Raj Perera
41298ccea5
Reverted leftover tasks from cert rotation functionality.
2017-06-20 13:29:31 -04:00
Raj Perera
d2131a8652
Merge branch 'rbac-kp' into rbac-script-cert
2017-06-20 00:54:43 -04:00
Raj Perera
e58d06ddd1
Remove cert rotation code. Remove disclaimer for supported auth methods.
2017-06-20 00:49:33 -04:00
jwfang
ba41d3ee55
kube-proxy use kubeconfig on kube-master
2017-06-20 10:54:02 +08:00
Raj Perera
4e95788e17
Make rotate_kubernetes_certs default to false
2017-06-19 13:20:25 -04:00
Raj Perera
cd143109fc
Merge branch 'rbac-kp' into rbac-script-cert
...
# Conflicts:
# roles/kubernetes-apps/ansible/tasks/main.yml
2017-06-19 12:12:45 -04:00
Raj Perera
eb91eab39a
Extract kubectl commands to resource yaml files and use kube module
2017-06-19 11:00:26 -04:00
Raj Perera
e663c6b61a
Address PR feedback.
...
* Consolidate variable definitions to `kargo-defaults`.
* Set `AlwaysAllow` as the default authorization mode.
* Ability to set multiple authorization modes.
* Various style fixes and typos
2017-06-19 10:24:56 -04:00
jwfang
c4fbf41220
replace insecure port with secure port for apiserver_endpoint on kube-masters
2017-06-19 14:01:35 +08:00
jwfang
36e3aae615
patch system:kube-dns clusterrole for get
2017-06-17 19:53:29 +08:00
jwfang
20cacc09ba
fix rename
2017-06-17 16:22:58 +08:00
Raj Perera
b800f7bb07
Use kubectl patch
2017-06-16 12:29:13 -04:00
Raj Perera
9924a33d6f
Replace static references to system namespace
2017-06-16 11:21:59 -04:00
Raj Perera
992a974b1e
Merge branch 'rbac-kp' into rbac-script-cert
...
# Conflicts:
# roles/kubernetes-apps/ansible/tasks/main.yml
# roles/kubernetes-apps/ansible/templates/kubedns-deploy.yml
# roles/kubernetes-apps/ansible/templates/kubedns-sa.yml
# roles/kubernetes/node/templates/manifests/kube-proxy.manifest.j2
# roles/kubernetes/secrets/files/make-ssl.sh
2017-06-16 11:11:12 -04:00
Raj Perera
0dc38ff9b3
Basic RBAC functionality. (Based from work done by @jwfang ( #1351 ))
...
* Add a flag "authorization_method", when set to "RBAC" enables role based access control.
* Add required cluster roles and bindings for kube-dns
* Patch tiller deployment to use a service account with proper credentials.
* Add a flag to regenerate kubernetes certs on the nodes.
2017-06-16 10:28:23 -04:00
jwfang
7c2816ba73
add label for kube-dns sa
2017-06-16 20:08:19 +08:00
jwfang
acbdfb08ce
run kubedns as system:serviceaccount:kube-system:kube-dns; but dns does NOT work
2017-06-16 18:54:18 +08:00
jwfang
765a5ce1ab
node identified as system:node:<node-name>
2017-06-16 17:15:37 +08:00
jwfang
0ee229488e
certs for system:kube-controller-manager system:kube-scheduler
2017-06-16 14:21:21 +08:00
jwfang
8b58394d8c
seperate kube-proxy certs for each node
2017-06-15 19:20:58 +08:00
jwfang
f3a4c31e66
add kube-node to system:nodes group, add system:kube-proxy cert for kube-proxy
2017-06-15 18:15:52 +08:00
Brad Beam
b73786c6d5
Merge pull request #1335 from bradbeam/imagerepo
...
Set default value for kube_hyperkube_image_repo
2017-06-12 09:46:17 -05:00
Brad Beam
db3e8edacd
Fixing up vault variables
2017-06-08 16:15:33 -05:00
Brad Beam
6e41634295
Set default value for kube_hyperkube_image_repo
...
Fixes #1334
2017-06-08 12:22:16 -05:00
Brad Beam
780308c194
Merge pull request #1174 from jlothian/atomic-docker-restart
...
Fix docker restart in atomic
2017-06-07 12:05:32 -05:00
Brad Beam
696fd690ae
Merge pull request #1092 from bradbeam/rkt_docker
...
Adding flag for docker container in kubelet w/ rkt
2017-06-06 12:58:40 -05:00
Spencer Smith
01c0ab4f06
check if cloud_provider is defined
2017-05-31 08:24:24 -04:00
Spencer Smith
7220b09ff9
Merge pull request #1315 from rsmitty/hostnames-upgrade
...
Resolve upgrade issues
2017-05-30 11:40:19 -04:00
Spencer Smith
56b86bbfca
inventory hostname for cordoning/uncordoning
2017-05-26 17:47:25 -04:00
Spencer Smith
7e2aafcc76
add direct path for cert in AWS with RHEL family
2017-05-26 17:32:50 -04:00
Justin Hunthrop
af55e179c7
adding --skip-exists flag for peer_with_router
2017-05-25 14:29:18 -05:00
zoues
43408634bb
Merge branch 'master' into master
2017-05-23 09:32:28 +08:00
zouyee
d47fce6ce7
upgrade k8s version to 1.6.4
2017-05-23 09:30:03 +08:00
Matthew Mosesohn
9e64267867
Merge pull request #1293 from mattymo/kubelet_host_mode
...
Add host-based kubelet deployment
2017-05-19 18:07:39 +03:00
Josh Lothian
7ae5785447
Removed the other unused handler
...
With live-restore: true, we don't need a special docker restart
2017-05-19 09:50:10 -05:00
Josh Lothian
ef8d3f684f
Remove unused handler
...
Previous patch removed the step that sets live-restore
back to false, so don't try to notify that handler any more
2017-05-19 09:45:46 -05:00
Matthew Mosesohn
cc6e3d14ce
Add host-based kubelet deployment
...
Kubelet gets copied from hyperkube container and run locally.
2017-05-19 16:54:07 +03:00
Spencer Smith
005b01bd9a
Merge pull request #1299 from bradbeam/kubelet
...
Minor kubelet updates
2017-05-18 12:52:43 -04:00
Josh Lothian
6f67367b57
Leave 'live-restore' false
...
Leave live-restore false to updates always pick
up new network configuration
2017-05-17 14:31:49 -05:00
Josh Lothian
9ee0600a7f
Update handler names and explanation
2017-05-17 14:31:49 -05:00
Josh Lothian
30cc7c847e
Reconfigure docker restart behavior on atomic
...
Before restarting docker, instruct it to kill running
containers when it restarts.
Needs a second docker restart after we restore the original
behavior, otherwise the next time docker is restarted by
an operator, it will unexpectedly bring down all running
containers.
2017-05-17 14:31:49 -05:00
Josh Lothian
a5bb24b886
Fix docker restart in atomic
...
In atomic, containers are left running when docker is restarted.
When docker is restarted after the flannel config is put in place,
the docker0 interface isn't re-IPed because docker sees the running
containers and won't update the previous config.
This patch kills all the running containers after docker is stopped.
We can't simply `docker stop` the running containers, as they respawn
before we've got a chance to stop the docker daemon, so we need to
use runc to do this after dockerd is stopped.
2017-05-17 14:31:49 -05:00
Brad Beam
b999ee60aa
Fixing typo in kubelet cluster-dns and cluster-domain flags
2017-05-16 15:43:29 -05:00
Brad Beam
85afd3ef14
Removing old sysv reference
2017-05-16 15:28:39 -05:00
Spencer Smith
1907030d89
issue raw yum command since we don't have facts in bootstrapping
2017-05-16 10:07:38 -04:00
Spencer Smith
efa2dff681
remove conditional
2017-05-12 17:16:49 -04:00
Spencer Smith
31a7b7d24e
default to kubedns and set nxdomain in kubedns deployment if that's the dns_mode
2017-05-12 15:57:24 -04:00
moss2k13
791ea89b88
Updated helm installation
...
Added full path for helm
2017-05-08 09:27:06 +02:00
Spencer Smith
c572760a66
Merge pull request #1254 from iJanki/cert_group
...
Adding /O=system:masters to admin certificate
2017-05-05 10:58:42 -04:00
Brad Beam
69fc19f7e0
Merge pull request #1252 from adidenko/separate-tags-for-netcheck-containers
...
Add support for different tags for netcheck containers
2017-05-05 08:04:54 -05:00
