Commit graph

3626 commits

Author SHA1 Message Date
Anthony Rabbito
93445b4dbc
Update hashes and set default version to 1.19.5 (#7012)
* Update hashes and set default version to 1.19.5

Signed-off-by: anthr76 <hello@anthonyrabbito.com>

* Reorder hashes

1.19.5 hashes should be near 1.19.x

* Added back blank line
2020-12-16 01:42:20 -08:00
Sylvain Desbureaux
9c1e08249d
change | to is (#6991)
Since ansible 2.9 search cannot be used as filter after a pipe but after `is`

Signed-off-by: Sylvain Desbureaux <sylvain.desbureaux@orange.com>
2020-12-09 07:26:50 -08:00
Kenichi Omichi
33a60fe919
Fix warning of mkdir usage (#6951)
This fixes the following warning:

  [kubernetes/client : Generate admin kubeconfig with external api endpoint]
  [WARNING]: Consider using the file module with state=directory rather than
  running 'mkdir'.  If you need to use command because file is insufficient
  you can
2020-12-09 07:14:51 -08:00
Sergey
85982dc8e9
add support crio version for varios k8s vers (#7003)
* add support crio version for various k8s vers

* regexp in pkg versions
2020-12-09 01:22:50 -08:00
Hannes Körber
dbe02d398a
etcd: Fix permissions of /etc/ssl/etcd/ssl (#6908) 2020-12-09 00:48:49 -08:00
emiran-orange
7084d38767
Fix ETCD_CIPHER_SUITES shell var assignment (#7002) 2020-12-08 13:23:34 -08:00
Etienne Champetier
00e0f3bd2b
Fix nf_conntrack_ipv4 modprobe (#6988)
RedHat 8.3 merged nf_conntrack_ipv4 in nf_conntrack but still advertise 4.18
so just try to modprobe and decide depending on the success
Also nf_conntrack is a dependency of ip_vs, so no need to care about it

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2020-12-07 18:17:11 -08:00
Samuel Liu
cd7212453e
Add etcd tls cipher suites (#7001)
* Add etcd tls cipher suites

* yamllint
2020-12-07 18:13:10 -08:00
Sergey
a69f2b09da
download run once feature for containerd (#6997) 2020-12-07 01:09:25 -08:00
Hans Feldt
878fe80ca3
add and use common crictl role (#6978) 2020-12-05 09:43:25 -08:00
Sander Klein
8331c1f858
Hold the docker-ce-cli (#6995)
This will make sure an upgrade doesn't upgrade the docker cli.
2020-12-04 18:21:25 -08:00
Florian Ruynat
f4a69d2827
Update docker to 19.03.14 and containerd to 1.3.9 (#6980) 2020-12-03 16:33:25 -08:00
Sergey
ed6cef85d8
add crio registry mirror support (#6977)
* add crio registry mirror support

* mdlint fix
2020-12-03 13:57:25 -08:00
OwenTuz
d315f73080
Ensure libseccomp is installed before starting containerd on CentOS 8 (#6922)
* Ensure libseccomp is installed before starting containerd on CentOS 8

* Simplify libseccomp install on CentOS 8

- Uses `package` module
- Replaces complex version check with 'state: latest'. The version must
  be > 2.3 when using with cri-o.
- Removes unnecessary `not is_ostree` condition as CentOS 8 does not use
  ostree
2020-12-03 13:43:26 -08:00
Sergey
06ec5393d7
up vagrant box to fedora/33-cloud-base in cri-o molecule tests (#6992) 2020-12-03 11:25:26 -08:00
Christoph Stäbler
1a491fc10c
Update hashes and set default to 1.19.4 (#6903) 2020-12-03 06:34:59 -08:00
Pasquale Toscano
488db81e36
Add pasqualet to approvers (#6976) 2020-12-03 00:58:59 -08:00
Emerson Ford
f377d9f057
Set etcd_.*_addresses to use etcd_[events_]access_address instead of access_ip (#6936) 2020-12-02 13:55:00 -08:00
Florian Ruynat
db4e942b0d
Remove hyperkube from codebase (#6965) 2020-12-02 13:50:59 -08:00
Etienne Champetier
68b96bdf1a
Helm v3 only (#6846)
* Fix etcd download dest

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>

* Only support Helm v3, cleanup install

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2020-12-02 00:20:50 -08:00
Victor Morales
4f7a760a94
Add crun support (#6864)
Signed-off-by: Victor Morales <v.morales@samsung.com>
2020-12-01 11:00:50 -08:00
Pasquale Toscano
f1231bb97d
Add molecule for Kata Containers with Containerd (#6905) 2020-11-30 23:34:49 -08:00
Hans Feldt
80eb1ad936
fix ansible password authentication (#6907)
* copying ssh key no longer required, works with password auth
* use copy module instead of synchronize (which requires sshpass)
* less tasks and always changed tasks
2020-11-30 15:12:50 -08:00
Danilo Riecken P. de Morais
cc5303e1c8
Add test for Fedora CoreOS before creating Docker service file (#6940) 2020-11-30 09:20:49 -08:00
Barry Melbourne
f6a5948f58
Upgrade Jetstack Cert-Manager v1.0.4 (#6937) 2020-11-30 06:52:50 -08:00
Florian Ruynat
f6eed8091e
Remove contiv related files (#6964) 2020-11-30 06:48:50 -08:00
Sergey
4a8a52bad9
containerd docker hub registry mirror support (#6962)
* containerd docker hub registry mirror support

* add docs

* fix typo

* fix yamllint

* fix indent in sample
and ansible-playbook param in testcases_run

* fix md

* mv common vars to tests/common/_docker_hub_registry_mirror.yml

* checkout vars to upgrade tests
2020-11-30 00:22:49 -08:00
Dmitry Chusovitin
c09aabab0c
Remove executable bit from yaml and j2 files (#6894) 2020-11-29 20:18:48 -08:00
Bas van den Brink
d47ba2b2ef
Disable CRI-O restart by Multus (#6930) 2020-11-28 08:52:47 -08:00
Bas van den Brink
17fb1ceed8
Allow airgapped CRI-O installation (#6927) 2020-11-28 08:38:47 -08:00
Clicia Scarlet
97ff67e54a
Fix yaml syntax error when use multilines in dns_etchosts (#6960) 2020-11-28 08:32:47 -08:00
Alexander D. Kanevskiy
d4204a42fd
Fix crictl paths and some of docker paths (#6961)
If crictl (and docker) binaries are deployed to the directories
that are not in standard PATH (e.g. /usr/local/bin), it is required
to specify full path to the binaries.
2020-11-28 08:30:47 -08:00
Kenichi Omichi
c6f6940459
Fix warning of "Enable ip forwarding" (#6953)
The task outputs the following warning:

  TASK [kubernetes/preinstall : Enable ip forwarding]
  [WARNING]: The value 1 (type int) in a string field was converted
  to u'1' (type string). If this does not look like what you expect,
  quote the entire value to ensure it does not change.
2020-11-27 03:54:49 -08:00
Florian Ruynat
d40701463f
Update kube-ovn to 1.5.2 (#6610) 2020-11-26 09:34:19 -08:00
Florian Ruynat
405692d793
Switch some image from dockerhub to k8s.gcr (also increase pkg retries) (#6955) 2020-11-26 08:46:19 -08:00
Bas van den Brink
7938748d77
Allow configuring container log limits for Kubelet (#6933) 2020-11-26 00:32:19 -08:00
Etienne Champetier
e909f84966
Bump nodelocaldns to 1.16.0 (#6916)
This new version uses the same base image as kube-proxy
(k8s.gcr.io/build-image/debian-iptables)
This allow to automatically pick iptables-legacy or iptables-nft,
and be compatible with RHEL/CentOS 8
https://github.com/kubernetes/dns/pull/367

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2020-11-25 17:10:19 -08:00
Andrii
8a153ed38e
Add serviceExternalIPs option for calico installation (#6928) 2020-11-25 05:34:39 -08:00
Barry Melbourne
eb16986f32
Add RHEL support subscription registration (#6572) 2020-11-24 08:33:00 -08:00
Lee Spottiswood
bd801de236
bump calico version to 3.16.5 (#6944) 2020-11-24 02:49:01 -08:00
Hans Feldt
ee23b947aa
fix flake8 errors in Kubespray CI - tox-inventory-builder (#6910)
* fix flake8 errors in Kubespray CI - tox-inventory-builder

* Invalidate CRI-O kubic repo's cache

Signed-off-by: Victor Morales <v.morales@samsung.com>

* add support to configure pkg install retries

and use in CI job tf-ovh_ubuntu18-calico (due to it failing often)

* Switch Calico, Cilium and MetalLB image repos to Quay.io

Co-authored-by: Victor Morales <v.morales@samsung.com>
Co-authored-by: Barry Melbourne <9964974+bmelbourne@users.noreply.github.com>
2020-11-22 23:47:35 -08:00
Hans Feldt
70bbb3e280
calico: avoid POD restart during initial deploy (#6886)
calico PODs are first started and then in a handler killed and
restarted for no reason, nothing has changed.

By using the existing variable 'calico_cni_config' (only defined when
calico has already started) the restart can be skipped.
2020-11-13 00:02:23 -08:00
Sebastian P
a27eebb225
Fix hash of pypy3.6-v7.3.2-linux64 archive. (#6897)
The previous hash was still that of v7.3.1, see https://www.pypy.org/download.html for the hash of the current release.
2020-11-11 09:20:27 -08:00
Mikael Johansson
93a1693040
Update BGPPeer CRD to match v3.16 of Calico (#6881) 2020-11-05 11:14:51 -08:00
Hans Feldt
544aa00c17
install etcdctl to host when etcd deployment type is kubeadm (#6857)
* create a wrapper script with pki options
* supports all kubespray managed container engines

Co-authored-by: Hans Feldt <hafe@users.noreply.github.com>
2020-11-04 00:20:04 -08:00
Hans Feldt
fc22453618
crio: avoid extra restart after install and upgrade (#6882)
Package upgrade restarts crio. By creating/updating config first,
an extra restart can be avoided.
2020-11-03 08:54:03 -08:00
David Medinets
fefcb8c9f8
Allow the eventRecordQPS setting to be set. (#6880)
* Allow the eventRecordQPS setting to be set.

The eventRecordQPS parameter controls rate limiting for event recording. When zero, unlimited events can cause denial-of-service situations. For my situation, I don't need more than a setting of "5". This change allows me to configure the setting before creating the cluster.

* Allow the eventRecordQPS setting to be set.

The default settings (see types.go) is five. So, this change does not affect the cluster provisioning. However, it does allow for the setting to be changed.
2020-11-03 00:42:15 -08:00
Victor Morales
9cf5dd0291
Use cgroup v1 in Fedora +31 (#6862)
Fedora 31 uses Cgroups v2 by default. This change by passes the kernel
parameter systemd.unified_cgroup_hierarchy=0.

Signed-off-by: Victor Morales <v.morales@samsung.com>
2020-11-02 06:32:53 -08:00
Kenichi Omichi
7a1f033c1d
Update helm stable repo (#6867)
As https://helm.sh/blog/new-location-stable-incubator-charts/
helm stable repo is changed to https://charts.helm.sh/stable
In addition, if using helm v3.4.0+ the old stable repo installation
is failed.
So this updates the stable repo to avoid such error.
2020-10-31 09:54:51 -07:00
Florian Ruynat
227e96469c
Minor update Calico and Cilium (#6871) 2020-10-29 07:14:59 -07:00
Michal Skalski
c93fa6effe
Handle dns_mode set to 'none' in generate nameservers task (#6825)
When dns_mode was set to 'none' the coredns_server became an empty
string and invalid operation of adding string to list was executed.
2020-10-29 01:04:58 -07:00
Mikhail Snetkov
c25d624524
Register missing outputs in role "remove-node" (#6856) 2020-10-28 12:55:56 -07:00
David Medinets
12ab8b7af3
update version of ingress-nginx controller in docs. (#6855)
* update version of ingress-nginx controller.

Change tag from controller-v0.34.0 to controller-v0.40.2 to use newest tag.

* Update docs about aws deploy templates.

In the yaml templates, there is no mention of idle timeouts. This is why I removed the documentation about it. This might be a mistake. Please verify this. I don't know enough to verify it myself.

* Change label when checking version.

When checking for `app.kubernetes.io/name=ingress-nginx`, a completed pod was selected which is not helpful when trying to `exec`. Changing the label selects the running controller pod.

* put back the information about ELB Idle Timeouts.

When I removed the information, I had overlooked that it was mentioned in the L7 yaml file. Thanks.
2020-10-28 11:05:57 -07:00
axelgobletbdr
097bec473c
fixed bug in etcd retention where backups are not sorted by date (#6860)
* fixed bug in etcd retention where backups are not sorted by date

* added directory filter to find command
2020-10-28 09:09:57 -07:00
Hans Feldt
d36b5d7d55
Install cri-o with package version (#6853)
and thereby support upgrade from e.g. 1.18.x to 1.19.y

Included OSes:
- Centos7/8
- Ubuntu18/20

New variables for overriding by default installed packages:
- centos_crio_packages
- ubuntu_crio_packages
2020-10-26 08:35:02 -07:00
axelgobletbdr
4b858b6466
Fixes 6621 etcd backup directory is consuming much rootfs disk space (#6836)
* added an ansible var to manage retention of etcd backups

* refactord ls/grep into find in etcd backup removal command
2020-10-23 07:09:57 -07:00
Victor Morales
e03e3c4582
Add Kata Containers support to CRI-O runtime (#6830)
* Enable Kata Containers for CRI-O runtime

Kata Containers is an OCI runtime where containers are run inside
lightweight VMs. This runtime has been enabled for containerd runtime
thru the kata_containers_enabled variable. This change enables Kata
Containers to CRI-O container runtime.

Signed-off-by: Victor Morales <v.morales@samsung.com>

* Set appropiate conmon_cgroup when crio_cgroup_manager is 'cgroupfs'

* Set manage_ns_lifecycle=true when KataContainers is enabed

* Add preinstall check for katacontainers

Signed-off-by: Victor Morales <v.morales@samsung.com>

Co-authored-by: Pasquale Toscano <pasqualetoscano90@gmail.com>
2020-10-23 03:07:46 -07:00
Florian Ruynat
91f1edbdd4
Update k8s-dns-node-cache to 1.15.16 (#6852) 2020-10-22 10:29:36 -07:00
Maciej
c6e2a4ebd8
Set feature gates in kube-proxy ConfigMap (#6851)
Command line flags aren't added to kube-proxy which results in missing
feature gates set in this component. Add appropriate setting to
ConfigMap instead.

Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>
2020-10-22 03:39:34 -07:00
Hans Feldt
3eefb5f2ad
fix scaling in kubeadm etcd mode (#6822)
'ansible.vars.hostvars.HostVarsVars object' has no attribute 'kubeadm_upload_cert'

kubeadm_upload_cert will never be found as a hostvar for the first
master since the task is executed for a worker.

Fix by executing the upload task for the first master and register
the needed key. After that, workers can read hostvars for the master

Var kubeadm_etcd_refresh_cert_key removed since it no longer has
any use.
2020-10-21 07:32:32 -07:00
Hans Feldt
04b19359cb
allow non existing etcd group (#6797)
When using kubeadm managed etcd, configuring an etcd group can now
be skipped.
2020-10-21 07:32:20 -07:00
Florian Ruynat
60b0fb3e88
Update hashes and set default version to 1.19.3 (#6841) 2020-10-21 00:58:20 -07:00
wand3r3r
f323d70c0f
Adding option to disable globally applying a proxy to etc/yum.conf (#6828)
* Adding option to disable gloablly applying a proxy to etc/yum.conf

* Change made to proxy_yum_globaly basedon reviewer feedback

* fix trailing spaces in ymllint
2020-10-20 23:22:19 -07:00
Etienne Champetier
03f316e7a2
Fix proxy and module_hotfixes (#6837)
This fixes the Containerd + EL8 case that was missed in 7d1ab3374e

On CentOS 8 with proxy ansible render inline `proxy` and `module_hotfixes` options.

For example:
```
proxy=http://127.0.0.1:3128module_hotfixes=True
```

But expected result:
```
proxy=http://127.0.0.1:3128
module_hotfixes=True
```

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2020-10-19 23:06:07 -07:00
David Louks
79b7f0d592
Use existing variable for tiller service account name (#6829)
* Use existing variable for tiller service account name

* keep crb as tiller
2020-10-19 03:04:13 -07:00
Florent Monbillard
d25aebdaf5
Upgrade Flannel to 0.13.0 (#6826) 2020-10-15 10:50:22 -07:00
Hans Feldt
4781df587c
bump crio version to 1.19 (#6758)
* bump crio version to 1.19

* crio package name has changed for debian/ubuntu
* crio upgrade does not work, see #6757

* update crio info in docs
2020-10-13 02:08:26 -07:00
Sergey
e49330d6ee
change owner to root for bin_dir directory (#6814) 2020-10-12 18:13:22 -07:00
Samuel Liu
dbe6eb20c8
Modify imagepullpolicy (#6816) 2020-10-12 17:45:22 -07:00
yelhouti
8bec5beb4b
fix: add tags for set facts nodelocaldns (#6813) 2020-10-12 16:47:21 -07:00
Hans Feldt
e6effb8245
Make reset work for crio (#6812)
crio refuses to delete pods when cni is unavailable which is the
case e.g. using calico with kdd datastore. See:

https://github.com/cri-o/cri-o/issues/4084

Fix by deleting storage associated with containers. Stop and disable
crio service so switching container runtime can be done.
2020-10-12 15:47:22 -07:00
Bogdan Peste
5e32655830
Added option to force apiserver and respective client certificate to … (#6403)
* Added option to force apiserver and respective client certificate to be regenerated without necessarily needing to bump the K8S cluster version

* Removed extra blank line
2020-10-12 06:02:48 -07:00
holmesb
4cb5a4f609
Fix line-spacing in no_proxy.yml (#6810)
Signed-off-by: holmesb <5072156+holmesb@users.noreply.github.com>
2020-10-11 08:50:47 -07:00
Nikita Velgin
cb57c3c916
Fix handler naming issue for Kubeadm | kubelet (#6803)
Handlers with the same name (Kubeadm | restart kubelet) leads to incorrect playbook execution. As a result, after completing the tasks, kubelet does not restart. This PR fix this behavior
2020-10-11 08:26:47 -07:00
Hans Feldt
92b1166dd0
Disable dashboard by default (#6804)
Users should opt in for features and not opt out.
2020-10-11 08:06:47 -07:00
Kenichi Omichi
e6c28982dd
Chmod kubeconfig to avoid group-readable (#6800)
After upgrading to newer Kubernetes(v1.17 at least), kubectl command
shows the following warning message:

  WARNING: Kubernetes configuration file is group-readable.
  This is insecure. Location: /home/foo/.kube/config

The kubeconfig was copied from {{ artifacts_dir }}/admin.conf with
kubeconfig_localhost feature. It is better to set valid file mode
at getting it on Kubespray.
2020-10-09 01:39:08 -07:00
Florian Ruynat
64f69718fb
Update bunch of dependencies (#6801) 2020-10-09 01:35:06 -07:00
holmesb
1301e69c7d
If no_proxy_exclude_workers is true, workers will be excluded from the no_proxy variable.  This prevents docker engine restarting when scaling workers. (#6520)
Signed-off-by: holmesb <5072156+holmesb@users.noreply.github.com>
2020-10-09 01:15:07 -07:00
Hans Feldt
99b8f0902e
crio: ensure service is started and enabled (#6753) 2020-10-07 00:10:42 -07:00
Sergey
6a4d322a7c
Do not install etcd and etcdctl on master with scale.yml playbook. (#6798)
Remove task with install etcdctl from etcd role when etcd_kubeadm_enabled=true
2020-10-06 07:04:20 -07:00
rafal-jan
9d7f358d4b
Fix csi-snapshotter timeout option. Fix ebs-external-attacher-role ClusterRole. (#6776) 2020-10-06 06:44:21 -07:00
bozzo
b1bb5a4796
Fix cinder & external_openstack cacert deployment (#6745)
The CA cert was only deployed on master nodes
2020-10-06 05:34:21 -07:00
5-sigma
f8ae086334
Added Comment line above checksum section to add clarification about Kubespray's version support and testing (#6785) 2020-10-06 05:30:21 -07:00
Florian Ruynat
c49bda7319
Update nginx ingress controller to 0.40.1 (#6786) 2020-10-06 05:10:21 -07:00
Florian Ruynat
a687013fbe
Update kube-router to 1.1.0 (#6793) 2020-10-05 13:46:20 -07:00
Hans Feldt
b0097fd0c1
harden reset to work in more cases (#6781)
reset playbook fails and does not continue cleanup after for
example a host reboot with kubelet stopped/disabled
2020-10-05 12:55:21 -07:00
Joren Zandstra
9729b6b75a
Add extra arguments variables for openstack and vsphere cloud controller manager daemonsets (#6783) 2020-10-02 10:14:48 -07:00
Florian Ruynat
58959ae82f
Update cilium with minor fix for CVE (#6784) 2020-10-02 10:02:48 -07:00
Victor Morales
a374301570
Remove arch from flannel image tag (#6765)
The 0d0cc8cf9c change creates several
DaemonSets to cover the Flannel CNI installation for different CPU
architectures. This change removes the unnecessary architecture value
from the docker tag value.

Signed-off-by: Victor Morales <v.morales@samsung.com>
2020-09-30 14:16:54 -07:00
dlandtwing
bc8e16fc69
nginx ingress: fix yaml for multiple nodeselectors (#6768)
In case multiple nodeselectors are specified in ingress_nginx_nodeselector, the generated daemonset yaml template for nginx is invalid due to missing indentation starting with the second nodeselector
2020-09-30 07:23:26 -07:00
petruha
7a730d42dd
Add bin_dir to PATH environment. (#6764) 2020-09-29 06:35:27 -07:00
Kenichi Omichi
109391031b
Add error msg for check of local ip (#6761)
When stopping at the check of "Stop if ip var does not match local ips"
the error message is like:

  fatal: [single-k8s]: FAILED! => {
      "assertion": "ip in ansible_all_ipv4_addresses",
      "changed": false,
      "evaluated_to": false,
      "msg": "Assertion failed"
  }

That doesn't contain actual IP addresses and it is difficult to understand
what was wrong. This adds the error message which contain actual IP addresses
to investigate the issue if happens.
2020-09-29 06:29:27 -07:00
Mateusz Adamek
aba63f0f9a
Added support for dynamic tags in AWS and Azure. (#6752)
* Added support for dynamic tags in AWS and Azure.

* Added examples of dynamic tags configuration.
2020-09-26 10:50:48 -07:00
Lennart Weller
e67886bf9d
add leader election timeouts and durations to available parameters (#6691) 2020-09-25 08:21:11 -07:00
Florian Ruynat
c2ac3b51c1
Update containerd to 1.3.7 - add fedora32/centos8 containerd packages (#6749) 2020-09-25 08:15:11 -07:00
emiran-orange
081a9e7bd8
/opt/cni/bin/install not before calico 3.16 (#6738) 2020-09-25 06:15:11 -07:00
Florian Ruynat
55d8ed093a
Add centos8 docker repo (#6747) 2020-09-25 06:11:11 -07:00
axelgobletbdr
77149e5d89
Fixes #6740: Allow disabling reverse DNS lookups in coredns (#6741)
* created variable to enable/disable reverse dns lookups in coredns

* fixed linting-error in dns-stack.md
2020-09-25 02:33:11 -07:00
orange-llajeanne
28839f6b71
remove duplicate audit-policy-file argument in kubeadm configuration (#6734) 2020-09-24 09:26:06 -07:00
Hans Feldt
28073c76ac
Calico upgrade path validation and old version cleanup (#6733)
* calico: add constant calico_min_version_required

and verify current deployed version against it.

* calico: remove upgrade support with data migration

The tool was used pre v3.0.0 and is no longer needed.

* calico: remove old version support from tasks

* calico: remove old ver support from policy ctrl

* calico: remove old ver support from node

* canal: remove old ver support

* remove unused calicoctl download checksums

calico_min_version_required is the oldest version that can be installed
Older versions can be removed.
2020-09-24 09:04:06 -07:00