C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
1377 commits 17 branches 66 tags 141 MiB
Commit graph

366 commits

Author SHA1 Message Date
Mark Lee
224e6acb3a use ansible sysctl module for config ip forwarding 2017-02-09 17:28:44 +09:00
Josh Conant
764ad6e099 Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00
Matthew Mosesohn
ce3bee4eb8 Merge pull request #990 from mattymo/fix_cert_upgrade 
Fix check for node-NODEID certs existence
 2017-02-08 14:44:09 +03:00
Matthew Mosesohn
3c7952d7f1 Merge pull request #992 from vwfs/host_mount_dev 
Host mount /dev for kubelet
 2017-02-08 13:45:22 +03:00
Bogdan Dobrelya
320d03c01c Merge pull request #956 from adidenko/update-netchecker 
Update playbooks to support new netchecker
 2017-02-08 10:09:46 +01:00
Alexander Block
08367f4abb Host mount /dev for kubelet 2017-02-08 09:55:51 +01:00
Matthew Mosesohn
012bc49404 Fix check for node-NODEID certs existence 
Fixes upgrade from pre-individual node cert envs.
 2017-02-07 21:06:48 +03:00
Aleksandr Didenko
3b816ee660 Update playbooks to support new netchecker 
Netchecker is rewritten in Go lang with some new args instead of
env variables. Also netchecker-server no longer requires kubectl
container. Updating playbooks accordingly.
 2017-02-07 15:20:34 +01:00
Matthew Mosesohn
7a9161d462 Prevent dynamic port allocation in nodePort range 
kube_apiserver_node_port_range should be accessible only
to kube-proxy and not be taken by a dynamic port allocation.

Potentially temporary if https://github.com/kubernetes/kubernetes/issues/40920
gets fixed.
 2017-02-06 20:01:16 +03:00
Matthew Mosesohn
be24fab5d0 Revert "Drop linux capabilities and rework users/groups" 2017-02-06 15:58:54 +03:00
Bogdan Dobrelya
9d31173db4 Merge pull request #911 from bogdando/DROP_CAPS 
Drop linux capabilities and rework users/groups
 2017-02-06 12:05:51 +01:00
Bogdan Dobrelya
e53d3fe9c8 Merge pull request #949 from vmtyler/master 
Fixes Support for OpenStack v3 credentials
 2017-02-03 12:22:00 +01:00
Matthew Mosesohn
b7cbd5b9c5 Merge pull request #927 from holser/nsenter_fix 
Remove nsenter workaround
 2017-02-02 18:18:15 +03:00
Sergii Golovatiuk
b610c1627e Remove nsenter workaround 
- Docker 1.12 and further don't need nsenter hack. This patch removes
  it.  Also, it bumps the minimal version to 1.12.

Closes #776

Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>
 2017-02-02 14:38:11 +01:00
Greg Althaus
0037d0e6b2 This continues the DHCP hook checks. Also protect the create side 
if the system doesn't have any config files at all.
 2017-01-31 09:56:27 -06:00
Matthew Mosesohn
1011e416a7 Fix cert distribution at scale 
Use stdin instead of bash args to pass node filenames and base64 data.
Use tempfile for master cert data
 2017-01-31 16:27:45 +03:00
Tyler Britten
6b29c6c702 Fixed for non-null output 2017-01-27 10:47:59 -05:00
Tyler Britten
ec1c47bc5a Updated OpenStack vars to check for tenant_id (v2) and project_id (v3) 2017-01-27 10:26:20 -05:00
Xavier Lange
eb07363ddb Bugfix: skip cloud_config on etcd 2017-01-25 14:09:21 -08:00
Bogdan Dobrelya
48e77cd8bb Drop linux capabilities and rework users/groups 
* Drop linux capabilities for unprivileged containerized
  worlkoads Kargo configures for deployments.
* Configure required securityContext/user/group/groups for kube
  components' static manifests, etcd, calico-rr and k8s apps,
  like dnsmasq daemonset.
* Rework cloud-init (etcd) users creation for CoreOS.
* Fix nologin paths, adjust defaults for addusers role and ensure
  supplementary groups membership added for users.
* Add netplug user for network plugins (yet unused by privileged
  networking containers though).
* Grant the kube and netplug users read access for etcd certs via
  the etcd certs group.
* Grant group read access to kube certs via the kube cert group.
* Remove priveleged mode for calico-rr and run it under its uid/gid
  and supplementary etcd_cert group.
* Adjust docs.
* Align cpu/memory limits and dropped caps with added rkt support
  for control plane.

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
 2017-01-20 08:50:42 +01:00
Matthew Mosesohn
979b01a145 Merge pull request #905 from galthaus/async-runs 
Add tasks to ensure that the first nodes have their directories for cert gen
 2017-01-19 18:32:27 +03:00
Matthew Mosesohn
77eeacb315 Merge pull request #904 from galthaus/nginx-port-config 
Add nginx local balancer port configuration variable
 2017-01-19 18:31:57 +03:00
Greg Althaus
d9fb51b046 Add explicit name printing in task names for deletgated task during 
cert creation
 2017-01-18 14:06:50 -06:00
Matthew Mosesohn
67719c162e Fix setting resolvconf when using rkt deploy mode 
rkt deploy mode doesn't create {{ bin_dir }}/kubelet, so
let's rely on kubelet.env file instad.
 2017-01-18 19:18:47 +03:00
Matthew Mosesohn
8369f5ebad Fix bash completion installation 2017-01-17 20:36:58 +03:00
Greg Althaus
113925afea Add a variable that defaults to kube_apiserver_port that defines 
the which port the local nginx proxy should listen on for HA
local balancer configurations.
 2017-01-14 23:38:07 -06:00
Greg Althaus
707e6a4642 This PR adds/or modifies a few tasks to allow for the playbook to 
be run by limit on each node without regard for order.

The changes make sure that all of the directories needed to do
certificate management are on the master[0] or etcd[0] node regardless
of when the playbook gets run on each node.  This allows for separate
ansible playbook runs in parallel that don't have to be synchronized.
 2017-01-14 23:24:34 -06:00
Greg Althaus
04fbe42aa6 If the inventory name of the host exceeds 63 characters, 
the openssl tools will fail to create signing requests because
the CN is too long.  This is mainly a problem when FQDNs are used
in the inventory file.

THis will truncate the hostname for the CN field only at the
first dot.  This should handle the issue for most cases.
 2017-01-13 10:02:23 -06:00
Matthew Mosesohn
3b562c494d Use only one certificate for all apiservers 
https://github.com/kubernetes/kubernetes/issues/25063
 2017-01-13 14:03:20 +03:00
Bogdan Dobrelya
9a07782016 Merge pull request #891 from galthaus/selinux-order 
preinstall fails on AWS CentOS7 image
 2017-01-13 11:51:18 +01:00
Alexander Block
cee3b01987 Don't try to delete kargo specific config from dhclient when file does not exist 
Also remove the check for != "RedHat" when removing the dhclient hook,
as this had also to be done on other distros. Instead, check if the
dhclienthookfile is defined.
 2017-01-13 10:56:10 +01:00
Greg Althaus
85efd263b3 When running on CentOS7 image in AWS with selinux on, the order of 
the tasks fail because selinux prevents ip-forwarding setting.

Moving the tasks around addresses two issues.  Makes sure that
the correct python tools are in place before adjusting of selinux
and makes sure that ipforwarding is toggled after selinux adjustments.
 2017-01-12 10:12:21 -06:00
Bogdan Dobrelya
808a50bc23 Merge pull request #830 from mattymo/k8sperhost 
Generate individual certificates for k8s hosts
 2017-01-12 12:42:14 +01:00
Alexander Block
d6c0d2785b Add tasks to undo changes to hosts /etc/resolv.conf and dhclient configs 2017-01-11 16:56:16 +01:00
Matthew Mosesohn
ed253e5c5a Generate individual certificates for k8s hosts 2017-01-11 12:58:07 +03:00
Matthew Mosesohn
c779bf8cd3 Merge pull request #878 from bradbeam/rkt-cni 
Adding /opt/cni /etc/cni to rkt run kubelet
 2017-01-11 12:22:04 +03:00
Bogdan Dobrelya
928de8d8bb Merge pull request #872 from mattymo/bug868 
Bind nginx localhost proxy to localhost
 2017-01-10 17:09:25 +01:00
Brad Beam
7420bf584c Adding /opt/cni /etc/cni to rkt run kubelet 2017-01-10 08:48:58 -06:00
Bogdan Dobrelya
fd53e2c670 Merge pull request #793 from kubernetes-incubator/fix_dhclientconf_path 
Fix wrong path of dhclient on CentOS+Azure
 2017-01-10 13:23:55 +01:00
Matthew Mosesohn
e9d5aa0f07 Bind nginx localhost proxy to localhost 
This proxy should only be listening for local connections, not 0.0.0.0.

Fixes #868
 2017-01-09 17:19:54 +03:00
Bogdan Dobrelya
d296284bfa Merge pull request #799 from kubernetes-incubator/docker_dns 
Implement "dockerd --dns-xxx" based dns mode
 2017-01-09 11:38:02 +01:00
Alexander Block
2b3dbae9d6 Introduce dns_mode and resolvconf_mode and implement docker_dns mode 
Also update reset.yml to do more dns/network related cleanup.
 2017-01-05 23:38:51 +01:00
Spencer Smith
bee6166b4c remove assertion for family not being CoreOS 2017-01-05 13:36:25 -05:00
Bogdan Dobrelya
da9da08964 Better fix for different CoreOS os family facts 
Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
 2017-01-05 16:32:08 +01:00
Bogdan Dobrelya
68a6fa1146 Rename CoreOS fact 
Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
 2017-01-05 14:02:29 +01:00
Brad Beam
9432a5cd73 Adding kubelet in rkt 2017-01-03 14:49:48 -06:00
Alexander Block
2538c958db Upgrade docker version and do some cleanups for unsupported distros/docker versions 2017-01-02 18:05:50 +01:00
Bogdan Dobrelya
130f0908ce Merge pull request #847 from bogdando/bug_769 
Fix etc hosts for cluster nodes
 2017-01-02 17:47:23 +01:00
Bogdan Dobrelya
62313afccc Fix etc hosts for cluster nodes 
Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
 2017-01-02 13:20:51 +01:00
Bogdan Dobrelya
f16a512aea Drop non systemd OS types support 
Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
 2017-01-02 12:14:03 +01:00