Commit graph

3852 commits

Author SHA1 Message Date
Cristian Calin
4c06aa98b5
crio: add supported versions 1.20 and 1.21 and align default with k8s version (#7562)
* crio: add supported versions 1.20 and 1.21 and align default with k8s version

* cri-o: drop versions 1.17 and 1.18 from version matrix

* update note on cri-o version alignment
2021-04-28 11:30:51 -07:00
muzi502
1b267b6599
Fix calico-kube-controller becomes Error for canal (#7564) 2021-04-28 11:26:52 -07:00
Cristian Calin
dd6efb73f7
Calico new versions v3.17.4 and v3.18.2 (#7563)
* calico: upgrade from v3.17.3 to v3.17.4

* calico: upgrade from v3.18.1 to v3.18.2
2021-04-28 08:22:50 -07:00
harihud
0071e3c99c
Update main.yml (#7557) 2021-04-27 15:41:27 -07:00
faruryo
975f84494c
Fix calico-kube-controller becomes Error (#7548)
Change mode so that calico-kube-controllers can be read because it was changed to run as non-root
https://github.com/projectcalico/kube-controllers/pull/566
2021-04-26 15:37:03 -07:00
Florian Ruynat
7c86734d2e
Add cri-o 1.20/1.21 (#7544) 2021-04-26 09:21:16 -07:00
Cristian Calin
8665e1de87
Fix cri-o support for Oracle and AlmaLinux (#7541) 2021-04-26 09:11:02 -07:00
Florian Ruynat
c16efc9ab8
Fix Opensuse not working with ansible_distribution (#7551) 2021-04-26 08:37:02 -07:00
muzi502
69806e0a46
Add nerdctl cli tool for containerd user (#7500)
* Add nerdctl cli tool for containerd user

* Add nerdctl enable option

* Add nerdctl enable option and update nerdctl version to 0.8.0
2021-04-25 23:47:01 -07:00
Cristian Calin
ad15a4b755
Bump calico versions (#7543)
* add calico 3.16.10 hashes

* drop old calico version 3.16.9
2021-04-24 12:37:01 -07:00
Cristian Calin
002a4b03a4
Drop calico 3.15 (#7545)
* calico: drop support for version 3.15

* drop check for calico version >= 3.3, we are at 3.16 minimum now

* we moved to calico 3.16+ so we can default to /opt/cni/bin/install
2021-04-23 23:43:14 -07:00
Cristian Calin
73db44b00c
Initial AlmaLinux support (#7538)
* AlmaLinux: ansible>2.9.19 is needed to know about AlmaLinux

* AlmaLinux: identify as a centos derrivative

* AlmaLinux: add AlmaLinux to checks for CentOS

* Use ansible_os_family to compare family and not distribution
2021-04-22 23:50:03 -07:00
Florian Ruynat
b32d25942d Minor update to cni-plugins and kube-router 2021-04-22 06:47:42 -07:00
Florian Ruynat
fce705a92b Helm minor update to 3.5.4 2021-04-22 06:47:42 -07:00
Florian Ruynat
6164c90f70 Update kube-ovn to 1.6.2 2021-04-22 06:47:42 -07:00
Samuel Liu
8c7b90ebbf
add ingress controller class (#7522) 2021-04-22 00:22:38 -07:00
Ian Martin
38d9d2ea0e
Ambassador can watch multiple namespaces (#7516)
* Ambassador can watch multiple namespaces

* update variable name per PR review
2021-04-22 00:22:31 -07:00
Cristian Calin
384d30b675
add support for configuring cri-o pids_limit (#7525) 2021-04-21 10:55:51 -07:00
Cristian Calin
add61868c6
Add Calico v3.17.3 and v3.18.1 (#7524)
* add hashes for calico v3.17.3

* add hashes for claico v3.18.1

* bump default calico version to v3.17.3

* calico crds are missing yaml separator breaking kdd
2021-04-21 10:45:51 -07:00
Xachman
a7493e26e1
add enablerepo: amzn2extra-docker for docker install on aws 2 (#7507) 2021-04-21 07:24:10 -07:00
Kenichi Omichi
ae3a1d7c01
Fix keepcache values of yum_repository (#7506)
As the official document[1], the parameter keepcache should be
'0' or '1' as string. To avoid the following warning message,
this fixes the parameter value:

  [WARNING]: The value False (type bool) in a string field was
  converted to u'False' (type string). If this does not look
  like what you expect, quote the entire value to ensure it
  does not change.

https://docs.ansible.com/ansible/latest/collections/ansible/builtin/yum_repository_module.html
2021-04-21 07:20:11 -07:00
Mathieu Parent
e39e3d5c26
Fix OpenId Connect example prefixes (#7527)
Fixes "mapping values are not allowed in this context
2021-04-20 17:32:10 -07:00
holmesb
1e7d48846a
Fixes issue #7528 - allow configuring CALICO_STARTUP_LOGLEVEL via a new variable: calico_node_startup_loglevel (#7530)
Signed-off-by: Brendan Holmes <5072156+holmesb@users.noreply.github.com>
2021-04-20 15:37:42 -07:00
Florian Ruynat
6001edeecd
Cleanup hashes and 1.18 hooks (#7534) 2021-04-20 15:34:33 -07:00
Frank Ritchie
ce0b7834ff
Refactor cilium_ipsec_enabled check (#7520)
This is a followup to

https://github.com/kubernetes-sigs/kubespray/pull/7413

Although the code worked there was a desire for a better solution.
Hopefully people will be happy with this alternative.
2021-04-19 02:06:36 -07:00
Florian Ruynat
1c0836946f Update default Kubernetes version to 1.20.6 2021-04-15 22:26:22 -07:00
Florian Ruynat
bccbe323b7 Add new kubernetes hashes (1.19.10, 1.20.6) 2021-04-15 22:26:22 -07:00
Samuel Liu
d73249a793
Add bash-completion package (#7510) 2021-04-15 08:33:50 -07:00
Florian Ruynat
cd9a03f86c
Update some docker defaults (#7499) 2021-04-14 15:13:07 -07:00
muzi502
b47c21c683
Remove some bash completion file when reset cluster (#7502) 2021-04-14 11:07:09 -07:00
Krystian Młynek
2a2fb68b2f
Add missing proxy environment in crio_repo.yml (#7492) 2021-04-13 01:20:51 -07:00
Etienne Champetier
bf6a39eb84
Add auto_renew_certificates_systemd_calendar (#7490)
This allow to configure when K8S certificates renewal runs

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-04-12 09:47:45 -07:00
Etienne Champetier
e444b3c140
Regenerate apiserver.crt on all control-plane nodes (#7463)
We were regenerating only the cert of the first node
While at it speed up the check step

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-04-12 09:17:38 -07:00
emiran-orange
d56ac216f4
Use kubeadm_feature_gates instead of kube_feature_gates to leverage kubeadm feature gates and not to interfere with k8s components feature gates (#7447) 2021-04-12 01:05:59 -07:00
Zhong Jianxin
420a412234
Add containerd_extra_args (#7461)
* Add containerd_extra_args

This is useful for custom containerd config, e.g. auth

Signed-off-by: Zhong Jianxin <azuwis@gmail.com>

* Make containerd config.toml mode 0640

It may contain sensitive information like password

Signed-off-by: Zhong Jianxin <azuwis@gmail.com>
2021-04-12 01:02:00 -07:00
Samuel Liu
90c643f3ab
format ansible output (#7482) 2021-04-11 00:37:59 -07:00
Florian Ruynat
6d293ba899
Update hashes with 1.21.0 (#7478) 2021-04-09 08:05:05 -07:00
Florian Ruynat
aa086e5407
Remove dead code from kubeadm-etcd (#7470) 2021-04-09 01:10:47 -07:00
Sergey
cce0940e1f
add CI test for auto_renew_certificates (#7472)
* add CI test for auto_renew_certificates

* change timer value

fix typo error in rotate cert script
2021-04-09 00:42:47 -07:00
Samuel Liu
e2a7f3e2ab
remove-node roles: fix kubectl absolute path (#7469)
* kubelet absolute path

* kubelet absolute path
2021-04-08 12:24:02 -07:00
Kenichi Omichi
5a351b4b00
Add condition for audit_webhook_mode batch (#7444)
According to the document[1], audit-webhook-batch-max-size and
audit-webhook-batch-max-wait are used only in the batch mode.
This adds a condition to avoid unnecessary writting on the config.

[1]: https://kubernetes.io/docs/tasks/debug-application-cluster/audit/#batching
2021-04-08 07:52:56 -07:00
Frank Ritchie
6f2abbf79c
Move cilium kvstore settings to configmap (#7462)
This PR is to move the cilium kvstore options to the configmap
rather than specifying them in the deployment as args. This
is not technically necessary but keeping all the options in
one place is probably not a bad idea.

Tested with cilium 1.9.5.
2021-04-08 07:32:56 -07:00
Florian Ruynat
bef1e628ac
Fix issue with 'latest' in containerd version (#7459) 2021-04-07 08:33:53 -07:00
Frank Ritchie
a6622b176b
Update cilium_ipsec_enabled check (#7413)
When attempting a fresh install without cilium_ipsec_enabled I ran
into the following error:

failed: [k8m01] (item={'name': 'cilium', 'file': 'cilium-secret.yml', 'type': 'secret', 'when': 'cilium_ipsec_enabled'}) =>
{"ansible_loop_var": "item", "changed": false, "item": {"file": "cilium-secret.yml", "name": "cilium", "type": "secret",
"when": "cilium_ipsec_enabled"},"msg": "AnsibleUndefinedVariable: 'cilium_ipsec_key' is undefined"}

Moving the when condition from the item level to the task level solved
the issue.
2021-04-06 06:17:33 -07:00
Maciej Wereski
771a5e26bb
Add KubeSchedulerConfiguration for k8s 1.19 and up (#7351)
* Add KubeSchedulerConfiguration for k8s 1.19 and up

With release of version 1.19.0 of kubernetes KubeSchedulerConfiguration
was graduated to beta. It allows to extend different stages of
scheduling with profiles. Such effect is achieved by using plugins and
extensions.

This patch adds KubeSchedulerConfiguration for versions 1.19 and later.
Configuration is set to k8s defaults or to kubespray vars. Moving those
defaults to new vars will be done in following patch.

Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>

* KubeSchedulerConfiguration: add defaults

Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>
2021-04-06 00:35:35 -07:00
Florian Ruynat
6479e26904
Replace deprecated 'with_dict' with 'loop' (#7442) 2021-04-05 13:45:19 -07:00
Samuel Liu
7df7054bdc
remove local lb privileged (#7437) 2021-04-05 05:22:14 -07:00
Necatican Yıldırım
ceb6c172ad
Crun v0.19 support (#7433)
* Add support for crun v0.19

* Change default crun version to v0.19
2021-04-05 01:20:13 -07:00
Samuel Liu
7f52c1d3a2
reset roles need flush iptables:raw (#7426) 2021-04-05 01:16:13 -07:00
Daniil Muidinov
2257181ca8
Set containerd version to 1.4.4 (#7398)
* Set containerd version to 1.4.3

* Set containerd version to 1.4.4

Co-authored-by: Barry Melbourne <9964974+bmelbourne@users.noreply.github.com>
2021-04-01 23:20:11 -07:00
orange-llajeanne
7e75d48cc4
local provisioner 'useNodeNameOnly' option can be configured (#7421) 2021-04-01 16:54:11 -07:00
Pasquale Toscano
6330db89a7
Update KataContainers to 1.12.1 (#7427) 2021-04-01 08:55:21 -07:00
Frank Ritchie
f05d6b3711
Add cilium_ipam_mode variable (#7418)
Starting with Cilium v1.9 the default ipam mode has changed to "Cluster
Scope". See:

https://docs.cilium.io/en/v1.9/concepts/networking/ipam/

With this ipam mode Cilium handles assigning subnets to nodes to use
for pod ip addresses. The default Kubespray deploy uses the Kube
Controller Manager for this (the --allocate-node-cidrs
kube-controller-manager flag is set). This makes the proper ipam mode
for kubespray using cilium v1.9+ "kubernetes".

Tested with Cilium 1.9.5.

This PR also mounts the cilium-config ConfigMap for this variable
to be read properly.

In the future we can probably remove the kvstore and kvstore-opt
Cilium Operator args since they can be in the ConfigMap. I will tackle
that after this merges.
2021-04-01 07:33:22 -07:00
Helmut Januschka
cce9d3125d
Update k8s-certs-renew.sh.j2 (#7422)
fix undefinedElse
2021-03-31 00:00:58 -07:00
Etienne Champetier
e381ce57e2
Remove left over nodes_to_drain (#7412)
Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-29 16:17:56 -07:00
Fernando
5dbce6a2bd
add support for custom calico port (#7419) 2021-03-29 08:38:45 -07:00
Frank Ritchie
5b0e88339a
Update cilium-operator clusterrole (#7416)
When upgrading cilium from 1.8.8 to 1.9.5 I ran into the following
error:

level=error msg="Unable to update CRD" error="customresourcedefinitions.apiextensions.k8s.io
\"ciliumnodes.cilium.io\" is forbidden: User \"system:serviceaccount:kube-system:cilium-operator\"
cannot update resource \"customresourcedefinitions\" in API group \"apiextensions.k8s.io\" at the
cluster scope" name=CiliumNode/v2 subsys=k8s

The fix was to add the update verb to the clusterrole. I also added
create to match the clusterrole created by the cilium helm chart.
2021-03-29 00:04:51 -07:00
Samuel Liu
db43891f2b
remove unused handlers in cilium roles (#7414) 2021-03-29 00:04:44 -07:00
Terry
f72063e7c2
Remove DNSSEC config management in bootstrap-debian.yml (#7408)
DNSSEC is off by default on ubuntu/bionic64 (18.04) as per resolved.conf(5).
These tasks are artefacts of obsolete infra configuration, and no longer needed.

Further removing these tasks resolves the issue that the tasks always reports
'changed' and bounces systemd-resolved unneccesarily, even if there was no
actual modification of /etc/systemd/resolved.conf.
2021-03-29 00:00:45 -07:00
Etienne Champetier
36a3a78952
Fix remove-node by removing jq usage (#7405)
Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-26 08:48:43 -07:00
Etienne Champetier
2d1597bf10
Fix k8s-certs-renew for k8s < 1.20 (#7410)
Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-26 08:44:44 -07:00
Anthony Rabbito
edfa3e9b14
Correct Jinja Syntax for etcd-unsupported-arch (#6919)
`-%` causes `etcd-unsupported-arch: arm64` to print on COL 1 instead of
COL 6.

Signed-off-by: anthr76 <hello@anthonyrabbito.com>
2021-03-26 02:10:43 -07:00
Kaleb Elwert
6fa3565dac
Allow connecting to bastion via non-standard SSH port (#7396)
* Allow connecting to bastion via non-standard port

* Fix bastion connection when ansible_port is not provided
2021-03-26 00:48:43 -07:00
rptaylor
7dec8e5caa
specify runAsGroup, allow safe sysctls by default (#7399) 2021-03-25 08:03:30 -07:00
Etienne Champetier
f0cdf71ccb
Remove vault (#7400)
* Remove contrib/vault

This is marked as broken since 2018 / 3dcb914607
This still reference apiserver.pem, not used since ddffdb63bf

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>

* Finish nuking vault from the codebase

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-24 09:26:08 -07:00
Boris Barnier
8655b92e93
Set Kube-router version to 1.2.0 (#7402)
See: `https://github.com/cloudnativelabs/kube-router/releases/tag/v1.2.0`
2021-03-24 09:22:07 -07:00
Jacky Wu
e1c6992c55
fix: correct hardcoded macvlan template, use var macvlan_interface. (#7401) 2021-03-24 01:46:06 -07:00
Kenichi Omichi
486b223e01
Replace kube-master with kube_control_plane (#7256)
This replaces kube-master with kube_control_plane because of [1]:

  The Kubernetes project is moving away from wording that is
  considered offensive. A new working group WG Naming was created
  to track this work, and the word "master" was declared as offensive.
  A proposal was formalized for replacing the word "master" with
  "control plane". This means it should be removed from source code,
  documentation, and user-facing configuration from Kubernetes and
  its sub-projects.

NOTE: The reason why this changes it to kube_control_plane not
      kube-control-plane is for valid group names on ansible.

[1]: https://github.com/kubernetes/enhancements/blob/master/keps/sig-cluster-lifecycle/kubeadm/2067-rename-master-label-taint/README.md#motivation
2021-03-23 17:26:05 -07:00
Qasim Sarfraz
d53fd29e34
Add support for cilium ipsec (#7342)
* Add support for cilium ipsec

* Fix typo for bpffs
2021-03-23 13:46:06 -07:00
Maciej Wereski
4f89bfac48
MetalLB: bump to v0.9.6 (#7397)
Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>
2021-03-23 13:42:06 -07:00
p53
5fee96b404
Fix cinder cert permissions (#7384)
* Fix permissions of cinder cert

* Change runuser for external_cloud_controller to kube user with id 999, part of 999 - kube-cert group
2021-03-23 11:03:37 -07:00
Samuel Liu
12873f916b
download_file for kata (#7393) 2021-03-23 01:39:36 -07:00
Etienne Champetier
efa180392b
Auto renew control plane certificates (#7358)
While at it remove force_certificate_regeneration
This boolean only forced the renewal of the apiserver certs
Either manually use k8s-certs-renew.sh or set auto_renew_certificates

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-22 11:22:48 -07:00
Florian Ruynat
6d9ed398e3 Set default k8s version to 1.20.5 2021-03-19 10:04:34 -07:00
Florian Ruynat
6d3dbb43a4 Update hashes for 1.20.5/1.19.9/1.18.17 2021-03-19 10:04:34 -07:00
Necatican Yıldırım
811f546ea6
Download crun using download_file.yml (#7370)
* Add crun download_url and checksum

* Change versioning format to crun native versioning

* Download crun using download_file.yml

* Get crun version from download defaults

* Delegate crun binary copy task to crun role
2021-03-19 08:40:33 -07:00
Florian Ruynat
ead8a4e4de
Fix calico crds missing 3.16.9 (#7386) 2021-03-19 06:58:34 -07:00
Florian Ruynat
05f132c136 Update CNI (calico, kubeovn, multus) and Helm 2021-03-18 17:20:36 -07:00
Florian Ruynat
5f2c8ac38f Update nodelocaldns to 1.17.1 2021-03-18 17:20:36 -07:00
Florian Ruynat
14511053aa Update docker to 20.10.5 2021-03-18 17:20:36 -07:00
LuciferInLove
8353532a09
Added experimental cri-o support for Amazon Linux 2 (#7353)
* Added experimental cri-o support for Amazon Linux 2

* Fixed dependencies order
2021-03-18 17:16:37 -07:00
Erwan Miran
1c62af0c95
Download Calico KDD CRDs (#7372)
* Download Calico KDD CRDs

* Replace kustomize with lineinfile and use ansible assemble module

* Replace find+lineinfile by sed in shell module to avoid nested loop

* add condition on sed

* use block for kdd tasks + remove supernumerary kdd manifest apply in start "Start Calico resources"
2021-03-18 17:06:36 -07:00
Mikael Johansson
f103ac7640
Change default OCCM internal and public networks variables to empty lists (#7380)
Signed-off-by: Mikael Johansson <mik.json@gmail.com>
2021-03-18 16:52:36 -07:00
Samuel Liu
274e06a48d
add etcd max snapshot and wals (#7382) 2021-03-18 16:48:36 -07:00
Victor Morales
2bcd9eb9e9
Bump crun to 0.18 version (#7364) 2021-03-11 00:00:24 -08:00
Lennart Jern
5a54db2f3c
Check for dummy kernel module (#7348)
The dummy module is needed for nodelocaldns.
2021-03-09 08:07:00 -08:00
Etienne Champetier
14b63ede8c
Fixup kubelet.conf to point to kubelet-client-current.pem (#7347)
c9c0c01de0 only fix the problem for new clusters

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-08 23:55:00 -08:00
François Hernandez
c7db72e1da
Add nodeselector and tolerations for metallb (#7334)
* add nodeselector and tolerations for metallb

* remove unnecessary commented lines in metallb template

* set default speaker toleration to match original manifest
2021-03-08 07:57:42 -08:00
Victor Morales
dc5df57c26
Add privileged_without_host_devices support (#7343)
When privileged is enabled for a container, all the `/dev/*` block
devices from the host are mounted into the guest. The
`privileged_without_host_devices` flag prevents host devices from
being passed to privileged containers.

More information:
* https://github.com/containerd/cri/pull/1225
* 1d0f68156b
2021-03-08 00:17:44 -08:00
Etienne Champetier
a9c97e5253 Delete misnammed kubeadm-version.yml
The important action in kubeadm-version.yml is the templating of the configuration,
not finding / setting the version

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-04 23:42:22 -08:00
Etienne Champetier
53e5ef6b4e Always backup both certs and kubeconfig
There are no reasons not to backup during upgrade

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-04 23:42:22 -08:00
Etienne Champetier
8800b5c01d Remove rotate_tokens logic
kubeadm never rotates sa.key/sa.pub, so there is no need to delete tokens/restart pods

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-04 23:42:22 -08:00
Etienne Champetier
280036fad6 Remove admin.conf removal
kubeadm is the default for a long time now,
and admin.conf is created by it, so let kubeadm handle it

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-04 23:42:22 -08:00
Etienne Champetier
a6e1f5ece9 Remove useless call to 'kubeadm version'
Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-04 23:42:22 -08:00
Etienne Champetier
fedd671d68 Remove pre kubeadm cert migration tasks
apiserver.pem is not used since ddffdb63bf

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-04 23:42:22 -08:00
Du9L.com
b7c22659e3
kubeadm-config.v1beta2.yaml.j2: etcd log level arg (#7339)
According to [etcd's docs](https://etcd.io/docs/v3.4.0/op-guide/configuration/#--log-package-levels), argument 'log-package-levels' should not contain underscores.
2021-03-03 11:39:50 -08:00
Etienne Champetier
c9c0c01de0
Stop using kubeadm to update server in kubeconfigs (#7338)
Using `kubeadm init phase kubeconfig all` breaks kubelet client certificate rotation
as we are missing `kubeadm init phase kubelet-finalize all` to point to `kubelet-client-current.pem`

kubeconfig format is stable so let's just use lineinfile,
this will avoid other future breakage

This revert to the logic before 6fe2248314

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-03 09:39:20 -08:00
Etienne Champetier
e442b1d2b9
Add kube-ipvs0/nodelocaldns to NetworkManager unmanaged-devices (#7315)
On CentOS 8 they seem to be ignored by default, but better be extra safe
This also make it easy to exclude other network plugin interfaces

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-03 07:27:20 -08:00
yydzhou
e9f4ff227e
fix master node taint removal bug (#7336)
code improvement
2021-03-03 05:35:20 -08:00
Florian Ruynat
668bbe0528 Update Kubernetes dashboard and metrics-server 2021-03-02 08:33:19 -08:00