2029 commits

Author	SHA1	Message	Date
neith00	88204642b7	updated weave to 2.1.3	2018-01-09 13:50:42 +01:00
Matthew Mosesohn	1401286910	Add support for cert alt names for etcd (#2139) ... * Add support for cert alt names for etcd * Update gen_certs_vault.yml	2018-01-09 14:37:34 +03:00
Lukasz Piatkowski	12eb242224	fix fluentd template	2018-01-08 13:40:47 +00:00
Philippe Chepy	df9faa1743	Add support for flex volumes plugins.	2018-01-05 17:56:36 +01:00
ArchiFleKs	ce85bcaee7	Simplify and update OpenStack cloud provider ... Simplify the number of variables necessary to "just" enable OpenStack cloud provider. Also add the new options available in K8s 1.9.	2018-01-05 12:05:24 +01:00
rong.zhang	6ed2a60978	fix run dashboard error	2018-01-04 13:13:36 +08:00
Bogdan Dobrelya	bac3bf1a5f	Fix auto-evaluated API access endpoint for bind IP (#2086) ... Auto configure API access endpoint with a custom bind IP, if provided. Fix HA docs' http URLs are https in fact, clarify the insecure vs secure API access modes as well. Closes: #issues/2051 Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>	2018-01-03 17:40:21 +01:00
RongZhang	e3b684df21	Remove blank lines ... Remove blank lines	2018-01-03 00:54:04 -06:00
Steve Mitchell	e45b30d033	Add etcd key and cert environment variables for use with client auth	2018-01-02 13:52:17 -05:00
Matthew Mosesohn	ad6fecefa8	Update Kubernetes to v1.9.0 (#2100) ... Update checksum for kubeadm Use v1.9.0 kubeadm params Include hash of ca.crt for kubeadm join Update tag for testing upgrades Add workaround for testing upgrades Remove scale CI scenarios because of slow inventory parsing in ansible 2.4.x. Change region for tests to us-central1 to improve ansible performance	2017-12-25 08:57:45 +00:00
Jan Jungnickel	3fdb2ccf55	Revert back to using an empty var as default to exclude hostname (#2110)	2017-12-22 22:09:59 +00:00
Matthew Mosesohn	29f5b55d42	remove unwanted whitespace for kube_override_hostname (#2105)	2017-12-22 11:31:18 +00:00
rong.zhang	5aef52e8c0	fix dashboard certs secret	2017-12-22 11:17:05 +08:00
Matthew Mosesohn	6bb46e3ecb	Fix param names in preparation for Kubernetes v1.9.0 (#2098) ... This does not update v1.9.0, but fixes two incompatibilities when trying to deploy v1.9.0.	2017-12-20 10:48:09 +00:00
Matthew Mosesohn	127bc01857	Do not override kubelet hostname if cloud_provider is used (#2095) ... Starting with Kubernetes v1.8.4, kubelet ignores the AWS cloud provider string and uses the override hostname, which fails Node admission checks. Fixes #2094	2017-12-19 20:18:20 +00:00
Evan Zeimet	a6975c1850	Rename runtime docker_version (#2082) ... Renaming runtime docker_version to prevent setting that value on the command line from breaking the play run. This fixes #2081	2017-12-19 14:47:54 +00:00
Stanislav Makar	b2cb0725ac	Default OpenStack Cinder Storage Class (#2083) ... Add possibility to create default OpenStack Cinder Storage Class Closes: #1609	2017-12-19 14:47:00 +00:00
rong.zhang	b974b144a8	Add RBAC to binding Dahsboard UI	2017-12-18 23:07:19 +08:00
Matthew Mosesohn	bfb25fa47b	Change vault cert ttl to 8y (#2013)	2017-12-15 13:34:00 +00:00
Wei Tie	3bb505d43f	Remove unrequired mounts	2017-12-14 14:59:40 -08:00
Matthew Mosesohn	b135bcb9d9	Split download container task for delegate and non-delegate modes (#2077) ... Ansible cannot seem to handle omitting delegate_to since v2.4.0.0. Possibly related: https://github.com/ansible/ansible/issues/30760	2017-12-14 16:45:54 +00:00
Wei Tie	4e97225424	Add quote for etcd endpoints	2017-12-13 18:35:12 -08:00
rong.zhang	0771cd8599	Remove dashboard_tls_key and dashboard_tls_cert	2017-12-13 15:42:20 +08:00
Fang Zhen	91d848f98a	Make spliting system_search_domains more robust ... The search line in /etc/resolv.conf could have multiple spaces or tabs between domains. split(' ') will give wrong results in some case, use split() without argument instead. e.g. >>> 'domain.tld cluster.tld '.split(' ') ['domain.tld\tcluster.tld', ''] >>> 'domain.tld cluster.tld '.split() ['domain.tld', 'cluster.tld']	2017-12-13 15:39:38 +08:00
rong.zhang	40edf8c6f5	Update dashboard version to v1.8.0 ... Update dependencies to be compatible with Kubernetes v1.8	2017-12-13 12:50:44 +08:00
Chad Swenson	e78562830f	Retry kube container removal during upgrade ... As we have seen with other containers, sometimes container removal fails on the first attempt due to some Docker bugs. Retrying typically corrects the issue.	2017-12-12 12:06:41 -06:00
Simon Li	bef259a6eb	Always set net.bridge.bridge-nf-call-* sysctl	2017-12-12 17:11:35 +00:00
Brad Beam	39ce1bd8be	Merge pull request #2059 from bradbeam/vaultalt ... Fixing alt_names for vault cert generation	2017-12-12 09:28:51 -06:00
Spencer Smith	6291881943	Merge pull request #2057 from rsmitty/master ... set docker_version fact regardless of docker_dns in use	2017-12-12 10:28:14 -05:00
Brad Beam	802fd94dad	Merge pull request #2054 from ArchiFleKs/os-cloud-provider-domain-fix ... Fix domain id for OpenStack provider	2017-12-11 21:06:16 -06:00
Xu Zhipei	66f38a1b31	fix: always only one docker image got synced after download	2017-12-12 09:51:03 +08:00
Brad Beam	d3850a4da5	Fixing alt_names for vault cert generation	2017-12-11 17:28:18 -06:00
Spencer Smith	53a4355e60	set docker_version fact regardless of docker_dns in use	2017-12-11 17:48:11 -05:00
Brad Beam	19def41fdf	Merge pull request #2047 from bradbeam/vaulttime ... Adding retries for vault-temp to come online	2017-12-11 09:04:57 -06:00
ArchiFleKs	44b9dce134	Fix domain id for OpenStack provider ... OpenStack authentication does not support using a mix of DomainID and DomainName, only one or the other should be used.	2017-12-11 15:57:33 +01:00
Brad Beam	fa5a538fe5	Merge pull request #2050 from jbonachera/fix-vault-tls-validation ... append newline char to vault generated certs	2017-12-11 08:41:34 -06:00
Brad Beam	9643c2c1e3	Fixes to reset (#2046) ... - adding additional directories to cleanup (rkt/vault) - targeting kubespray ansible groups instead of all	2017-12-11 12:49:21 +00:00
Brad Beam	93f3614382	Fixes #2039 - changing alt_names to be string instead of list (#2043)	2017-12-11 12:48:07 +00:00
Brad Beam	cbc8a7d679	Merge pull request #1995 from b0r1sp/patch-1 ... Update main.yml	2017-12-10 21:45:02 -06:00
Julien BONACHERA	290bc993a5	append newline char to vault generated certs	2017-12-10 13:06:28 +01:00
Brad Beam	3694657eb6	Adding retries for vault-init to come online	2017-12-09 17:40:44 -06:00
Thomas Sarboni	79417e07ca	Fix systemd service unit for docker >= 17.03 (#1844)	2017-12-08 13:12:45 +00:00
Wei Tie	dad95c873b	Remove templating for etcd members ... Use a etcd-initer init container to generate etcd args, it determines etcd name by comparing its ip and etcd cluster ips. This way will make etcd configuration independent to the ansible templating so that could be easier on adding master nodes.	2017-12-07 23:33:29 -08:00
Spencer Smith	626b35e1b0	Merge pull request #2005 from riverzhang/patch-1 ... Delete helm home	2017-12-07 11:23:30 -05:00
Wei Tie	5881ba43f8	Split contiv etcd and etcd-proxy into two daemonsets ... Putting contiv etcd and etcd-proxy into the same daemonset and manage the difference by a env file is not good for scaling (adding nodes). This commit split them into two daemonsets so that when adding nodes, k8s could automatically starting a etcd-proxy on new nodes without need to run related play that putting env file.	2017-12-06 22:21:50 -08:00
Brad Beam	fed7b97dcb	Merge pull request #2030 from mattymo/removerbaccheck ... Remove RBAC from boolean checks	2017-12-06 23:41:13 -06:00
Spencer Smith	c4458c9d9a	Merge pull request #1997 from mrbobbytables/feature-keepalived-cloud-provider ... Add minimal keepalived-cloud-provider support	2017-12-06 23:28:27 -05:00
riverzhang	aeb3e647d4	Remove the network device created by the flannel (#2006) ... * Remove the network device created by the flannel Remove the network device created by the flannel * Modify flannel.1 device path Modify flannel.1 device path * remove trailing spaces	2017-12-06 14:15:39 +00:00
Kuldip Madnani	fe036cbe77	Adding changes to handle updation of yum Management cache in rhel. (#2026) ... * Adding changes to handle updation of yum cache in rhel. * Removed the redundant spaces	2017-12-06 09:00:41 +00:00
Matthew Mosesohn	952ec65a40	Remove RBAC from boolean checks	2017-12-06 11:57:40 +03:00
Chad Swenson	b8788421d5	Support for disabling apiserver insecure port ... This allows `kube_apiserver_insecure_port` to be set to 0 (disabled). Rework of #1937 with kubeadm support Also, fixed an issue in `kubeadm-migrate-certs` where the old apiserver cert was copied as the kubeadm key	2017-12-05 09:13:45 -06:00
Brad Beam	c2347db934	Merge pull request #1953 from chadswen/dashboard-refactor ... Kubernetes Dashboard v1.7.1 Refactor	2017-12-05 08:50:55 -06:00
Brad Beam	27ead5d4fa	Merge pull request #2003 from abelgana/master ... Change altnames to alt_names	2017-12-05 08:48:32 -06:00
Stanislav Makar	6ade7c0a8d	Update k8s version to 1.8.4 (#2015) ... * Update k8s version to 1.8.4 * Update main.yml	2017-12-04 16:23:04 +00:00
Matthew Mosesohn	a0225507a0	Set helm deployment type to host (#2012)	2017-11-29 19:52:54 +00:00
Steven Hardy	d39a88d63f	Allow setting --bind-address for apiserver hyperkube (#1985) ... * Allow setting --bind-address for apiserver hyperkube This is required if you wish to configure a loadbalancer (e.g haproxy) running on the master nodes without choosing a different port for the vip from that used by the API - in this case you need the API to bind to a specific interface, then haproxy can bind the same port on the VIP: root@overcloud-controller-0 ~]# netstat -taupen | grep 6443 tcp 0 0 192.168.24.6:6443 0.0.0.0:* LISTEN 0 680613 134504/haproxy tcp 0 0 192.168.24.16:6443 0.0.0.0:* LISTEN 0 653329 131423/hyperkube tcp 0 0 192.168.24.16:6443 192.168.24.16:58404 ESTABLISHED 0 652991 131423/hyperkube tcp 0 0 192.168.24.16:58404 192.168.24.16:6443 ESTABLISHED 0 652986 131423/hyperkube This can be achieved e.g via: kube_apiserver_bind_address: 192.168.24.16 * Address code review feedback * Update kube-apiserver.manifest.j2	2017-11-29 15:24:02 +00:00
unclejack	e5d353d0a7	contiv network support (#1914) ... * Add Contiv support Contiv is a network plugin for Kubernetes and Docker. It supports vlan/vxlan/BGP/Cisco ACI technologies. It support firewall policies, multiple networks and bridging pods onto physical networks. * Update contiv version to 1.1.4 Update contiv version to 1.1.4 and added SVC_SUBNET in contiv-config. * Load openvswitch module to workaround on CentOS7.4 * Set contiv cni version to 0.1.0 Correct contiv CNI version to 0.1.0. * Use kube_apiserver_endpoint for K8S_API_SERVER Use kube_apiserver_endpoint as K8S_API_SERVER to make contiv talks to a available endpoint no matter if there's a loadbalancer or not. * Make contiv use its own etcd Before this commit, contiv is using a etcd proxy mode to k8s etcd, this work fine when the etcd hosts are co-located with contiv etcd proxy, however the k8s peering certs are only in etcd group, as a result the etcd-proxy is not able to peering with the k8s etcd on etcd group, plus the netplugin is always trying to find the etcd endpoint on localhost, this will cause problem for all netplugins not runnign on etcd group nodes. This commit make contiv uses its own etcd, separate from k8s one. on kube-master nodes (where net-master runs), it will run as leader mode and on all rest nodes it will run as proxy mode. * Use cp instead of rsync to copy cni binaries Since rsync has been removed from hyperkube, this commit changes it to use cp instead. * Make contiv-etcd able to run on master nodes * Add rbac_enabled flag for contiv pods * Add contiv into CNI network plugin lists * migrate contiv test to tests/files Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> * Add required rules for contiv netplugin * Better handling json return of fwdMode * Make contiv etcd port configurable * Use default var instead of templating * roles/download/defaults/main.yml: use contiv 1.1.7 Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com>	2017-11-29 14:24:16 +00:00
Di Xu	de422c822d	update nginx tag to use multi-arch docker image (#2009)	2017-11-29 10:39:52 +00:00
Matthew Mosesohn	4d3326b542	Raise default vault lease TTL to 10y (#2008)	2017-11-29 10:38:59 +00:00
riverzhang	1b82138142	Delete helm home ... Delete helm home	2017-11-29 13:27:09 +08:00
Christopher Randles	208ff8e350	Allow for more customization of the tiller deploy (#1946)	2017-11-28 18:33:57 +00:00
Matthew Mosesohn	ec54b36e05	add retries for calico/canal etcd commands (#2007)	2017-11-28 16:39:55 +00:00
Spencer Smith	38e8522cbf	Merge pull request #1983 from tomdee/bump-flannel-ver ... Bump flannel version to v0.9.1	2017-11-28 11:38:55 -05:00
Spencer Smith	52f8687397	Merge pull request #1977 from mattymo/initializers ... Disable initializers feature gate if istio is not used	2017-11-28 11:37:41 -05:00
Spencer Smith	43600ffcf8	Merge pull request #1972 from chadswen/master-static-pod-flush ... Additional flush for static pod master upgrade	2017-11-28 11:36:38 -05:00
Christopher Randles	938d2d9e6e	update helm/tiller to v2.7.2 -- security bugfix (#1986)	2017-11-28 14:52:42 +00:00
Kevin Lefevre	9368dbe0e7	update calico to 2.6.2 (#1874) ... Move RS to deployment so no need to take care of the revision history limits : - Delete the old RS - Make Calico manifest a deployment - move deployments to apps/v1beta2 API since Kubernetes 1.8	2017-11-28 12:01:30 +00:00
abelgana	fe3290601a	The variable altnames is used by this task. ... Since the value will change on the default. It needs to change here also.	2017-11-27 06:57:16 -05:00
abelgana	e7173e1d62	Change altnames to alt_names ... Hi, Could you please check if it was a typo? https://www.vaultproject.io/api/secret/pki/ Regards,	2017-11-25 17:29:21 -05:00
Bogdan Dobrelya	8aafe64397	Defaults for apiserver_loadbalancer_domain_name (#1993) ... * Defaults for apiserver_loadbalancer_domain_name When loadbalancer_apiserver is defined, use the apiserver_loadbalancer_domain_name with a given default value. Fix unconsistencies for checking if apiserver_loadbalancer_domain_name is defined AND using it with a default value provided at once. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru> * Define defaults for LB modes in common defaults Adjust the defaults for apiserver_loadbalancer_domain_name and loadbalancer_apiserver_localhost to come from a single source, which is kubespray-defaults. Removes some confusion and simplefies the code. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>	2017-11-23 16:15:48 +00:00
Bob Killen	2140303fcc	add minimal keepalived-cloud-provider support	2017-11-23 08:43:36 -05:00
brx	b80ded63ca	Update main.yml ... just a small spelling mistake	2017-11-21 22:37:52 +01:00
Simon Li	7be2521a31	Add flannel hairping mode	2017-11-21 10:43:50 +00:00
Tom Denham	15b9d54a32	Bump flannel version to v0.9.1	2017-11-16 12:52:18 -07:00
Spencer Smith	bc1a4e12ad	fix broken variable in ansible 2.4.1.0 and ensure tasks for calico-rr (#1982)	2017-11-16 18:44:15 +00:00
Matthew Mosesohn	67419e8d0a	Run rotate_tokens role only once (#1970)	2017-11-15 18:50:23 +00:00
Chad Swenson	849aaf7435	Update to k8s 1.8.3 (#1971)	2017-11-15 17:43:22 +00:00
Chad Swenson	a89ee8c406	Add ability to use custom cert secret instead of init container provisioned self-signed certs	2017-11-15 10:05:52 -06:00
Chad Swenson	0c6f172e75	Kubernetes Dashboard v1.7.1 Refactor ... This version required changing the previous access model for dashboard completely but it's a change for the better. Docs were updated. * New login/auth options that use apiserver auth proxying by default * Requires RBAC in `authorization_modes` * Only serves over https * No longer available at https://first_master:6443/ui until apiserver is updated with the https proxy URL: * Can access from https://first_master:6443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/#!/login you will be prompted for credentials * Or you can run 'kubectl proxy' from your local machine to access dashboard in your browser from: http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/ * It is recommended to access dashboard from behind a gateway that enforces an authentication token, details and other access options here: https://github.com/kubernetes/dashboard/wiki/Accessing-Dashboard---1.7.X-and-above	2017-11-15 10:05:48 -06:00
Matthew Mosesohn	a67349b076	Disable initializers feature gate if istio is not used	2017-11-15 12:56:36 +00:00
Matthew Mosesohn	f9b68a5d17	Revert "Support for disabling apiserver insecure port" (#1974)	2017-11-14 13:41:28 +00:00
chenhonggc	c7910b51a1	--peers DEPRECATED - --endpoints should be used instead (#1943)	2017-11-14 11:28:35 +00:00
Chad Swenson	1f99710b21	Additional flush for static pod master upgrade ... Thought this wasn't required at first but I forgot there's no auto flush at the end of these tasks since the `kubernetes/master` role is not the end of the play.	2017-11-13 18:11:57 -06:00
Aivars Sterns	5e558c361b	update weave-net to 2.0.5 version (#1877)	2017-11-13 16:11:47 +00:00
neith00	5f39efcdfd	adding mount for kubelet to enable rbd mounts (#1957) ... * adding mount for kubelet to enable rbd mounts * fix conditionnal variable name	2017-11-13 14:04:13 +00:00
Stanislav Makar	037edf1215	Fix failed task of setting up bash completion for helm (#1968) ... Closes: #1967	2017-11-13 10:15:53 +00:00
Hyunsun Moon	37125866ca	Make calico_node_ignorelooserpf have an effect (#1945)	2017-11-13 09:35:13 +00:00
Günther Grill	421e73b87c	Add missing exclamation mark in shebang line (#1966)	2017-11-13 09:34:21 +00:00
Brad Beam	c115e5677e	Merge pull request #1828 from hzamani/patch-1 ... Use etcd_access_addresses for vault_etcd_url	2017-11-10 10:56:37 -05:00
Spencer Smith	09d85631dc	Merge pull request #1944 from chadswen/reload-master-pods ... Master component and kubelet container upgrade fixes	2017-11-08 22:23:12 -05:00
Brad Beam	f25e4dc3ed	Merge pull request #1937 from chadswen/disable-api-insecure-port ... Support for disabling apiserver insecure port	2017-11-08 18:13:49 -05:00
Spencer Smith	0126168472	provide environment for rkt trust and run with etcd	2017-11-08 12:57:22 -05:00
Chad Swenson	e9f795c5ce	Master component and kubelet container upgrade fixes ... * Fixes an issue where apiserver and friends (controller manager, scheduler) were prevented from restarting after manifests/secrets are changed. This occurred when a replaced kubelet doesn't reconcile new master manifests, which caused old master component versions to linger during deployment. In my case this was causing upgrades from k8s 1.6/1.7 -> k8s 1.8 to fail * Improves transitions from kubelet container to host kubelet by preventing issues where kubelet container reappeared during the deployment	2017-11-08 01:40:33 -06:00
Chad Swenson	0c7e1889e4	Support for disabling apiserver insecure port ... This allows `kube_apiserver_insecure_port` to be set to 0 (disabled). It's working, but so far I have had to: 1. Make the `uri` module "Wait for apiserver up" checks use `kube_apiserver_port` (HTTPS) 2. Add apiserver client cert/key to the "Wait for apiserver up" checks 3. Update apiserver liveness probe to use HTTPS ports 4. Set `kube_api_anonymous_auth` to true to allow liveness probe to hit apiserver's /healthz over HTTPS (livenessProbes can't use client cert/key unfortunately) 5. RBAC has to be enabled. Anonymous requests are in the `system:unauthenticated` group which is granted access to /healthz by one of RBAC's default ClusterRoleBindings. An equivalent ABAC rule could allow this as well. Changes 1 and 2 should work for everyone, but 3, 4, and 5 require new coupling of currently independent configuration settings. So I also added a new settings check. Options: 1. The problem goes away if you have both anonymous-auth and RBAC enabled. This is how kubeadm does it. This may be the best way to go since RBAC is already on by default but anonymous auth is not. 2. Include conditional templates to set a different liveness probe for possible combinations of `kube_apiserver_insecure_port = 0`, RBAC, and `kube_api_anonymous_auth` (won't be possible to cover every case without a guaranteed authorizer for the secure port) 3. Use basic auth headers for the liveness probe (I really don't like this, it adds a new dependency on basic auth which I'd also like to leave independently configurable, and it requires encoded passwords in the apiserver manifest) Option 1 seems like the clear winner to me, but is there a reason we wouldn't want anonymous-auth on by default? The apiserver binary defaults anonymous-auth to true, but kubespray's default was false.	2017-11-06 14:01:10 -06:00
Günther Grill	0d55ed3600	Avoid that some read-only tasks cause an ansible-change (#1910)	2017-11-06 13:51:07 +00:00
Haiwei Liu	ad0cd6939a	Add support cAdvisor (#1908) ... Signed-off-by: Haiwei Liu <carllhw@gmail.com>	2017-11-06 13:50:28 +00:00
Stanislav Makar	33adb334cd	Fix openstack tenant id variable name (#1932)	2017-11-05 08:40:41 +00:00
Spencer Smith	ef87a8a1f0	Merge pull request #1916 from vtomasr5/master ... Fix bad handler directory name in kubeadm role	2017-11-03 18:14:48 -04:00
Spencer Smith	a595c84f7e	Merge pull request #1928 from chadswen/flannel-rbac-fix ... Flannel RBAC Fix	2017-11-03 18:12:16 -04:00
Chad Swenson	b158dbcf79	Docker Version Update ... Update default docker version to 17.03.1	2017-11-03 12:34:45 -05:00
Matthew Mosesohn	ab3832f3e7	Set host IP for kubelet always (#1924) ... * Set host IP for kubelet always Use ansible default IP if ip var is not set. * Update main.yml	2017-11-03 10:19:37 +00:00
Kevin Lefevre	9bf415f749	update helm to v2.7.0 (#1875) ... * update helm to v2.7.0 * Update main.yml	2017-11-03 07:15:00 +00:00
Günther Grill	a2bda9e5f1	Eliminate jinja2 template expression warning and rename coreos-python var (#1911) ... * Change deprecated vagrant ansible flag 'sudo' to 'become' * Emphasize, that the name of the pip_pyton_modules is only considered in coreos * Remove useless unused variable * Fix warning when jinja2 template-delimiters used in when statement There is no need for jinja2 template-delimiters like {{ }} or {% %} any more. They can just be omitted as described in https://github.com/ansible/ansible/issues/22397 * Fix broken link in getting-started guide	2017-11-03 07:11:36 +00:00
Günther Grill	0195725563	Workaround ansible bug where access var via dict doesn't get real value (#1912) ... * Change deprecated vagrant ansible flag 'sudo' to 'become' * Workaround ansible bug where access var via dict doesn't get real value When accessing a variable via it's name "{{ foo }}" its value is retrieved. But when the variable value is retrieved via the vars-dict "{{ vars['foo'] }}" this doesn't resolve the expression of the variable any more due to a bug. So e.g. a expression foo="{{ 1 == 1 }}" isn't longer resolved but just returned as string "1 == 1". * Make file yamllint complient	2017-11-03 07:11:14 +00:00
Spencer Smith	ec1170bd37	only mount volumes if local_volumes_enabled is true. fix mount flags in rkt. (#1923)	2017-11-03 07:10:37 +00:00
Matthew Mosesohn	66c67dbe73	Add optional helm deployment mode for host (#1920)	2017-11-03 07:09:24 +00:00
Chad Swenson	16ae2c1809	Flannel RBAC Fix ... Fixes a bug that can occur if `cni-flannel-rbac.yml` was written but the playbook failed before it was applied. Uses the same approach as calico.	2017-11-02 23:20:23 -05:00
Spencer Smith	4771716ab2	Merge pull request #1907 from mattymo/disable_anon_auth ... Block anonymous auth requests to kubelet	2017-11-02 12:01:39 -04:00
Spencer Smith	b156585739	Merge pull request #1917 from chadswen/docker-daemon-graph ... Fix kubelet container with alternate Docker data paths	2017-11-02 11:58:55 -04:00
Matthew Mosesohn	520103df78	Change namespace for provisioner account	2017-11-02 10:16:08 +00:00
Matthew Mosesohn	3e3787de15	Fix local volume provisioner mount point for rkt	2017-11-02 09:45:26 +00:00
Chad Swenson	0c824d5ef1	Fix kubelet container with alternate Docker data paths ... Some time ago I think the hardcoded `/var/lib/docker` was required, but kubelet running in a container has been aware of the Docker path since at least as far back as k8s 1.6. Without this change, you see a large number of errors in the kubelet logs if you installed with a non-default `docker_daemon_graph`	2017-11-01 13:25:15 -05:00
Matthew Mosesohn	c0e989b17c	New addon: local_volume_provisioner (#1909)	2017-11-01 14:25:35 +00:00
Vicenç Juan Tomàs Montserrat	5218b3af82	Fix bad handler directory name in kubeadm role	2017-11-01 14:36:28 +01:00
Spencer Smith	ef0a91da27	Merge pull request #1891 from rsmitty/proxy-fixes ... Improved proxy support	2017-10-31 14:32:12 -04:00
Spencer Smith	8412181746	Merge pull request #1899 from skyscooby/update_kube182 ... Update to Kubernetes 1.8.2	2017-10-31 14:30:56 -04:00
Spencer Smith	400ee2aa57	Merge pull request #1898 from skyscooby/update_kubedns ... Update kubedns to 1.14.7 release	2017-10-31 14:30:36 -04:00
Spencer Smith	05b8466f87	Merge pull request #1890 from chadswen/apt-repo-params ... Parameterize dockerproject apt repo endpoints	2017-10-31 14:29:19 -04:00
Spencer Smith	19962f6b6a	fix indentation for master template (#1906)	2017-10-31 06:43:54 +00:00
Matthew Mosesohn	f7703dbca3	Block anonymous auth requests to kubelet	2017-10-30 19:06:54 +00:00
Spencer Smith	74a9eedb93	helm template check for http/https_proxy	2017-10-30 13:11:04 -04:00
Spencer Smith	6df104b275	don't check for no_proxy, only http/https_proxy. fix linting issues.	2017-10-30 11:42:14 -04:00
Spencer Smith	b27453d8d8	improved proxy support	2017-10-30 11:42:14 -04:00
Spencer Smith	4470ee4ccf	Merge pull request #1887 from mattymo/fix_indent_apiserver ... fix indentation for network policy option	2017-10-30 11:33:13 -04:00
Andrew Greenwood	8a86acf75d	Update kubespray-defaults kubernetes to v1.8.2	2017-10-30 09:34:32 -04:00
abelgana	d738acf638	Update kubelet.kubeadm.env.j2 (#1901)	2017-10-30 11:33:02 +00:00
tanshanshan	84d92aa3c7	fix-bug (#1900)	2017-10-30 11:23:24 +00:00
Andrew Greenwood	dd01cabcdc	Update to kubernetes 1.8.2	2017-10-29 22:13:06 -04:00
Andrew Greenwood	c383c7e2c1	Update kubedns image to latest	2017-10-29 21:58:05 -04:00
Andrew Greenwood	958bb5285d	Update kubedns image to latest	2017-10-29 21:57:32 -04:00
Spencer Smith	f0317ae70b	Merge pull request #1876 from ArchiFleKs/update_flannel ... update flannel	2017-10-27 15:22:54 -04:00
Spencer Smith	591941bd39	Merge pull request #1884 from abelgana/master ... Sysctl reload if needed after IP forward enabling	2017-10-27 15:12:08 -04:00
Spencer Smith	e90769c869	Merge pull request #1888 from chapsuk/issue_1885 ... Disable swap in vagrant vms	2017-10-27 15:10:16 -04:00
Chad Swenson	256bbb1a8a	Parameterize apt repo endpoints ... This allows overriding of apt repo endpoints when internet sources are not accessible. Additionally, switch to using the dockerproject.org gpg key url for apt instead of keyservers.net	2017-10-27 13:48:11 -05:00
mkrasilnikov	2c7c956be9	Disable swap in vagrant vms	2017-10-27 19:57:54 +03:00
Matthew Mosesohn	fe81bba08d	Force kubelet certificates to be generated as lowercase (#1886) ... All nodes get converted to lowercase, so certs should set CN with lowercase as well.	2017-10-27 15:58:25 +01:00
Matthew Mosesohn	564de07963	fix indentation for network policy option	2017-10-27 14:56:22 +01:00
Aivars Sterns	84cf6fbe83	change ssh_args/bastion configuration (#1883)	2017-10-27 12:18:39 +01:00
abelgana	d9160f19c0	Sysctl reload if needed after IP forward enabling ... Add reload yes to reload sysctl if the value of net.ipv4.ip_forward changes. - name: Enable ip forwarding sysctl: sysctl_file: "{{sysctl_file_path}}" name: net.ipv4.ip_forward value: 1 state: present reload: yes tags: - bootstrap-os	2017-10-26 13:06:21 -04:00
Brad Beam	ba0a03a8ba	Merge pull request #1880 from mattymo/node_auth_fixes2 ... Move cluster roles and system namespace to new role	2017-10-26 10:02:24 -05:00
Matthew Mosesohn	b0f04d925a	Update network policy setting for Kubernetes 1.8 (#1879) ... It is now enabled by default in 1.8 with the api changed to networking.k8s.io/v1 instead of extensions/v1beta1.	2017-10-26 15:35:26 +01:00
Matthew Mosesohn	ec53b8b66a	Move cluster roles and system namespace to new role ... This should be done after kubeconfig is set for admin and before network plugins are up.	2017-10-26 14:36:05 +01:00
ArchiFleKs	6e949bf951	update flannel	2017-10-26 11:18:06 +02:00
Matthew Mosesohn	86fb669fd3	Idempotency fixes (#1838)	2017-10-25 21:19:40 +01:00
Matthew Mosesohn	7123956ecd	update checksum for kubeadm (#1869)	2017-10-25 21:15:16 +01:00
Spencer Smith	46cf6b77cf	Merge pull request #1857 from pmontanari/patch-1 ... Use same kubedns_version: 1.14.5 in downloads and kubernetes-apps/ansible roles	2017-10-25 10:05:43 -04:00
Matthew Mosesohn	a52bc44f5a	Fix broken CI jobs (#1854) ... * Fix broken CI jobs Adjust image and image_family scenarios for debian. Checkout CI file for upgrades * add debugging to file download * Fix download for alternate playbooks * Update ansible ssh args to force ssh user * Update sync_container.yml	2017-10-25 11:45:54 +01:00
Matthew Mosesohn	acb63a57fa	Only limit etcd memory on small hosts (#1860) ... Also disable oom killer on etcd	2017-10-25 10:25:15 +01:00
Flavio Percoco Premoli	5b08277ce4	Access dict item's value keys using .value (#1865)	2017-10-24 20:49:36 +01:00
Chiang Fong Lee	5dc56df64e	Fix ordering of kube-apiserver admission control plug-ins (#1841)	2017-10-24 17:28:07 +01:00
Matthew Mosesohn	33c4d64b62	Make ClusterRoleBinding to admit all nodes with right cert (#1861) ... This is to work around #1856 which can occur when kubelet hostname and resolvable hostname (or cloud instance name) do not match.	2017-10-24 17:05:58 +01:00
Matthew Mosesohn	25de6825df	Update Kubernetes to v1.8.1 (#1858)	2017-10-24 17:05:45 +01:00
Peter Lee	0b60201a1e	fix etcd health check bug (#1480)	2017-10-24 16:10:56 +01:00
Haiwei Liu	cfea99c4ee	Fix scale.yml to supoort kubeadm (#1863) ... Signed-off-by: Haiwei Liu <carllhw@gmail.com>	2017-10-24 16:08:48 +01:00
Matthew Mosesohn	cea41a544e	Use include instead of import tasks to support v2.3 (#1855) ... Eventually 2.3 support will be dropped, so this is a temporary change.	2017-10-23 13:56:03 +01:00
pmontanari	8371a060a0	Update main.yml ... Match kubedns_version with roles/download/defaults/main.yml:kubedns_version: 1.14.5	2017-10-22 23:48:51 +02:00
Matthew Mosesohn	7ed140cea7	Update refs to kubernetes version to v1.8.0 (#1845)	2017-10-20 08:29:28 +01:00
Matthew Mosesohn	0b4fcc83bd	Fix up warnings and deprecations (#1848)	2017-10-20 08:25:57 +01:00
Matthew Mosesohn	514359e556	Improve etcd scale up (#1846) ... Now adding unjoined members to existing etcd cluster occurs one at a time so that the cluster does not lose quorum.	2017-10-20 08:02:31 +01:00
Matthew Mosesohn	fc9a65be2b	Refactor downloads to use download role directly (#1824) ... * Refactor downloads to use download role directly Also disable fact delegation so download delegate works acros OSes. * clean up bools and ansible_os_family conditionals	2017-10-19 09:17:11 +01:00
Jan Jungnickel	49dff97d9c	Relabel controler-manager to kube-controller-manager (#1830) ... Fixes #1129	2017-10-18 17:29:18 +01:00
Matthew Mosesohn	4efb0b78fa	Move CI vars out of gitlab and into var files (#1808)	2017-10-18 17:28:54 +01:00
Hassan Zamani	c9fe8fde59	Use fail-swap-on flag only for kube_version >= 1.8 (#1829)	2017-10-18 16:32:38 +01:00
Matthew Mosesohn	16462292e1	Properly skip extra SANs when not specified for kubeadm (#1831)	2017-10-18 12:04:13 +01:00
pmontanari	20d80311f0	Update main.yml (#1822) ... * Update main.yml Needs to set up resolv.conf before updating Yum cache otherwise no name resolution available (resolv.conf empty). * Update main.yml Removing trailing spaces	2017-10-18 11:42:00 +01:00
Hassan Zamani	3acc42c5b3	Use etcd_access_addresses for vault_etcd_url	2017-10-17 19:27:36 +03:30
Tennis Smith	54320c5b09	set to 3 digit version number (#1817)	2017-10-17 11:14:29 +01:00
Seungkyu Ahn	291b71ea3b	Changing default value string to boolean. (#1669) ... When downloading containers or files, use boolean as a default value.	2017-10-17 11:14:12 +01:00
Rémi de Passmoilesel	356515222a	Add possibility to insert more ip adresses in certificates (#1678) ... * Add possibility to insert more ip adresses in certificates * Add newline at end of files * Move supp ip parameters to k8s-cluster group file * Add supplementary addresses in kubeadm master role * Improve openssl indexes	2017-10-17 11:06:07 +01:00
Aivars Sterns	688e589e0c	fix #1788 lock dashboard version to 1.6.3 version while 1.7.x is not working (#1805)	2017-10-17 11:04:55 +01:00
刘旭	6c98201aa4	remove kube-dns versions and images in kubernetes-apps/ansible/defaults/main.yaml (#1807)	2017-10-17 11:03:53 +01:00
Matthew Mosesohn	d4b10eb9f5	Fix path for calico get node names (#1816)	2017-10-17 10:54:48 +01:00
Jiří Stránský	728d56e74d	Only write bastion ssh config when needed (#1810) ... This will allow running Kubespray when the user who runs it doesn't have write permissions to the Kubespray dir, at least when not using bastion.	2017-10-17 10:28:45 +01:00
neith00	77f1d4b0f1	Revert "Update roadmap" (#1809) ... * Revert "Debian jessie docs (#1806)" This reverts commit d78577c810. * Revert "[contrib/network-storage/glusterfs] adds service for glusterfs endpoint (#1800)" This reverts commit 5fb6b2eaf7. * Revert "[contrib/network-storage/glusterfs] bootstrap for glusterfs nodes (#1799)" This reverts commit 404caa111a. * Revert "Fixed kubelet standard log environment (#1780)" This reverts commit b838468500. * Revert "Add support for fedora atomic host (#1779)" This reverts commit f2235be1d3. * Revert "Update network-plugins to use portmap plugin (#1763)" This reverts commit 6ec45b10f1. * Revert "Update roadmap (#1795)" This reverts commit d9879d8026.	2017-10-16 14:09:24 +01:00
Seungkyu Ahn	b838468500	Fixed kubelet standard log environment (#1780) ... Change KUBE_LOGGING to KUBE_LOGTOSTDERR, when installing kubelet as host type.	2017-10-16 08:22:54 +01:00
Jason Brooks	f2235be1d3	Add support for fedora atomic host (#1779) ... * don't try to install this rpm on fedora atomic * add docker 1.13.1 for fedora * built-in docker unit file is sufficient, as tested on both fedora and centos atomic	2017-10-16 08:03:33 +01:00
Kevin Lefevre	6ec45b10f1	Update network-plugins to use portmap plugin (#1763) ... Portmap allow to use hostPort with CNI plugins. Should fix #1675	2017-10-16 07:11:38 +01:00
Matthew Mosesohn	d9879d8026	Update roadmap (#1795)	2017-10-16 07:06:06 +01:00
Matthew Mosesohn	d487b2f927	Security best practice fixes (#1783) ... * Disable basic and token auth by default * Add recommended security params * allow basic auth to fail in tests * Enable TLS authentication for kubelet	2017-10-15 20:41:17 +01:00
Julian Poschmann	66e5e14bac	Restart kubelet on update in deployment-type host on update (#1759) ... * Restart kubelet on update in deployment-type host on update * Update install_host.yml * Update install_host.yml * Update install_host.yml	2017-10-15 20:22:17 +01:00
Matthew Mosesohn	7e4668859b	Change file used to check kubeadm upgrade method (#1784) ... * Change file used to check kubeadm upgrade method Test for ca.crt instead of admin.conf because admin.conf is created during normal deployment. * more fixes for upgrade	2017-10-15 10:33:22 +01:00
Matthew Mosesohn	92d038062e	Fix node authorization for cloudprovider installs (#1794) ... In 1.8, the Node authorization mode should be listed first to allow kubelet to access secrets. This seems to only impact environments with cloudprovider enabled.	2017-10-14 11:28:46 +01:00
abelgana	2972bceb90	Changre raw execution to use yum module (#1785) ... * Changre raw execution to use yum module Changed raw exection to use yum module provided by Ansible. * Replace ansible_ssh_* by ansible_* Ansible 2.0 has deprecated the “ssh” from ansible_ssh_user, ansible_ssh_host, and ansible_ssh_port to become ansible_user, ansible_host, and ansible_port. If you are using a version of Ansible prior to 2.0, you should continue using the older style variables (ansible_ssh_*). These shorter variables are ignored, without warning, in older versions of Ansible. I am not sure about the broader impact of this change. But I have seen on the requirements the version required is ansible>=2.4.0. http://docs.ansible.com/ansible/latest/intro_inventory.html	2017-10-14 09:52:40 +01:00
刘旭	cb0a60a0fe	calico v2.5.0 should use calico/routereflector:v0.4.0 (#1792)	2017-10-14 09:51:48 +01:00
Matthew Mosesohn	3ee91e15ff	Use commas in no_proxy (#1782)	2017-10-13 15:43:10 +01:00
Matthew Mosesohn	ef47a73382	Add new addon Istio (#1744) ... * add istio addon * add addons to a ci job	2017-10-13 15:42:54 +01:00
Matthew Mosesohn	dc515e5ac5	Remove kernel-upgrade role (#1798) ... This role only support Red Hat type distros and is not maintained or used by many users. It should be removed because it creates feature disparity between supported OSes and is not maintained.	2017-10-13 15:36:21 +01:00
Julian Poschmann	56763d4288	Persist br_netfilter module loading (#1760)	2017-10-13 10:50:29 +01:00
Matthew Mosesohn	10dd049912	Revert "Security fixes for etcd (#1778)" (#1786) ... This reverts commit 4209f1cbfd.	2017-10-12 14:02:51 +01:00
Matthew Mosesohn	4209f1cbfd	Security fixes for etcd (#1778) ... * Security fixes for etcd * Use certs when querying etcd	2017-10-12 13:32:54 +01:00
Matthew Mosesohn	ee83e874a8	Clear admin kubeconfig when rotating certs (#1772) ... * Clear admin kubeconfig when rotating certs * Update main.yml	2017-10-12 09:55:46 +01:00
Vijay Katam	27ed73e3e3	Rename dns_server, add var for selinux. (#1572) ... * Rename dns_server to dnsmasq_dns_server so that it includes role prefix as the var name is generic and conflicts when integrating with existing ansible automation. * Enable selinux state to be configurable with new var preinstall_selinux_state	2017-10-11 20:40:21 +01:00
Aivars Sterns	e41c0532e3	add possibility to disable fail with swap (#1773)	2017-10-11 19:49:31 +01:00
Matthew Mosesohn	eeb7274d65	Adjust memory reservation for master nodes (#1769)	2017-10-11 19:47:42 +01:00
Matthew Mosesohn	eb0dcf6063	Improve proxy (#1771) ... * Set no_proxy to all local ips * Use proxy settings on all necessary tasks	2017-10-11 19:47:27 +01:00
Matthew Mosesohn	83be0735cd	Fix setting etcd client cert serial (#1775)	2017-10-11 19:47:11 +01:00
Matthew Mosesohn	fe4ba51d1a	Set node IP correctly (#1770) ... Fixes #1741	2017-10-11 15:28:42 +01:00
Hyunsun Moon	adf575b75e	Set default value for disable_shared_pid (#1710) ... PID namespace sharing is disabled only in Kubernetes 1.7. Explicitily enabling it by default could help reduce unexpected results when upgrading to or downgrading from 1.7.	2017-10-11 14:55:51 +01:00
Spencer Smith	e5426f74a8	Merge pull request #1762 from manics/bindir-helm ... Include bin_dir when patching helm tiller with kubectl	2017-10-10 10:40:47 -04:00
Spencer Smith	f5212d3b79	Merge pull request #1752 from pmontanari/patch-1 ... Force synchronize to use ssh_args so it works when using bastion	2017-10-10 10:40:01 -04:00
Spencer Smith	3d09c4be75	Merge pull request #1756 from kubernetes-incubator/fix_bool_assert ... Fix bool check assert	2017-10-10 10:38:53 -04:00
Spencer Smith	f2db15873d	Merge pull request #1754 from ArchiFleKs/rkt-kubelet-fix ... add hosts to rkt kubelet	2017-10-10 10:37:36 -04:00
ArchiFleKs	7c663de6c9	add /etc/hosts volume to rkt templates	2017-10-09 16:41:51 +02:00
Simon Li	c14bbcdbf2	Include bin_dir when patching helm tiller with kubectl	2017-10-09 15:17:52 +01:00
ant31	1be4c1935a	Fix bool check assert	2017-10-06 17:02:38 +00:00
pmontanari	764b1aa5f8	Force synchronize to use ssh_args so it works when using bastion ... In case ssh.config is set to use bastion, synchronize needs to use it too.	2017-10-06 00:21:54 +02:00
Spencer Smith	d13b07ba59	Merge pull request #1751 from bradbeam/calicoprometheus ... Adding calico/node env vars for prometheus configuration	2017-10-05 17:29:12 -04:00
Brad Beam	55dfae2a52	Followup fix for CVE-2017-14491	2017-10-05 11:31:04 -05:00
Brad Beam	b81c0d869c	Adding calico/node env vars for prometheus configuration	2017-10-05 08:46:01 -05:00
Matthew Mosesohn	f14f04c5ea	Upgrade to kubernetes v1.8.0 (#1730) ... * Upgrade to kubernetes v1.8.0 hyperkube no longer contains rsync, so now use cp * Enable node authorization mode * change kube-proxy cert group name	2017-10-05 10:51:21 +01:00
Aivars Sterns	9c86da1403	Normalize tags in all places to prepare for tag fixing in future (#1739)	2017-10-05 08:43:04 +01:00
Spencer Smith	cb611b5ed0	Merge pull request #1742 from mattymo/facts_as_vars ... Move set_facts to kubespray-defaults defaults	2017-10-04 15:46:39 -04:00
Spencer Smith	ab171a1d6d	don't delegate cert slurp	2017-10-04 13:06:51 -04:00
Matthew Mosesohn	a56738324a	Move set_facts to kubespray-defaults defaults ... These facts can be generated in defaults with a performance boost. Also cleaned up duplicate etcd var names.	2017-10-04 14:02:47 +01:00
Matthew Mosesohn	e42cb43ca5	add bootstrap for debian (#1726)	2017-10-03 08:30:45 +01:00
Brad Beam	ca541c7e4a	Ensuring vault service is stopped in reset tasks (#1736)	2017-10-03 08:30:28 +01:00
Brad Beam	96e14424f0	Adding kubedns update for CVE-2017-14491 (#1735)	2017-10-03 08:30:14 +01:00
Matthew Mosesohn	dae9f6d3c2	Test if tokens are expired from host instead of inside container (#1727) ... * Test if tokens are expired from host instead of inside container * Update main.yml	2017-10-02 13:14:50 +01:00
Julian Poschmann	8e1210f96e	Fix cluster-network w/ prefix > 25 not possible with CNI (#1713)	2017-10-01 10:43:00 +01:00
Brad Beam	1b9a6d7ad8	Merge pull request #1672 from manics/bastion-proxycommand-newline ... Insert a newline in bastion ssh config after ProxyCommand conditional	2017-09-29 11:37:47 -05:00
Peter Slijkhuis	371fa51e82	Make installation of EPEL optional (#1721)	2017-09-29 13:44:29 +01:00
Matthew Mosesohn	a55675acf8	Enable RBAC with kubeadm always (#1711)	2017-09-29 09:18:24 +01:00
Matthew Mosesohn	25dd3d476a	Fix error for azure+calico assert (#1717) ... Fixes #1716	2017-09-29 08:17:18 +01:00
Matthew Mosesohn	3ff5f40bdb	fix graceful upgrade (#1704) ... Fix system namespace creation Only rotate tokens when necessary	2017-09-27 14:49:20 +01:00
Matthew Mosesohn	689ded0413	Enable kubeadm upgrades to any version (#1709)	2017-09-27 14:48:18 +01:00
Matthew Mosesohn	327ed157ef	Verify valid settings before deploy (#1705) ... Also fix yaml lint issues Fixes #1703	2017-09-27 14:47:47 +01:00
tanshanshan	477afa8711	when and run_once are reduplicative (#1694)	2017-09-26 14:48:05 +01:00
Matthew Mosesohn	bd272e0b3c	Upgrade to kubeadm (#1667) ... * Enable upgrade to kubeadm * fix kubedns upgrade * try upgrade route * use init/upgrade strategy for kubeadm and ignore kubedns svc * Use bin_dir for kubeadm * delete more secrets * fix waiting for terminating pods * Manually enforce kube-proxy for kubeadm deploy * remove proxy. update to kubeadm 1.8.0rc1	2017-09-26 10:38:58 +01:00
Brad Beam	14c232e3c4	Merge pull request #1663 from foxyriver/fix-shell ... use command module instead of shell module	2017-09-25 13:24:45 -05:00
Brad Beam	57f5fb1f4f	Merge pull request #1661 from neith00/master ... upgrading from weave version 2.0.1 to 2.0.4	2017-09-25 13:23:57 -05:00
Bogdan Dobrelya	bcddfb786d	Merge pull request #1692 from mattymo/old-etcd-logic ... drop unused etcd logic	2017-09-25 17:44:33 +02:00
Martin Uddén	20db1738fa	feature: install project atomic CSS on RedHat family (#1499) ... * feature: install project atomic CSS on RedHat family * missing patch for this feature * sub-role refactor * Yamllint fix	2017-09-25 12:29:17 +01:00
Hassan Zamani	b23d81f825	Add etcd_blkio_weight var (#1690)	2017-09-25 12:20:24 +01:00
Matthew Mosesohn	a1cde03b20	Correct master manifest cleanup logic (#1693) ... Fixes #1666	2017-09-25 12:19:04 +01:00
Bogdan Dobrelya	cfce23950a	Merge pull request #1687 from jistr/cgroup-driver-kubeadm ... Set correct kubelet cgroup-driver also for kubeadm deployments	2017-09-25 11:16:40 +02:00
Deni Bertovic	64740249ab	Adds tags for asserts (#1639)	2017-09-25 08:41:03 +01:00
Matthew Mosesohn	126f42de06	drop unused etcd logic ... Fixes #1660	2017-09-25 07:52:55 +01:00
Matthew Mosesohn	d94e3a81eb	Use api lookup for kubelet hostname when using cloudprovider (#1686) ... The value cannot be determined properly via local facts, so checking k8s api is the most reliable way to look up what hostname is used when using a cloudprovider.	2017-09-24 09:22:15 +01:00
Jiri Stransky	70d0235770	Set correct kubelet cgroup-driver also for kubeadm deployments ... This follows pull request #1677, adding the cgroup-driver autodetection also for kubeadm way of deploying. Info about this and the possibility to override is added to the docs.	2017-09-22 13:19:04 +02:00
foxyriver	30b5493fd6	use command module instead of shell module	2017-09-22 15:47:03 +08:00
Jiri Stransky	dbbe9419e5	Allow setting cgroup driver for kubelet ... Red Hat family platforms run docker daemon with `--exec-opt native.cgroupdriver=systemd`. When kubespray tried to start kubelet service, it failed with: Error: failed to run Kubelet: failed to create kubelet: misconfiguration: kubelet cgroup driver: "cgroupfs" is different from docker cgroup driver: "systemd" Setting kubelet's cgroup driver to the correct value for the platform fixes this issue. The code utilizes autodetection of docker's cgroup driver, as different RPMs for the same distro may vary in that regard.	2017-09-21 11:58:11 +02:00
Matthew Mosesohn	188bae142b	Fix wait for hosts in CI (#1679) ... Also fix usage of failed_when and handling exit code.	2017-09-20 14:30:09 +01:00
Simon Li	7c2b12ebd7	Insert a newline in bastion after ProxyCommand conditional	2017-09-18 16:29:12 +01:00
Matthew Mosesohn	ef8e35e39b	Create admin credential kubeconfig (#1647) ... New files: /etc/kubernetes/admin.conf /root/.kube/config $GITDIR/artifacts/{kubectl,admin.conf} Optional method to download kubectl and admin.conf if kubeconfig_lcoalhost is set to true (default false)	2017-09-18 13:30:57 +01:00
Brad Beam	aaa27d0a34	Adding quotes around parameters in cloud_config (#1664) ... This is to help support escapes and special characters	2017-09-16 08:43:47 +01:00
Kevin Lefevre	9302ce0036	Enhanced OpenStack cloud provider (#1627) ... - Enable Cinder API version for block storage - Enable floating IP for LBaaS	2017-09-16 08:43:24 +01:00
Matthew Mosesohn	8e731337ba	Enable HA deploy of kubeadm (#1658) ... * Enable HA deploy of kubeadm * raise delay to 60s for starting gce hosts	2017-09-15 22:28:15 +01:00
Matthew Mosesohn	b294db5aed	fix apply for netchecker upgrade (#1659) ... * fix apply for netchecker upgrade and graceful upgrade * Speed up daemonset upgrades. Make check wait for ds upgrades.	2017-09-15 13:19:37 +01:00
Brad Beam	f2ae16e71d	Merge pull request #1651 from bradbeam/vaultnocontent ... Fixing condition where vault CA already exists	2017-09-14 17:04:15 -05:00
Brad Beam	ac281476c8	Prune unnecessary certs from vault setup (#1652) ... * Cleaning up cert checks for vault * Removing all unnecessary etcd certs from each node * Removing all unnecessary kube certs from each node	2017-09-14 12:28:11 +01:00
neith00	1b1c8d31a9	upgrading from weave version 2.0.1 to 2.0.4 ... This upgrade has been testing offline on a 1.7.5 cluster	2017-09-14 10:29:28 +02:00
Brad Beam	4b587aaf99	Adding ability to specify altnames for vault cert (#1640)	2017-09-14 07:19:44 +01:00
Kyle Bai	016301508e	Update to Kubernetes v1.7.5 (#1649)	2017-09-14 07:18:03 +01:00
Matthew Mosesohn	6744726089	kubeadm support (#1631) ... * kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml	2017-09-13 19:00:51 +01:00
Brad Beam	0a89f88b89	Fixing condition where CA already exists	2017-09-13 03:40:46 +00:00
Brad Beam	69fac8ea58	Merge pull request #1634 from bradbeam/calico_cni ... fix for calico cni plugin node name	2017-09-11 22:18:06 -05:00
Seungkyu Ahn	e8bde03a50	Setting kubectl bin directory (#1635)	2017-09-09 23:54:13 +03:00
Matthew Mosesohn	75b13caf0b	Fix kube-apiserver status checks when changing insecure bind addr (#1633)	2017-09-09 23:41:48 +03:00
Matthew Mosesohn	5d99fa0940	Purge old upgrade hooks and unused tasks (#1641)	2017-09-09 23:41:20 +03:00
Matthew Mosesohn	649388188b	Fix netchecker update side effect (#1644) ... * Fix netchecker update side effect kubectl apply should only be used on resources created with kubectl apply. To workaround this, we should apply the old manifest before upgrading it. * Update 030_check-network.yml	2017-09-09 23:38:38 +03:00
Matthew Mosesohn	9fa1873a65	Add kube dashboard, enabled by default (#1643) ... * Add kube dashboard, enabled by default Also add rbac role for kube user * Update main.yml	2017-09-09 23:38:03 +03:00
Matthew Mosesohn	f2057dd43d	Refactor downloads (#1642) ... * Refactor downloads Add prefixes to tasks (file vs container) Remove some delegates Clean up some conditions * Update ansible.cfg	2017-09-09 23:32:12 +03:00
Brad Beam	eeffbbb43c	Updating calicocni.hostname to calicocni.nodename	2017-09-08 12:47:40 +00:00
Brad Beam	aaa0105f75	Flexing calicocni.hostname based on cloud provider	2017-09-08 12:47:40 +00:00
Matthew Mosesohn	079d317ade	Default is_atomic to false (#1637)	2017-09-08 15:00:57 +03:00
Maxim Krasilnikov	e16b57aa05	Store vault users passwords to credentials dir. Create vault and etcd roles after start vault cluster (#1632)	2017-09-07 23:30:16 +03:00
Matthew Mosesohn	7117614ee5	Use a generated password for kube user (#1624) ... Removed unnecessary root user	2017-09-06 20:20:25 +03:00
Chad Swenson	e26aec96b0	Consolidate kube-proxy module and sysctl loading (#1586) ... This sets br_netfilter and net.bridge.bridge-nf-call-iptables sysctl from a single play before kube-proxy is first ran instead of from the flannel and weave network_plugin roles after kube-proxy is started	2017-09-06 15:11:51 +03:00
Sam Powers	c60d104056	Update checksums (etcd calico calico-cni weave) to fix uploads.yml (#1584) ... the uploads.yml playbook was broken with checksum mismatch errors in various kubespray commits, for example, 3bfad5ca73 which updated the version from 3.0.6 to 3.0.17 without updating the corresponding checksums.	2017-09-06 15:11:13 +03:00
Oliver Moser	e6ff8c92a0	Using 'hostnamectl' to set unconfigured hostname on CoreOS (#1600)	2017-09-06 15:10:52 +03:00
Chad Swenson	cbaa2b5773	Retry Remove all Docker containers in reset (#1623) ... Due to various occasional docker bugs, removing a container will sometimes fail. This can often be mitigated by trying again.	2017-09-06 14:23:16 +03:00
Matthieu	0453ed8235	Fix an error with Canal when RBAC are disabled (#1619) ... * Fix an error with Canal when RBAC are disabled * Update using same rbac strategy used elsewhere	2017-09-06 11:32:32 +03:00
Brad Beam	a341adb7f3	Updating CN for node certs generated by vault (#1622) ... This allows the node authorization plugin to function correctly	2017-09-06 10:55:08 +03:00
mkrasilnikov	957b7115fe	Remove node name from kube-proxy and admin certificates	2017-09-05 14:40:26 +03:00
mkrasilnikov	b930b0ef5a	Place vault role credentials only to vault group hosts	2017-09-05 11:16:18 +03:00
mkrasilnikov	ad313c9d49	typo fix	2017-09-05 09:07:36 +03:00
mkrasilnikov	e1384f6618	Using issue cert result var instead hostvars	2017-09-05 09:07:36 +03:00
mkrasilnikov	3acb86805b	Rename vault_address to vault_bind_address	2017-09-05 09:07:35 +03:00
mkrasilnikov	bf0af1cd3d	Vault role updates: ... * using separated vault roles for generate certs with different `O` (Organization) subject field; * configure vault roles for issuing certificates with different `CN` (Common name) subject field; * set `CN` and `O` to `kubernetes` and `etcd` certificates; * vault/defaults vars definition was simplified; * vault dirs variables defined in kubernetes-defaults foles for using shared tasks in etcd and kubernetes/secrets roles; * upgrade vault to 0.8.1; * generate random vault user password for each role by default; * fix `serial` file name for vault certs; * move vault auth request to issue_cert tasks; * enable `RBAC` in vault CI;	2017-09-05 09:07:35 +03:00
ArthurMa	c77d11f1c7	Bugfix (#1616) ... lost executable path	2017-09-05 08:35:14 +03:00
Matthew Mosesohn	d279d145d5	Fix non-rbac deployment of resources as a list (#1613) ... * Use kubectl apply instead of create/replace Disable checks for existing resources to speed up execution. * Fix non-rbac deployment of resources as a list * Fix autoscaler tolerations field * set all kube resources to state=latest * Update netchecker and weave	2017-09-05 08:23:12 +03:00
Matthew Mosesohn	fc7905653e	Add socat for CoreOS when using host deploy kubelet (#1575)	2017-09-04 11:30:18 +03:00
Matthew Mosesohn	660282e82f	Make daemonsets upgradeable (#1606) ... Canal will be covered by a separate PR	2017-09-04 11:30:01 +03:00
Matthew Mosesohn	77602dbb93	Move calico to daemonset (#1605) ... * Drop legacy calico logic * add calico as a daemonset	2017-09-04 11:29:51 +03:00
Matthew Mosesohn	a3e6896a43	Add RBAC support for canal (#1604) ... Refactored how rbac_enabled is set Added RBAC to ubuntu-canal-ha CI job Added rbac for calico policy controller	2017-09-04 11:29:40 +03:00
Dann	702ce446df	Apply ClusterRoleBinding to dnsmaq when rbac_enabled (#1592) ... * Add RBAC policies to dnsmasq * fix merge conflict * yamllint * use .j2 extension for dnsmasq autoscaler	2017-09-03 10:53:45 +03:00
Brad Beam	8ae77e955e	Adding in certificate serial numbers to manifests (#1392)	2017-09-01 09:02:23 +03:00
sgmitchell	783924e671	Change backup handler to only run v2 data backup if snap directory exists (#1594)	2017-08-31 18:23:24 +03:00
Julian Poschmann	93304e5f58	Fix calico leaving service behind. (#1599)	2017-08-31 12:00:05 +03:00
Brad Beam	917373ee55	Merge pull request #1595 from bradbeam/cacerts ... Fixing CA certificate locations for k8s components	2017-08-30 21:31:19 -05:00
Brad Beam	7a98ad50b4	Fixing CA certificate locations for k8s components	2017-08-30 15:30:40 -05:00
Brad Beam	982058cc19	Merge pull request #1514 from vijaykatam/docker_systemd ... Configurable docker yum repos, systemd fix	2017-08-30 11:50:23 -05:00
Oliver Moser	576beaa6a6	Include /opt/bin in PATH for host deployed kubelet on CoreOS (#1591) ... * Include /opt/bin in PATH for host deployed kubelet on CoreOS * Removing conditional check for CoreOS	2017-08-30 16:50:33 +03:00
Maxim Krasilnikov	6eb22c5db2	Change single Vault pki mount to multi pki mounts paths for etcd and kube CA`s (#1552) ... * Added update CA trust step for etcd and kube/secrets roles * Added load_balancer_domain_name to certificate alt names if defined. Reset CA's in RedHat os. * Rename kube-cluster-ca.crt to vault-ca.crt, we need separated CA`s for vault, etcd and kube. * Vault role refactoring, remove optional cert vault auth because not not used and worked. Create separate CA`s fro vault and etcd. * Fixed different certificates set for vault cert_managment * Update doc/vault.md * Fixed condition create vault CA, wrong group * Fixed missing etcd_cert_path mount for rkt deployment type. Distribute vault roles for all vault hosts * Removed wrong when condition in create etcd role vault tasks.	2017-08-30 16:03:22 +03:00
Brad Beam	72a0d78b3c	Merge pull request #1585 from mattymo/canal_upgrade ... Fix upgrade for canal and apiserver cert	2017-08-29 18:45:21 -05:00
Matthew Mosesohn	13d08af054	Fix upgrade for canal and apiserver cert ... Fixes #1573	2017-08-29 22:08:30 +01:00
Eric Hoffmann	6c30a7b2eb	update calico version ... update calico releases link	2017-08-28 16:23:51 -07:00
Matthew Mosesohn	76b72338da	Add CNI config for rkt kubelet (#1579)	2017-08-28 21:11:01 +03:00
Chad Swenson	a39e78d42d	Initial version of Flannel using CNI (#1486) ... * Updates Controller Manager/Kubelet with Flannel's required configuration for CNI * Removes old Flannel installation * Install CNI enabled Flannel DaemonSet/ConfigMap/CNI bins and config (with portmap plugin) on host * Uses RBAC if enabled * Fixed an issue that could occur if br_netfilter is not a module and net.bridge.bridge-nf-call-iptables sysctl was not set	2017-08-25 10:07:50 +03:00
Brad Beam	4550dccb84	Fixing reference to vault leader url (#1569)	2017-08-24 23:21:39 +03:00
Hassan Zamani	01ce09f343	Add feature_gates var for customizing Kubernetes feature gates (#1520)	2017-08-24 23:18:38 +03:00
Brad Beam	71dca67ca2	Merge pull request #1508 from tmjd/update-calico-2-4-0 ... Update Calico to 2.4.1 release.	2017-08-24 14:57:29 -05:00
Yuki KIRII	a98b866a66	Verify if br_netfilter module exists (#1492)	2017-08-24 17:47:32 +03:00
Xavier Mehrenberger	3aabba7535	Remove discontinued option --reconcile-cidr if kube_network_plugin=="cloud" (#1568)	2017-08-24 17:01:30 +03:00
Mohamed Mehany	c22cfa255b	Added private key file to ssh bastion conf (#1563) ... * Added private key file to ssh bastion conf * Used regular if condition insted of inline conditional	2017-08-24 17:00:45 +03:00
Matthew Mosesohn	6bb3463e7c	Enable scheduling of critical pods and network plugins on master ... Added toleration to DNS, netchecker, fluentd, canal, and calico policy. Also small fixes to make yamllint pass.	2017-08-24 10:41:17 +01:00
Brad Beam	8b151d12b9	Adding yamllinter to ci steps (#1556) ... * Adding yaml linter to ci check * Minor linting fixes from yamllint * Changing CI to install python pkgs from requirements.txt - adding in a secondary requirements.txt for tests - moving yamllint to tests requirements	2017-08-24 12:09:52 +03:00
Ian Lewis	ecb6dc3679	Register standalone master w/ taints (#1426) ... If Kubernetes > 1.6 register standalone master nodes w/ a node-role.kubernetes.io/master=:NoSchedule taint to allow for more flexible scheduling rather than just marking unschedulable.	2017-08-23 16:44:11 +03:00
riverzhang	49a223a17d	Update elrepo-release rpm version (#1554)	2017-08-23 09:54:51 +03:00
Brad Beam	e5cfdc648c	Adding ability to override max ttl (#1559) ... Prior this would fail because we didnt set max ttl for vault temp	2017-08-23 09:54:01 +03:00
Erik Stidham	9f9f70aade	Update Calico to 2.4.1 release. ... - Switched Calico images to be pulled from quay.io - Updated Canal too	2017-08-21 09:33:12 -05:00
Matthew Mosesohn	ca3050ec3d	Update to Kubernetes v1.7.3 (#1549) ... Change kubelet deploy mode to host Enable cri and qos per cgroup for kubelet Update CoreOS images Add upgrade hook for switching from kubelet deployment from docker to host. Bump machine type for ubuntu-rkt-sep	2017-08-21 10:53:49 +03:00
Vijay Katam	97031f9133	Make epel-release install configurable (#1497)	2017-08-20 14:03:10 +03:00
Vijay Katam	c92506e2e7	Add calico variable that enables ignoring Kernel's RPF Setting (#1493)	2017-08-20 14:01:09 +03:00
Kevin Lefevre	65a9772adf	Add OpenStack LBaaS support (#1506)	2017-08-20 13:59:15 +03:00
Anton	1e07ee6cc4	etcd_compaction_retention every 8 hour (#1527)	2017-08-20 13:55:48 +03:00
Miad Abrin	3c710219a1	Fix Some Typos in kubernetes master role (#1547) ... * Fix Typo etc3 -> etcd3 * Fix typo in post-upgrade of master. stop -> start	2017-08-20 13:54:28 +03:00
Maxim Krasilnikov	2ba285a544	Fixed deploy cluster with vault cert manager (#1548) ... * Added custom ips to etcd vault distributed certificates * Added custom ips to kube-master vault distributed certificates * Added comment about issue_cert_copy_ca var in vault/issue_cert role file * Generate kube-proxy, controller-manager and scheduler certificates by vault * Revert "Disable vault from CI (#1546)" This reverts commit 781f31d2b8. * Fixed upgrade cluster with vault cert manager * Remove vault dir in reset playbook	2017-08-20 13:53:58 +03:00
Antoine Legrand	72ae7638bc	Merge pull request #1446 from matlockx/master ... add possibility to ignore the hostname override	2017-08-18 17:03:40 +02:00
Xavier Lange	3bfad5ca73	Bump etcd to 3.2.4 (#1468)	2017-08-18 17:12:33 +03:00
Matthew Mosesohn	df28db0066	Fix cert and netchecker upgrade issues (#1543) ... * Bump tag for upgrade CI, fix netchecker upgrade netchecker-server was changed from pod to deployment, so we need an upgrade hook for it. CI now uses v2.1.1 as a basis for upgrade. * Fix upgrades for certs from non-rbac to rbac	2017-08-18 15:46:22 +03:00
Jan Jungnickel	20183f3860	Bump Calico CNI Plugin to 1.8.0 (#1458) ... This aligns calico component versions with Calico release 2.1.5 and fixes an issue with nodes being unable to schedule existing workloads as per [#349](https://github.com/projectcalico/cni-plugin/issues/349)	2017-08-18 15:40:14 +03:00
Matthew Mosesohn	2645e88b0c	Fix vault setup partially (#1531) ... This does not address per-node certs and scheduler/proxy/controller-manager component certs which are now required. This should be handled in a follow-up patch.	2017-08-18 15:09:45 +03:00
Vijay Katam	55ba81fee5	Add changed_when: false to rpm query	2017-08-14 12:31:44 -07:00
Brad Beam	af007c7189	Fixing netchecker-server type - pod => deployment (#1509)	2017-08-14 18:43:56 +03:00
Seungkyu Ahn	b22bef5cfb	Apply RBAC to efk and create fluentd.conf ... Making fluentd.conf as configmap to change configuration. Change elasticsearch rc to deployment. Having installed previous elastaicsearch as rc, first should delete that.	2017-08-11 05:31:50 +00:00
Vijay Katam	7ad5523113	restrict rpm query to redhat	2017-08-10 13:49:14 -07:00
Brad Beam	1155008719	Merge pull request #1481 from magnon-bliex/fluentd-template-fix-typo ... fixed typo in fluentd-ds.yml.j2	2017-08-10 08:19:59 -05:00
Vijay Katam	5efda3eda9	Configurable docker yum repos, systemd fix ... * Make yum repos used for installing docker rpms configurable * TasksMax is only supported in systemd version >= 226 * Change to systemd file should restart docker	2017-08-09 15:49:53 -07:00
Brad Beam	383d582b47	Merge pull request #1382 from jwfang/rbac ... basic rbac support	2017-08-07 08:01:51 -05:00
Spencer Smith	6eacedc443	Merge pull request #1483 from delfer/patch-3 ... Update flannel from 0.6.2 to 0.8.0	2017-08-01 13:57:43 -04:00
Spencer Smith	e55f8a61cd	Merge pull request #1482 from bradbeam/fix1393 ... Removing run_once in these tasks so that etcd ca certs get propogated…	2017-07-31 13:47:18 -04:00
Spencer Smith	cb6892d2ed	Merge pull request #1469 from hzamani/etcd_metrics ... Add etcd metrics flag	2017-07-31 09:04:07 -04:00
Spencer Smith	43eda8d878	Merge pull request #1471 from whereismyjetpack/fix_1447 ... add newline after expanding user information	2017-07-31 09:03:04 -04:00
nico	cc9f3ea938	Fix enforce-node-allocatable option ... Closes #1228 pods is default enforcement see https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/ add update	2017-07-31 10:06:53 +02:00
Alexander Chumakov	8bc717a55c	Update flannel from 0.6.2 to 0.8.0	2017-07-29 10:54:31 +03:00
Brad Beam	d09222c900	Removing run_once in these tasks so that etcd ca certs get propogated properly to worker nodes ... without this etcd ca certs dont exist on worker nodes causing calico to fail	2017-07-28 14:34:47 -05:00
magnon-bliex	38eb1d548a	fixed typo	2017-07-28 14:10:13 +09:00
Anton	e0960f6288	FIX: Unneded (extra) cycles in some tasks (#1393)	2017-07-27 20:46:21 +03:00
timtoum	3e457e4edf	Enable weave seed mode for kubespray (#1414) ... * Enable weave seed mode for kubespray * fix task Weave seed | Set peers if existing peers * fix mac address variabilisation * fix default values * fix include seed condition * change weave var to default values * fix Set peers if existing peers	2017-07-26 19:09:34 +03:00
Dann Bohn	c4894d6092	add newline after expanding user information	2017-07-25 12:59:10 -04:00
Hassan Zamani	3fb0383df4	Add etcd metrics flag	2017-07-25 20:00:30 +04:30
Spencer Smith	ee36763f9d	Merge pull request #1464 from johnko/patch-4 ... set loadbalancer_apiserver_localhost default true	2017-07-25 10:00:56 -04:00
Spencer Smith	955c5549ae	Merge pull request #1402 from Lendico/fix_failed_when ... "failed_when: false" and "|succeeded" checks for registered vars	2017-07-25 09:33:43 -04:00
Spencer Smith	4a34514b21	Merge pull request #1447 from whereismyjetpack/template_known_users ... Template out known_users.csv, optionally add groups	2017-07-25 08:55:08 -04:00
Brad Beam	20f29327e9	Merge pull request #1379 from gdmello/etcd_data_dir_fix ... Custom `etcd_data_dir` saves etcd data to host, not container	2017-07-20 09:30:18 -05:00
John Ko	018b5039e7	set loadbalancer_apiserver_localhost default true ... to match this https://github.com/kubernetes-incubator/kubespray/blob/master/roles/kubernetes/node/tasks/main.yml#L20 and the documented behaviour in HA docs related to #1456 @rsmitty	2017-07-20 10:27:05 -04:00
Spencer Smith	b5d3d4741f	Merge pull request #1454 from Abdelsalam-Abbas/higher_drain_timeout ... higher the timeouts for draining nodes while upgrading kubernetes version	2017-07-19 10:39:33 -04:00
Spencer Smith	85c747d444	Merge pull request #1441 from bradbeam/1434 ... Adding recursive=true for rkt kubelet dir	2017-07-19 10:38:06 -04:00
Spencer Smith	927e6d89d7	Merge pull request #1435 from delfer/master ... Kubernetes upgrade to 1.6.7	2017-07-19 05:23:38 -07:00
jwfang	3d87f23bf5	uncomment unintended local changes	2017-07-19 12:11:47 +08:00
jwfang	789910d8eb	remote unused netchecker-agent-hostnet-ds.j2	2017-07-17 19:29:59 +08:00
jwfang	a8e6a0763d	run netchecker-server with list pods	2017-07-17 19:29:59 +08:00
jwfang	e1386ba604	only patch system:kube-dns role for old dns	2017-07-17 19:29:59 +08:00
jwfang	83deecb9e9	Revert "no need to patch system:kube-dns" ... This reverts commit c2ea8c588aa5c3879f402811d3599a7bb3ccab24.	2017-07-17 19:29:59 +08:00
jwfang	d8dcb8f6e0	no need to patch system:kube-dns	2017-07-17 19:29:59 +08:00
jwfang	552b2f0635	change authorization_modes default value	2017-07-17 19:29:59 +08:00
jwfang	0b3badf3d8	revert calico-related changes	2017-07-17 19:29:59 +08:00
jwfang	cea3e224aa	change authorization_modes default value	2017-07-17 19:29:59 +08:00
jwfang	1eaf0e1c63	rename task	2017-07-17 19:29:59 +08:00
jwfang	2cda982345	binding group system:nodes to clusterrole calico-role	2017-07-17 19:29:59 +08:00
jwfang	c9734b6d7b	run calico-policy-controller with proper sa/role/rolebinding	2017-07-17 19:29:59 +08:00
jwfang	fd01377f12	remove more bins when reset	2017-07-17 19:29:59 +08:00
jwfang	092bf07cbf	basic rbac support	2017-07-17 19:29:59 +08:00
Ubuntu	5145a8e8be	higher draining timeouts	2017-07-16 20:52:13 +00:00
Dann Bohn	d1f58fed4c	Template out known_users.csv, optionally add groups	2017-07-14 09:27:20 -04:00
Martin Joehren	12e918bd31	add possibility to ignore the hostname override	2017-07-13 14:04:39 +00:00
Brad Beam	637f445c3f	Merge pull request #1365 from AtzeDeVries/master ... Give more control over IPIP, but with same default behaviour	2017-07-12 10:17:17 -05:00
Brad Beam	e0bf8b2aab	Adding recursive=true for rkt kubelet dir ... Fixes #1434	2017-07-12 09:28:54 -05:00
Spencer Smith	c75b21a510	Merge pull request #1408 from amitkumarj441/patch-1 ... Remove deprecated 'enable-cri' flag in kubernetes 1.7	2017-07-11 08:56:14 -04:00
Delfer	9f45eba6f6	Kubernetes upgrade to 1.6.7	2017-07-11 09:11:55 +00:00
AtzeDeVries	e160018826	Fixed conflicts, ipip:true as defualt and added ipip_mode	2017-07-08 14:36:44 +02:00
Spencer Smith	d1a02bd3e9	match kubespray-defaults dns mode with k8s-cluster setting	2017-07-07 13:13:12 -04:00
Brad Beam	992023288f	Merge pull request #1319 from fieryvova/private-dns-server ... Add private dns server for a specific zone	2017-07-06 15:02:54 -05:00
Spencer Smith	3ab90db6ee	Merge pull request #1411 from kevinjqiu/allow-calico-ipip-subnet-mode ... Allow calico ipPool to be created with mode "cross-subnet"	2017-07-06 14:04:03 -04:00
Vladimir Kozyrev	e26be9cb8a	add private dns server for a specific zone	2017-07-06 16:30:47 +03:00
Spencer Smith	bba555bb08	Merge pull request #1346 from Starefossen/patch-1 ... Set kubedns minimum replicas to 2	2017-07-06 09:14:11 -04:00
Spencer Smith	4b0af73dd2	Merge pull request #1332 from gstorme/kube_apiserver_insecure_port ... Use the kube_apiserver_insecure_port variable instead of static 8080	2017-07-06 09:06:50 -04:00
Spencer Smith	da72b8c385	Merge pull request #1391 from Abdelsalam-Abbas/master ... Uncodron Masters which have scheduling Enabled	2017-07-06 09:06:02 -04:00
Spencer Smith	44079b7176	Merge pull request #1401 from Lendico/better_task_naming ... Better naming for recurrent tasks	2017-07-06 09:01:07 -04:00
Kevin Jing Qiu	a742d10c54	Allow calico ipPool to be created with mode "cross-subnet"	2017-07-04 19:05:16 -04:00
Hans Kristian Flaatten	38f5d1b18e	Set kubedns minimum replicas to 2	2017-07-04 16:58:16 +02:00
Abdelsalam Abbas	5f75d4c099	Uncodron Masters which have scheduling Enabled	2017-07-03 15:30:21 +02:00
Amit Kumar Jaiswal	319a0d65af	Update kubelet.j2 ... Updated with closing endif.	2017-07-03 16:23:35 +05:30
Amit Kumar Jaiswal	3d2680a102	Update kubelet.j2 ... Updated!	2017-07-03 15:58:50 +05:30
Amit Kumar Jaiswal	c36fb5919a	Update kubelet.j2 ... Updated!!	2017-07-03 15:55:04 +05:30
Amit Kumar Jaiswal	46d3f4369e	Updated K8s version ... Signed-off-by: Amit Kumar Jaiswal <amitkumarj441@gmail.com>	2017-07-03 04:06:42 +05:30
Martin Joehren	c2b3920b50	added flag for not populating inventory entries to etc hosts file	2017-06-30 16:41:03 +00:00
Spencer Smith	6e7323e3e8	Merge pull request #1398 from tanshanshan/fix-reset ... clean files in reset roles	2017-06-30 07:59:44 -04:00
Spencer Smith	f085419055	Merge pull request #1388 from vgkowski/master ... add six package to bootstrap role	2017-06-30 07:30:36 -04:00
Anton Nerozya	1fedbded62	ignore_errors instead of failed_when: false	2017-06-29 20:15:14 +02:00
Anton Nerozya	c8258171ca	Better naming for recurrent tasks	2017-06-29 19:50:09 +02:00
tanshanshan	007ee0da8e	fix reset	2017-06-29 14:45:15 +08:00
Brad Beam	5e1ac9ce87	Merge pull request #1354 from chadswen/kubedns-var-fix ... kubedns consistency fixes	2017-06-27 22:26:46 -05:00
Brad Beam	a7cd08603e	Merge pull request #1384 from gdmello/etcd_backup_dir_fix ... Make etcd_backup_prefix configurable.	2017-06-27 22:25:53 -05:00
Brad Beam	854cd1a517	Merge pull request #1380 from jwfang/max-dns ... docker_dns_servers_strict to control docker_dns_servers rtrim	2017-06-27 21:15:12 -05:00
Spencer Smith	23565ebe62	Merge pull request #1356 from rsmitty/rename ... Rename project to kubespray	2017-06-27 11:40:03 -04:00
Chad Swenson	8467bce2a6	Fix inconsistent kubedns version and parameterize kubedns autoscaler image vars	2017-06-27 10:19:31 -05:00
gdmelloatpoints	649654207f	mount the etcd data directory in the container with the same path as on the host.	2017-06-27 09:29:47 -04:00
gdmelloatpoints	3123502f4c	move etcd_backup_prefix to new home.	2017-06-27 09:12:34 -04:00
vincent gromakowski	17d54cffbb	add six package to bootstrap role	2017-06-27 10:08:57 +02:00
Seungkyu Ahn	d5516a4ca9	Make kubedns up to date ... Update kube-dns version to 1.14.2 https://github.com/kubernetes/kubernetes/pull/45684	2017-06-27 00:57:29 +00:00
gdmelloatpoints	4ba237c5d8	Make etcd_backup_prefix configurable. Ensures that backups can be stored on a different location other than ${HOST}/var/backups, say an EBS volume on AWS.	2017-06-26 09:42:30 -04:00
jwfang	ec2255764a	docker_dns_servers_strict to control docker_dns_servers rtrim	2017-06-26 17:29:12 +08:00
Abdelsalam Abbas	1a8e92c922	Fixing cordoning condition that cause fail for upgrading the cluster	2017-06-23 20:41:47 +02:00
gdmelloatpoints	5c1891ec9f	In the etcd container, the etcd data directory is always /var/lib/etcd. Reverting to this value, since etcd_data_dir on the host maps to /var/lib/etcd in the container.	2017-06-23 13:49:31 -04:00
Spencer Smith	bae5ce0bfa	Merge branch 'master' into rename	2017-06-23 12:23:51 -04:00
AtzeDeVries	61b74f9a5b	updated to direct control over ipip	2017-06-23 09:16:05 +02:00
AtzeDeVries	7332679678	Give more control over IPIP, but with same default behaviour	2017-06-20 14:50:08 +02:00
Seungkyu Ahn	91dff61008	Fixed helm bash complete	2017-06-19 15:33:50 +09:00
Spencer Smith	8203383c03	rename almost all mentions of kargo	2017-06-16 13:25:46 -04:00
Gregory Storme	fff0aec720	add configurable parameter for etcd_auto_compaction_retention	2017-06-14 10:39:38 +02:00
Brad Beam	b73786c6d5	Merge pull request #1335 from bradbeam/imagerepo ... Set default value for kube_hyperkube_image_repo	2017-06-12 09:46:17 -05:00
Gregory Storme	266ca9318d	Use the kube_apiserver_insecure_port variable instead of static 8080	2017-06-12 09:20:59 +02:00
Brad Beam	db3e8edacd	Fixing up vault variables	2017-06-08 16:15:33 -05:00
Brad Beam	6e41634295	Set default value for kube_hyperkube_image_repo ... Fixes #1334	2017-06-08 12:22:16 -05:00
Brad Beam	780308c194	Merge pull request #1174 from jlothian/atomic-docker-restart ... Fix docker restart in atomic	2017-06-07 12:05:32 -05:00
Brad Beam	696fd690ae	Merge pull request #1092 from bradbeam/rkt_docker ... Adding flag for docker container in kubelet w/ rkt	2017-06-06 12:58:40 -05:00
Spencer Smith	01c0ab4f06	check if cloud_provider is defined	2017-05-31 08:24:24 -04:00
Spencer Smith	7220b09ff9	Merge pull request #1315 from rsmitty/hostnames-upgrade ... Resolve upgrade issues	2017-05-30 11:40:19 -04:00
Spencer Smith	56b86bbfca	inventory hostname for cordoning/uncordoning	2017-05-26 17:47:25 -04:00
Spencer Smith	7e2aafcc76	add direct path for cert in AWS with RHEL family	2017-05-26 17:32:50 -04:00
Justin Hunthrop	af55e179c7	adding --skip-exists flag for peer_with_router	2017-05-25 14:29:18 -05:00
zoues	43408634bb	Merge branch 'master' into master	2017-05-23 09:32:28 +08:00
zouyee	d47fce6ce7	upgrade k8s version to 1.6.4	2017-05-23 09:30:03 +08:00
Matthew Mosesohn	9e64267867	Merge pull request #1293 from mattymo/kubelet_host_mode ... Add host-based kubelet deployment	2017-05-19 18:07:39 +03:00
Josh Lothian	7ae5785447	Removed the other unused handler ... With live-restore: true, we don't need a special docker restart	2017-05-19 09:50:10 -05:00
Josh Lothian	ef8d3f684f	Remove unused handler ... Previous patch removed the step that sets live-restore back to false, so don't try to notify that handler any more	2017-05-19 09:45:46 -05:00
Matthew Mosesohn	cc6e3d14ce	Add host-based kubelet deployment ... Kubelet gets copied from hyperkube container and run locally.	2017-05-19 16:54:07 +03:00
Spencer Smith	005b01bd9a	Merge pull request #1299 from bradbeam/kubelet ... Minor kubelet updates	2017-05-18 12:52:43 -04:00
Josh Lothian	6f67367b57	Leave 'live-restore' false ... Leave live-restore false to updates always pick up new network configuration	2017-05-17 14:31:49 -05:00
Josh Lothian	9ee0600a7f	Update handler names and explanation	2017-05-17 14:31:49 -05:00
Josh Lothian	30cc7c847e	Reconfigure docker restart behavior on atomic ... Before restarting docker, instruct it to kill running containers when it restarts. Needs a second docker restart after we restore the original behavior, otherwise the next time docker is restarted by an operator, it will unexpectedly bring down all running containers.	2017-05-17 14:31:49 -05:00
Josh Lothian	a5bb24b886	Fix docker restart in atomic ... In atomic, containers are left running when docker is restarted. When docker is restarted after the flannel config is put in place, the docker0 interface isn't re-IPed because docker sees the running containers and won't update the previous config. This patch kills all the running containers after docker is stopped. We can't simply `docker stop` the running containers, as they respawn before we've got a chance to stop the docker daemon, so we need to use runc to do this after dockerd is stopped.	2017-05-17 14:31:49 -05:00
Brad Beam	b999ee60aa	Fixing typo in kubelet cluster-dns and cluster-domain flags	2017-05-16 15:43:29 -05:00
Brad Beam	85afd3ef14	Removing old sysv reference	2017-05-16 15:28:39 -05:00
Spencer Smith	1907030d89	issue raw yum command since we don't have facts in bootstrapping	2017-05-16 10:07:38 -04:00
Spencer Smith	efa2dff681	remove conditional	2017-05-12 17:16:49 -04:00
Spencer Smith	31a7b7d24e	default to kubedns and set nxdomain in kubedns deployment if that's the dns_mode	2017-05-12 15:57:24 -04:00
moss2k13	791ea89b88	Updated helm installation ... Added full path for helm	2017-05-08 09:27:06 +02:00
Spencer Smith	c572760a66	Merge pull request #1254 from iJanki/cert_group ... Adding /O=system:masters to admin certificate	2017-05-05 10:58:42 -04:00
Brad Beam	69fc19f7e0	Merge pull request #1252 from adidenko/separate-tags-for-netcheck-containers ... Add support for different tags for netcheck containers	2017-05-05 08:04:54 -05:00
Spencer Smith	b939c24b3d	Merge pull request #1250 from digitalrebar/master ... bootstrap task on centos missing packages	2017-05-02 12:24:11 -04:00
Spencer Smith	3eb494dbe3	Merge pull request #1259 from bradbeam/calico214 ... Updating calico to v2.1.4	2017-05-02 12:20:47 -04:00
Spencer Smith	0afbc19ffb	ensure the /etc/os-release is mounted read only	2017-05-01 14:51:40 -04:00
Spencer Smith	ac9290f985	add for rkt as well	2017-04-28 17:45:10 -04:00
Brad Beam	a133ba1998	Updating calico to v2.1.4	2017-04-28 14:04:25 -05:00
Spencer Smith	5657738f7e	mount os-release to ensure the node's OS is what's seen in k8s api	2017-04-28 13:40:54 -04:00
Aleksandr Didenko	883ba7aa90	Add support for different tags for netcheck containers ... Replace 'netcheck_tag' with 'netcheck_version' and add additional 'netcheck_server_tag' and 'netcheck_agent_tag' config options to provide ability to use different tags for server and agent containers.	2017-04-27 17:15:28 +02:00
Sergii Golovatiuk	674b71b535	Ansible 2.3 support ... - Fix when clauses in various places - Update requirements.txt - Fix README.md Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>	2017-04-26 15:22:10 +02:00
Aleksey Kasatkin	2638ab98ad	add MY_NODE_NAME variable into netchecker-agent environment	2017-04-24 17:19:42 +03:00
Matthew Mosesohn	bc3068c2f9	Merge pull request #1251 from FengyunPan/fix-helm-home ... Specify a dir and attach it to helm for HELM_HOME	2017-04-24 15:17:28 +03:00
FengyunPan	2bde9bea1c	Specify a dir and attach it to helm for HELM_HOME	2017-04-21 10:51:27 +08:00
Greg Althaus	041d4d666e	Install required selinux-python bindings in bootstrap ... on centos. The bootstrap tty fixup needs it.	2017-04-20 11:17:01 -05:00
Spencer Smith	88b5065e7d	fix stray 'in' and break into multiple lines for clarity	2017-04-20 09:53:01 -04:00
Spencer Smith	b690008192	allow for correct aws default resolver	2017-04-20 09:32:03 -04:00
Matthew Mosesohn	2d6bc9536c	Merge pull request #1246 from holser/disable_dns_for_kube_services ... Change DNS policy for kubernetes components	2017-04-20 16:12:52 +03:00
Sergii Golovatiuk	01dc6b2f0e	Add aws to default_resolver ... When VPC is used, external DNS might not be available. This patch change behavior to use metadata service instead of external DNS when upstream_dns_servers is not specified. Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>	2017-04-20 11:47:19 +02:00
Sergii Golovatiuk	d8aa2d0a9e	Change DNS policy for kubernetes components ... According to code apiserver, scheduler, controller-manager, proxy don't use resolution of objects they created. It's not harmful to change policy to have external resolver. Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>	2017-04-20 11:22:57 +02:00
Matthew Mosesohn	19bb97d24d	Merge pull request #1238 from Starefossen/fix/namespace-template-file ... Move namespace file to template directory	2017-04-20 12:19:55 +03:00
Matthew Mosesohn	9f4f168804	Merge pull request #1241 from bradbeam/rktcnidir ... Explicitly create cni bin dir	2017-04-20 12:19:26 +03:00
Matthew Mosesohn	cf3083d68e	Merge pull request #1239 from mattymo/resettags ... Add tags to reset playbook and make iptables flush optional	2017-04-20 11:35:08 +03:00
Sergii Golovatiuk	e796cdbb27	Fix restart kube-controller (#1242) ... kubernetesUnitPrefix was changed to k8s_* in 1.5. This patch reflects this change in kargo	2017-04-20 11:26:01 +03:00
Matthew Mosesohn	2d44582f88	Add tags to reset playbook and make iptables flush optional ... Fixes #1229	2017-04-19 19:32:18 +03:00
Brad Beam	b60a897265	Explicitly create cni bin dir ... If this path doesnt exist, it will cause kubelet to fail to start when using rkt	2017-04-19 16:00:44 +00:00
Hans Kristian Flaatten	d68cfeed6e	Move namespace file to template directory	2017-04-19 13:37:02 +02:00
Spencer Smith	c3c9e955e5	Merge pull request #1232 from rsmitty/custom-flags ... add ability for custom flags	2017-04-17 14:01:32 -04:00
Spencer Smith	72d5db92a8	remove stray spaces in templating	2017-04-17 12:24:24 -04:00
Spencer Smith	3f302c8d47	ensure spacing on string of flags	2017-04-17 12:13:39 -04:00
Spencer Smith	04a769bb37	ensure spacing on string of flags	2017-04-17 11:11:10 -04:00
Spencer Smith	f9d4a1c1d8	update to safeguard against accidentally passing string instead of list	2017-04-17 11:09:34 -04:00
Matthew Mosesohn	3e7db46195	Merge pull request #1233 from gbolo/master ... allow admission control plug-ins to be easily customized	2017-04-17 12:59:49 +03:00
Matthew Mosesohn	e52aca4837	Merge pull request #1223 from mattymo/vault_cert_skip ... Skip vault cert task evaluation when using script certs	2017-04-17 12:52:42 +03:00
Matthew Mosesohn	5ec503bd6f	Merge pull request #1222 from bradbeam/calico ... Updating calico versions	2017-04-17 12:52:20 +03:00
gbolo	49be805001	allow admission control plug-ins to be easily customized	2017-04-16 22:03:45 -04:00
Spencer Smith	94596388f7	add ability for custom flags	2017-04-14 17:33:04 -04:00
Spencer Smith	5c4980c6e0	Merge pull request #1231 from holser/fix_netchecker-server ... Reschedule netchecker-server in case of HW failure.	2017-04-14 10:50:07 -04:00
Matthew Mosesohn	d7b8fb3113	Update start_vault_temp.yml	2017-04-14 13:32:41 +03:00
Sergii Golovatiuk	45044c2d75	Reschedule netchecker-server in case of HW failure. ... Pod opbject is not reschedulable by kubernetes. It means that if node with netchecker-server goes down, netchecker-server won't be scheduled somewhere. This commit changes the type of netchecker-server to Deployment, so netchecker-server will be scheduled on other nodes in case of failures.	2017-04-14 10:49:16 +02:00
Joe Duhamel	a9f260d135	Update dnsmasq-autoscaler ... changed target to be a deployment rather than a replicationcontroller.	2017-04-13 15:07:06 -04:00
Joe Duhamel	072b3b9d8c	Update kubedns-autoscaler change target ... The target was a replicationcontroller but kubedns is currently a deployment	2017-04-13 14:55:25 -04:00
Matthew Mosesohn	ae7f59e249	Skip vault cert task evaluation completely when using script cert generation	2017-04-13 19:29:07 +03:00
Brad Beam	bce1c62308	Updating calico versions	2017-04-11 20:52:04 -05:00
Spencer Smith	9b3aa3451e	Merge pull request #1218 from bradbeam/efkidempotent ... Fixing resource type for kibana	2017-04-11 19:04:13 -04:00
Spencer Smith	436c0b58db	Merge pull request #1217 from bradbeam/helmcompletion ... Excluding bash completion for helm on CoreOS	2017-04-11 17:34:11 -04:00
zouyee	0bcecae2a3	upgrade etcd version from v3.0.6 to v3.0.17	2017-04-11 10:42:35 +08:00
Brad Beam	bd130315b6	Excluding bash completion for helm on CoreOS	2017-04-10 11:07:15 -05:00
Brad Beam	504711647e	Fixing resource type for kibana	2017-04-10 11:01:12 -05:00
Antoine Legrand	ab12b23e6f	Merge pull request #1173 from bradbeam/dockerlogs ... Setting defaults for docker log rotation	2017-04-09 11:50:01 +02:00
Matthew Mosesohn	1c45d37348	Update kubelet.j2	2017-04-06 22:59:18 +03:00
Matthew Mosesohn	b521255ec9	Unbreak 1.5 deployment with kubelet ... 1.5 kubelet fails to start when using unknown params	2017-04-06 21:07:48 +03:00
Matthew Mosesohn	75ea001bfe	Merge pull request #1208 from mattymo/1.6-flannel ... Update to k8s 1.6 with flannel and centos fixes	2017-04-06 13:04:02 +03:00
Matthew Mosesohn	ff2fb9196f	Fix flannel for 1.6 and apply fixes to enable containerized kubelet	2017-04-06 10:06:21 +04:00
Matthew Mosesohn	acae0fe4a3	Merge pull request #1205 from holser/resolv_updates ... Refactoring resolv.conf	2017-04-05 14:22:52 +03:00
Matthew Mosesohn	ccc11e5680	Upgrade to Kubernetes 1.6.1	2017-04-05 13:26:36 +03:00
Sergii Golovatiuk	2670eefcd4	Refactoring resolv.conf ... - Renaming templates for netchecker - Add dnsPolicy: ClusterFirstWithHostNet to kube-proxy Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>	2017-04-05 09:28:01 +02:00
Matthew Mosesohn	c0cae9e8a0	Merge pull request #1204 from mattymo/resolvconf-nodes ... Restart kubelet when updating /etc/resolv.conf on all k8s nodes	2017-04-04 22:03:44 +03:00
Matthew Mosesohn	f8cf6b4f7c	Merge pull request #1186 from holser/resolv_conf ... Set ClusterFirstWithHostNet for Pods with hostnetwork: true	2017-04-04 20:49:55 +03:00
Matthew Mosesohn	a29182a010	Restart kubelet when updating /etc/resolv.conf on all k8s nodes	2017-04-04 20:43:47 +03:00
Sergii Golovatiuk	1cfe0beac0	Set ClusterFirstWithHostNet for Pods with hostnetwork: true ... In kubernetes 1.6 ClusterFirstWithHostNet was added as an option. In accordance to it kubelet will generate resolv.conf based on own resolv.conf. However, this doesn't create 'options', thus the proper solution requires some investigation. This patch sets the same resolv.conf for kubelet as host Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>	2017-04-04 16:34:13 +02:00
Matthew Mosesohn	798f90c4d5	Merge pull request #1153 from mattymo/graceful_drain ... Move graceful upgrade test to Ubuntu canal HA, adjust drain	2017-04-04 17:33:53 +03:00
Matthew Mosesohn	f8d44a8a88	Merge pull request #1200 from mattymo/issue1190 ... Fix multiline condition for k8s check certs	2017-04-04 15:48:05 +03:00
Matthew Mosesohn	b4d06ff8dd	Add /var/lib/cni to kubelet ... Necessary to persist this directory for host-local IPAM used by Canal Add pre-upgrade task to copy /var/lib/cni out of old kubelet.	2017-04-03 19:38:24 +03:00
Matthew Mosesohn	7581705007	Merge pull request #1185 from intelsdi-x/hostname ... Use hostname module to set hostname, and do it for all Os not only Co…	2017-04-03 19:01:12 +03:00
Matthew Mosesohn	5a5707159a	Fix multiline condition for k8s check certs ... Fixes #1190	2017-04-03 17:44:55 +03:00
Matthew Mosesohn	742a1681ce	Merge pull request #1166 from rogerwelin/master ... add iptables --flush to reset role	2017-04-03 17:25:10 +03:00
Matthew Mosesohn	fba9b9cb65	Merge pull request #1182 from artem-panchenko/bumpCalicoPolicyControllerVersion ... Bump calico policy controller version	2017-04-03 17:21:52 +03:00
Paweł Skrzyński	61b2d7548a	Use hostname module to set hostname, and do it for all Os not only CoreOS	2017-04-03 15:09:33 +02:00
Matthew Mosesohn	80828a7c77	use etcd2 when upgrading unless forced	2017-04-03 15:07:42 +03:00
Matthew Mosesohn	f5af86c9d5	Merge pull request #1194 from adidenko/fix-sync_certs ... Fix multiline when condition in sync_certs task	2017-03-31 17:39:40 +03:00
Aleksandr Didenko	58acbe7caf	Fix multiline when condition in sync_certs task ... Folded style in multiline 'when' condition causes error with unexpected ident. Changing it to literal style should fix the issue. Closes #1190	2017-03-30 22:21:04 +02:00
Spencer Smith	355b92d7ba	Merge pull request #1170 from jlothian/atomic-docker-network ... 1169 - fix docker systemd unit	2017-03-30 13:13:28 -07:00
Matthew Mosesohn	d42e4f2344	Update .gitlab-ci.yml	2017-03-30 12:19:15 +04:00
Matthew Mosesohn	fb467df47c	fix etcd restart	2017-03-29 23:22:49 +04:00
Matthew Mosesohn	48beef25fa	delete master containers forcefully	2017-03-27 19:08:22 +03:00
Matthew Mosesohn	a3f568fc64	restart scheduler and controller-manager too	2017-03-27 13:51:35 +03:00
Matthew Mosesohn	57ee304260	ensure post-upgrade purge ones only once	2017-03-27 13:28:37 +03:00
Matthew Mosesohn	0794a866a7	switch debian8-canal-ha to ubuntu	2017-03-27 13:28:37 +03:00
Matthew Mosesohn	49e4d344da	move network plugins out of grouped upgrades	2017-03-27 13:28:37 +03:00
Matthew Mosesohn	6e505c0c3f	Fix delegate tasks for kubectl and etcdctl	2017-03-27 13:28:37 +03:00
Matthew Mosesohn	e9a294fd9c	Significantly reduce memory requirements ... Canal runs more pods and upgrades need a bit of extra room to load new pods in and get the old ones out.	2017-03-27 13:28:37 +03:00
Matthew Mosesohn	44d851d5bb	Only cordon Ready nodes	2017-03-27 13:28:37 +03:00
Matthew Mosesohn	c1b9660ec8	Move graceful upgrade test to debian canal HA, adjust drain ... Graceful upgrades require 3 nodes Drain now has a command timeout of 40s	2017-03-27 13:28:37 +03:00
Matthew Mosesohn	c2c334d22f	Merge pull request #1181 from holser/refactor_etcd ... Refactor etcd role	2017-03-27 13:05:35 +03:00
Sergii Golovatiuk	f144fd1ed3	Refactor etcd role ... - Run docker run from script rather than directly from systemd target - Refactoring styling/templates Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>	2017-03-24 12:34:15 +01:00
Artem Panchenko	e96557f410	Bump calico policy controller version ... Latest released version of kube-policy-controller contains important bug fixes and should be used by default.	2017-03-24 12:13:09 +02:00
Matthew Mosesohn	b2af19471e	Merge pull request #1177 from rutsky/replace-nbsp ... replace non-breakable space with regular space	2017-03-23 12:59:45 +03:00
Matthew Mosesohn	6805d0ff2b	Merge pull request #1179 from kubernetes-incubator/missing_defaults ... Add missing defaults	2017-03-23 12:16:13 +03:00
Antoine Legrand	6e1de9d820	Add missing defaults	2017-03-23 10:05:34 +01:00
Vladimir Rutsky	c4e57477fb	replace non-breakable space with regular space ... Non-brekable space is 0xc2 0xa0 byte sequence in UTF-8. To find one: $ git grep -I -P '\xc2\xa0' To replace with regular space: $ git grep -l -I -P '\xc2\xa0' | xargs sed -i 's/\xc2\xa0/ /g' This commit doesn't include changes that will overlap with commit f1c59a91a1.	2017-03-23 00:25:01 +03:00
Matthew Mosesohn	5f082bc0e5	Merge pull request #1172 from mattymo/dnsmasq_upgrade ... Use checksum of dnsmasq config to trigger updates of dnsmasq	2017-03-22 18:00:10 +03:00
Matthew Mosesohn	0e3b7127b5	Merge pull request #1167 from mattymo/dnsmasq_when_deploying_master ... Change wait for dnsmasq to skip if there are no kube-nodes in play	2017-03-22 17:59:56 +03:00
Brad Beam	5d3414a40b	Setting defaults for docker log rotation	2017-03-22 09:40:10 -04:00
Roger Welin	f4638c7580	add iptables --flush to reset role	2017-03-22 11:10:24 +01:00
Matthew Mosesohn	8b0b500c89	Use checksum of dnsmasq config to trigger updates of dnsmasq ... Allows config changes made by Ansible to restart dnsmasq deployment	2017-03-22 13:03:55 +03:00
Josh Lothian	5e2f78424f	1169 - fix docker systemd unit ... The docker-network environment file masks the new values put into /etc/systemd/system/docker.service.d/flannel-options.conf to renumber the docker0 to work correctly with flannel.	2017-03-21 15:22:14 -05:00
Matthew Mosesohn	1887e984a0	Change wait for dnsmasq to skip if there are no kube-nodes in play ... Also changed unnecessary delay to a max timeout (now defaulting to 1s sleep between tries) Also rename play_hosts to ansible_play_hosts	2017-03-21 18:55:22 +03:00
Matthew Mosesohn	cd429d3654	Merge pull request #1159 from holser/etcd_backup_restore ... Backup etcd	2017-03-21 13:07:44 +03:00
Matthew Mosesohn	0f64f8db90	Merge pull request #1155 from mattymo/helm ... Add helm deployment	2017-03-20 17:00:06 +03:00
Sergii Golovatiuk	c04a6254b9	Backup etcd data before restarting etcd ... etcd is crucial part of kubernetes cluster. Ansible restarts etcd on reconfiguration. Backup helps operator to restore cluster manually in case of any issues. Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>	2017-03-20 14:50:52 +01:00
Matthew Mosesohn	939c1def5d	Merge pull request #1152 from mattymo/redhat_weave ... Fix weave on RHEL deployment	2017-03-19 16:45:20 +03:00
Matthew Mosesohn	b7ab80e8ea	Merge pull request #1149 from mattymo/centos-retries ... Retry yum/apt/rpm download commands	2017-03-18 11:12:36 +03:00
Matthew Mosesohn	b69d4b0ecc	Add helm deployment	2017-03-17 20:24:41 +03:00
Matthew Mosesohn	7760c3e4aa	Retry yum/apt/rpm download commands, fix succeeded filter	2017-03-17 18:56:26 +03:00
Matthew Mosesohn	3cfb76e57f	Merge pull request #1146 from mattymo/resolvconf_optimize ... Condense resolvconf sources before starting loop	2017-03-17 18:42:32 +03:00
Matthew Mosesohn	e1faeb0f6c	Fix weave on RHEL deployment ... Reduce retry delay checking weave Always load br_netfilter module	2017-03-17 18:17:47 +03:00
Matthew Mosesohn	25bff851dd	Merge pull request #1136 from adidenko/fix-calico-policy-order ... Move calico-policy-controller into separate role	2017-03-17 17:32:14 +03:00
Aleksandr Didenko	3a39904011	Move calico-policy-controller into separate role ... By default Calico CNI does not create any network access policies or profiles if 'policy' is enabled in CNI config. And without any policies/profiles network access to/from PODs is blocked. K8s related policies are created by calico-policy-controller in such case. So we need to start it as soon as possible, before any real workloads. This patch also fixes kube-api port in calico-policy-controller yaml template. Closes #1132	2017-03-17 11:21:52 +01:00
Matthew Mosesohn	a52064184e	Condense resolvconf sources before starting loop	2017-03-17 13:06:56 +03:00
Matthew Mosesohn	0b49eeeba3	Update calico to 1.1.0-rc8 ... Fixes bug in CentOS/RHEL in felix related to overlayfs driver.	2017-03-16 19:23:36 +03:00
Matthew Mosesohn	b0830f0cd7	Merge pull request #1087 from bradbeam/openstack ... Adding openstack domain id	2017-03-16 17:53:14 +03:00
Matthew Mosesohn	565d4a53b0	Merge pull request #1108 from idcrook/issue_1107-docker-versioning ... Adding Docker CE 'stable' and 'edge' version packages	2017-03-16 16:32:13 +03:00
Matthew Mosesohn	8195957461	Merge branch 'master' into idempotency2	2017-03-16 09:29:43 +03:00
Matthew Mosesohn	02fed4a082	Merge pull request #1138 from mattymo/idempotency-fixes ... Idempotency fixes for etcd certs and resolvconf tasks	2017-03-16 09:20:28 +03:00
Matthew Mosesohn	a422ad0d50	More idempotency fixes ... Fixed sync_tokens fact Fixed sync_certs for k8s tokens fact Disabled register docker images changability Fixed CNI dir permission Fix idempotency for etcd pre upgrade checks	2017-03-15 19:06:39 +03:00
Matthew Mosesohn	096d96e344	Merge pull request #1137 from holser/bug/1135 ... Turn on iptables for flannel	2017-03-15 17:06:42 +03:00
Matthew Mosesohn	4354162067	Merge pull request #1080 from VincentS/Granular_Auth_Control ... Granular authentication Control	2017-03-15 13:12:51 +03:00
Matthew Mosesohn	a62a444229	Merge pull request #1117 from mattymo/etcd3-upgrade ... Migrate k8s data to etcd3 api store	2017-03-15 12:56:06 +03:00
Matthew Mosesohn	f6b72fa830	Make resolvconf preinstall idempotent	2017-03-15 01:20:13 +04:00
Sergii Golovatiuk	9667e8615f	Turn on iptables for flannel ... Closes: #1135 Closes: #1026 Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>	2017-03-14 17:54:55 +01:00
Vincent Schwarzer	026da060f2	Granular authentication Control ... It is now possible to deactivate selected authentication methods (basic auth, token auth) inside the cluster by adding removing the required arguments to the Kube API Server and generating the secrets accordingly. The x509 authentification is currently not optional because disabling it would affect the kubectl clients deployed on the master nodes.	2017-03-14 16:57:35 +01:00
Matthew Mosesohn	3feab1cb2d	Merge pull request #1134 from mattymo/1.6-support ... Explicitly set cni-bin-dir	2017-03-14 17:53:08 +03:00
Matthew Mosesohn	804e9a09c0	Migrate k8s data to etcd3 api store ... Default backend is now etcd3 (was etcd2). The migration process consists of the following steps: * check if migration is necessary * stop etcd on first etcd server * run migration script * start etcd on first etcd server * stop kube-apiserver until configuration is updated * update kube-apiserver * purge old etcdv2 data	2017-03-14 17:50:20 +03:00
Matthew Mosesohn	4c6829513c	Fix etcd idempotency	2017-03-14 17:23:29 +03:00
Matthew Mosesohn	4038954f96	Merge pull request #1078 from VincentS/oidc_support ... Added Support for OpenID Connect Authentication	2017-03-14 12:07:21 +03:00
Matthew Mosesohn	52a6dd5427	Explicitly set cni-bin-dir	2017-03-13 20:13:21 +03:00
Matthew Mosesohn	c301dd5d94	Merge pull request #1118 from mattymo/noderolelabels ... Add node labels in kubelet	2017-03-13 19:04:21 +03:00
Cesarini, Daniele	69636d2453	Adding /O=system:masters to admin certificate ... Issue #1125. Make RBAC authorization plugin work out of the box. "When bootstrapping, superuser credentials should include the system:masters group, for example by creating a client cert with /O=system:masters. This gives those credentials full access to the API and allows an admin to then set up bindings for other users."	2017-03-08 14:42:25 +00:00
David Crook	a52e1069ce	updated debian and ubuntu package names based on testing ... docker-ce is not the .deb package until the repositories are switched over to new "downloads" docker webserver	2017-03-06 16:54:39 -07:00
David Crook	a8e5002aeb	removed irrelevant comments	2017-03-06 16:02:53 -07:00
David Crook	c515a351c6	Merge branch 'master' into issue_1107-docker-versioning	2017-03-06 16:00:31 -07:00
Brad Beam	d04fbf3f78	Removing cloud_provider tag to fix scenario where cloud_provider is not defined	2017-03-06 10:52:38 -06:00
Matthew Mosesohn	54207877bd	Add node labels in kubelet ... Related-issue: https://github.com/kubernetes/community/issues/300 Upgraded nodes do not obtain labels automatically. See https://github.com/kubernetes/kubernetes/pull/29459 for more details.	2017-03-06 17:18:42 +03:00
Vincent Schwarzer	b075960e3b	Added Support for OpenID Connect Authentication ... To use OpenID Connect Authentication beside deploying an OpenID Connect Identity Provider it is necesarry to pass additional arguments to the Kube API Server. These required arguments were added to the kube apiserver manifest.	2017-03-06 12:40:35 +01:00
Antoine Legrand	85596c2610	Merge pull request #1045 from bradbeam/vsphere ... Adding vsphere cloud provider support	2017-03-06 12:34:05 +01:00
Antoine Legrand	ee5f009b95	Merge pull request #1112 from mattymo/skip_vault_if_disabled ... Disable vault role properly on ansible 2.2.0	2017-03-06 11:27:53 +01:00
Matthew Mosesohn	45274560ec	Disable vault role properly on ansible 2.2.0 ... when condition does not seem to work correctly at playbook level for ansible 2.2.0.	2017-03-05 00:43:01 +04:00
Matthew Mosesohn	02a8e78902	Remove standalone etcd specific play, cleanup host mode ... Now etcd role can optionally disable etcd cluster setup for faster deployment when it is combined with etcd role.	2017-03-04 00:34:26 +04:00
Matthew Mosesohn	8f3d9e93ce	Merge pull request #1111 from mattymo/use_find_for_certs ... Use find module for checking for certificates	2017-03-03 20:08:33 +03:00
Matthew Mosesohn	d176818c44	Use find module for checking for certificates ... Also generate certs only when absent on master (rather than when absent on target node)	2017-03-03 16:21:01 +03:00
Bogdan Dobrelya	aeec0f9a71	Merge pull request #1071 from vijaykatam/atomic_host ... Add support for atomic host	2017-03-03 13:03:59 +01:00
Matthew Mosesohn	08a02af833	Merge pull request #1075 from VincentS/loadbalancer_aws ... Possibility to add Loadbalancers without static IP (e.g. AWS ELB) #1074	2017-03-03 14:07:22 +03:00
David Crook	3f4a375ac4	first pass at adding 'stable' and 'edge' version packages ... - Only have ubuntu to test on - fedora and redhat are placeholders/guesses - the "old" package repositories seem to have the "new" CE version which is `1.13.1` based - `docker-ce` looks like it is named as a backported `docker-engine` package in some places - Did not change the `defaults` version anywhere, so should work as before - Did not point to new package repositories, as existing ones have the new packages.	2017-03-02 13:48:09 -07:00
Matthew Mosesohn	5ebc9a380c	Merge pull request #1060 from holser/etcdv3 ... Allow to specify etcd backend for kube-api	2017-03-02 17:24:09 +03:00
Matthew Mosesohn	6453650895	Merge pull request #1093 from mattymo/scaledns ... Add autoscalers for dnsmasq and kubedns	2017-03-02 16:58:56 +03:00
Matthew Mosesohn	9cb12cf250	Add autoscalers for dnsmasq and kubedns ... By default kubedns and dnsmasq scale when installed. Dnsmasq is no longer a daemonset. It is now a deployment. Kubedns is no longer a replicationcluster. It is now a deployment. Minimum replicas is two (to enable rolling updates). Reduced memory erquirements for dnsmasq and kubedns	2017-03-02 13:44:22 +03:00
Vincent Schwarzer	68e8d74545	Changes based on feedback (additional ansible checks)	2017-03-02 11:04:10 +01:00
Vincent Schwarzer	fc054e21f6	Modified how adding LB for the Kube API is handled (AWS) ... Until now it was not possible to add an API Loadbalancer without an static IP Address. But certain Loadbalancers like AWS Elastic Loadbalanacer dontt have an fixed IP address. With this commit it is possible to add these kind of Loadbalancers to the Kargo deployment.	2017-03-02 11:04:10 +01:00
Matthew Mosesohn	efbb5b2db3	Merge pull request #1101 from retr0h/docker-1.13.1 ... Use docker-engine 1.13.1	2017-03-02 12:31:58 +03:00
John Dewey	a43569c8a5	Use docker-engine 1.13.1 ... The default version of Docker was switched to 1.13 in #1059. This change also bumped ubuntu from installing docker-engine 1.13.0 to 1.13.1. This PR updates os families which had 1.13 defined, but were using 1.13.0. The impetus for this change is an issue running tiller 1.2.3 on docker 1.13.0. See discussion [1][2]. [1] https://github.com/kubernetes/helm/issues/1838 [2] https://github.com/kubernetes-incubator/kargo/pull/1100	2017-03-01 12:53:39 -08:00
Matthew Mosesohn	a5cd73d047	Merge pull request #959 from galthaus/host-mode-restart ... Restart kube-controller for host_resolvconf mode	2017-03-01 20:54:21 +03:00
Vijay Katam	a0b1eda1d0	Add support for atomic host ... Updates based on feedback Simplify checks for file exists remove invalid char Review feedback. Use regular systemd file. Add template for docker systemd atomic	2017-03-01 09:38:19 -08:00
Antoine Legrand	77e5171679	Merge pull request #1076 from VincentS/etcd_openssl_count_fix ... Fixed counter in ETCD Openssl.conf	2017-03-01 14:17:27 +01:00
Bogdan Dobrelya	0c66418dad	Merge pull request #1090 from artem-panchenko/calicoAcceptHostEndpointConnections ... Allow connections from pods to local endpoints	2017-03-01 13:37:05 +01:00
Artem Panchenko	fa05d15093	Allow connections from pods to local endpoints ... By default Calico blocks traffic from endpoints to the host itself by using an iptables DROP action. It could lead to a situation when service has one alive endpoint, but pods which run on the same node can not access it. Changed the action to RETURN.	2017-03-01 09:21:02 +02:00
Matthew Mosesohn	cbaa6abdd0	Merge pull request #1066 from bradbeam/rkt-kubelet-cloudprovider ... Adding KUBELET_CLOUDPROVIDER to kubelet.rkt.service	2017-02-28 20:02:56 +03:00
Sergii Golovatiuk	295103adc0	Allow to specify etcd backend for kube-api ... Kubernetes project is about to set etcdv3 as default storage engine in 1.6. This patch allows to specify particular backend for kube-apiserver. User may force the option to etcdv3 for new environment. At the same time if the environment uses v2 it will continue uses it until user decides to upgrade to v3. Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>	2017-02-28 17:13:22 +01:00
Sergii Golovatiuk	d31c040dc0	Change kube-api default port from 443 to 6443 ... Operator can specify any port for kube-api (6443 default) This helps in case where some pods such as Ingress require 443 exclusively. Closes: 820 Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>	2017-02-28 15:45:35 +01:00
Brad Beam	8a63b35f44	Adding flag for docker container in kubelet w/ rkt	2017-02-28 07:55:12 -06:00
Brad Beam	bfff06d402	Adding KUBELET_CLOUDPROVIDER to kubelet.rkt.service	2017-02-28 06:29:35 -06:00