Commit graph

6062 commits

Author SHA1 Message Date
Mathieu Parent
e39e3d5c26
Fix OpenId Connect example prefixes (#7527)
Fixes "mapping values are not allowed in this context
2021-04-20 17:32:10 -07:00
holmesb
1e7d48846a
Fixes issue #7528 - allow configuring CALICO_STARTUP_LOGLEVEL via a new variable: calico_node_startup_loglevel (#7530)
Signed-off-by: Brendan Holmes <5072156+holmesb@users.noreply.github.com>
2021-04-20 15:37:42 -07:00
Florian Ruynat
6001edeecd
Cleanup hashes and 1.18 hooks (#7534) 2021-04-20 15:34:33 -07:00
Frank Ritchie
ce0b7834ff
Refactor cilium_ipsec_enabled check (#7520)
This is a followup to

https://github.com/kubernetes-sigs/kubespray/pull/7413

Although the code worked there was a desire for a better solution.
Hopefully people will be happy with this alternative.
2021-04-19 02:06:36 -07:00
Cristian Klein
3ac92689f0
exoscale: Rework EIP access from workers (#7337)
Context: Load-balancing in Exoscale is performed by associating many
workers with the same EIP. This works, however, the workers cannot access
themselves via the EIP, which is needed at least for cert-managers
"self-test".

Problem: The old iptables based workaround felt fragile and disappointed
me at least once.

New solution: Add the EIP to a loopback interface on each worker.
2021-04-16 03:22:22 -07:00
Florian Ruynat
1c0836946f Update default Kubernetes version to 1.20.6 2021-04-15 22:26:22 -07:00
Florian Ruynat
bccbe323b7 Add new kubernetes hashes (1.19.10, 1.20.6) 2021-04-15 22:26:22 -07:00
Samuel Liu
d73249a793
Add bash-completion package (#7510) 2021-04-15 08:33:50 -07:00
Florian Ruynat
cd9a03f86c
Update some docker defaults (#7499) 2021-04-14 15:13:07 -07:00
muzi502
b47c21c683
Remove some bash completion file when reset cluster (#7502) 2021-04-14 11:07:09 -07:00
Florian Ruynat
6de5303e3f
Fix sample inventory (offline template) (#7498) 2021-04-14 03:28:43 -07:00
Krystian Młynek
2a2fb68b2f
Add missing proxy environment in crio_repo.yml (#7492) 2021-04-13 01:20:51 -07:00
Samuel Liu
844ebb7838
fix offline mode (#7493)
* fix offline mode

* add offline messages
2021-04-13 00:46:50 -07:00
Etienne Champetier
332cc1cd58
Check if python netaddr and recent enough jinja are installed (#7486)
CentOS 7 provides up to date Ansible with really old jinja version

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-04-13 00:43:01 -07:00
Peter Zhang
e7ce83016e
correct a wrong word (#7484)
* correct a wrong word

* correct a wrong word
2021-04-13 00:42:50 -07:00
Etienne Champetier
bf6a39eb84
Add auto_renew_certificates_systemd_calendar (#7490)
This allow to configure when K8S certificates renewal runs

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-04-12 09:47:45 -07:00
Florian Ruynat
42382e2cde
Update Terraform/Vagrant + increase tf_ovh retries (#7477) 2021-04-12 09:47:39 -07:00
Zachary Chang
f8e4650791
Fix typo (#7489) 2021-04-12 09:43:38 -07:00
Etienne Champetier
e444b3c140
Regenerate apiserver.crt on all control-plane nodes (#7463)
We were regenerating only the cert of the first node
While at it speed up the check step

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-04-12 09:17:38 -07:00
emiran-orange
d56ac216f4
Use kubeadm_feature_gates instead of kube_feature_gates to leverage kubeadm feature gates and not to interfere with k8s components feature gates (#7447) 2021-04-12 01:05:59 -07:00
Zhong Jianxin
420a412234
Add containerd_extra_args (#7461)
* Add containerd_extra_args

This is useful for custom containerd config, e.g. auth

Signed-off-by: Zhong Jianxin <azuwis@gmail.com>

* Make containerd config.toml mode 0640

It may contain sensitive information like password

Signed-off-by: Zhong Jianxin <azuwis@gmail.com>
2021-04-12 01:02:00 -07:00
Samuel Liu
90c643f3ab
format ansible output (#7482) 2021-04-11 00:37:59 -07:00
Mathieu Parent
1d4e380231
Remove containerd_runtimes var in k8s-cluster.yml (#7476)
Also set in all/containerd.yml
2021-04-09 10:25:17 -07:00
Florian Ruynat
6d293ba899
Update hashes with 1.21.0 (#7478) 2021-04-09 08:05:05 -07:00
Florian Ruynat
aa086e5407
Remove dead code from kubeadm-etcd (#7470) 2021-04-09 01:10:47 -07:00
Sergey
cce0940e1f
add CI test for auto_renew_certificates (#7472)
* add CI test for auto_renew_certificates

* change timer value

fix typo error in rotate cert script
2021-04-09 00:42:47 -07:00
Florian Ruynat
daed3e5b6a
Use v2.15.1 as base image for CI (#7466) 2021-04-08 12:28:02 -07:00
Samuel Liu
e2a7f3e2ab
remove-node roles: fix kubectl absolute path (#7469)
* kubelet absolute path

* kubelet absolute path
2021-04-08 12:24:02 -07:00
Kenichi Omichi
5a351b4b00
Add condition for audit_webhook_mode batch (#7444)
According to the document[1], audit-webhook-batch-max-size and
audit-webhook-batch-max-wait are used only in the batch mode.
This adds a condition to avoid unnecessary writting on the config.

[1]: https://kubernetes.io/docs/tasks/debug-application-cluster/audit/#batching
2021-04-08 07:52:56 -07:00
Frank Ritchie
6f2abbf79c
Move cilium kvstore settings to configmap (#7462)
This PR is to move the cilium kvstore options to the configmap
rather than specifying them in the deployment as args. This
is not technically necessary but keeping all the options in
one place is probably not a bad idea.

Tested with cilium 1.9.5.
2021-04-08 07:32:56 -07:00
Florian Ruynat
bef1e628ac
Fix issue with 'latest' in containerd version (#7459) 2021-04-07 08:33:53 -07:00
Samuel Liu
7340a163a4
fix scale (#7449) 2021-04-07 01:35:53 -07:00
Frank Ritchie
a6622b176b
Update cilium_ipsec_enabled check (#7413)
When attempting a fresh install without cilium_ipsec_enabled I ran
into the following error:

failed: [k8m01] (item={'name': 'cilium', 'file': 'cilium-secret.yml', 'type': 'secret', 'when': 'cilium_ipsec_enabled'}) =>
{"ansible_loop_var": "item", "changed": false, "item": {"file": "cilium-secret.yml", "name": "cilium", "type": "secret",
"when": "cilium_ipsec_enabled"},"msg": "AnsibleUndefinedVariable: 'cilium_ipsec_key' is undefined"}

Moving the when condition from the item level to the task level solved
the issue.
2021-04-06 06:17:33 -07:00
Maciej Wereski
771a5e26bb
Add KubeSchedulerConfiguration for k8s 1.19 and up (#7351)
* Add KubeSchedulerConfiguration for k8s 1.19 and up

With release of version 1.19.0 of kubernetes KubeSchedulerConfiguration
was graduated to beta. It allows to extend different stages of
scheduling with profiles. Such effect is achieved by using plugins and
extensions.

This patch adds KubeSchedulerConfiguration for versions 1.19 and later.
Configuration is set to k8s defaults or to kubespray vars. Moving those
defaults to new vars will be done in following patch.

Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>

* KubeSchedulerConfiguration: add defaults

Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>
2021-04-06 00:35:35 -07:00
Necatican Yıldırım
be278f9dba
Add documentation for audit webhook variables (#7434)
* Add documentation for audit webhook variables

* Enclose the value of  audit_webhook_server_url in a codeblock

* Add default value for audit_webhook_batch_max_wait
2021-04-05 13:51:19 -07:00
Florian Ruynat
6479e26904
Replace deprecated 'with_dict' with 'loop' (#7442) 2021-04-05 13:45:19 -07:00
Florian Ruynat
1c7053c9d8
Fix CI template for etcd recover jobs (kube-master rename) (#7441) 2021-04-05 13:41:19 -07:00
Maxime Lavandier
596d0289f8
Remove calico-rr from local inventory hosts file (#7439) 2021-04-05 05:24:12 -07:00
Samuel Liu
7df7054bdc
remove local lb privileged (#7437) 2021-04-05 05:22:14 -07:00
dsy3502
5377aac936
fix typo (#7436) 2021-04-05 01:20:19 -07:00
Necatican Yıldırım
ceb6c172ad
Crun v0.19 support (#7433)
* Add support for crun v0.19

* Change default crun version to v0.19
2021-04-05 01:20:13 -07:00
Samuel Liu
7f52c1d3a2
reset roles need flush iptables:raw (#7426) 2021-04-05 01:16:13 -07:00
Kenichi Omichi
af1e16b934
Remove old note related to offline installation (#7429)
The PR https://github.com/kubernetes-sigs/kubespray/pull/6927 has been
merged and the issue https://github.com/kubernetes-sigs/kubespray/issues/6233
was fixed.
This removes unnecessary note for the above PR.
2021-04-02 09:48:11 -07:00
Daniil Muidinov
2257181ca8
Set containerd version to 1.4.4 (#7398)
* Set containerd version to 1.4.3

* Set containerd version to 1.4.4

Co-authored-by: Barry Melbourne <9964974+bmelbourne@users.noreply.github.com>
2021-04-01 23:20:11 -07:00
orange-llajeanne
7e75d48cc4
local provisioner 'useNodeNameOnly' option can be configured (#7421) 2021-04-01 16:54:11 -07:00
Pasquale Toscano
6330db89a7
Update KataContainers to 1.12.1 (#7427) 2021-04-01 08:55:21 -07:00
Frank Ritchie
f05d6b3711
Add cilium_ipam_mode variable (#7418)
Starting with Cilium v1.9 the default ipam mode has changed to "Cluster
Scope". See:

https://docs.cilium.io/en/v1.9/concepts/networking/ipam/

With this ipam mode Cilium handles assigning subnets to nodes to use
for pod ip addresses. The default Kubespray deploy uses the Kube
Controller Manager for this (the --allocate-node-cidrs
kube-controller-manager flag is set). This makes the proper ipam mode
for kubespray using cilium v1.9+ "kubernetes".

Tested with Cilium 1.9.5.

This PR also mounts the cilium-config ConfigMap for this variable
to be read properly.

In the future we can probably remove the kvstore and kvstore-opt
Cilium Operator args since they can be in the ConfigMap. I will tackle
that after this merges.
2021-04-01 07:33:22 -07:00
Helmut Januschka
cce9d3125d
Update k8s-certs-renew.sh.j2 (#7422)
fix undefinedElse
2021-03-31 00:00:58 -07:00
Etienne Champetier
e381ce57e2
Remove left over nodes_to_drain (#7412)
Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-29 16:17:56 -07:00
Fernando
5dbce6a2bd
add support for custom calico port (#7419) 2021-03-29 08:38:45 -07:00