C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
6208 commits 17 branches 66 tags 141 MiB
Commit graph

4107 commits

Author SHA1 Message Date
Florian Ruynat
ecd267854b
Move ovn4nvf crd from v1beta1 to v1 (#8006) 2021-09-27 01:18:22 -07:00
Hugo Blom
ac846667b7
Check if openstack application credentials are empty since they always exists (#8021) 2021-09-27 01:14:22 -07:00
rtsp
4bace2491d
Ensure apparmor is installed (#8011) 
Kubespray deployment failed when using containerd backend on nodes that apparmor was not installed or previously removed. This PR ensure apparmor is installed by adding it into required_pkgs var.
 2021-09-24 07:55:23 -07:00
Maxim Pogozhiy
22017b7ff0
kube-router 1.3.0 -> 1.3.1 (#8007) 2021-09-23 13:42:55 -07:00
Florian Ruynat
88c11b5946
Revert "etcd: enable v2 api only if needed (#8001)" (#8008) 
This reverts commit c0e1211abe.
 2021-09-23 10:43:14 -07:00
Kenichi Omichi
843252c968
Use kube_config_dir for kubeconfig (#7996) 
The path of kubeconfig should be configurable, and its default value
is /etc/kubernetes/admin.conf. Most paths of the file are configurable
but some were not. This make those configurable.
 2021-09-23 10:19:13 -07:00
Eric Lake
ddea79f0f0
Issue 8004: Fix typha prometheus (#8005) 
The typha prometheus settings were in the `volumeMounts` section of the
spec and not in the `envs` section. This was cauing the deployment to
fail because it was looking for a volumeMount.

```
failed: [controller-001.a2.da.dev.logdna.net] (item=calico-typha.yml) => {"ansible_loop_var": "item", "changed": false, "item": {"ansible_loop_var": "item", "changed": true, "checksum": "598ac79530749e8e2110793b53fc49ac208e7130", "dest": "/etc/kubernetes/calico-typha.yml", "diff": [], "failed": false, "gid": 0, "group": "root", "invocation": {"module_args": {"_original_basename": "calico-typha.yml.j2", "attributes": null, "backup": false, "checksum": "598ac79530749e8e2110793b53fc49ac208e7130", "content": null, "delimiter": null, "dest": "/etc/kubernetes/calico-typha.yml", "directory_mode": null, "follow": false, "force": true, "group": null, "local_follow": null, "mode": null, "owner": null, "regexp": null, "remote_src": null, "selevel": null, "serole": null, "setype": null, "seuser": null, "src": "/home/core/.ansible/tmp/ansible-tmp-1632349768.56-75434-32452975679246/source", "unsafe_writes": null, "validate": null}}, "item": {"file": "calico-typha.yml", "name": "calico", "type": "typha"}, "md5sum": "53c00ac7f562cf9ecbbfd27899ea066d", "mode": "0644", "owner": "root", "size": 5378, "src": "/home/core/.ansible/tmp/ansible-tmp-1632349768.56-75434-32452975679246/source", "state": "file", "uid": 0}, "msg": "error running kubectl (/opt/bin/kubectl --namespace=kube-system apply --force --filename=/etc/kubernetes/calico-typha.yml) command (rc=1), out='service/calico-typha unchanged\n', err='error: error validating \"/etc/kubernetes/calico-typha.yml\": error validating data: [ValidationError(Deployment.spec.template.spec.containers[0].volumeMounts[2]): unknown field \"value\" in io.k8s.api.core.v1.VolumeMount, ValidationError(Deployment.spec.template.spec.containers[0].volumeMounts[2]): missing required field \"mountPath\" in io.k8s.api.core.v1.VolumeMount, ValidationError(Deployment.spec.template.spec.containers[0].volumeMounts[3]): unknown field \"value\" in io.k8s.api.core.v1.VolumeMount, ValidationError(Deployment.spec.template.spec.containers[0].volumeMounts[3]): missing required field \"mountPath\" in io.k8s.api.core.v1.VolumeMount]; if you choose to ignore these errors, turn validation off with --validate=false\n'"}
```
 2021-09-23 08:37:22 -07:00
Max Gautier
c0e1211abe
etcd: enable v2 api only if needed (#8001) 
* etcd: enable v2 api only if needed

Only enable v2 API if we have a consumer (flannel)
This reduce the exposed surface for etcd.

* Fix bad group name
 2021-09-22 12:36:32 -07:00
Florian Ruynat
c8d7f000c9
Remove k8s hooks for versions prior to 1.20 (#7998) 2021-09-22 10:32:01 -07:00
Léopold Jacquot
598f178054
Fix cilium operator metrics activation (#8000) 2021-09-22 10:00:02 -07:00
Florian Ruynat
5d1b34bdcd Move min k8s version to 1.20 2021-09-22 09:50:01 -07:00
Florian Ruynat
8efde799e1 Update kubernetes version to 1.22.2 2021-09-22 09:50:01 -07:00
Cristian Calin
a517a8db01
Drop chech for kubelet_shutdown_grace_period (#7993) 
and kubelet_shutdown_grace_period_critical_pods as ansible cannot do
sane time interval calculations
 2021-09-21 18:34:00 -07:00
Wang Zhen
2211504790
Fix k8s-certs-renew cp path (#7992) 
Signed-off-by: Wang Zhen <lazybetrayer@gmail.com>
 2021-09-21 00:36:22 -07:00
Cristian Calin
fb8662ec19
Calico: update versions 3.20.1, 3.19.3 (#7984) 
* make Calico 3.20.1 the default version
* drop Calico 3.17.x support
 2021-09-20 17:40:23 -07:00
Cristian Calin
6f7911264f
Calico: make calico_min_version check relevant (#7939) 
* Calico: make calico_min_version check relevant

* Calico: only check currently installed version against the oldest supported version by the previous release
 2021-09-20 07:58:09 -07:00
Cristian Calin
ae44aff330
Calico: increase calico node probe timeouts and allow tunning (#7981) 2021-09-17 16:08:07 -07:00
Florian Ruynat
b83e8b020a
Fix default version (#7977) 2021-09-17 07:31:00 -07:00
Hari Hud
30cd91dc6b
Add option to kubeadm upgrade command to control certificates renewal during control plane upgrade (#7976) 
* Add option to kubeadm upgrade command to control certificates renewal during control plane upgrade

* Remove training whitespace
 2021-09-17 04:31:00 -07:00
Florian Ruynat
f2fa9c3b31 Update hashes with new versions 2021-09-17 00:39:02 -07:00
Florian Ruynat
30a7dfa4f8
Fix ubuntu16/centos8 CI jobs (#7972) 2021-09-16 23:39:01 -07:00
Samuel Liu
62ab477838
remove kube_proxy_conntrack_max var (#7971) 2021-09-15 08:22:31 -07:00
rtsp
f8a57f7598
Fix iptables missing on Debian 11 if APT::Install-Recommends=0 (#7964) 
On Debian 11, `ipset` just recommend `iptables` so on the system that apt is configured with `APT::Install-Recommends "0";` iptables will not install automatically.
 2021-09-14 08:19:09 -07:00
Bryan Hundven
35c928798d
Fix missing file mode (risky-file-permissions) (#7959) 
* Fix missing file mode (risky-file-permissions)

Found this using ansible-lint.

Signed-off-by: Bryan Hundven <bryanhundven@gmail.com>

* Fix another missing file mode (risky-file-permissions)

This one fixes `/etc/crio/config.json`

Signed-off-by: Bryan Hundven <bryanhundven@gmail.com>
 2021-09-09 23:35:59 -07:00
jhchong92
83f64a7ff9
Bugfix/cinder csi cloud config template (#7955) 
* Fix invalid condition for username and password inclusion

* Use length filter to test variable conditions
 2021-09-09 10:04:11 -07:00
Florian Ruynat
60853fa682 Update kube-ovn to 1.7.2 2021-09-09 08:14:10 -07:00
Florian Ruynat
b66356be65 Update cilium to 1.9.10 2021-09-09 08:14:10 -07:00
jhchong92
efae2dbad6
Update snapshot-controller repository and image versions (#7957) 2021-09-09 08:10:11 -07:00
jhchong92
bd8b8916a8
Remove invalid spec - deployment.spec.serviceName (#7949) 2021-09-08 13:05:56 -07:00
jhchong92
57063b6828
Replace incorrect {% end %} tags with {% endif %} in csi_crd templates (#7947) 2021-09-08 12:59:57 -07:00
Ole Mathias Aa. Heggem
69b67a293a
Calico: Add kube_service_addresses_ipv6 to serviceClusterIPs (#7889) (#7944) 
Add IPv6 Service Addresses to BGP advertisement when 
calico_advertise_cluster_ips is true.
 2021-09-08 00:37:20 -07:00
Cristian Calin
d57ddf0be8
Feature DynamicKubeletConfig is deprecated in 1.22 and will not move to GA (#7938) 
* Feature DynamicKubeletConfig is deprecated in 1.22 and will not move to GA

* Add check for dynamic_kubelet_configuration with kube >= 1.22
 2021-09-07 10:47:16 -07:00
Cristian Calin
43e7e2d663
nginx-ingress: bump to 1.0.0 to support kube 1.22 (#7942) 2021-09-06 04:50:36 -07:00
Cristian Calin
d355b43dce
ContainerD: bump containerd version to 1.4.9 (#7940) 2021-09-06 04:50:29 -07:00
Cristian Calin
5d52025266
crictl: add hashes for 1.22 (#7936) 2021-09-06 04:46:29 -07:00
Cristian Calin
db470f8529
Update CSI snaphotter and make it independent (#7943) 
* CSI: update CSI snapshot CRDs

* CSI: update snapshot controller tag version with kubernetes specific versions

* CSI: allow enabling csi_snapshot_controller independent of Cinder CSI

* CSI: Align csi-snapshot-controller with upstream and use a Deployment instead of a StatefulSet
 2021-09-06 04:24:29 -07:00
kranthi guttikonda
81bf4f9304
cri-o registry auth support (#7837) 
* cri-o registry auth support

* yaml lint for comments

* crio_registry_auth from registry_auth

* crio_registry_auth as defaults
 2021-09-01 10:20:59 -07:00
Maciej Wereski
e1967b0700
MetalLB: keep nodeSelector in one place (#7931) 
Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>
 2021-09-01 09:05:00 -07:00
Olivier Lemasle
507091ec8b
Replace cluster_name by dns_domain (#7923) 
`cluster_name` defaults to `dns_domain` value (see [here][1] and [here][2])
but they could have different values.

`dns_domain` should be used here instead of `cluster_name` because the DNS
resolution is configured to use `dns_domain`.

[1]: 0ef7af76bc/roles/kubespray-defaults/defaults/main.yaml (L104)
[2]: 1afdb05ea9/inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml (L196)
 2021-09-01 08:18:59 -07:00
Maciej Wereski
48ceca4919
MetalLB: update to v0.10.2 (#7925) 
Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>
 2021-09-01 03:00:59 -07:00
Cristian Calin
426ad81db0
Calico: replace hashes for latest 3.17 and 3.18 to the .5 minor versions (#7924) 2021-08-31 13:38:21 -07:00
Olivier Lemasle
497d2ca306
Fix Calico's FelixConfiguration when "IP in IP" is disabled (#7926) 
When using Calico with:

- `calico_network_backend: vxlan`,
- `calico_ipip_mode: "Never"`,
- `calico_vxlan_mode: "Always"`,

the `FelixConfiguration` object has `ipipEnabled: true`, when it should be false:

This is caused by an error in the `| bool` conversion in the install task:
when `calico_ipip_mode` is `Never`,
`{{ calico_ipip_mode != 'Never' | bool }}` evaluates to `true`:
 2021-08-31 13:14:21 -07:00
Calvin Park
9d3888a756
During pre-upgrade add a flag to always cordon (#7892) 
* During pre-upgrade add a flag to always cordon

* empty

* empty

* empty

* Better default val
 2021-08-30 10:56:09 -07:00
rtsp
c8e090c17f
Add preliminary Debian 11 (bullseye) support (#7853) 
- Use python3-apt instead because python-apt was removed in Debian 11
- Add gnupg (fix "container-engine/containerd : ensure containerd repository public key is installed" task failed)
- Remove aufs-tools

Signed-off-by: rtsp <git@rtsp.us>
 2021-08-30 09:53:06 -07:00
Florian Ruynat
1ccf32e08f
Update docker to 20.10.8 (#7918) 2021-08-30 08:25:06 -07:00
Florian Ruynat
17af348be8 Add bunch of Kubernetes versions missing 2021-08-30 08:17:05 -07:00
Cristian Calin
1afdb05ea9
Fedora and RHEL use etc_t and the convention is <type_name>_t (#7891) 
* Fedora and RHEL use etc_t and the convention is <type_name>_t

* Docs: specify all values for preinstall_selinux_state

* CI: Add Fedora 34 with SELinux in enforcing mode
 2021-08-27 14:20:53 -07:00
Sergey
89993e4833
fix error metrics server capabilities name (#7905) 2021-08-25 12:06:15 -07:00
Cristian Calin
1c3d33e146
Calico: 3.20.0 policy update to allow access to endpointslices (#7899) 2021-08-25 12:06:01 -07:00
Cristian Calin
f66c49bf42
Calico: replace version 3.19.1 with 3.19.2 and set as default (#7867) 
Bump calico version to 3.19.2 due to adding 3.20.0 earlier
 2021-08-25 07:32:41 -07:00
rtsp
4c9d7dedb3
addons/cert_manager: retries until webhook pods has been created (#7850) 
Fix task 'Cert Manager | Wait for Webhook pods become ready' failed due to webhook pods don't exist yet by using `retries..until` trick like kubernetes-sigs/kubespray#7842

This fix should be removed in the future if the kubernetes/kubernetes#83242 is resolved.

Signed-off-by: rtsp <git@rtsp.us>
 2021-08-25 07:16:41 -07:00
Sergey
5336943a8c
add cilium_operator_api_serve_addr to cilium operator config (#7901) 2021-08-24 03:49:13 -07:00
Samuel
a040e521b4
feat(containerd): auth support (#7868) 
* feat(containerd): auth support

* fix(registry-auth): rename variable
 2021-08-23 06:40:00 -07:00
Cristian Calin
0ac364dfae
Calico: use --allow-version-mismatch in calicoctl.sh to allow upgrades (#7873) 2021-08-20 14:30:48 -07:00
rtsp
79166496f3
debian: Fix test failed after bullseye release (#7888) 2021-08-19 15:37:24 -07:00
Frank Ritchie
1f09229740
Update cilium to 1.9.9 (#7871) 
Now that 1.10 is out this is to make 1.9.9 the default. I am running
this version successfully.
 2021-08-16 13:34:22 -07:00
Léopold Jacquot
c06896a352
Update metrics-server to 0.5.0 (#7864) 2021-08-12 08:19:48 -07:00
Cristian Calin
c119620f7c
Calico: add v3.20.0 hashes (#7855) 2021-08-11 07:50:46 -07:00
Daniil Muidinov
7f309bb092
fix parameters for module replace in 0060-resolvconf (#7858) 2021-08-10 17:13:26 -07:00
Eugene Artemenko
e2b67b5700
Add suport of Vsphere CSI driver 2.2.X versions (#7848) 2021-08-09 08:19:38 -07:00
rtsp
82a9064d8d
addons/cert_manager: fix kubernetes-sigs#7085 by adding retries..until (#7842) 
Fix task 'Cert Manager | Apply ClusterIssuer manifest' failed due to service/endpoints updating delayed even though the wekhook pod status is ready.

Signed-off-by: rtsp <git@rtsp.us>
 2021-08-09 08:19:31 -07:00
Victor Morales
a70fab2249
Bump crun to 0.21 version (#7854) 2021-08-09 08:11:31 -07:00
Smita Srivastava
31a5a4e808
retry to fetch binary if it fails first time (#7839) 2021-07-30 00:17:38 -07:00
Vitaliy D
5db86f4c2b
Update vSphere CPI (#7838) 
Changes:
  * ClusterRole updated according to the latest manifests from
    https://github.com/kubernetes/cloud-provider-vsphere
  * vSphere CPI/CSI default versions bumped and
    tested successfully on K8S 1.21.1
  * vSphere documentation updated

Signed-off-by: Vitaliy D <vi7alya@gmail.com>
 2021-07-29 18:17:37 -07:00
AnatomicJC
627a06e30d
CRI-O: Install libseccomp2 from backports on Debian 10 (#7816) 
* CRI-O: Install libseccomp2 from backports on Debian 10

libseccomp2 is a required dependency of cri-o-runc package

The one provided in Debian 10 repositories is outdated

* 7816: Remove useless when condition

As this condition is handled by block
 2021-07-23 07:07:16 -07:00
Kenichi Omichi
56e230863a
Separate gvisor_download_url for runsc and shim (#7760) 
To download necessary files in advance for offline deployment,
we can see all file URLs with contrib/offline/generate_list.sh
Most URLs are downloadable, but gvisor's one is not because the
URL is a part of full URLs for gvisor.
To download gvisor's files from the URLs directory, this separates
into two URLs for runsc and the shim.
 2021-07-22 07:51:51 -07:00
cola-zero
f21a707e99
Add containerd on Flatcar Container Linux (#7681) 2021-07-21 06:28:07 -07:00
Florian Ruynat
0ef7af76bc Fixup label for oracle linux bootstrap 2021-07-20 01:29:31 -07:00
Florian Ruynat
18666b3e2d Update multus to 3.7.2 (and move to ghcr.io) 2021-07-20 01:29:31 -07:00
Florian Ruynat
ed87386d7b Set default k8s version to 1.21.3 2021-07-20 01:29:31 -07:00
Florian Ruynat
1ad9b33b08 Add hashes for k8s 1.20.8/.9 and 1.19.12/.13 and 1.21.3 2021-07-20 01:29:31 -07:00
Florian Ruynat
000b4565c2 Fix erroneous ansible args 2021-07-20 01:29:31 -07:00
Florian Ruynat
eda75fc706 Update kube-router to 1.3.0 2021-07-20 01:29:31 -07:00
Florian Ruynat
6583add63a Update flannel to 0.14.0 (moved from coreos repo to flannel-io) 2021-07-20 01:29:31 -07:00
Florian Ruynat
441ad841cc Use dashboard 2.3.1 image 2021-07-20 01:29:31 -07:00
Florian Ruynat
6511c5dd7a Set Helm default version to 3.6.3 2021-07-20 01:29:31 -07:00
Florian Ruynat
d5cbb19b39 Update kube-ovn to 1.7.1 2021-07-20 01:29:31 -07:00
Atsushi Nukariya
417180246c
Fix: typos in docs and comments (#7805) 2021-07-16 18:58:50 -07:00
Fredrik Liv
802fb8b591
Add application credentials support for cinder (#7799) 
* csi-driver: Added possibility to use application credentials for cinder

* external-cloud-controller: Added env vars for openstack application credentials
 2021-07-15 00:56:48 -07:00
spaced
c2cf0d9945
add containerd on fedora CoreOS (#7794) 
* set selinux type t_etc if selinux state is enforcing

* workaround with update repo is no longer needed
remove comments about failing playbook

* grubby is not available in distros using ostree

* remove docker support because removed in fcos
update install script example with live rootfs

* do not call grubby on ostree based distro

* update docs enabling containerd on fedora coreos
 2021-07-15 00:00:48 -07:00
jayonlau
e61a9077f4
Clean up extra spaces about configuration-qemu.toml.j2 (#7795) 
Clean up extra spaces, although these errors are not important, they affect the code specification.
 2021-07-13 06:38:34 -07:00
spaced
bf54dc082b
set selinux type t_etc if selinux state is enforcing (#7791) 2021-07-13 06:34:29 -07:00
cleveritcz
3ff7bc1f64
Added k8s 1.21.2 (#7789) 2021-07-13 06:26:29 -07:00
Cristian Calin
7516fe142f
Move to Ansible 3.4.0 (#7672) 
* Ansible: move to Ansible 3.4.0 which uses ansible-base 2.10.10

* Docs: add a note about ansible upgrade post 2.9.x

* CI: ensure ansible is removed before ansible 3.x is installed to avoid pip failures

* Ansible: use newer ansible-lint

* Fix ansible-lint 5.0.11 found issues

* syntax issues
* risky-file-permissions
* var-naming
* role-name
* molecule tests

* Mitogen: use 0.3.0rc1 which adds support for ansible 2.10+

* Pin ansible-base to 2.10.11 to get package fix on RHEL8
 2021-07-12 00:00:47 -07:00
Sébastien Huss
b0e4c375a7
Allow cri-o offline install (#7777) 2021-07-09 20:52:45 -07:00
Florian Ruynat
d1388d69d0
Fix tests following python change (#7775) 
* Fix ansible detection for python3 and ubuntu

* Fix oracle missing centos-extras repo for containerd/docker dependencies
 2021-07-08 18:52:53 -07:00
Shinerrs
d0fb537448
Ubuntu changed package name python-apt to python3-apt (#7769) 
* replaced deprecated python package with python3 package

* removed the version due to duplication
 2021-07-02 06:56:13 -07:00
jayonlau
59cf1770bc
Clean up residual files about /usr/libexec (#7756) 
When reset, need to clean up directory /usr/libexec.
 2021-07-01 02:13:54 -07:00
Vadim
0aaba5ea30
added destination filename to cp command (#7764) 2021-06-30 08:13:03 -07:00
Cristian Calin
bd6d810d0a
nodelocaldns: allow binding metrics address to host IP (#7748) 2021-06-29 05:28:41 -07:00
jayonlau
e3850fbbbc
Extra spaces of macvlan (#7752) 
Although these errors are not important, they affect the code specification.
 2021-06-28 02:13:25 -07:00
Cristian Calin
a3e34f589a
Enable Graceful Node Shutdown for Kubernetes >= 1.21.0 (#7746) 
* Enable Graceful Node Shutdown for Kubernetes >= 1.21.0

* Add sample graceful shutdown parameters
 2021-06-27 23:53:25 -07:00
Cristian Calin
a2cf6816ce
Calico wireguard (#7638) 
* Calico: add Wireguard support

* CI: Add Calico Wireguard scenario
 2021-06-25 03:22:45 -07:00
jayonlau
bbcafb5d7b
Clean up residual files about modules-load.d (#7737) 
When reset, need to clean up files kube_proxy-ipvs.conf and kubespray-br_netfilter.conf.
 2021-06-25 00:32:45 -07:00
Id2ndR
a31baf3c16
Fix deployment without openstack cacert (#7723) 
* fix group name

* fix external-openstack-cloud-config secret

* don't add ca.cert in the secret if not defined
 2021-06-21 05:38:50 -07:00
jayonlau
e83728897b
Clean up residual files (#7722) 
* Clean up residual files

When reset, you need to clean up to the kerw directory.

* Update main.yml
 2021-06-21 05:34:50 -07:00
Cristian Calin
282a27a07c
gVisor: initial support for gVisor container runtime (#7661) 
* Docker/Containerd: move downloads urls to containerd-common

* gVisor: initial support for gVisor container runtime
 2021-06-21 05:18:51 -07:00
Sergey
3fe6dbb65c
fix image pull url for coredns v1.8.0 (#7702) 2021-06-16 17:00:19 -07:00
flix444
7547e6a272
Ubuntu 21.04 changed packagename python-apt in python3-apt (#7715) 2021-06-16 13:58:00 -07:00
Cristian Calin
1928dafc7e
Revert to conmon location override for Redhat and Fedora (#7701) 2021-06-16 09:07:59 -07:00
Florian Ruynat
e77b9bf3ee
Update kube-ovn to 1.7.0 (#7686) 2021-06-16 08:10:00 -07:00
Samuel Liu
7f7e83a4d9
fix local-path-provisioner helper image repo (#7703) 2021-06-16 08:06:00 -07:00
Marko Kohtala
85fe716d46
Drop "Server" from crio repo URL (#7698) (#7699) 
$releasever can be 7Server, but there is no such CentOS path on
download.opensuse.org.

Use ansible_distribution_major_version instead of $releasever.
 2021-06-11 05:10:59 -07:00
Kenichi Omichi
85ff3eb8be
Update the version of local_volume_provisioner (#7684) 
As [1], v2.4.0 has been released already for local_volume_provisioner.
This updates the version.

[1]: https://github.com/kubernetes-sigs/sig-storage-local-static-provisioner/tags
 2021-06-11 04:36:59 -07:00
Florian Ruynat
e55c359cf9
Updage docker packages to 20.10.7 (#7685) 2021-06-11 04:32:59 -07:00
Kasakaze
d66da21726
make sure serviceaccounts/token is only in the metadata stage (#7679) 2021-06-07 08:38:40 -07:00
forselli-stratio
1069b05e68
Improve scale flow and documentation (#7610) 
* Improve scale flow

* Add confirmation prompt again
 2021-06-07 05:02:40 -07:00
Cristian Calin
ec0c0d4a28
Calico enable support for eBPF (#7618) 
* Calico: align manifests with upstream

* allow enabling typha prometheus metrics

* Calico: enable eBPF support

* manage the kubernetes-services-endpoint configmap

* Calico: document the use of eBPF dataplane

* Calico: improve checks before deployment

* enforce disabling kube-proxy when using eBPF dataplane
* ensure calico_version is supported
 2021-06-07 04:58:39 -07:00
jiriproX
1739b27231
Replace yum module with package module (#7621) 2021-06-05 04:16:39 -07:00
Sergey
d9d29af87f
update containerd to version 1.4.6 (#7674) 2021-06-03 10:55:38 -07:00
Cristian Calin
7036b704b3
Replace Kata 1.x with Kata 2.x (#7670) 
* Kata: add Kata 2.x checksums and adjust download urls for 2.x

* Kata: drop 1.x version which is no longer supported

* Kata: set default version 2.1.0
 2021-06-02 00:50:41 -07:00
Florian Ruynat
54cda80018
Fix debian docker available version (#7668) 2021-06-01 20:58:39 -07:00
Cristian Calin
6a2ea94b39
Docs improvements (#7660) 
* Docs: update sidebar

* Docs: move registry documentation into docs/

* Docs: move rbd_provisioner documentation into docs/

* Docs: move cephfs_provisioner into docs/

* Docs: move local_volume_provisioner documentation into docs/

* Docs: move ambassador.md to docs/ingress_controller/

* Docs: move metallb.md to docs/ingress_controller/

* Docs: move ingress_nginx documentation into docs/

* Docs: move alb_ingress_controller documentation into docs/

* Docs: merge ambassador documentation into docs/ingress_controller/

* Docs: move cert_manager documentation into docs/

* Docs: move bootstrap-os documentation into docs/

* Docs: update file locations in sidebar
 2021-06-01 07:30:27 -07:00
Cedric Hnyda
4674b03661
Add cinder_csi_ignore_volume_az (#7624) 
Signed-off-by: Cedric Hnyda <cedric.hnyda@itera.io>
 2021-06-01 07:10:27 -07:00
kongxs
922de32290
spelling mistakes (#7664) 
Signed-off-by: kjinan <2008kongxiangsheng@163.com>
 2021-05-31 05:46:26 -07:00
Florian Ruynat
7896bc7831
Add Fedora 33 image and CI, remove Fedora 31 (EOL) + update docker packages (#7657) 
* Update docker package to 20.10.6

* Add Fedora 33 image and CI, remove Fedora 31 (EOL)
 2021-05-28 08:04:25 -07:00
AnatomicJC
da07459bd6
Update crun 0.19 checksum (#7655) 
Checksum of crun 0.19 is not correct, this commit fixes it
 2021-05-27 15:20:23 -07:00
Fredrik Liv
3ca205446e
Added possibility to specify vSphere credentials via env variables (#7646) 
* Added possibility to specify vSphere credentials via env variables

* Removed excessive spacing
 2021-05-27 12:02:30 -07:00
forselli-stratio
eff1931283
Add retries to 'Set label for route reflector' task (#7645) 2021-05-27 12:02:23 -07:00
Florian Ruynat
fd8ae54fa7 Docker default version is now 20.10 2021-05-27 11:18:24 -07:00
Florian Ruynat
79fdee3979 Bump crio to default 1.21 2021-05-27 11:18:24 -07:00
Florian Ruynat
a754c0d476 Kubernetes now use CoreDNS 1.8.0 2021-05-27 11:18:24 -07:00
Florian Ruynat
7208169db3 Update kubernetes version to 1.21.1 2021-05-27 11:18:24 -07:00
Cristian Calin
7b5d43cc00
Calico: upgrade 3.18 to 3.18.4 (#7648) 2021-05-26 05:51:21 -07:00
Cristian Calin
c5ccedb694
store openstack external cloud controller ca.cert in a k8s secret instead of the host filesystem (#7603) 2021-05-26 00:35:21 -07:00
Cristian Calin
858b29f425
Calico: add support for v3.19.1 (#7630) 
* Calico: add v3.19.1 hashes

* enable liveness probe for calico-kube-controllers

3.19.1

* Calico: drop support for v3.16.x

* Calico: promote v3.18.3 as default
 2021-05-25 13:40:50 -07:00
efrikin
7db76f8809
Add nodeSelctor for other services and node labels before CNI setup (#7613) 2021-05-25 13:40:43 -07:00
Florian Ruynat
bcf695913f
Fix Oracle yum disabled repository file after EPEL install (#7639) 2021-05-25 08:30:23 -07:00
Fatih Sarhan
59fc17f4e3
Override the default value of containerd's root, state, and oom_score (#7622) 
* Override the default value of containerd's root, state, and oom_score configurations

* Add tests data for containerd_storage_dir, containerd_state_dir and containerd_oom_score variables
 2021-05-19 08:24:53 -07:00
Florian Ruynat
c1aa755a3c
Fix missing broken_etcd filter in recover control plane task (#7619) 2021-05-18 10:29:04 -07:00
Pavel Martynov
29c2fbdbc1
Fix cloud_resolver type from str to list (issue #7605) (#7606) 2021-05-18 06:41:30 -07:00
Pavel Martynov
4b9f98f933
Fix pull_by_digest variable type to boolean instead of str (#7612) 2021-05-18 06:29:31 -07:00
Cristian Calin
e9870b8d25
add support for using ansible 2.10.x for deploying kubespray (#7600) 
* add support for using ansible 2.10.x for deploying kubespray

* move dns-autoscaler-clusterrole{binding}.yml to files/ folder

* note that ansible 2.10 is now experimentally supported

* coredns: move files to templates like before #4341
 2021-05-18 05:39:31 -07:00
Muzi Li
e0c74fa082
Update nerdctl version to 0.8.1 (#7617) 2021-05-17 11:07:30 -07:00
Florian Ruynat
bdf74c6749 Set default version to 1.20.7 2021-05-14 09:48:06 -07:00
Florian Ruynat
d6f9a8d752 Update hashes with 1.21.1/1.20.7/1.19.11 2021-05-14 09:48:06 -07:00
Cristian Calin
14cf3e138b
Support Calico advertisement of MetalLB LoadBalancer IPs (#7593) 
* add initial MetalLB docs

* metallb allow disabling the deployment of the metallb speaker

* calico>=3.18 allow using calico to advertise service loadbalancer IPs

* Document the use of MetalLB and Calico

* clean MetalLB docs
 2021-05-12 05:22:17 -07:00
emiran-orange
afbabebfd5
Enables Calico serviceAccount token monitoring and update of /etc/cni/net.d/calico-kubeconfig if need be. (#7586) 
Since K8S 1.21, BoundServiceAccountTokenVolume feature gate is in beta stage, thus activated by default (anyone who follows CSI guidelines has enabled AllAlpha and faced the issue before 1.21).
With this feature, SA tokens are regenerated every hour.
As a consequence for Calico CNI, token in /etc/cni/net.d/calico-kubeconfig copied from /var/run/secrets/kubernetes.io/serviceaccount in install-cni initContainer expires after one hour and any pod creation fails due to unauthorization.
Calico pods need to be restarted so that /etc/cni/net.d/calico-kubeconfig is updated with the new SA token.
 2021-05-11 08:47:36 -07:00
Cristian Calin
8c0a2741ae
allow overriding calico peers names and avoid ipv6 naming issues (#7591) 2021-05-11 07:05:36 -07:00
Cristian Calin
d90baa8601
add containerd support for Amazon Linux 2 (#7595) 2021-05-10 19:25:36 -07:00
muzi502
d5660cd37c
Fix reset cluster task failed (#7597) 2021-05-10 17:25:36 -07:00
Cristian Calin
63cec45597
Add Amazon to the check for supported distributions (#7589) 2021-05-10 16:17:36 -07:00
Hari Hud
f07e24db8f
Cleanup duplicate task in etcd role (#7598) 
* Remove the duplicate task in etcd role

* Remove inessential delegate_to
 2021-05-10 16:11:36 -07:00
Cristian Calin
5d5be3e96a
bump calico 3.18 to v3.18.3 (#7592) 2021-05-10 00:34:51 -07:00
Hari Hud
6e7649360f
Ignore error when ipvsadm utility not found on node (#7587) 2021-05-07 13:37:04 -07:00
Cedric Hnyda
1dd38721b3
Add external_openstack_enable_ingress_hostname option for openstack (#7572) 
Signed-off-by: Cedric Hnyda <cedric.hnyda@itera.io>
 2021-05-04 00:33:11 -07:00
Eugene Artemenko
6a001e4971
Add suport of Vsphere CSI driver 2.X versions (#7480) 2021-05-04 00:05:11 -07:00
Samuel Liu
96e6a6ac3f
Add krew support (#7464) 
* Add krew support

* Add reset for krew

* Update install krew(local)

* ansible lint

* yamllint

* fix krew default vars

* fix kubectl_localhost mode

* replace include

* fix e206
 2021-05-03 07:16:03 -07:00
bac-w
2556eb2733
Upgrade cilium role (#7521) 
* Upgrade cilium roles

* Del old test result

* Add hubble ui examples

* Refactor hubble metrics

* Markdown fix pipeline errors

* yamllint check and fix

* refactor install from https://github.com/kubernetes-sigs/kubespray/pull/7520

* Docs syntax change (fix)

* Cilium set default 1.8.9

* Update cilium version in Readme
 2021-04-30 08:09:59 -07:00
MRoci
a0ee569091
change coredns image name to coredns/coredns and prefix v to tag (#7570) 
follow new naming conventions for gcr's coredns image.
starting from 1.21 kubeadm assumes it to be `coredns/coredns`:
this causes the kubeadm deployment being unable to pull image, beacuse `v`
was also added in image tag, until the role `kubernetes-apps` ovverides
it with the old name, which is only compatible with <=1.7.

Backward comptability with kubeadm <=1.20 is mantained checking
kubernetes version and falling back to old names (`coredns:1.xx`) when
the version is less than 1.21
 2021-04-30 07:43:58 -07:00
holmesb
3f4eb9be08
Fixes issue #7573 - Made Calico permissions compatible with v3.18.x (see https://github.com/projectcalico/calico/issues/4557). Specifically, granted watch to custom resources blockaffinities, ipamblocks & ipamhandles (#7575) 2021-04-30 07:25:59 -07:00
muzi502
5ea2d1eb67
Add image_arch in flannel image tag (#7560) 
* Add image_arch variable when download flannel image

* Fix flannel image tag typo with image arch
 2021-04-29 17:51:57 -07:00
Florian Ruynat
ffc38a2237
Fix busybox for tests to reduce dockerhub calls (#7571) 2021-04-29 17:39:57 -07:00
Cristian Calin
360aff4a57
Rename ansible groups to use _ instead of - (#7552) 
* rename ansible groups to use _ instead of -

k8s-cluster -> k8s_cluster
k8s-node -> k8s_node
calico-rr -> calico_rr
no-floating -> no_floating

Note: kube-node,k8s-cluster groups in upgrade CI
      need clean-up after v2.16 is tagged

* ensure old groups are mapped to the new ones
 2021-04-29 05:20:50 -07:00
Sergey
d26191373a
add default empty value for etc_hosts_localhosts_dict_target (#7567) 2021-04-28 11:34:50 -07:00
Cristian Calin
4c06aa98b5
crio: add supported versions 1.20 and 1.21 and align default with k8s version (#7562) 
* crio: add supported versions 1.20 and 1.21 and align default with k8s version

* cri-o: drop versions 1.17 and 1.18 from version matrix

* update note on cri-o version alignment
 2021-04-28 11:30:51 -07:00
muzi502
1b267b6599
Fix calico-kube-controller becomes Error for canal (#7564) 2021-04-28 11:26:52 -07:00
Cristian Calin
dd6efb73f7
Calico new versions v3.17.4 and v3.18.2 (#7563) 
* calico: upgrade from v3.17.3 to v3.17.4

* calico: upgrade from v3.18.1 to v3.18.2
 2021-04-28 08:22:50 -07:00
harihud
0071e3c99c
Update main.yml (#7557) 2021-04-27 15:41:27 -07:00
faruryo
975f84494c
Fix calico-kube-controller becomes Error (#7548) 
Change mode so that calico-kube-controllers can be read because it was changed to run as non-root
https://github.com/projectcalico/kube-controllers/pull/566
 2021-04-26 15:37:03 -07:00
Florian Ruynat
7c86734d2e
Add cri-o 1.20/1.21 (#7544) 2021-04-26 09:21:16 -07:00
Cristian Calin
8665e1de87
Fix cri-o support for Oracle and AlmaLinux (#7541) 2021-04-26 09:11:02 -07:00
Florian Ruynat
c16efc9ab8
Fix Opensuse not working with ansible_distribution (#7551) 2021-04-26 08:37:02 -07:00
muzi502
69806e0a46
Add nerdctl cli tool for containerd user (#7500) 
* Add nerdctl cli tool for containerd user

* Add nerdctl enable option

* Add nerdctl enable option and update nerdctl version to 0.8.0
 2021-04-25 23:47:01 -07:00
Cristian Calin
ad15a4b755
Bump calico versions (#7543) 
* add calico 3.16.10 hashes

* drop old calico version 3.16.9
 2021-04-24 12:37:01 -07:00
Cristian Calin
002a4b03a4
Drop calico 3.15 (#7545) 
* calico: drop support for version 3.15

* drop check for calico version >= 3.3, we are at 3.16 minimum now

* we moved to calico 3.16+ so we can default to /opt/cni/bin/install
 2021-04-23 23:43:14 -07:00
Cristian Calin
73db44b00c
Initial AlmaLinux support (#7538) 
* AlmaLinux: ansible>2.9.19 is needed to know about AlmaLinux

* AlmaLinux: identify as a centos derrivative

* AlmaLinux: add AlmaLinux to checks for CentOS

* Use ansible_os_family to compare family and not distribution
 2021-04-22 23:50:03 -07:00
Florian Ruynat
b32d25942d Minor update to cni-plugins and kube-router 2021-04-22 06:47:42 -07:00
Florian Ruynat
fce705a92b Helm minor update to 3.5.4 2021-04-22 06:47:42 -07:00
Florian Ruynat
6164c90f70 Update kube-ovn to 1.6.2 2021-04-22 06:47:42 -07:00
Samuel Liu
8c7b90ebbf
add ingress controller class (#7522) 2021-04-22 00:22:38 -07:00
Ian Martin
38d9d2ea0e
Ambassador can watch multiple namespaces (#7516) 
* Ambassador can watch multiple namespaces

* update variable name per PR review
 2021-04-22 00:22:31 -07:00
Cristian Calin
384d30b675
add support for configuring cri-o pids_limit (#7525) 2021-04-21 10:55:51 -07:00
Cristian Calin
add61868c6
Add Calico v3.17.3 and v3.18.1 (#7524) 
* add hashes for calico v3.17.3

* add hashes for claico v3.18.1

* bump default calico version to v3.17.3

* calico crds are missing yaml separator breaking kdd
 2021-04-21 10:45:51 -07:00
Xachman
a7493e26e1
add enablerepo: amzn2extra-docker for docker install on aws 2 (#7507) 2021-04-21 07:24:10 -07:00
Kenichi Omichi
ae3a1d7c01
Fix keepcache values of yum_repository (#7506) 
As the official document[1], the parameter keepcache should be
'0' or '1' as string. To avoid the following warning message,
this fixes the parameter value:

  [WARNING]: The value False (type bool) in a string field was
  converted to u'False' (type string). If this does not look
  like what you expect, quote the entire value to ensure it
  does not change.

https://docs.ansible.com/ansible/latest/collections/ansible/builtin/yum_repository_module.html
 2021-04-21 07:20:11 -07:00
Mathieu Parent
e39e3d5c26
Fix OpenId Connect example prefixes (#7527) 
Fixes "mapping values are not allowed in this context
 2021-04-20 17:32:10 -07:00
holmesb
1e7d48846a
Fixes issue #7528 - allow configuring CALICO_STARTUP_LOGLEVEL via a new variable: calico_node_startup_loglevel (#7530) 
Signed-off-by: Brendan Holmes <5072156+holmesb@users.noreply.github.com>
 2021-04-20 15:37:42 -07:00
Florian Ruynat
6001edeecd
Cleanup hashes and 1.18 hooks (#7534) 2021-04-20 15:34:33 -07:00
Frank Ritchie
ce0b7834ff
Refactor cilium_ipsec_enabled check (#7520) 
This is a followup to

https://github.com/kubernetes-sigs/kubespray/pull/7413

Although the code worked there was a desire for a better solution.
Hopefully people will be happy with this alternative.
 2021-04-19 02:06:36 -07:00
Florian Ruynat
1c0836946f Update default Kubernetes version to 1.20.6 2021-04-15 22:26:22 -07:00
Florian Ruynat
bccbe323b7 Add new kubernetes hashes (1.19.10, 1.20.6) 2021-04-15 22:26:22 -07:00
Samuel Liu
d73249a793
Add bash-completion package (#7510) 2021-04-15 08:33:50 -07:00
Florian Ruynat
cd9a03f86c
Update some docker defaults (#7499) 2021-04-14 15:13:07 -07:00
muzi502
b47c21c683
Remove some bash completion file when reset cluster (#7502) 2021-04-14 11:07:09 -07:00
Krystian Młynek
2a2fb68b2f
Add missing proxy environment in crio_repo.yml (#7492) 2021-04-13 01:20:51 -07:00
Etienne Champetier
bf6a39eb84
Add auto_renew_certificates_systemd_calendar (#7490) 
This allow to configure when K8S certificates renewal runs

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
 2021-04-12 09:47:45 -07:00
Etienne Champetier
e444b3c140
Regenerate apiserver.crt on all control-plane nodes (#7463) 
We were regenerating only the cert of the first node
While at it speed up the check step

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
 2021-04-12 09:17:38 -07:00
emiran-orange
d56ac216f4
Use kubeadm_feature_gates instead of kube_feature_gates to leverage kubeadm feature gates and not to interfere with k8s components feature gates (#7447) 2021-04-12 01:05:59 -07:00
Zhong Jianxin
420a412234
Add containerd_extra_args (#7461) 
* Add containerd_extra_args

This is useful for custom containerd config, e.g. auth

Signed-off-by: Zhong Jianxin <azuwis@gmail.com>

* Make containerd config.toml mode 0640

It may contain sensitive information like password

Signed-off-by: Zhong Jianxin <azuwis@gmail.com>
 2021-04-12 01:02:00 -07:00
Samuel Liu
90c643f3ab
format ansible output (#7482) 2021-04-11 00:37:59 -07:00
Florian Ruynat
6d293ba899
Update hashes with 1.21.0 (#7478) 2021-04-09 08:05:05 -07:00
Florian Ruynat
aa086e5407
Remove dead code from kubeadm-etcd (#7470) 2021-04-09 01:10:47 -07:00
Sergey
cce0940e1f
add CI test for auto_renew_certificates (#7472) 
* add CI test for auto_renew_certificates

* change timer value

fix typo error in rotate cert script
 2021-04-09 00:42:47 -07:00
Samuel Liu
e2a7f3e2ab
remove-node roles: fix kubectl absolute path (#7469) 
* kubelet absolute path

* kubelet absolute path
 2021-04-08 12:24:02 -07:00
Kenichi Omichi
5a351b4b00
Add condition for audit_webhook_mode batch (#7444) 
According to the document[1], audit-webhook-batch-max-size and
audit-webhook-batch-max-wait are used only in the batch mode.
This adds a condition to avoid unnecessary writting on the config.

[1]: https://kubernetes.io/docs/tasks/debug-application-cluster/audit/#batching
 2021-04-08 07:52:56 -07:00
Frank Ritchie
6f2abbf79c
Move cilium kvstore settings to configmap (#7462) 
This PR is to move the cilium kvstore options to the configmap
rather than specifying them in the deployment as args. This
is not technically necessary but keeping all the options in
one place is probably not a bad idea.

Tested with cilium 1.9.5.
 2021-04-08 07:32:56 -07:00
Florian Ruynat
bef1e628ac
Fix issue with 'latest' in containerd version (#7459) 2021-04-07 08:33:53 -07:00
Frank Ritchie
a6622b176b
Update cilium_ipsec_enabled check (#7413) 
When attempting a fresh install without cilium_ipsec_enabled I ran
into the following error:

failed: [k8m01] (item={'name': 'cilium', 'file': 'cilium-secret.yml', 'type': 'secret', 'when': 'cilium_ipsec_enabled'}) =>
{"ansible_loop_var": "item", "changed": false, "item": {"file": "cilium-secret.yml", "name": "cilium", "type": "secret",
"when": "cilium_ipsec_enabled"},"msg": "AnsibleUndefinedVariable: 'cilium_ipsec_key' is undefined"}

Moving the when condition from the item level to the task level solved
the issue.
 2021-04-06 06:17:33 -07:00
Maciej Wereski
771a5e26bb
Add KubeSchedulerConfiguration for k8s 1.19 and up (#7351) 
* Add KubeSchedulerConfiguration for k8s 1.19 and up

With release of version 1.19.0 of kubernetes KubeSchedulerConfiguration
was graduated to beta. It allows to extend different stages of
scheduling with profiles. Such effect is achieved by using plugins and
extensions.

This patch adds KubeSchedulerConfiguration for versions 1.19 and later.
Configuration is set to k8s defaults or to kubespray vars. Moving those
defaults to new vars will be done in following patch.

Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>

* KubeSchedulerConfiguration: add defaults

Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>
 2021-04-06 00:35:35 -07:00