C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity
5152 commits 17 branches 66 tags 141 MiB
Commit graph

1376 commits

Author SHA1 Message Date
Seongjin Cho 16715adfa0 Adds support for webhook token auth. (#3939) 
Webhook token auth:
https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication

Fixes #3063.
 2018-12-26 01:52:53 -08:00
rongzhang 1bb1ba2274 Fix GPU node Scheduling 2018-12-25 21:37:10 +08:00
Zefool 6ebcaab2bb controlPlaneEndpoint set up through load balancer should be possible … (#3888) 
* controlPlaneEndpoint set up through load balancer should be possible  even in single master setups

Enable load balancer for single-master setups
Fixes an issue where single-master setups are not reachable using the usual admin.conf from outside the cluster. 

controlPlaneEndpoint set up through load balancer should be possible  even in single master setups

* add fix to other api versions

* remove obsolete check completely

* remove check, pass 2

* removes checks in client configuration

* delete 'and'
 2018-12-25 00:03:32 -08:00
Rong Zhang cd42e649a7 Fix reconfigure and upgrade cluster (#3938) 2018-12-24 23:06:27 -08:00
rongzhang dd4159fe65 Delete unused controlPlane for join node 
it is used for join master or use --experimental-control-plane argments
 2018-12-23 00:31:01 +08:00
Seongjin Cho e7b835eb4c Fix duplicate storage-backend (#3906) 2018-12-20 01:01:39 -08:00
Rong Zhang 925a820b56 Fix skip upgrade first master (#3915) 2018-12-19 05:16:14 -08:00
Matthew Mosesohn 50b884a32d Fixup line breaks for kubeadm SANs (#3908) 2018-12-19 02:47:31 -08:00
Ganesh Maharaj Mahalingam 73aee004ac Enable ClearLinux as a distro in kubespray (#3855) 
Signed-off-by: Ganesh Maharaj Mahalingam <ganesh.mahalingam@intel.com>
 2018-12-18 01:39:25 -08:00
ihard 30a9149b52 add vars for cilium init container (#3893) 
* add vars for cilium init container

* make yamllint happy

* add var cilium_init in downloads
 2018-12-18 00:34:19 -08:00
Egor dc8a8011be Load nf_conntrack module if nf_conntrack_ipv4 failed (#3764) 2018-12-12 05:33:54 -08:00
Maxim Snezhkov 5e84dabb46 Fix assertion for alone etcd nodes (#3847) 2018-12-12 05:21:54 -08:00
Maxim Snezhkov 90a7941d56 Fix disabling swap on ubuntu systems (#3864) 2018-12-11 02:42:00 -08:00
Egor 7da9880ff7 Move node-cidr-mask-size to ControllerManagerextraArgs (#3845) 2018-12-07 04:23:17 -08:00
pasqualet ea833a4cd7 Fix apiServerCertSANs in kubeadm config file (#3839) 2018-12-07 00:11:08 -08:00
Andreas Krüger d5ce5874e8 Streamline path to certs dir (#3836) 
* Streamline path to certs dir

* More fixes

* Set path to etcd certs in kubernetes defaults instead
 2018-12-06 23:11:53 -08:00
Rong Zhang 225f765b56 Upgrade kubernetes to v1.13.0 (#3810) 
* Upgrade kubernetes to v1.13.0

* Remove all precense of scheduler.alpha.kubernetes.io/critical-pod in templates

* Fix cert dir

* Use kubespray v2.8 as baseline for gitlab
 2018-12-06 12:11:48 -08:00
Andreas Krüger ddffdb63bf Remove non-kubeadm deployment (#3811) 
* Remove non-kubeadm deployment

* More cleanup

* More cleanup

* More cleanup

* More cleanup

* Fix gitlab

* Try stop gce first before absent to make the delete process work

* More cleanup

* Fix bug with checking if kubeadm has already run

* Fix bug with checking if kubeadm has already run

* More fixes

* Fix test

* fix

* Fix gitlab checkout untill kubespray 2.8 is on quay

* Fixed

* Add upgrade path from non-kubeadm to kubeadm. Revert ssl path

* Readd secret checking

* Do gitlab checks from v2.7.0 test upgrade path to 2.8.0

* fix typo

* Fix CI jobs to kubeadm again. Fix broken hyperkube path

* Fix gitlab

* Fix rotate tokens

* More fixes

* More fixes

* Fix tokens
 2018-12-06 02:33:38 -08:00
Andreas Krüger 432f8e9841 Fix basic auth tokens for kubeadm deployment. (#3801) 
* Fix basic auth tokens for kubeadm deployment.

* Tokens should be a dependancy on master, not nodes
 2018-12-03 10:44:29 -08:00
karbyshevds b109f52dab Set configure-cloud-routes=false as default if no network plugin is used (#3788) 
* Set configure-cloud-routes=false as default if no network plugin is used

As configure-cloud-routes default value is `true`, so it need to be set to `false` when not required to avoid error messages like:
"Couldn't reconcile node routes: error listing routes: unable to find route table for AWS cluster" 
on, for example, AWS installations that don't use cloud native routing.

* Update kube-controller-manager.manifest.j2

remove extra spaces
 2018-12-03 05:04:03 -08:00
Chad Swenson 487cfa5e6c Add options for configuring control plane component extra volumes (#3779) 
This takes care of a few arbitrary use cases that may require custom mounts
inside of apiserver, controller manager, or scheduler.
 2018-11-28 23:16:55 -08:00
Chad Swenson b59d5c35bc Fix kubeadm_controller_extra_args (#3778) 2018-11-27 19:30:43 -08:00
Michal Belica 8331f7b056 Add support for setting custom node taints (#3774) 
Introduced variable node_taints which can be set in inventory for
specific hosts or in group_vars, which generates --register-with-taints
command line argument for kubelet.
 2018-11-27 15:56:49 -08:00
Rong Zhang ddc19f43ba Add cloud provider config to kubeadm deployments (#3766) 2018-11-27 05:03:03 -08:00
Egor 9a5438ce2f Fix kubeadm-config: add kube_network_node_prefix (#3761) 2018-11-27 00:12:16 -08:00
Aivars Sterns b07e93e08b
Merge pull request #3754 from MiaoZhou/fix-aws-node-label-error 
Fix AWS Node Labels Error
 2018-11-27 09:09:54 +02:00
Andreas Krüger bad886ca9b Update defaults to match k8s 1.12 suggestions (#3760) 
* Update defaults to match k8s 1.12 suggestions

* Test if Netchecker works with node ip instead of localhost

* Update defaults to ipvs and coredns

* Update defaults for kube_apiserver_insecure_port

* Update main.yaml
 2018-11-26 15:36:39 -08:00
Miao Zhou 885c6cff71 Fix AWS Node Labels Error 
Now the `kubespray-aws-inventory.py` script always set a node_labels key
to ansible_host.

When AWS instance did not set property labels, it would be an empty
string.

The TASK `Write kubelet config file (kubeadm or non-kubeadm)` will
failed with a msg:

`AnsibleUndefinedVariable: 'unicode object' has no attribute 'items'`.
 2018-11-23 17:37:41 +08:00
Rong Zhang 0cfcd39d55 Switch to kubeadm deployment mode (#3461) 
* Switch to kubeadm deployment mode

Discuss:https://github.com/kubernetes-incubator/kubespray/issues/3301

* Add non-kubeadm upgrage to kubeadm cluster
 2018-11-21 01:35:40 -08:00
Matthew Mosesohn daa290100c Fix helper script to refer to admin.conf as relative path (#3738) 2018-11-19 18:28:51 -08:00
Matthew Mosesohn ac00d23b80 Skip etcd upgrade steps in kubeadm because it is not used (#3737) 2018-11-19 06:29:58 -08:00
Danny Kulchinsky 9ae2eefb9a Add resource-container flag to kube-proxy manifest (#3519) 
* Add resource-container flag to kube-proxy manifest

* add resourceContainer: "" to kubeadm kube-proxy configs
 2018-11-19 00:39:29 -08:00
Andreas Krüger 6e01c1e377 Fix missing run_once (#3733) 2018-11-18 21:39:29 -08:00
Matthew Mosesohn ff09141a14 Retry kubeadm proxy and secondary master init tasks (#3715) 
Due to suboptimal external loadbalancer configs, the LoadBalancer
might point to a downed kube-apiserver that is not set up yet.
 2018-11-15 10:03:23 -08:00
Arslanbekov Denis d188876a91 Added feature-gates flags in kubelet.env (for kubeadm) (#3713) 2018-11-15 10:01:53 -08:00
Andreas Krüger 931c76e58f Add DNS entries to node certs (#3710) 2018-11-14 13:58:17 -08:00
Erwan Miran 3fafa583d1 hostnameOverride on a per-node basis (#3708) 2018-11-14 09:37:53 -08:00
Dann 98d766c68e Moves apiserver port to bindPort when using controlPlaneEndpoint (#3449) 2018-11-14 00:23:30 -08:00
Arnaud MAZIN 633bfa7ebc Bring static tokens and user back to 1.12 (#3593) 2018-11-13 10:25:59 -08:00
Andreas Krüger afc3f7dce4 Create certificates for each node too (#3698) 2018-11-13 07:10:59 -08:00
Ryler Hockenbury e8901a2422 Apply linux node selector to coreDNS deployment (#3688) 
* Apply linux node selector to coreDNS deployment

* Remove comment before linux node selector on manifests

* mend
 2018-11-13 04:54:15 -08:00
Miao Zhou fefa1670a6 fix calico_version wrong get (#3694) 
the ':' makes wrong return of calico_version after the calicoctl downloaded && before the cluster is up
 2018-11-12 07:35:21 -08:00
Antoine Legrand 3dcb914607 Remove Vault (#3684) 
* Remove Vault

* Remove reference to 'kargo' in the doc

* change check order
 2018-11-10 08:51:24 -08:00
Bily Zhang b2b421840c Fix some typos (#3690) 
Signed-off-by: mooncake <xcoder@tenxcloud.com>
 2018-11-10 15:53:58 +01:00
RuriRyan c2710899ed Fixes network restart for Ubuntu Bionic Beaver (#3600) 
As Ubuntu Bionic Beaver uses systemd-networkd the step fails
if it tries to restart networking, as it is nonexistent.
 2018-11-09 08:13:57 -08:00
Erwan Miran a6932b6b81 Install ipvsadm when kube_proxy_mode is ipvs (#3548) 2018-11-07 14:04:11 -08:00
Erwan Miran 77d705ca9f cluster_name is to be set in initConfiguration too (#3661) 2018-11-07 12:41:11 -08:00
Erwan Miran 1e22c83f0f kube_override_hostname must be in kubernetes/master role defaults (#3647) 2018-11-07 12:38:19 -08:00
Erwan Miran 1ad1e80ae3 Checking new CA key presence is not relevant to determine if kubeadm has already run (#3653) 2018-11-07 11:46:11 -08:00
Matthew Mosesohn 2ba4e9bda5 Skip most of kubernetes/preinstall role during late DNS config (#3627) 
When using resolvconf_mode host_resolvconf, there is an early DNS
config stage where Kubernetes cluster DNS is not injected for host
DNS intially. Later, the cluster DNS is enabled, but we do not
need to run every task from the kubernetes/preinstall role.
 2018-11-01 08:08:50 -07:00
Louis a84508d6b9 remove deprecated parameters of blockinfile module (#3581) 2018-10-30 05:56:58 -07:00
Louis 93104d9224 fix typo 2018-10-24 11:39:15 +08:00
Matthew Mosesohn 7e84de2ae1 Purge /root/.kube/config when migrating to kubeadm (#3566) 2018-10-23 05:09:11 -07:00
Maxim Makarov 8a17de327e Not necessary run on Nginx proxy all cpu cores (#3559) 2018-10-20 13:56:53 -07:00
Matthew Mosesohn 127969d65f Align node-role value for kubeadm compatibility (#3558) 
kubeadm sets node label node-role.kubernetes.io/master=''
and this is not configurable. We should use it everywhere.
 2018-10-20 07:12:54 -07:00
Matthew Mosesohn 4bdd0ce417 Allow kubeadm master untaint to fail (#3549) 2018-10-19 00:38:12 -07:00
Erwan Miran 87193fd270 Fix ansible syntax to avoid ansible warnings (one more) (#3536) 
* warning on meta flush_handlers

* avoid rm

* avoid "Module remote_tmp /root/.ansible/tmp did not exist and was created with a mode of 0700, this may cause issues when running as another user. To avoid this, create the remote_tmp dir with the correct permissions manually" warning on subsequent tasks using blockinfile

* is match
 2018-10-17 12:27:11 -07:00
Erwan Miran 7bec169d58 Fix ansible syntax to avoid ansible deprecation warnings (#3512) 
* failed

* version_compare

* succeeded

* skipped

* success

* version_compare becomes version since ansible 2.5

* ansible minimal version updated in doc and spec

* last version_compare
 2018-10-16 15:33:30 -07:00
Rong Zhang 76fe84fe93 Use imageRepository instead of the unifiedControlPlaneImage (#3484) 2018-10-16 07:26:04 -07:00
刘旭 cf4dd645a7 fix --etcd-servers-overrides invalid (#3470) 2018-10-16 07:25:03 -07:00
JuanJo Ciarlante a5edd0d709 [jjo] add kube-router support (#3339) 
* [jjo] add kube-router support

Fixes cloudnativelabs/kube-router#147.

* add kube-router as another network_plugin choice
* support most used kube-router flags via
  `kube_router_foo` vars as other plugins
* implement replacing kube-proxy (--run-service-proxy=true) via
  `kube_proxy_mode: none`, verified in a _non kubeadm_enabled_
  install, should also work for recent kubeadm releases via
  `skipKubeProxyInstall: true` config

* [jjo] address PR#3339 review from @woopstar

* add busybox image used by kube-router to downloads

* fix busybox download groups key

* rework kubeadm_enabled + kube_router_run_service_proxy

- verify it working ok w/the kubeadm_enabled and
  kube_router_run_service_proxy true or false

- introduce `kube_proxy_remove` fact, to decouple logic
  from kube_proxy_mode (which affects kubeadm configmap
  settings, thus no-good to ab-use it to 'none')

* improve kube-router.md re: kubeadm_enabled and kube_router_run_service_proxy

* address @woopstar latest review

* add inventory/sample/group_vars/k8s-cluster/k8s-net-kube-router.yml

* fix kube_router_run_service_proxy conditional for kube-proxy removal

* fix kube_proxy_remove fact (w/ |bool), add some needed kube-proxy tags on my and existing changes

* update kube-router tolerations for 1.12 compatibility

* add PriorityClass to kube-router DaemonSet
 2018-10-16 07:15:05 -07:00
anarcat c33e08c3fa show FQDN first in /etc/hosts (closes: #3521) (#3522) 
The hosts(5) manpage clearly states that the first entry is the
"canonical name", or FQDN (Fully-Qualified Domain Name):

    IP_address canonical_hostname [aliases...]

By using the alias as a first entry, `hostname -f` does not return the
correct domain which breaks all sorts of unrelated functionality (it
has impact over email server configuration, for example).
 2018-10-16 03:55:55 -07:00
Erwan Miran fcd8d850dc Fix ansible syntax to avoid ansible warnings (again) (#3509) 
* Fix ansible syntax to avoid ansible warnings (again)

* warn: false on tar -cfz

* wrong placement of warn:false
 2018-10-15 23:47:04 -07:00
JuanJo Ciarlante 4077934519 [jjo] add DIND support to contrib/ (#3468) 
* [jjo] add DIND support to contrib/

- add contrib/dind with ansible playbook to
  create "node" containers, and setup them to mimic
  host nodes as much as possible (using Ubuntu images),
  see contrib/dind/README.md

- nodes' /etc/hosts editing via `blockinfile` and
  `lineinfile` need `unsafe_writes: yes` because /etc/hosts
  are mounted by docker, and thus can't be handled atomically
  (modify copy + rename)

* dind-host role: set node container hostname on creation

* add "Resulting deployment" section with some CLI outputs

* typo

* selectable node_distro: debian, ubuntu

* some fixes for node_distro: ubuntu

* cpu optimization: add early `pkill -STOP agetty`

* typo

* add centos dind support ;)

* add kubespray-dind.yaml, support fedora

- add kubespray-dind.yaml (former custom.yaml at README.md)
- rework README.md as per above
- use some YAML power to share distros' commonality
- add fedora support

* create unique /etc/machine-id and other updates

- create unique /etc/machine-id in each docker node,
  used as seed for e.g. weave mac addresses

- with above, now netchecker 100% passes WoHooOO!
  🎉 🎉 🎉

- updated README.md output from (1.12.1, verified
  netcheck)

* minor typos

* fix centos node creation, needs earlier udevadm removal to avoid flaky facts, also verified netcheck Ok \o/

* add Q&D test-distros.sh, back to manual /etc/machine-id hack

* run-test-distros.sh cosmetics and minor fixes

* run-test-distros.sh: $rc fix and minor formatting changes

* run-test-distros.sh output cosmetics
 2018-10-15 09:44:02 +02:00
Loic Gouarin 36322901a6 fix kube-controller-manager config with openstack-cacert (#3435) 2018-10-12 06:39:58 -07:00
Johann Queuniet 1911fe5ca8 fix nginx proxy configuration conflicts (#3489) 
* Allow configuration of nginx proxy config path

* Fix the internal nginx configuration location

Signed-off-by: Johann Queuniet <contact@lordran.net>
 2018-10-11 06:33:18 -07:00
Andreas Krüger 2117e8167d Update pre-install verify settings with network checks and etc. (#3504) 
* Update pre-install verify settings with network checks and etc.

* Remove upstream dns server check. It's bogus
 2018-10-11 06:28:21 -07:00
Erwan Miran dd5327ef9e Fix ansible syntax to avoid ansible warnings (#3499) 2018-10-11 00:45:00 -07:00
Erwan Miran 2ab2f3a0a3 Ability to define SSL certificates duration and SSL key size (#3482) 
* Ability to specify ssl certificate duration and ssl key size - etcd/secrets

* Ability to specify ssl certificate duration and ssl key size - helm/contiv + fix contiv missing copy certs generation script
 2018-10-09 04:43:30 -07:00
okamototk c825f4d180 Untaint master when it has node role (#3466) 2018-10-09 01:40:43 -07:00
Dylan 30132d8c35 Removed hostname truncation. (#3409) 2018-10-08 05:14:01 -07:00
Chad Swenson 6602760a48 Support multiple local volume provisioner StorageClasses (#3450) 
- Local Volume StorageClass configuration is now manged by `local_volume_provisioner_storage_classes`, a list of maps that specifies local storage classes with `name` `host_dir` and `mount_dir` keys per entry
- Tasks and templates updated to loop through local volume storage classes
- Previous defaults for path/class names were not changed
- Fixed an issue where a `kubernetes/preinstall` was creating directories inconsistently with the `kubernetes-apps/external_provisioner/local_volume_provisioner` task
 2018-10-05 05:52:25 -07:00
Rong Zhang af97febb04 Upgrade kubernetes to v1.12.0 (#3410) 
* Upgrade kubernetes to v1.12.0

Use kubeadm v1alpha3 config

* Upgrade coredns and etcd

* Upgrage docker to 18.06
 2018-10-04 02:05:55 -07:00
LiuDui 192f7967c9 Remove excess space (#3421) 2018-10-01 00:09:45 -07:00
rboyapat d9f495d391 Fix the dic iteration method in the kubelet template (#3415) 
* Fix the jinja expression for openstack_tenant_id

OS_PROJECT_ID is obsolete in keystone v3 and jinja expression
doesn't set openstack_tenant_id as expected because of
undefined env var. Fixed the expression.

* Fix the dic iteration method in the kubelet template

Kubelet template rendering errors when additional Node lables are
added and using Python3. Update the method to be compatible to both
python2/3

Node lables doesn't work
 2018-09-30 05:10:12 -07:00
sangwook 0536125f75 Better fix for openstack cinder zone issue using ignore-volume-az option (#2980) 
* Better fix for openstack cinder zone issue[1][2]
using ignore-volume-az option[3].
[1]: https://github.com/kubernetes-incubator/kubespray/pull/2155
[2]: https://github.com/kubernetes-incubator/kubespray/pull/2346
[3]: https://github.com/kubernetes/kubernetes/pull/53523

* Remove kube-scheduler-policy.yaml
 2018-09-27 22:15:47 -07:00
Shida Qiu 8b8e534769 remove the redundant space (#3400) 2018-09-27 03:32:26 -07:00
Kuldip Madnani 36898a2c39 Adding pod priority for all the components. (#3361) 
* Changes to assign pod priority to kube components.

* Removed the boolean flag pod_priority_assignment

* Created new priorityclass k8s-cluster-critical

* Created new priorityclass k8s-cluster-critical

* Fixed the trailing spaces

* Fixed the trailing spaces

* Added kube version check while creating Priority Class k8s-cluster-critical

* Moved k8s-cluster-critical.yml

* Moved k8s-cluster-critical.yml to kube_config_dir
 2018-09-25 07:50:22 -07:00
Andreas Krüger d6ebe8c3e7 Sync manifests with kubeadm (#3383) 2018-09-24 02:17:18 -07:00
Sergey Magidovich 2197330727 Add check that kube-master, kube-node and etcd groups are not empty. 2018-09-21 17:02:53 +03:00
k8s-ci-robot 51a5f54fc4
Merge pull request #3335 from AtzeDeVries/fix/ubuntu-xenial-resolv-conf 
Fix/ubuntu xenial resolv conf
 2018-09-20 23:16:11 -07:00
Rajitha Perera e3d562bcdb Support for AWS cloud-config (#1465) 
* Support for AWS cloud-config

* Update docs

* Fix version incompatibilities

* Do not use shorthand `default`

* Add new cloud config variable, roleArn
 2018-09-20 16:31:28 +02:00
rongzhang 4d1055f5d5 Remove some useless files 2018-09-20 20:24:06 +08:00
Andreas Kruger 09b67c1ad5 Remove EFK from Kubespray 2018-09-20 10:44:17 +02:00
k8s-ci-robot 8512cc5cca
Merge pull request #3280 from wozniakjan/openstack/openstack_cacert 
Check `openstack_cacert` for empty string
 2018-09-19 22:42:37 -07:00
k8s-ci-robot 34d1f0bff2
Merge pull request #3351 from woopstar/kubeadm_token_basic_auth_fix 
Mount basic auth or token auth dirs to support it on kubeadm deployments
 2018-09-19 07:50:43 -07:00
Jan Wozniak a330b281e8 Check openstack_cacert for empty string 2018-09-19 16:37:24 +02:00
k8s-ci-robot a8a62afd74
Merge pull request #3304 from kubernetes-incubator/gpu2 
Add support for GPU accelerator
 2018-09-19 07:12:32 -07:00
k8s-ci-robot 7fa682bdd5
Merge pull request #3342 from okamototk/fix_path_for_kubeadm_join 
Add kubelet path for kubeadm.
 2018-09-19 06:17:47 -07:00
Aivars Sterns 34019291b8
Merge pull request #3143 from jbcraig/add_os_trust_id 
add support for openstack trust to cloud provider config
 2018-09-19 16:07:03 +03:00
Antoine Legrand 08179018d4
Merge branch 'master' into gpu2 2018-09-19 15:02:51 +02:00
k8s-ci-robot 39c567de47
Merge pull request #3307 from kaarolch/upgrade_docs 
Calico version verification before cluster upgrade begin.
 2018-09-19 05:15:55 -07:00
Andreas Kruger cac485756b Mount basic auth or token auth dirs to support it on kubeadm deployments 2018-09-19 13:21:58 +02:00
Andreas Kruger c058e7a5ec Remove audit again from Kubeadm 1.10.x. Write mounts not supported untill 1.11 2018-09-19 13:15:14 +02:00
Andreas Kruger e0ddabc463 Add support for kubelet_node_custom_flags 2018-09-19 12:58:06 +02:00
Andreas Kruger 940d2fdbb1 Add missing enforce-node-allocatable to kubelet for kubeadm deployments 2018-09-19 11:54:34 +02:00
Andreas Kruger 1c999b2a61 Move kube_kubeadm_controller_extra_args to controllerManagerExtraArgs section. It was placed in controllerManagerExtraVolumes 2018-09-19 11:24:19 +02:00
Andreas Kruger 8e37841a2e Add audit support to v1alpha1 of Kubeadm 2018-09-19 11:01:30 +02:00
Andreas Kruger 8d1c0c469c Added missing enable-aggregator-routing option 2018-09-19 10:58:46 +02:00
Andreas Kruger 26d7380c2e Sync manifests from non-kubeadm to kubeadm deploy 2018-09-19 10:01:45 +02:00
Takashi Okamoto 95703fb6f2 Add kubelet path for kubeadm. 2018-09-19 03:04:03 +00:00
Karol Chrapek 0121bce9e5 Instead of doc update, change the verify step 2018-09-18 22:13:15 +02:00
AtzeDeVries 4cbd97667d Merge remote-tracking branch 'upstream/master' into fix/ubuntu-xenial-resolv-conf 2018-09-18 09:51:46 +02:00
rongzhang 77e08ba204 Support dynamic kubelet config 
https://kubernetes.io/blog/2018/07/11/dynamic-kubelet-configuration/
 2018-09-18 08:44:39 +08:00
AtzeDeVries 482857611a added extra var for ubuntu 18 netplan resolv 2018-09-17 09:01:55 +02:00
AtzeDeVries 8d8bbc294a fix for resolvconf in ubuntu18 2018-09-17 09:00:55 +02:00
rongzhang 84c4c7dc82 Use synchronize module 2018-09-16 20:36:44 +08:00
rongzhang 1d4aa7abcc Fix upgrade k8s 2018-09-16 10:35:12 +08:00
Rong Zhang aa0da221e9
Merge pull request #2880 from hfinucane/rh7-paths 
Fix #2261 by supporting Red Hat's limited PATH
 2018-09-15 19:27:22 +08:00
k8s-ci-robot ffbe9e7fd8
Merge pull request #1973 from guenhter/rsync-cmd-to-synchronize 
Replace the raw rsync command with the synchronize module
 2018-09-13 03:12:05 -07:00
AtzeDeVries 91b02c057e Add support for GPU accelerator 2018-09-13 11:53:11 +02:00
Erwan Miran af74d85b7d Remove --insecure-bind-address when insecure-port=0 2018-09-12 08:22:11 +02:00
Chad Swenson 97e5f28537
Revert "Remove insecure-port and insecure-bind-address when possible" 2018-09-11 17:42:12 -05:00
k8s-ci-robot 5c2e9a5376
Merge pull request #3252 from mirwan/remove_insecure-bind-address_when_insecure-bind-port_is_0 
Remove insecure-port and insecure-bind-address when possible
 2018-09-07 07:41:21 -07:00
k8s-ci-robot b3a689658b
Merge pull request #3255 from mlushpenko/calico_check 
Fix calico health checks
 2018-09-07 07:39:20 -07:00
k8s-ci-robot 9c49e071d3
Merge pull request #3260 from riverzhang/discoverytimeout 
Add discovery_timeout to join configuration
 2018-09-07 05:20:19 -07:00
rongzhang 0f63924ed4 Add discovery_timeout to join configuration 
https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1alpha2#JoinConfiguration
 2018-09-07 16:28:53 +08:00
mlushpenko ea2c9d8f57 Fix yaml checks 2018-09-06 16:26:57 +02:00
k8s-ci-robot 27905bbddf
Merge pull request #3250 from mattymo/openstack_cacert 
Fix openstack cacert task
 2018-09-06 06:15:59 -07:00
Erwan Miran a5509fc2ce Remove insecure-port and insecure-bind-address when possible 2018-09-06 13:46:09 +02:00
Matthew Mosesohn b614a3504b Fix openstack cacert task 2018-09-06 14:06:06 +03:00
Matthew Mosesohn 991b3dbe54 put back endif in kubelet rkt template 2018-09-06 13:21:22 +03:00
Matthew Mosesohn faedfb6307 remove broken endifs in kubelet rkt mode 2018-09-06 11:59:25 +03:00
Antoine Legrand 7e140e5f3c
Merge pull request #3122 from jbcraig/fix_cacert_feature 
resolve issues with new cacert feature
 2018-09-05 23:31:53 +02:00
rongzhang 435e098751 Fix feature-gates 2018-09-05 22:55:51 +08:00
Erwan Miran a644b7c267 Introducing credentials_dir in order to be able to override it 2018-09-03 18:04:50 +02:00
k8s-ci-robot c32145057d
Merge pull request #3178 from gitphill/patch-1 
Add azure-container-registry-config for Azure
 2018-09-03 05:06:01 -07:00
rboyapat fbb98b0070 Fix the jinja expression for openstack_tenant_id (#3151) 
OS_PROJECT_ID is obsolete in keystone v3 and jinja expression
doesn't set openstack_tenant_id as expected because of
undefined env var. Fixed the expression.
 2018-09-03 14:59:49 +03:00
k8s-ci-robot db11394711
Merge pull request #3200 from pablodav/feature/k8s_win_v1.11 
Required support to start working on windows node support
 2018-09-03 04:51:23 -07:00
Pablo Estigarribia 7cbe3c2171 ensure there is pin priority for docker package to avoid upgrade of docker to incompatible version 
ensure there is pin priority for docker package to avoid upgrade of docker to incompatible version

remove empty when line

ensure there is pin priority for docker package to avoid upgrade of docker to incompatible version

force kubeadm upgrade due to failure without --force flag

ensure there is pin priority for docker package to avoid upgrade of docker to incompatible version

added nodeSelector to have compatibility with hybrid cluster with win nodes, also fix for download with missing container type

fixes in syntax and LF for newline in files

fix on yamllint check

ensure there is pin priority for docker package to avoid upgrade of docker to incompatible version

some cleanup for innecesary lines

remove conditions for nodeselector
 2018-09-02 12:47:06 -03:00
mlushpenko 8e95974930 Fix ports for kubeadm client and master configs for ha setups 2018-09-01 18:02:52 +02:00
Erwan Miran 059cd17b47 Fix target hosts generation when /etc/hosts does not contain 127.0.0.1 or ::1 2018-08-31 16:33:18 +02:00
Antoine Legrand 247b9e83d8 etcd arch-image 2018-08-31 13:45:08 +02:00
Antoine Legrand 9c2098b8fa fix kubelet_max_pod assert 2018-08-31 13:45:08 +02:00
Antoine Legrand 48c0c8d854 Update dir list 2018-08-31 13:45:08 +02:00
rongzhang 2609ec0dc3 Fix copy etcd-ssl-ca failed 2018-08-31 15:06:03 +08:00
rongzhang 16fc22a207 Fix ipvs by kubeadm v1alpha1 2018-08-30 23:04:57 +08:00
k8s-ci-robot d9ea937493
Merge pull request #3187 from mirwan/kubeadm-config_syntax 
Fix kubeadm-config for audit-log-path and feature-gates
 2018-08-30 06:55:43 -07:00
rongzhang 35e5adaf0a Fix kubeadm v1alpha1 configure 2018-08-30 17:44:00 +08:00
k8s-ci-robot 4feb62f6bf
Merge pull request #3193 from riverzhang/fix-lb-kubeadm 
Fix kubeadm lb
 2018-08-29 04:22:40 -07:00
k8s-ci-robot 3bfda55fca
Merge pull request #3061 from okamototk/crio 
cri-o support
 2018-08-29 03:48:40 -07:00
rongzhang 9eade647e6 Fix kubeadm lb 2018-08-29 18:29:24 +08:00
Phill Garrett 1babbcca85
Fix elif azure statement 2018-08-28 15:43:03 +01:00
Phill Garrett f325d13082 Add azure-container-registry-config for Azure 
Seperated out KUBELET_CLOUDPROVIDER env var assignment when cloud_provider equals azure
Appended azure-container-registry-config parameter
 2018-08-28 10:23:25 +00:00
Erwan Miran 52ab54eeea Fix missing quotes for audit-log-path and wrong placement of feature-gates 2018-08-28 09:05:57 +02:00
Takashi Okamoto d407a590a6 container_manager variable to specify runtime. 2018-08-28 06:23:38 +00:00
Takashi Okamoto 5eb805f098 Change timeout for kubeadm 600s. 
* kubeadm timeout is too short and it may interrupt by timeout.
 2018-08-28 04:51:38 +00:00
Takashi Okamoto 236f066635 kubeadm cri-o support. 2018-08-28 02:24:45 +00:00
Takashi Okamoto 5ab8a712d9 Add download_container flag to avoid docker pull when use cri-o. 2018-08-28 01:24:26 +00:00
Takashi Okamoto cf7b9cfeef Support crio in kubelet service. 2018-08-28 01:24:26 +00:00
Takashi Okamoto 6090af29e7 Add cri-o role. 2018-08-28 01:24:26 +00:00
Takashi Okamoto 359009bb05 Download etcd and hyperkube binary. 2018-08-28 01:24:26 +00:00
Takashi Okamoto bdbfa4d403 Add ipvs support for kubeadm 1.10 or later. 2018-08-28 01:24:26 +00:00
Takashi Okamoto 6849788ebc Fix copy ca cert and ca key for kubeadm. 2018-08-28 01:24:25 +00:00
Takashi Okamoto ac639b2a17 Change kubeadm config to run etcd by kubeadm. 2018-08-28 01:24:25 +00:00
Erwan Miran b395bb953f Fix wrong when condition that ends up with jinja error when the content of /etc/hosts contains parenthesis 2018-08-27 21:20:57 +02:00
k8s-ci-robot 7efe287c74
Merge pull request #2474 from mirwan/localhost_in_etc_hosts 
Localhost in hosts files should be updated (if necessary), not overriden
 2018-08-27 06:25:43 -07:00
k8s-ci-robot d43cd9a24c
Merge pull request #3104 from maxbrunet/hotfix/replace-local_actions 
Use delegate_to: localhost instead of local_action
 2018-08-27 02:50:42 -07:00
guenhter fff48d24ea Replace the raw rsync command with the synchronize module 2018-08-27 10:00:21 +02:00
Maxime Brunet 33135f2ada k8s/preinstall: Turn AND condition into a list 2018-08-25 14:33:31 -04:00
k8s-ci-robot f97515352b
Merge pull request #3161 from nutellinoit/kube_proxy_nodeport_addresses 
--nodeport-addresses added on kube-proxy.manifest.j2 and on k8s-cluster.yml
 2018-08-25 02:00:19 -07:00
Erwan Miran 1432e511a2 same work with less lines 2018-08-24 14:06:07 +02:00
Samuele Chiocca cb8be37f72 fix on v1alpha1 2018-08-24 11:19:06 +02:00
Samuele Chiocca e5dd4e1e70 added on v1alpha1 2018-08-24 10:59:06 +02:00
Antoine Legrand 4882531c29
Merge pull request #3115 from oracle/oracle_oci_controller 
Cloud provider support for OCI (Oracle Cloud Infrastructure)
 2018-08-23 18:22:45 +02:00
rongzhang 7b61a0eff0 Fix kubeadm LB configure 
1. join node add LB discoveryTokenAPIServers
2. kubeadm_config_api_fqdn support ipddress and domain_name
 2018-08-23 22:22:34 +08:00
Aivars Sterns 23fd3461bc calico upgrade to v3 (#3086) 
* calico upgrade to v3

* update calico_rr version

* add missing file

* change contents of main.yml as it was left old version

* enable network policy by default

* remove unneeded task

* Fix kubelet calico settings

* fix when statement

* switch back to node-kubeconfig.yaml
 2018-08-23 17:17:18 +03:00
Rong Zhang f453567cce
Merge pull request #3144 from riverzhang/fix-audit-log 
Fix install audit failed
 2018-08-23 14:41:37 +08:00
rongzhang 5a4352657d Fix install audit failed 
1.fix audit log not write
2.fix Parameter not recognized
3.delete kubedm futuregates auditing and use apiServerExtraArgs
 2018-08-23 01:47:15 +08:00
Samuele Chiocca f13bc796d9 added nodePortAddresses on kubeadm conf v1alpha2 (not present on v1alpha1) 2018-08-22 18:43:03 +02:00
Erwan Miran 80cfeea957 psp, roles and rbs for PodSecurityPolicy when podsecuritypolicy_enabled is true 2018-08-22 18:16:13 +02:00
Samuele Chiocca 5d9908c2c3 --nodeport-addresses added on kube-proxy.manifest.j2 
Changed author
 2018-08-22 15:32:07 +02:00
Erwan Miran a7b0c454db Localhost in hosts files should be updated (if necessary), not overriden 2018-08-22 12:10:49 +02:00
Jeff Bornemann 94df70be98 Cloud provider support for OCI (Oracle Cloud Infrastructure) 
Signed-off-by: Jeff Bornemann <jeff.bornemann@oracle.com>
 2018-08-21 17:36:42 -04:00
Mark Eisenblaetter 0c0a2138d9 allow '.' in hostnames 
we use FQDN as inventory_hostname
 2018-08-21 08:24:33 +02:00
Jonathan Craig 5bf152886b add support for openstack trust to cloud provider config 2018-08-20 12:51:25 -04:00
Andreas Krüger 497db69c9f
Merge pull request #3130 from riverzhang/add-control-plane 
Add kubeadm controlplaneEndpoint
 2018-08-20 10:43:50 +02:00
Andreas Krüger c7de737551
Merge pull request #3133 from mirwan/auditlog_to_stdout_w_kubeadm 
Audit log to stdout with kubeadm
 2018-08-20 10:43:22 +02:00
Erwan Miran fc38b6d0ca Ability to define custom audit polcy rules 2018-08-20 07:04:56 +02:00
Erwan Miran c34900e569 Define apiserver flags directly instead of relying on auditPolicy section in order to have the ability to redirect audit log to stdout with kubeadm 2018-08-20 07:00:53 +02:00
Rong Zhang 855f2a55cb
Merge pull request #3135 from ishitatsuyuki/patch-1 
Add bad hostname preflight check
 2018-08-20 12:08:02 +08:00
Rong Zhang fd16f77e20
Merge pull request #3017 from seungkyua/fix_kubeadm_client_conf 
Fix kubeadm client conf
 2018-08-20 10:51:02 +08:00
Tatsuyuki Ishi 3eef8dc8d0 Add bad hostname preflight check 
Hostname must be a valid DNS name, which is checked as https://github.com/kubernetes/apimachinery/blob/master/pkg/util/validation/validation.go#L115

The situation I have encountered is that my hostname contained underscore which is disallowed and apiserver refused to start.
 2018-08-20 09:09:00 +09:00
rongzhang 59176ebbb9 Add kubeadm controlplaneEndpoint 
Nginx LB(default)
Other LB by kubeadm controlplane
 2018-08-20 00:57:13 +08:00
rongzhang b421d0ed5b Fix install nss 2018-08-20 00:07:31 +08:00
Rong Zhang fb309ca446
Merge pull request #3128 from riverzhang/delete-kubeadm 
Remove unused configuration
 2018-08-19 10:01:33 +08:00
rongzhang 095ccef8bd Remove unused configuration 2018-08-19 01:23:20 +08:00
Rong Zhang 0df969ad19
Merge pull request #3117 from mirwan/audit_usecases 
Audit support improvement
 2018-08-19 01:13:22 +08:00
Antoine Legrand ac49bbb336
Merge pull request #2168 from xd007/docker_arm64 
fix docker opts incompatible running on aarch64 Redhat/Centos
 2018-08-17 16:24:07 +02:00
Antoine Legrand 7a0f0126f7
Merge pull request #1295 from xuhuilong/master 
fix curl get calico status error ( error in tls version, centos 7.3 1611)
 2018-08-17 14:29:01 +02:00
Seungkyu Ahn 29894293eb Fix kubeadm client conf 
Fix DiscoveryTokenCACertHashes key to discoveryTokenCACertHashes in kubeadm-client.conf
 2018-08-17 04:40:08 +00:00
Jonathan Craig 4d783fff0d resolve issues with new cacert feature 2018-08-16 23:31:21 -04:00
Antoine Legrand 58ee5f1cc9
Merge pull request #3089 from mattymo/cloudconfig 
Remove erroneous cloud-config task
 2018-08-16 16:17:01 +02:00
Erwan Miran 54548d3b95 kubeadm mounts the hostpaths itself 2018-08-16 13:17:30 +02:00
Erwan Miran 58d4d65fab minor variable fix and reuse + handle auditlog redirected to stdout 2018-08-16 12:51:09 +02:00
rongzhang 2ffc1afe40 Support audit 2018-08-16 14:38:07 +08:00
Maxime Brunet 70b28288a3 Use delegate_to: localhost instead of local_action 
Allow to use `ansible_become: true` (#2969)
And set it to `false` for `localhost` with an `host_var`
 2018-08-14 10:08:43 -04:00
Rong Zhang a11e1eba9e Upgrade kubernetes to V1.11.x (#3078) 
Upgrade Kubernetes to V1.11.2
The kubeadm configuration file version has been upgraded from v1alpha1 to v1alpha2
Add bootstrap kubeadm-config.yaml with external etcd
 2018-08-14 15:13:44 +03:00
Matthew Mosesohn 581a30fdec Remove erroneous cloud-config task 2018-08-10 15:59:18 +03:00
Andreas Krüger d8e77600e2
Merge pull request #3066 from luisyonaldo/fix-conditional 
fix bad conditional
 2018-08-10 10:38:52 +02:00
Luis Nuñez fd380615a0 fix bad conditional 2018-08-09 10:20:45 +02:00
Robert Everson 4eadf3228e Only add admission plugins if defined 2018-08-07 11:25:03 -07:00
Robert Everson 99c5aa5a02 Use k8s default plugin list 2018-08-07 11:25:03 -07:00
Robert Everson 6ed65d762b Separate out plugins into 2 variables 2018-08-07 11:25:03 -07:00
Robert Everson ac18f6cf8b Add support for admission controllers in 1.10 and above 2018-08-07 11:25:03 -07:00
Rong Zhang e71f261935
Merge pull request #3068 from riverzhang/swap 
Enable swap
 2018-08-07 21:29:41 +08:00
rongzhang b902602d16 Enable swap 2018-08-07 21:13:12 +08:00
Rong Zhang c288ffc55d
Merge pull request #2342 from southquist/add-ca-cert 
allow for setting the cacert on openstack cloud provider
 2018-08-07 17:46:01 +08:00
Rong Zhang 9075dbdd3c
Merge pull request #2875 from bradbeam/movault 
Adding cluster_name to api cert alt name for vault
 2018-08-07 17:36:04 +08:00
Rong Zhang 3d19e03294
Merge pull request #3015 from podnov/kube_proxy_healthz_bind_address 
Variablize kube_proxy_healthz_bind_address
 2018-08-07 17:10:33 +08:00
rongzhang ac644ed049 Fix yaml roles error 2018-08-05 18:48:07 +08:00
woosley.xu 72074f283b set local for growpart part 2 2018-07-31 06:56:09 +08:00
woosley.xu a5db3dbea9 set locale for growpart 2018-07-31 06:52:56 +08:00
Seungkyu Ahn 0366600b45 Remove double slash 
Even without this PR, the operation works well.
However, it is better to use a single slash rather than
a double slash in the path.
 2018-07-20 07:34:33 +00:00
Evan Zeimet 6a4ce96b7d Variablize kube_proxy_healthz_bind_address 
This fixes #3014
 2018-07-19 14:19:09 -05:00
Takashi Okamoto 37ccf7e405 Fixed kubectl path. 2018-07-13 15:32:08 +00:00
Matthew Mosesohn 97e0de7e29
Fix vault file owner issues and k8s apiserver cert creation (#2985) 
apiserver cert should be created only once
 2018-07-11 14:58:02 +03:00
Rong Zhang cf445fd4fe
Merge pull request #2930 from alvistack/ingress-nginx-0.16.1 
ingress-nginx: Upgrade to 0.16.2
 2018-07-10 14:42:37 +08:00
Aivars Sterns 72f053d9bb
Merge pull request #2972 from mattymo/force_cni_cp 
Force copy cni files
 2018-07-10 09:40:10 +03:00
Wong Hoi Sing Edison a0defefb3f ingress-nginx: Upgrade to 0.16.2 
ingress-nginx 0.16.2 (https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.16.2)

This patch simplify ingress-nginx deployment by default deploy on
master, with customizable options; on the other hand, remove the
additional Ansible group "kube-ingress" and its k8s node label
injection.

Reference to https://kubernetes.io/docs/concepts/services-networking/ingress/#prerequisites:

    GCE/Google Kubernetes Engine deploys an ingress controller on the master.

By changing `ingress_nginx_nodeselector` plus custom k8s node
label, user could customize the DaemonSet deployment target.

If `ingress_nginx_nodeselector` is empty, will deploy DaemonSet on
every k8s node.
 2018-07-10 12:26:06 +08:00
Dao Hoang Son d306c9708c Remove step that force disable kube_basic_auth. 
The referenced issue (https://github.com/kubernetes/kubeadm/issues/441) has already been fixed.
 2018-07-08 16:57:43 +07:00
Matthew Mosesohn 1a3b9dd864 Force copy cni files 2018-07-06 16:39:42 +03:00
Matthew Mosesohn 5c617c5a8b
Add tags to deploy components by --tags option (#2960) 
* Add tags for cert serial tasks

This will help facilitate tag-based deployment of specific components.

* fixup kubernetes node
 2018-07-06 09:12:13 +03:00
Aivars Sterns 4092f96dd8
Merge pull request #2946 from Miouge1/remove-pid-predicate 
CheckNodePIDPressure is not supported in v1.10
 2018-07-04 18:30:19 +03:00
Matthew Mosesohn c20196f9a0
Remove modprobe binary from kubelet rkt deployment (#2917) 2018-07-02 15:37:24 +03:00
Miouge1 2a279e30b0 CheckNodePIDPressure is not supported in v1.10 2018-06-28 20:10:38 +02:00
southquist c685dc493f allow for setting the cacert on openstack cloud provider 2018-06-28 16:00:13 +02:00
Yumo Yang 6c2f169ea2 update test-pr2 (#2911) 2018-06-22 13:22:26 +03:00
Rong Zhang 1aee6ec371
Merge pull request #2903 from riverzhang/swap 
Add manage swap on the worker node
 2018-06-21 22:20:23 +08:00
rongzhang 3232e2743e Add manage swap on the worker node 2018-06-21 08:15:01 +00:00
Andreas Krüger cbb959151c
Merge pull request #2737 from Miouge1/update-scheduler 
Update kube-scheduler policy
 2018-06-19 14:53:22 +02:00
Andreas Krüger c3d8b131db
Merge pull request #2801 from dvazar/bugfix/undefined__network_plugin__variable 
Fixed "network_plugin" variable
 2018-06-19 10:01:06 +02:00
Matthew Mosesohn 61e97251a5 Improve variable handling for disabling etcd events cluster 2018-06-18 16:58:29 +03:00
Henry Finucane 3ad9e9c5eb Fix #2261 by supporting Red Hat's limited PATH 
Red Hat has this theory that binaries in sbin are too dangerous to be on
the default path, but we need them anyway.

RH7 has /sbin and /usr/sbin as symlinks, so that is no longer important.

I'm adding it to the `PATH` instead of making the path to `modinfo`
absolute because I am worried about breaking support for other
distributions.
 2018-06-15 12:49:22 -07:00
Andreas Krüger 3a569c9dcb
Merge pull request #2750 from w-leads/feature/add-vmname-to-vcp-config 
Add vm_name option to vsphere cloud provider config
 2018-06-14 22:22:34 +02:00
Brad Beam 3d819a6edd Adding cluster_name to api cert alt name for vault 2018-06-12 14:15:07 -05:00
rongzhang 20bd656975 Reconfigure kube-proxy to access kube-apiserver via the LB(kubeadm) 2018-06-12 12:53:50 +00:00
Rong Zhang 10c9fe96b0
Merge pull request #2859 from riverzhang/nginx 
Fix nginx-proxy HA when kubeadm enable
 2018-06-08 01:10:01 +08:00
rongzhang f9ccb93825 Fix nginx-proxy HA when kubeadm enable 2018-06-07 14:27:19 +00:00
Aivars Sterns daeea75fbb
Merge pull request #2835 from oracle/bm_fix-apiserver-access-ip 
roles/kubernetes/client: kubeconfig template should use access_ip
 2018-06-07 11:50:57 +03:00
Matthew Mosesohn 59be578842
Revert "wip pr for improved cert sync" (#2849) 2018-06-06 17:22:25 +03:00
Aivars Sterns cb0a257349
Merge pull request #2819 from oleh-ozimok/fix-cidr-assert 
Fix enough network address space assert
 2018-06-06 07:32:16 +03:00
Di Xu f4d762bb95 fix docker opts incompatible running on aarch64 Redhat/Centos 
On Aarch64, the default cgroup driver for docker is systemd
instead of cgroupfs. Should conform kubelet to use systemd
as cgroup driver as well to keep it consistent with docker.

Without this change, below exception will be raised.
/usr/bin/docker-current: Error response from daemon: shim
error: docker-runc not installed on system.

Change-Id: Id496ec9eaac6580e4da2f3ef1a386c9abc2a5129
 2018-06-05 16:17:16 +08:00
Aivars Sterns 69ea28e187
Merge pull request #2827 from mattymo/testpr 
wip pr for improved cert sync
 2018-06-04 12:43:00 +03:00
Ben Meier 2f5a9e180c kubernetes/client: kubeconfig template should use the access_ip for the chosen master node 2018-06-04 09:51:05 +01:00
Dmitry f912a4ece5 Fix compare AnsibleUnsafeText with int (#2828) 2018-06-04 11:34:10 +03:00
Rong Zhang d1e66f9cc8 Add label to kubelet env for kubeadm deploy cluster (#2841) 2018-06-04 11:26:47 +03:00
Matthew Mosesohn 7433348aae wip pr for improved cert sync 2018-05-30 12:15:11 +03:00
Oleg Ozimok 38f7ba2584 Fix enough network address space assert 2018-05-27 18:01:17 +03:00
dvazar b3f9cae820 fixed a check unknown networks (cilium & contiv) 2018-05-22 16:43:19 +07:00
Andreas Krüger a67bdff28c
Merge pull request #2743 from mrostecki/opensuse-tumbleweed-openssl 
opensuse: Fix OpenSSL package name
 2018-05-22 11:21:04 +02:00
dvazar 4b8daa22f6 Fixes #2800 2018-05-19 00:57:09 +07:00
Andreas Krüger e60a63ea51
Merge pull request #2577 from woopstar/etcd-fix-4 
Makeover of etcd- and etcd-cluster setup.
 2018-05-16 20:49:54 +02:00
Christopher J. Ruwe c1bc4615fe assert that number of pods on node does not exceed CIDR address range 
The number of pods on a given node is determined by the  --max-pods=k
directive. When the address space is exhausted, no more pods can be
scheduled even if from the --max-pods-perspective, the node still has
capacity.

The special case that a pod is scheduled and uses the node IP in the
host network namespace is too "soft" to derive a guarantee.

Comparing kubelet_max_pods with kube_network_node_prefix when given
allows to assert that pod limits match the CIDR address space.
 2018-05-16 11:55:46 +00:00
Matthew Mosesohn 7c93e71801
Upgrade k8s to 1.10.2 (#2748) 
* Upgrade k8s to 1.10.2

Bumped etcd version to 3.2.16 as recommended

* Add ipvs fix for v1.10

* change flannel addons test to ha
 2018-05-15 16:00:29 +03:00
Christopher J. Ruwe 73800ef111 make certificates non-executable 2018-05-15 07:54:32 +00:00
Christopher J. Ruwe 49d106f615 make admin.conf -> .kube/config non-executable 
Almost certainly, the .kube/config file (YAML) should not be executable.
 2018-05-14 09:29:48 +00:00
Miouge1 ad48606e4e Restart scheduler when policy changes 2018-05-14 10:09:30 +02:00
Matthew Mosesohn 07cc981971
refactor vault role (#2733) 
* Move front-proxy-client certs back to kube mount

We want the same CA for all k8s certs

* Refactor vault to use a third party module

The module adds idempotency and reduces some of the repetitive
logic in the vault role

Requires ansible-modules-hashivault on ansible node and hvac
on the vault hosts themselves

Add upgrade test scenario
Remove bootstrap-os tags from tasks

* fix upgrade issues

* improve unseal logic

* specify ca and fix etcd check

* Fix initialization check

bump machine size
 2018-05-11 19:11:38 +03:00
Ryo Nishikawa 51a9379d3c Add vm_name option to vsphere cloud provider config 2018-05-08 12:23:58 -07:00
Andreas Krüger d73d60c9b0
Merge pull request #2600 from maximegaillard/master 
Add Openstack tenant name
 2018-05-08 12:03:01 +02:00
Michal Rostecki 066016cd3e opensuse: Fix OpenSSL package name 
OpenSSL 1.1 package in openSUSE Tumbleweed is named openssl-1_1,
not openssl-1_1_0.
 2018-05-08 10:03:30 +02:00
Andreas Krüger 28d6eb6af1
Merge pull request #2644 from cp3hu/master 
Fix apiserver manifest and kubelet for kube version < 1.9
 2018-05-08 09:22:36 +02:00
Miouge1 70e0998a70 Update kube-scheduler policy 2018-05-03 21:56:51 +02:00
Chad Swenson 595e96ebf1
Merge pull request #2693 from romaindequidt/sync-certs-tasks-fix 
sync certs tasks (fix #2596 #2667)
 2018-05-02 12:17:23 -05:00
woopstar 4c81cd2a71 Merge branch 'master' of https://github.com/kubernetes-incubator/kubespray into etcd-fix-4 2018-05-02 14:45:58 +02:00
Maxime Gaillard 00db751646 Add Openstack tenant name 2018-05-01 09:21:37 +02:00
Tomasz Majchrowski 59789ae02a ISSUE-2706: Provide consistent usage of supplementary_addresses_in_ssl_keys across vault and script mode (#2707) 2018-04-30 14:48:17 +03:00
Andreas Krüger 03de4c0806
Merge pull request #2695 from suzutan/add-oidc-prefix-args 
Add oidc-user-prefix and oidc-group-prefix args
 2018-04-30 09:17:02 +02:00
mirwan 06cdb260f6 labelvalue must be formatted to handle non string values (#2722) 2018-04-29 19:02:14 +03:00
mirwan c3c5817af6 sysctl file should be in defaults so that it can be overriden (#2475) 
* sysctl file should be in defaults so that it can be overriden

* Change sysctl_file_path to be consistent with roles/kubernetes/preinstall/defaults/main.yml
 2018-04-27 18:50:58 +03:00
Markos Chandras 9168c71359 Revert "Revert "Add openSUSE support" (#2697)" (#2699) 
This reverts commit 51f4e6585a.
 2018-04-26 12:52:06 +03:00
Matthew Mosesohn 1a14f1ecc1
Fix vol format for local volume provisioner in rkt (#2698) 2018-04-24 20:32:08 +03:00
Matthew Mosesohn 51f4e6585a
Revert "Add openSUSE support" (#2697) 2018-04-23 14:28:24 +03:00
Suzuka Asagiri f81e6d2ccf
Add oidc-user-prefix and oidc-group-prefix args 2018-04-23 12:23:59 +09:00
Romain DEQUIDT 80dd230a65 sync certs tasks (fix #2596 #2667) 2018-04-22 10:00:31 +02:00
Paul Montero 75950344fb
run_once pre_upgrade tasks which are executing in localhost 2018-04-19 11:38:13 -05:00
Matthew Mosesohn f73717ea35
Mount local volume provisioner dirs for containerized kubelet (#2648) 2018-04-12 22:55:13 +03:00
Aivars Sterns 1967963702
Merge pull request #2380 from hwoarang/add-opensuse-support 
Add openSUSE support
 2018-04-12 20:28:50 +03:00
Chad Swenson d87b6fd9f3 Use dedicated front-proxy-ca for front-proxy-client 2018-04-12 11:03:22 -05:00
Chad Swenson a6a47dbc96
Merge pull request #2617 from bradbeam/savaultcert 
Adding missing service-account certificate for vault
 2018-04-12 11:02:24 -05:00
Aivars Sterns 298c6cb790
Merge pull request #2633 from grebois/patch-3 
Enabling MutatingAdmissionWebhook for Istio Automatic sidecar injection
 2018-04-12 11:53:58 +03:00
Markos Chandras d07f75b389 roles: kubernetes: secrets: Add SUSE support 
Add path for certificate location for SUSE distributions. Also make sure
the 'update-ca-certificates' command is executed on SUSE hosts as well.
 2018-04-11 20:55:02 +01:00
Nirmoy Das 45eac53ec7 roles: kubernetes: preinstall: Install openssl-1.1.0 on Tumbleweed 
The openssl package on Tumbleweed is actually a virtual package covering
openssl-1.0.0 and openssl-1.1.0 implementations. It defaults to 1.1.0 so
when trying to install it and openssl-1.0.0 is installed, zypper fails
with conflicts. As such, lets explicitly pull the package that we need
which also updates the virtual one.

Co-authored-by: Markos Chandras <mchandras@suse.de>
 2018-04-11 17:46:14 +01:00
Markos Chandras e42203a13e roles: kubernetes: preinstall: Add SUSE support 
Add support for installing package dependencies and refreshing metadata
on SUSE distributions

Co-authored-by: Nirmoy Das <ndas@suse.de>
 2018-04-11 17:46:14 +01:00
Christian Phu 3535c29e59 Fix apiserver manifest for kube version < 1.9 2018-04-10 18:17:56 +02:00
Marcelo Grebois 88765f62e6
Updating order 
https://kubernetes.io/docs/admin/admission-controllers/#is-there-a-recommended-set-of-admission-controllers-to-use
 2018-04-10 17:17:39 +02:00
Robin Skahjem-Eriksen 0f35e17e23 Fix new envvar for setting openstack_tenant_id (#2641) 
Changed from OS_PROJECT_ID to OS_PROJECT_NAME.
 2018-04-10 17:23:31 +03:00
Brad Beam 77b3f9bb97 Removing default for volume-plugins mountpoint (#2618) 
All checks test if this is defined meaning there is no way to undefine it.
 2018-04-10 17:19:25 +03:00
Matthew Mosesohn 45f15bf753
Revert "Fix new envvar for setting openstack_tenant_id" (#2640) 2018-04-10 14:37:24 +03:00
Aivars Sterns 913cc5a9af
Merge pull request #2639 from ironhouzi/openstack_tenant_id_fix 
Fix new envvar for setting openstack_tenant_id
 2018-04-10 14:35:28 +03:00
Aivars Sterns a46acfcdd8
Merge pull request #2627 from mattymo/no_more_do_do 
Remove jinja2 dependency of do
 2018-04-10 14:32:29 +03:00
Robin Skahjem-Eriksen 0c0f6b755d Fix new envvar for setting openstack_tenant_id 
Changed from OS_PROJECT_ID to OS_PROJECT_NAME.
 2018-04-10 13:30:48 +02:00
Marcelo Grebois 4c12b273ac
Enabling MutatingAdmissionWebhook for Istio Automatic sidecar injection 
https://istio.io/docs/setup/kubernetes/sidecar-injection.html#automatic-sidecar-injection
 2018-04-09 12:49:05 +02:00
Atoms b68854f79d fix kubectl download location and kubectl.sh helper owner/group remove 2018-04-09 13:19:26 +03:00
Matthew Mosesohn f954bc0a5a Remove jinja2 dependency of do 
While `do` looks cleaner, forcing this extra option in ansible.cfg
seems to be more invasive. It would be better to keep the traditional
approach of `set dummy = ` instead.
 2018-04-09 12:27:53 +03:00
Brad Beam dfc46f02d7 Adding missing service-account certificate for vault 
Missed in #2554
 2018-04-06 15:29:52 -05:00
Daniel Hoherd ca40d51bc6 Fix typos (no logic changes) 2018-04-05 15:54:58 -07:00
Chen Hong 973e7372b4 content: | 2018-04-04 23:05:27 +08:00
Chen Hong b54e091886 Persist ip_vs modules 2018-04-04 18:18:51 +08:00