703d 100644 --- a/roles/dnsmasq/tasks/main.yml +++ b/roles/dnsmasq/tasks/main.yml @@ -63,9 +63,6 @@ with_items: - {name: dnsmasq, file: dnsmasq-deploy.yml, type: deployment} - {name: dnsmasq, file: dnsmasq-svc.yml, type: svc} - - {name: cluster-proportional-autoscaler, file: dnsmasq-serviceaccount.yml, type: serviceaccount} - - {name: cluster-proportional-autoscaler, file: dnsmasq-clusterrole.yml, type: clusterrole} - - {name: cluster-proportional-autoscaler, file: dnsmasq-clusterrolebinding.yml, type: clusterrolebinding} - {name: dnsmasq-autoscaler, file: dnsmasq-autoscaler.yml, type: deployment} register: manifests delegate_to: "{{ groups['kube-master'][0] }}" diff --git a/roles/kubernetes-apps/efk/fluentd/templates/fluentd-ds.yml.j2 b/roles/kubernetes-apps/efk/fluentd/templates/fluentd-ds.yml.j2 index d15b10b43..f220baaea 100644 --- a/roles/kubernetes-apps/efk/fluentd/templates/fluentd-ds.yml.j2 +++ b/roles/kubernetes-apps/efk/fluentd/templates/fluentd-ds.yml.j2 @@ -40,6 +40,7 @@ spec: mountPath: /var/lib/docker/containers readOnly: true terminationGracePeriodSeconds: 30 + serviceAccountName: fluentd volumes: - name: varlog hostPath: diff --git a/roles/rbac/tasks/main.yml b/roles/rbac/tasks/main.yml new file mode 100644 index 000000000..2e5965b60 --- /dev/null +++ b/roles/rbac/tasks/main.yml @@ -0,0 +1,34 @@ +--- +- name: Create RBAC manifests + template: + src: "{{item.file}}" + dest: "{{kube_config_dir}}/{{item.file}}" + with_items: + - {name: calico-cni-plugin, file: calico-cni-plugin-serviceaccount.yml, type: serviceaccount} + - {name: calico-cni-plugin, file: calico-cni-plugin-clusterrole.yml, type: clusterrole} + - {name: calico-cni-plugin, file: calico-cni-plugin-clusterrolebinding.yml, type: clusterrolebinding} + - {name: calico-policy-controller, file: calico-policy-controller-serviceaccount.yml, type: serviceaccount} + - {name: calico-policy-controller, file: calico-policy-controller-clusterrole.yml, type: clusterrole} + - {name: calico-policy-controller, file: calico-policy-controller-clusterrolebinding.yml, type: clusterrolebinding} + - {name: cluster-proportional-autoscaler, file: cluster-proportional-autoscaler-serviceaccount.yml, type: serviceaccount} + - {name: cluster-proportional-autoscaler, file: cluster-proportional-autoscaler-clusterrole.yml, type: clusterrole} + - {name: cluster-proportional-autoscaler, file: cluster-proportional-autoscaler-clusterrolebinding.yml, type: clusterrolebinding} + - {name: 'custom:system:kube-dns', file: 'custom:system:kube-dns-clusterrole.yml', type: clusterrole} + - {name: 'custom:system:kube-dns', file: 'custom:system:kube-dns-clusterrolebinding.yml', type: clusterrolebinding} + - {name: fluentd, file: fluentd-clusterrole.yml, type: clusterrole} + - {name: fluentd, file: fluentd-clusterrolebinding.yml, type: clusterrolebinding} + register: manifests + when: inventory_hostname == groups['kube-master'][0] + +- name: Start Resources + kube: + name: "{{item.item.name}}" + namespace: "{{system_namespace}}" + kubectl: "{{bin_dir}}/kubectl" + resource: "{{item.item.type}}" + filename: "{{kube_config_dir}}/{{item.item.file}}" + state: "{{item.changed | ternary('latest','present') }}" + with_items: "{{ manifests.results }}" + when: inventory_hostname == groups['kube-master'][0] + + diff --git a/roles/rbac/templates/calico-cni-plugin-clusterrole.yml b/roles/rbac/templates/calico-cni-plugin-clusterrole.yml new file mode 100644 index 000000000..cc20667ed --- /dev/null +++ b/roles/rbac/templates/calico-cni-plugin-clusterrole.yml @@ -0,0 +1,13 @@ +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1beta1 +metadata: + name: calico-cni-plugin + namespace: kube-system +rules: + - apiGroups: [""] + resources: + - pods + - nodes + verbs: + - get diff --git a/roles/rbac/templates/calico-cni-plugin-clusterrolebinding.yml b/roles/rbac/templates/calico-cni-plugin-clusterrolebinding.yml new file mode 100644 index 000000000..77a24b013 --- /dev/null +++ b/roles/rbac/templates/calico-cni-plugin-clusterrolebinding.yml @@ -0,0 +1,13 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: calico-cni-plugin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: calico-cni-plugin +subjects: +- kind: ServiceAccount + name: calico-cni-plugin + namespace: kube-system diff --git a/roles/rbac/templates/calico-cni-plugin-serviceaccount.yml b/roles/rbac/templates/calico-cni-plugin-serviceaccount.yml new file mode 100644 index 000000000..0b71f847d --- /dev/null +++ b/roles/rbac/templates/calico-cni-plugin-serviceaccount.yml @@ -0,0 +1,6 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: calico-cni-plugin + namespace: kube-system diff --git a/roles/rbac/templates/calico-policy-controller-clusterrole.yml b/roles/rbac/templates/calico-policy-controller-clusterrole.yml new file mode 100644 index 000000000..dfc7faf53 --- /dev/null +++ b/roles/rbac/templates/calico-policy-controller-clusterrole.yml @@ -0,0 +1,17 @@ +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1beta1 +metadata: + name: calico-policy-controller + namespace: kube-system +rules: + - apiGroups: + - "" + - extensions + resources: + - pods + - namespaces + - networkpolicies + verbs: + - watch + - list diff --git a/roles/rbac/templates/calico-policy-controller-clusterrolebinding.yml b/roles/rbac/templates/calico-policy-controller-clusterrolebinding.yml new file mode 100644 index 000000000..4a3ebc3e8 --- /dev/null +++ b/roles/rbac/templates/calico-policy-controller-clusterrolebinding.yml @@ -0,0 +1,13 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: calico-policy-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: calico-policy-controller +subjects: +- kind: ServiceAccount + name: calico-policy-controller + namespace: kube-system diff --git a/roles/rbac/templates/calico-policy-controller-serviceaccount.yml b/roles/rbac/templates/calico-policy-controller-serviceaccount.yml new file mode 100644 index 000000000..6f7ab0a47 --- /dev/null +++ b/roles/rbac/templates/calico-policy-controller-serviceaccount.yml @@ -0,0 +1,6 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: calico-policy-controller + namespace: kube-system diff --git a/roles/dnsmasq/templates/dnsmasq-clusterrole.yml b/roles/rbac/templates/cluster-proportional-autoscaler-clusterrole.yml similarity index 99% rename from roles/dnsmasq/templates/dnsmasq-clusterrole.yml rename to roles/rbac/templates/cluster-proportional-autoscaler-clusterrole.yml index a50b975e4..d4d2b1271 100644 --- a/roles/dnsmasq/templates/dnsmasq-clusterrole.yml +++ b/roles/rbac/templates/cluster-proportional-autoscaler-clusterrole.yml @@ -1,3 +1,4 @@ +--- apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRole metadata: diff --git a/roles/dnsmasq/templates/dnsmasq-clusterrolebinding.yml b/roles/rbac/templates/cluster-proportional-autoscaler-clusterrolebinding.yml similarity index 98% rename from roles/dnsmasq/templates/dnsmasq-clusterrolebinding.yml rename to roles/rbac/templates/cluster-proportional-autoscaler-clusterrolebinding.yml index d91d0d9eb..53c69fc21 100644 --- a/roles/dnsmasq/templates/dnsmasq-clusterrolebinding.yml +++ b/roles/rbac/templates/cluster-proportional-autoscaler-clusterrolebinding.yml @@ -1,3 +1,4 @@ +--- apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRoleBinding metadata: diff --git a/roles/dnsmasq/templates/dnsmasq-serviceaccount.yml b/roles/rbac/templates/cluster-proportional-autoscaler-serviceaccount.yml similarity index 96% rename from roles/dnsmasq/templates/dnsmasq-serviceaccount.yml rename to roles/rbac/templates/cluster-proportional-autoscaler-serviceaccount.yml index 7b30a2b9e..933782ef6 100644 --- a/roles/dnsmasq/templates/dnsmasq-serviceaccount.yml +++ b/roles/rbac/templates/cluster-proportional-autoscaler-serviceaccount.yml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: ServiceAccount metadata: diff --git a/roles/rbac/templates/custom:system:kube-dns-clusterrole.yml b/roles/rbac/templates/custom:system:kube-dns-clusterrole.yml new file mode 100644 index 000000000..9074953da --- /dev/null +++ b/roles/rbac/templates/custom:system:kube-dns-clusterrole.yml @@ -0,0 +1,15 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + name: custom:system:kube-dns +rules: +- apiGroups: + - "" + resources: + - endpoints + - services + verbs: + - get + - list + - watch diff --git a/roles/rbac/templates/custom:system:kube-dns-clusterrolebinding.yml b/roles/rbac/templates/custom:system:kube-dns-clusterrolebinding.yml new file mode 100644 index 000000000..0b31f34fc --- /dev/null +++ b/roles/rbac/templates/custom:system:kube-dns-clusterrolebinding.yml @@ -0,0 +1,13 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: custom:system:kube-dns +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: custom:system:kube-dns +subjects: +- kind: ServiceAccount + name: kube-dns + namespace: kube-system diff --git a/roles/rbac/templates/fluentd-clusterrole.yml b/roles/rbac/templates/fluentd-clusterrole.yml new file mode 100644 index 000000000..930ae4fa6 --- /dev/null +++ b/roles/rbac/templates/fluentd-clusterrole.yml @@ -0,0 +1,9 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + name: fluentd +rules: + - apiGroups: [""] + resources: ["pods"] + verbs: ["get"] diff --git a/roles/rbac/templates/fluentd-clusterrolebinding.yml b/roles/rbac/templates/fluentd-clusterrolebinding.yml new file mode 100644 index 000000000..0a66648c3 --- /dev/null +++ b/roles/rbac/templates/fluentd-clusterrolebinding.yml @@ -0,0 +1,13 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: fluentd +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: fluentd +subjects: +- kind: ServiceAccount + name: fluentd + namespace: kube-system