Commit graph

5634 commits

Author SHA1 Message Date
Mathieu Parent
3ad248b007 Update Helm version to 3.5.2 (#7248)
Helm v3.5.2 is a security (patch) release. Users are strongly
recommended to update to this release. It fixes two security issues in
upstream dependencies and one security issue in the Helm codebase.

See https://github.com/helm/helm/releases/tag/v3.5.2

(cherry picked from commit 670c37b428)
2021-02-22 06:01:43 -08:00
petruha
754a54adfc Run containerd related tasks on OracleLinux. (#7250)
(cherry picked from commit fc8551bcba)
2021-02-22 06:01:43 -08:00
forselli-stratio
960844d87b Fix ansible calico route reflector tasks in calico role (#7224)
* Fix calico-rr tasks

* revert stdin only when it's already a string

(cherry picked from commit 88bee6c68e)
2021-02-22 06:01:43 -08:00
Sander Cornelissen
6bde4e3fb3 Ensure when use_oracle_public_repo is set to false the public Oracle Linux yum repos are not set (#7228)
(cherry picked from commit b70d986bfa)
2021-02-22 06:01:43 -08:00
Felix Breuer
3725c80a71 FIX: Bastion undefined variable (#7227)
Fixes the following error when using Bastion Node with the sample config.
```
fatal: [bastion]: FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: 'dict object' has no attribute 'bastion'\n\nThe error appears to be in '/home/felix/inovex/kubespray/roles/bastion-ssh-config/tasks/main.yml': line 2, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n---\n- name: set bastion host IP\n  ^ here\n"}
```

(cherry picked from commit 973628fc1b)
2021-02-22 06:01:43 -08:00
Robin Elfrink
d94f32c160 Fix unintended SIGPIPEs. (#7214)
(cherry picked from commit 91fea7c956)
2021-02-22 06:01:43 -08:00
Jorik Jonker
6b184905e6 calico: fix NetworkManager check (#7169)
Previous check for presence of NM assumed "systemctl show
NetworkManager" would exit with a nonzero status code, which seems not
the case anymore with recent Flatcar Container Linux.

This new check also checks the activeness of network manager, as
`is-active` implies presence.

Signed-off-by Jorik Jonker <jorik@kippendief.biz>

(cherry picked from commit bba55faae8)
2021-02-22 06:01:43 -08:00
takmori_tech
782c3dc1c4 Update main.yml (#7175)
Fix issue #7129. Calico image tags support multiarch on quay.io.

(cherry picked from commit 2525d7aff8)
2021-02-22 06:01:43 -08:00
Florian Ruynat
f6b806e971 Update bunch of dependencies (#7187)
(cherry picked from commit 9ef62194c3)
2021-02-22 06:01:43 -08:00
Sergey
dee0594d74 Adding other masters sequentially, not in parallel (#7166)
(cherry picked from commit b2995e4ec4)
2021-02-22 06:01:43 -08:00
Arian van Putten
f8b15a714c
roles/docker: Make repokey fingerprint overrideable (#7263)
This makes the docker role work the same as the containerd role.
Being able to override this is needed when you have your own debian
repository. E.g. when performing an airgapped installation
2021-02-15 20:47:05 -08:00
Ryler Hockenbury
d8ab76aa04
Update azure cloud config (#7208) (#7221)
* Allow configureable vni and port for flannel overlay

* additional options for azure cloud config
2021-01-27 03:47:40 -08:00
Rick Haan
8a5139e54c
Check kube-apiserver up on all masters before upgrade (#7193) (#7217)
Only checking the kubernetes api on the first master when upgrading is not enough.
Each master needs to be checked before it's upgrade.

Signed-off-by: Rick Haan <rickhaan94@gmail.com>
2021-01-26 07:20:35 -08:00
Etienne Champetier
1727b3501f containerd,docker: stop installing extras repo on CentOS/RHEL
This was introduced in 143e2272ff
Extra repo is enabled by default in CentOS, and is not the right repo for EL8
Instead of adding a CentOS repo to RHEL, enable the needed RHEL repos with rhsm_repository

For RHEL 7, we need the "extras" repo for container-selinux
For RHEL 8, we need the "appstream" repo for container-selinux, ipvsadm and socat

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 8f2b0772f9)
2021-01-25 23:48:34 -08:00
Etienne Champetier
4ed05cf655 Calico: fixup check when ipipMode / vxlanMode is not present
calicoctl.sh get ipPool default-pool -o json
{
  "kind": "IPPool",
  "apiVersion": "projectcalico.org/v3",
  "metadata": {
    "name": "default-pool",
...
  },
  "spec": {
    "cidr": "10.233.64.0/18",
    "ipipMode": "Always",
    "natOutgoing": true,
    "blockSize": 24,
    "nodeSelector": "all()"
  }
}

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit f1576eabb1)
2021-01-25 23:48:34 -08:00
Etienne Champetier
8105cd7fbe preinstall: etcd group might not exists
fixes 8c1821228d

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 49c4345c9a)
2021-01-25 23:48:34 -08:00
Etienne Champetier
cf84a6bd3b containerd: ensure containerd is really started and enabled
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit a5d2137ed9)
2021-01-25 23:48:34 -08:00
Etienne Champetier
b80f612d29 containerd,docker: use apt_repository instead of action
yum_repository expect really different params, so nothing to factor here
Ubuntu is not an ansible_os_family, the OS family for Ubuntu is Debian
Check for ansible_pkg_mgr == apt

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit a8e51e686e)
2021-01-25 23:48:34 -08:00
Etienne Champetier
5e06ee6ea6 containerd,docker: use apt_key instead of action
we don't need rpm_key, so nothing to factor here
Ubuntu is not an ansible_os_family, the OS family for Ubuntu is Debian
Check for ansible_pkg_mgr == apt

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit a2429ef64d)
2021-01-25 23:48:34 -08:00
Etienne Champetier
4de5a070e1 containerd: use package instead of action
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 1b88678cf3)
2021-01-25 23:48:34 -08:00
Etienne Champetier
b198cd23d0 docker: use package instead of action, cleanup
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 0e96852159)
2021-01-25 23:48:34 -08:00
Etienne Champetier
74e8f58c57 containerd: use copy to set apt pin
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 19a61d838f)
2021-01-25 23:48:34 -08:00
Etienne Champetier
803f89e82b preinstall: use package instead of action, use state: present
Before this commit we were upgrading base os packages on each run

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 4eec302e86)
2021-01-25 23:48:34 -08:00
Etienne Champetier
a652a3b3b5 docker: stop using apt force
Here the desciption from Ansible docs
Corresponds to the --force-yes to apt-get and implies allow_unauthenticated: yes
This option will disable checking both the packages' signatures and the certificates of the web servers they are downloaded from.
This option *is not* the equivalent of passing the -f flag to apt-get on the command line
**This is a destructive operation with the potential to destroy your system, and it should almost never be used.** Please also see man apt-get for more information.

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit f3885aa589)
2021-01-25 23:48:34 -08:00
Florian Ruynat
a923f4e7c0
Update kube_version_min_required and cleanup hashes for release (#7160) 2021-01-15 00:33:51 -08:00
Etienne Champetier
82af8e455e docker: remove old versions
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2021-01-14 09:39:05 -08:00
Etienne Champetier
1baee488ab containerd: remove duplicate package pining task
Leave it with the install instead of the repo config

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2021-01-14 09:39:05 -08:00
Etienne Champetier
7433b70d95 docker: remove kernel check
Only CentOS 7 uses Linux 3.10, all other OSs have more recent kernels

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2021-01-14 09:39:05 -08:00
Etienne Champetier
de6c71a426 docker: remove dockerproject repo reference
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2021-01-14 09:39:05 -08:00
Etienne Champetier
16a34548ea docker: remove checks for docker 1.12
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2021-01-14 09:39:05 -08:00
Etienne Champetier
b2f3ab77cd docker: remove some old debug code
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2021-01-14 09:39:05 -08:00
Etienne Champetier
b2f6ed7dee docker: remove obsoletes=0 in yum.conf
This was introduced in ef7f5edbb3
obsoletes=0 is not present in the official repo config
https://download.docker.com/linux/centos/docker-ce.repo
so it might not be needed for some time

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2021-01-14 09:39:05 -08:00
Etienne Champetier
09e34d29cd containerd: remove docker_yum_conf / yum_conf
leftover from 1945499e2f

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2021-01-14 09:39:05 -08:00
Etienne Champetier
667a6981ea preinstall: remove credentials folder move
This was introduced in 3004791c64,
so since 2018 everyone should be upgraded ;)

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2021-01-14 09:39:05 -08:00
Etienne Champetier
cf1d9f5612 preinstall: remove old Fedora task
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2021-01-14 09:39:05 -08:00
Etienne Champetier
55b03a41b2 containerd-common,containerd,docker: remove ubuntu arch specific vars
By removing ancient version we don't need arch specific vars

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2021-01-14 09:39:05 -08:00
Florian Ruynat
81b4ffa6b4
Add Fedora 33 CI, remove Fedora 31 (#7072) 2021-01-14 08:27:05 -08:00
Etienne Champetier
8c1821228d
preinstall: fixup etcd_deployment_type check (#7152)
fixes 8331939aed
Thanks to Tomas Vanderka / karlism / LuckySB

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2021-01-14 06:53:05 -08:00
Etienne Champetier
9c5c1a09a1
test-infra: update CentOS images (#7134)
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2021-01-14 05:25:04 -08:00
Florian Ruynat
09fa99fdc6
Update hashes and set default version to 1.19.7 (#7150) 2021-01-13 14:57:02 -08:00
Etienne Champetier
8331939aed
preinstall: check etcd_deployment_type (#7149)
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2021-01-13 14:19:03 -08:00
Sergey
02213d6e07
change nodeSelector label from deprecated beta.kubernetes.io/os and arch to kubernetes.io prefix (#7138) 2021-01-13 13:55:02 -08:00
Wang Zhen
387df0ee1f
Remove unnecessary condition check when updating server field in kube-proxy kubeconfig (#7145) 2021-01-13 09:50:37 -08:00
Florian Ruynat
b59035df06
change nginx default HTTPS protocol from "SSLv2" to "TLSv1.2 TLSv1.3" (#7144) 2021-01-13 08:34:36 -08:00
Mateusz Piotrowski
5517e62c86
Fix and document environment variable KUBE_MASTERS (#7127)
This variable was added as KUBE_MASTERS_MASTERS. That's probably a typo.
Remove the redundant `_MASTERS` suffix. Also, document the variable in the
help message.
2021-01-11 11:34:24 -08:00
Gregor Krmelj
5dca5225dc
update docs main menu with CRI section (#7132) 2021-01-11 09:07:05 -08:00
Kenichi Omichi
c005c90746
Remove unnecessary failed_when (#7120)
TASK [Generate a list of information about the images on a node]
registers list of container images to docker_images.
Then the next TASK [Set pull_required if the desired image is not
yet loaded] does based on expecting images are registered.
However sometimes the first TASK was failed as [1] but the failure
is ignored due to failed_when:false and it makes another issue.
This removes this unnecessary failed_when to detect the failure
at the point.
In addition, this removes no_log:true also because the output doesn't
contain any sensitive data and now it just makes debugging difficult.

[1]: https://gitlab.com/kargo-ci/kubernetes-sigs-kubespray/-/jobs/934714534#L2953
2021-01-11 08:49:10 -08:00
Etienne Champetier
8bdd0bb82f
Require 2.9.0 <= Ansible version < 2.10.0 (#7130)
We have multiple breakage report with Ansible 2.10+ in https://github.com/kubernetes-sigs/kubespray/issues/6762
README.md already recommended 2.9+

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2021-01-11 07:49:11 -08:00
Etienne Champetier
a790935d02
Only setup *_PROXY env variables where needed (#7095)
no_proxy is a pain to get right, and having proxy variables present causes issues
(k8s components get proxy configuration after upgrade, see #7100)

It's better to only configure what require proxy:
- the runtime (containerd/docker/crio)
- the package manager + apt_key
- the download tasks

Tested with the following clusters
- 4 CentOS 8 nodes
- 1 Ubuntu 20.04 node

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2021-01-11 07:21:08 -08:00
Gregor Krmelj
1fcbbd3b9d
Update containerd documentation with etcd change (#7126)
* update containerd documentation with etcd change

* update conterind docs
2021-01-11 06:39:08 -08:00