C12s/c12s-kubespray

Author	SHA1	Message	Date
rongzhang	2609ec0dc3	Fix copy etcd-ssl-ca failed	2018-08-31 15:06:03 +08:00
rongzhang	16fc22a207	Fix ipvs by kubeadm v1alpha1	2018-08-30 23:04:57 +08:00
k8s-ci-robot	d9ea937493	Merge pull request #3187 from mirwan/kubeadm-config_syntax Fix kubeadm-config for audit-log-path and feature-gates	2018-08-30 06:55:43 -07:00
rongzhang	35e5adaf0a	Fix kubeadm v1alpha1 configure	2018-08-30 17:44:00 +08:00
k8s-ci-robot	4feb62f6bf	Merge pull request #3193 from riverzhang/fix-lb-kubeadm Fix kubeadm lb	2018-08-29 04:22:40 -07:00
k8s-ci-robot	3bfda55fca	Merge pull request #3061 from okamototk/crio cri-o support	2018-08-29 03:48:40 -07:00
rongzhang	9eade647e6	Fix kubeadm lb	2018-08-29 18:29:24 +08:00
Phill Garrett	1babbcca85	Fix elif azure statement	2018-08-28 15:43:03 +01:00
Phill Garrett	f325d13082	Add azure-container-registry-config for Azure Seperated out KUBELET_CLOUDPROVIDER env var assignment when cloud_provider equals azure Appended azure-container-registry-config parameter	2018-08-28 10:23:25 +00:00
Erwan Miran	52ab54eeea	Fix missing quotes for audit-log-path and wrong placement of feature-gates	2018-08-28 09:05:57 +02:00
Takashi Okamoto	d407a590a6	container_manager variable to specify runtime.	2018-08-28 06:23:38 +00:00
Takashi Okamoto	5eb805f098	Change timeout for kubeadm 600s. * kubeadm timeout is too short and it may interrupt by timeout.	2018-08-28 04:51:38 +00:00
Takashi Okamoto	236f066635	kubeadm cri-o support.	2018-08-28 02:24:45 +00:00
Takashi Okamoto	5ab8a712d9	Add download_container flag to avoid docker pull when use cri-o.	2018-08-28 01:24:26 +00:00
Takashi Okamoto	cf7b9cfeef	Support crio in kubelet service.	2018-08-28 01:24:26 +00:00
Takashi Okamoto	6090af29e7	Add cri-o role.	2018-08-28 01:24:26 +00:00
Takashi Okamoto	359009bb05	Download etcd and hyperkube binary.	2018-08-28 01:24:26 +00:00
Takashi Okamoto	bdbfa4d403	Add ipvs support for kubeadm 1.10 or later.	2018-08-28 01:24:26 +00:00
Takashi Okamoto	6849788ebc	Fix copy ca cert and ca key for kubeadm.	2018-08-28 01:24:25 +00:00
Takashi Okamoto	ac639b2a17	Change kubeadm config to run etcd by kubeadm.	2018-08-28 01:24:25 +00:00
Erwan Miran	b395bb953f	Fix wrong when condition that ends up with jinja error when the content of /etc/hosts contains parenthesis	2018-08-27 21:20:57 +02:00
k8s-ci-robot	7efe287c74	Merge pull request #2474 from mirwan/localhost_in_etc_hosts Localhost in hosts files should be updated (if necessary), not overriden	2018-08-27 06:25:43 -07:00
k8s-ci-robot	d43cd9a24c	Merge pull request #3104 from maxbrunet/hotfix/replace-local_actions Use delegate_to: localhost instead of local_action	2018-08-27 02:50:42 -07:00
guenhter	fff48d24ea	Replace the raw rsync command with the synchronize module	2018-08-27 10:00:21 +02:00
Maxime Brunet	33135f2ada	k8s/preinstall: Turn AND condition into a list	2018-08-25 14:33:31 -04:00
k8s-ci-robot	f97515352b	Merge pull request #3161 from nutellinoit/kube_proxy_nodeport_addresses --nodeport-addresses added on kube-proxy.manifest.j2 and on k8s-cluster.yml	2018-08-25 02:00:19 -07:00
Erwan Miran	1432e511a2	same work with less lines	2018-08-24 14:06:07 +02:00
Samuele Chiocca	cb8be37f72	fix on v1alpha1	2018-08-24 11:19:06 +02:00
Samuele Chiocca	e5dd4e1e70	added on v1alpha1	2018-08-24 10:59:06 +02:00
Antoine Legrand	4882531c29	Merge pull request #3115 from oracle/oracle_oci_controller Cloud provider support for OCI (Oracle Cloud Infrastructure)	2018-08-23 18:22:45 +02:00
rongzhang	7b61a0eff0	Fix kubeadm LB configure 1. join node add LB discoveryTokenAPIServers 2. kubeadm_config_api_fqdn support ipddress and domain_name	2018-08-23 22:22:34 +08:00
Aivars Sterns	23fd3461bc	calico upgrade to v3 (#3086 ) * calico upgrade to v3 * update calico_rr version * add missing file * change contents of main.yml as it was left old version * enable network policy by default * remove unneeded task * Fix kubelet calico settings * fix when statement * switch back to node-kubeconfig.yaml	2018-08-23 17:17:18 +03:00
Rong Zhang	f453567cce	Merge pull request #3144 from riverzhang/fix-audit-log Fix install audit failed	2018-08-23 14:41:37 +08:00
rongzhang	5a4352657d	Fix install audit failed 1.fix audit log not write 2.fix Parameter not recognized 3.delete kubedm futuregates auditing and use apiServerExtraArgs	2018-08-23 01:47:15 +08:00
Samuele Chiocca	f13bc796d9	added nodePortAddresses on kubeadm conf v1alpha2 (not present on v1alpha1)	2018-08-22 18:43:03 +02:00
Erwan Miran	80cfeea957	psp, roles and rbs for PodSecurityPolicy when podsecuritypolicy_enabled is true	2018-08-22 18:16:13 +02:00
Samuele Chiocca	5d9908c2c3	--nodeport-addresses added on kube-proxy.manifest.j2 Changed author	2018-08-22 15:32:07 +02:00
Erwan Miran	a7b0c454db	Localhost in hosts files should be updated (if necessary), not overriden	2018-08-22 12:10:49 +02:00
Jeff Bornemann	94df70be98	Cloud provider support for OCI (Oracle Cloud Infrastructure) Signed-off-by: Jeff Bornemann <jeff.bornemann@oracle.com>	2018-08-21 17:36:42 -04:00
Mark Eisenblaetter	0c0a2138d9	allow '.' in hostnames we use FQDN as inventory_hostname	2018-08-21 08:24:33 +02:00
Jonathan Craig	5bf152886b	add support for openstack trust to cloud provider config	2018-08-20 12:51:25 -04:00
Andreas Krüger	497db69c9f	Merge pull request #3130 from riverzhang/add-control-plane Add kubeadm controlplaneEndpoint	2018-08-20 10:43:50 +02:00
Andreas Krüger	c7de737551	Merge pull request #3133 from mirwan/auditlog_to_stdout_w_kubeadm Audit log to stdout with kubeadm	2018-08-20 10:43:22 +02:00
Erwan Miran	fc38b6d0ca	Ability to define custom audit polcy rules	2018-08-20 07:04:56 +02:00
Erwan Miran	c34900e569	Define apiserver flags directly instead of relying on auditPolicy section in order to have the ability to redirect audit log to stdout with kubeadm	2018-08-20 07:00:53 +02:00
Rong Zhang	855f2a55cb	Merge pull request #3135 from ishitatsuyuki/patch-1 Add bad hostname preflight check	2018-08-20 12:08:02 +08:00
Rong Zhang	fd16f77e20	Merge pull request #3017 from seungkyua/fix_kubeadm_client_conf Fix kubeadm client conf	2018-08-20 10:51:02 +08:00
Tatsuyuki Ishi	3eef8dc8d0	Add bad hostname preflight check Hostname must be a valid DNS name, which is checked as https://github.com/kubernetes/apimachinery/blob/master/pkg/util/validation/validation.go#L115 The situation I have encountered is that my hostname contained underscore which is disallowed and apiserver refused to start.	2018-08-20 09:09:00 +09:00
rongzhang	59176ebbb9	Add kubeadm controlplaneEndpoint Nginx LB(default) Other LB by kubeadm controlplane	2018-08-20 00:57:13 +08:00
rongzhang	b421d0ed5b	Fix install nss	2018-08-20 00:07:31 +08:00
Rong Zhang	fb309ca446	Merge pull request #3128 from riverzhang/delete-kubeadm Remove unused configuration	2018-08-19 10:01:33 +08:00
rongzhang	095ccef8bd	Remove unused configuration	2018-08-19 01:23:20 +08:00
Rong Zhang	0df969ad19	Merge pull request #3117 from mirwan/audit_usecases Audit support improvement	2018-08-19 01:13:22 +08:00
Antoine Legrand	ac49bbb336	Merge pull request #2168 from xd007/docker_arm64 fix docker opts incompatible running on aarch64 Redhat/Centos	2018-08-17 16:24:07 +02:00
Antoine Legrand	7a0f0126f7	Merge pull request #1295 from xuhuilong/master fix curl get calico status error ( error in tls version, centos 7.3 1611)	2018-08-17 14:29:01 +02:00
Seungkyu Ahn	29894293eb	Fix kubeadm client conf Fix DiscoveryTokenCACertHashes key to discoveryTokenCACertHashes in kubeadm-client.conf	2018-08-17 04:40:08 +00:00
Jonathan Craig	4d783fff0d	resolve issues with new cacert feature	2018-08-16 23:31:21 -04:00
Antoine Legrand	58ee5f1cc9	Merge pull request #3089 from mattymo/cloudconfig Remove erroneous cloud-config task	2018-08-16 16:17:01 +02:00
Erwan Miran	54548d3b95	kubeadm mounts the hostpaths itself	2018-08-16 13:17:30 +02:00
Erwan Miran	58d4d65fab	minor variable fix and reuse + handle auditlog redirected to stdout	2018-08-16 12:51:09 +02:00
rongzhang	2ffc1afe40	Support audit	2018-08-16 14:38:07 +08:00
Maxime Brunet	70b28288a3	Use delegate_to: localhost instead of local_action Allow to use `ansible_become: true` (#2969) And set it to `false` for `localhost` with an `host_var`	2018-08-14 10:08:43 -04:00
Rong Zhang	a11e1eba9e	Upgrade kubernetes to V1.11.x (#3078 ) Upgrade Kubernetes to V1.11.2 The kubeadm configuration file version has been upgraded from v1alpha1 to v1alpha2 Add bootstrap kubeadm-config.yaml with external etcd	2018-08-14 15:13:44 +03:00
Matthew Mosesohn	581a30fdec	Remove erroneous cloud-config task	2018-08-10 15:59:18 +03:00
Andreas Krüger	d8e77600e2	Merge pull request #3066 from luisyonaldo/fix-conditional fix bad conditional	2018-08-10 10:38:52 +02:00
Luis Nuñez	fd380615a0	fix bad conditional	2018-08-09 10:20:45 +02:00
Robert Everson	4eadf3228e	Only add admission plugins if defined	2018-08-07 11:25:03 -07:00
Robert Everson	99c5aa5a02	Use k8s default plugin list	2018-08-07 11:25:03 -07:00
Robert Everson	6ed65d762b	Separate out plugins into 2 variables	2018-08-07 11:25:03 -07:00
Robert Everson	ac18f6cf8b	Add support for admission controllers in 1.10 and above	2018-08-07 11:25:03 -07:00
Rong Zhang	e71f261935	Merge pull request #3068 from riverzhang/swap Enable swap	2018-08-07 21:29:41 +08:00
rongzhang	b902602d16	Enable swap	2018-08-07 21:13:12 +08:00
Rong Zhang	c288ffc55d	Merge pull request #2342 from southquist/add-ca-cert allow for setting the cacert on openstack cloud provider	2018-08-07 17:46:01 +08:00
Rong Zhang	9075dbdd3c	Merge pull request #2875 from bradbeam/movault Adding cluster_name to api cert alt name for vault	2018-08-07 17:36:04 +08:00
Rong Zhang	3d19e03294	Merge pull request #3015 from podnov/kube_proxy_healthz_bind_address Variablize kube_proxy_healthz_bind_address	2018-08-07 17:10:33 +08:00
rongzhang	ac644ed049	Fix yaml roles error	2018-08-05 18:48:07 +08:00
woosley.xu	72074f283b	set local for growpart part 2	2018-07-31 06:56:09 +08:00
woosley.xu	a5db3dbea9	set locale for growpart	2018-07-31 06:52:56 +08:00
Seungkyu Ahn	0366600b45	Remove double slash Even without this PR, the operation works well. However, it is better to use a single slash rather than a double slash in the path.	2018-07-20 07:34:33 +00:00
Evan Zeimet	6a4ce96b7d	Variablize kube_proxy_healthz_bind_address This fixes #3014	2018-07-19 14:19:09 -05:00
Takashi Okamoto	37ccf7e405	Fixed kubectl path.	2018-07-13 15:32:08 +00:00
Matthew Mosesohn	97e0de7e29	Fix vault file owner issues and k8s apiserver cert creation (#2985 ) apiserver cert should be created only once	2018-07-11 14:58:02 +03:00
Rong Zhang	cf445fd4fe	Merge pull request #2930 from alvistack/ingress-nginx-0.16.1 ingress-nginx: Upgrade to 0.16.2	2018-07-10 14:42:37 +08:00
Aivars Sterns	72f053d9bb	Merge pull request #2972 from mattymo/force_cni_cp Force copy cni files	2018-07-10 09:40:10 +03:00
Wong Hoi Sing Edison	a0defefb3f	ingress-nginx: Upgrade to 0.16.2 ingress-nginx 0.16.2 (https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.16.2) This patch simplify ingress-nginx deployment by default deploy on master, with customizable options; on the other hand, remove the additional Ansible group "kube-ingress" and its k8s node label injection. Reference to https://kubernetes.io/docs/concepts/services-networking/ingress/#prerequisites: GCE/Google Kubernetes Engine deploys an ingress controller on the master. By changing `ingress_nginx_nodeselector` plus custom k8s node label, user could customize the DaemonSet deployment target. If `ingress_nginx_nodeselector` is empty, will deploy DaemonSet on every k8s node.	2018-07-10 12:26:06 +08:00
Dao Hoang Son	d306c9708c	Remove step that force disable `kube_basic_auth`. The referenced issue (https://github.com/kubernetes/kubeadm/issues/441) has already been fixed.	2018-07-08 16:57:43 +07:00
Matthew Mosesohn	1a3b9dd864	Force copy cni files	2018-07-06 16:39:42 +03:00
Matthew Mosesohn	5c617c5a8b	Add tags to deploy components by --tags option (#2960 ) * Add tags for cert serial tasks This will help facilitate tag-based deployment of specific components. * fixup kubernetes node	2018-07-06 09:12:13 +03:00
Aivars Sterns	4092f96dd8	Merge pull request #2946 from Miouge1/remove-pid-predicate CheckNodePIDPressure is not supported in v1.10	2018-07-04 18:30:19 +03:00
Matthew Mosesohn	c20196f9a0	Remove modprobe binary from kubelet rkt deployment (#2917 )	2018-07-02 15:37:24 +03:00
Miouge1	2a279e30b0	CheckNodePIDPressure is not supported in v1.10	2018-06-28 20:10:38 +02:00
southquist	c685dc493f	allow for setting the cacert on openstack cloud provider	2018-06-28 16:00:13 +02:00
Yumo Yang	6c2f169ea2	update test-pr2 (#2911 )	2018-06-22 13:22:26 +03:00
Rong Zhang	1aee6ec371	Merge pull request #2903 from riverzhang/swap Add manage swap on the worker node	2018-06-21 22:20:23 +08:00
rongzhang	3232e2743e	Add manage swap on the worker node	2018-06-21 08:15:01 +00:00
Andreas Krüger	cbb959151c	Merge pull request #2737 from Miouge1/update-scheduler Update kube-scheduler policy	2018-06-19 14:53:22 +02:00
Andreas Krüger	c3d8b131db	Merge pull request #2801 from dvazar/bugfix/undefined__network_plugin__variable Fixed "network_plugin" variable	2018-06-19 10:01:06 +02:00
Matthew Mosesohn	61e97251a5	Improve variable handling for disabling etcd events cluster	2018-06-18 16:58:29 +03:00
Henry Finucane	3ad9e9c5eb	Fix #2261 by supporting Red Hat's limited PATH Red Hat has this theory that binaries in sbin are too dangerous to be on the default path, but we need them anyway. RH7 has /sbin and /usr/sbin as symlinks, so that is no longer important. I'm adding it to the `PATH` instead of making the path to `modinfo` absolute because I am worried about breaking support for other distributions.	2018-06-15 12:49:22 -07:00
Andreas Krüger	3a569c9dcb	Merge pull request #2750 from w-leads/feature/add-vmname-to-vcp-config Add vm_name option to vsphere cloud provider config	2018-06-14 22:22:34 +02:00
Brad Beam	3d819a6edd	Adding cluster_name to api cert alt name for vault	2018-06-12 14:15:07 -05:00
rongzhang	20bd656975	Reconfigure kube-proxy to access kube-apiserver via the LB(kubeadm)	2018-06-12 12:53:50 +00:00
Rong Zhang	10c9fe96b0	Merge pull request #2859 from riverzhang/nginx Fix nginx-proxy HA when kubeadm enable	2018-06-08 01:10:01 +08:00
rongzhang	f9ccb93825	Fix nginx-proxy HA when kubeadm enable	2018-06-07 14:27:19 +00:00
Aivars Sterns	daeea75fbb	Merge pull request #2835 from oracle/bm_fix-apiserver-access-ip roles/kubernetes/client: kubeconfig template should use access_ip	2018-06-07 11:50:57 +03:00
Matthew Mosesohn	59be578842	Revert "wip pr for improved cert sync" (#2849 )	2018-06-06 17:22:25 +03:00
Aivars Sterns	cb0a257349	Merge pull request #2819 from oleh-ozimok/fix-cidr-assert Fix enough network address space assert	2018-06-06 07:32:16 +03:00
Di Xu	f4d762bb95	fix docker opts incompatible running on aarch64 Redhat/Centos On Aarch64, the default cgroup driver for docker is systemd instead of cgroupfs. Should conform kubelet to use systemd as cgroup driver as well to keep it consistent with docker. Without this change, below exception will be raised. /usr/bin/docker-current: Error response from daemon: shim error: docker-runc not installed on system. Change-Id: Id496ec9eaac6580e4da2f3ef1a386c9abc2a5129	2018-06-05 16:17:16 +08:00
Aivars Sterns	69ea28e187	Merge pull request #2827 from mattymo/testpr wip pr for improved cert sync	2018-06-04 12:43:00 +03:00
Ben Meier	2f5a9e180c	kubernetes/client: kubeconfig template should use the access_ip for the chosen master node	2018-06-04 09:51:05 +01:00
Dmitry	f912a4ece5	Fix compare AnsibleUnsafeText with int (#2828 )	2018-06-04 11:34:10 +03:00
Rong Zhang	d1e66f9cc8	Add label to kubelet env for kubeadm deploy cluster (#2841 )	2018-06-04 11:26:47 +03:00
Matthew Mosesohn	7433348aae	wip pr for improved cert sync	2018-05-30 12:15:11 +03:00
Oleg Ozimok	38f7ba2584	Fix enough network address space assert	2018-05-27 18:01:17 +03:00
dvazar	b3f9cae820	fixed a check unknown networks (cilium & contiv)	2018-05-22 16:43:19 +07:00
Andreas Krüger	a67bdff28c	Merge pull request #2743 from mrostecki/opensuse-tumbleweed-openssl opensuse: Fix OpenSSL package name	2018-05-22 11:21:04 +02:00
dvazar	4b8daa22f6	Fixes #2800	2018-05-19 00:57:09 +07:00
Andreas Krüger	e60a63ea51	Merge pull request #2577 from woopstar/etcd-fix-4 Makeover of etcd- and etcd-cluster setup.	2018-05-16 20:49:54 +02:00
Christopher J. Ruwe	c1bc4615fe	assert that number of pods on node does not exceed CIDR address range The number of pods on a given node is determined by the --max-pods=k directive. When the address space is exhausted, no more pods can be scheduled even if from the --max-pods-perspective, the node still has capacity. The special case that a pod is scheduled and uses the node IP in the host network namespace is too "soft" to derive a guarantee. Comparing kubelet_max_pods with kube_network_node_prefix when given allows to assert that pod limits match the CIDR address space.	2018-05-16 11:55:46 +00:00
Matthew Mosesohn	7c93e71801	Upgrade k8s to 1.10.2 (#2748 ) * Upgrade k8s to 1.10.2 Bumped etcd version to 3.2.16 as recommended * Add ipvs fix for v1.10 * change flannel addons test to ha	2018-05-15 16:00:29 +03:00
Christopher J. Ruwe	73800ef111	make certificates non-executable	2018-05-15 07:54:32 +00:00
Christopher J. Ruwe	49d106f615	make admin.conf -> .kube/config non-executable Almost certainly, the .kube/config file (YAML) should not be executable.	2018-05-14 09:29:48 +00:00
Miouge1	ad48606e4e	Restart scheduler when policy changes	2018-05-14 10:09:30 +02:00
Matthew Mosesohn	07cc981971	refactor vault role (#2733 ) * Move front-proxy-client certs back to kube mount We want the same CA for all k8s certs * Refactor vault to use a third party module The module adds idempotency and reduces some of the repetitive logic in the vault role Requires ansible-modules-hashivault on ansible node and hvac on the vault hosts themselves Add upgrade test scenario Remove bootstrap-os tags from tasks * fix upgrade issues * improve unseal logic * specify ca and fix etcd check * Fix initialization check bump machine size	2018-05-11 19:11:38 +03:00
Ryo Nishikawa	51a9379d3c	Add vm_name option to vsphere cloud provider config	2018-05-08 12:23:58 -07:00
Andreas Krüger	d73d60c9b0	Merge pull request #2600 from maximegaillard/master Add Openstack tenant name	2018-05-08 12:03:01 +02:00
Michal Rostecki	066016cd3e	opensuse: Fix OpenSSL package name OpenSSL 1.1 package in openSUSE Tumbleweed is named openssl-1_1, not openssl-1_1_0.	2018-05-08 10:03:30 +02:00
Andreas Krüger	28d6eb6af1	Merge pull request #2644 from cp3hu/master Fix apiserver manifest and kubelet for kube version < 1.9	2018-05-08 09:22:36 +02:00
Miouge1	70e0998a70	Update kube-scheduler policy	2018-05-03 21:56:51 +02:00
Chad Swenson	595e96ebf1	Merge pull request #2693 from romaindequidt/sync-certs-tasks-fix sync certs tasks (fix #2596 #2667)	2018-05-02 12:17:23 -05:00
woopstar	4c81cd2a71	Merge branch 'master' of https://github.com/kubernetes-incubator/kubespray into etcd-fix-4	2018-05-02 14:45:58 +02:00
Maxime Gaillard	00db751646	Add Openstack tenant name	2018-05-01 09:21:37 +02:00
Tomasz Majchrowski	59789ae02a	ISSUE-2706: Provide consistent usage of supplementary_addresses_in_ssl_keys across vault and script mode (#2707 )	2018-04-30 14:48:17 +03:00
Andreas Krüger	03de4c0806	Merge pull request #2695 from suzutan/add-oidc-prefix-args Add oidc-user-prefix and oidc-group-prefix args	2018-04-30 09:17:02 +02:00
mirwan	06cdb260f6	labelvalue must be formatted to handle non string values (#2722 )	2018-04-29 19:02:14 +03:00
mirwan	c3c5817af6	sysctl file should be in defaults so that it can be overriden (#2475 ) * sysctl file should be in defaults so that it can be overriden * Change sysctl_file_path to be consistent with roles/kubernetes/preinstall/defaults/main.yml	2018-04-27 18:50:58 +03:00
Markos Chandras	9168c71359	Revert "Revert "Add openSUSE support" (#2697 )" (#2699 ) This reverts commit `51f4e6585a`.	2018-04-26 12:52:06 +03:00
Matthew Mosesohn	1a14f1ecc1	Fix vol format for local volume provisioner in rkt (#2698 )	2018-04-24 20:32:08 +03:00
Matthew Mosesohn	51f4e6585a	Revert "Add openSUSE support" (#2697 )	2018-04-23 14:28:24 +03:00
Suzuka Asagiri	f81e6d2ccf	Add oidc-user-prefix and oidc-group-prefix args	2018-04-23 12:23:59 +09:00
Romain DEQUIDT	80dd230a65	sync certs tasks (fix #2596 #2667 )	2018-04-22 10:00:31 +02:00
Paul Montero	75950344fb	run_once pre_upgrade tasks which are executing in localhost	2018-04-19 11:38:13 -05:00
Matthew Mosesohn	f73717ea35	Mount local volume provisioner dirs for containerized kubelet (#2648 )	2018-04-12 22:55:13 +03:00
Aivars Sterns	1967963702	Merge pull request #2380 from hwoarang/add-opensuse-support Add openSUSE support	2018-04-12 20:28:50 +03:00
Chad Swenson	d87b6fd9f3	Use dedicated front-proxy-ca for front-proxy-client	2018-04-12 11:03:22 -05:00
Chad Swenson	a6a47dbc96	Merge pull request #2617 from bradbeam/savaultcert Adding missing service-account certificate for vault	2018-04-12 11:02:24 -05:00
Aivars Sterns	298c6cb790	Merge pull request #2633 from grebois/patch-3 Enabling MutatingAdmissionWebhook for Istio Automatic sidecar injection	2018-04-12 11:53:58 +03:00
Markos Chandras	d07f75b389	roles: kubernetes: secrets: Add SUSE support Add path for certificate location for SUSE distributions. Also make sure the 'update-ca-certificates' command is executed on SUSE hosts as well.	2018-04-11 20:55:02 +01:00
Nirmoy Das	45eac53ec7	roles: kubernetes: preinstall: Install openssl-1.1.0 on Tumbleweed The openssl package on Tumbleweed is actually a virtual package covering openssl-1.0.0 and openssl-1.1.0 implementations. It defaults to 1.1.0 so when trying to install it and openssl-1.0.0 is installed, zypper fails with conflicts. As such, lets explicitly pull the package that we need which also updates the virtual one. Co-authored-by: Markos Chandras <mchandras@suse.de>	2018-04-11 17:46:14 +01:00
Markos Chandras	e42203a13e	roles: kubernetes: preinstall: Add SUSE support Add support for installing package dependencies and refreshing metadata on SUSE distributions Co-authored-by: Nirmoy Das <ndas@suse.de>	2018-04-11 17:46:14 +01:00
Christian Phu	3535c29e59	Fix apiserver manifest for kube version < 1.9	2018-04-10 18:17:56 +02:00
Marcelo Grebois	88765f62e6	Updating order https://kubernetes.io/docs/admin/admission-controllers/#is-there-a-recommended-set-of-admission-controllers-to-use	2018-04-10 17:17:39 +02:00
Robin Skahjem-Eriksen	0f35e17e23	Fix new envvar for setting openstack_tenant_id (#2641 ) Changed from OS_PROJECT_ID to OS_PROJECT_NAME.	2018-04-10 17:23:31 +03:00
Brad Beam	77b3f9bb97	Removing default for volume-plugins mountpoint (#2618 ) All checks test if this is defined meaning there is no way to undefine it.	2018-04-10 17:19:25 +03:00
Matthew Mosesohn	45f15bf753	Revert "Fix new envvar for setting openstack_tenant_id" (#2640 )	2018-04-10 14:37:24 +03:00
Aivars Sterns	913cc5a9af	Merge pull request #2639 from ironhouzi/openstack_tenant_id_fix Fix new envvar for setting openstack_tenant_id	2018-04-10 14:35:28 +03:00
Aivars Sterns	a46acfcdd8	Merge pull request #2627 from mattymo/no_more_do_do Remove jinja2 dependency of do	2018-04-10 14:32:29 +03:00
Robin Skahjem-Eriksen	0c0f6b755d	Fix new envvar for setting openstack_tenant_id Changed from OS_PROJECT_ID to OS_PROJECT_NAME.	2018-04-10 13:30:48 +02:00
Marcelo Grebois	4c12b273ac	Enabling MutatingAdmissionWebhook for Istio Automatic sidecar injection https://istio.io/docs/setup/kubernetes/sidecar-injection.html#automatic-sidecar-injection	2018-04-09 12:49:05 +02:00
Atoms	b68854f79d	fix kubectl download location and kubectl.sh helper owner/group remove	2018-04-09 13:19:26 +03:00
Matthew Mosesohn	f954bc0a5a	Remove jinja2 dependency of do While `do` looks cleaner, forcing this extra option in ansible.cfg seems to be more invasive. It would be better to keep the traditional approach of `set dummy = ` instead.	2018-04-09 12:27:53 +03:00
Brad Beam	dfc46f02d7	Adding missing service-account certificate for vault Missed in #2554	2018-04-06 15:29:52 -05:00
Daniel Hoherd	ca40d51bc6	Fix typos (no logic changes)	2018-04-05 15:54:58 -07:00
Chen Hong	973e7372b4	content: \|	2018-04-04 23:05:27 +08:00
Chen Hong	b54e091886	Persist ip_vs modules	2018-04-04 18:18:51 +08:00
Andreas Krüger	2511e14289	Merge pull request #2346 from Miouge1/kube-scheduler-mode Use legacy policy config to apply the scheduler policy	2018-04-04 10:20:51 +02:00
georgejdli	76bb5f8d75	check if dedicated service account token signing key exists	2018-04-02 10:57:24 -05:00
Andreas Krüger	ba24fe3226	Merge pull request #2570 from avoidik/transfer-cloud-configs Move cloud config configurations to proper location	2018-04-02 10:31:38 +02:00
Matthew Mosesohn	3004791c64	Add pre-upgrade task for moving credentials file (#2394 ) * Add pre-upgrade task for moving credentials file This reverts commit `7ef9f4dfdd`. * add python interpreter workaround for localhost	2018-04-02 11:19:23 +03:00
woopstar	86e3506ae6	Etcd cluster setup makeover The current way to setup the etc cluster is messy and buggy. - It checks for cluster is healthy before the cluster is even created. - The unit files are started on handlers, not in the task, so you mess with "flush handlers". - The join_member.yml is not used. - etcd events cluster is not configured for kubeadm - remove duplicate runs between running the role on etcd nodes and k8s nodes	2018-04-01 21:38:33 +02:00
Wong Hoi Sing Edison	5fe144aa0f	ingress-nginx: container download related things should defined in the download role	2018-04-01 00:22:33 +08:00
Andreas Krüger	5b0da4279f	Merge pull request #2543 from hswong3i/cert-manager-0.2.3 Integrate jetstack/cert-manager 0.2.3 to Kubespray	2018-03-31 18:15:25 +02:00
Andreas Krüger	1ac978b8fa	Merge pull request #2567 from mirwan/node_labels_doc_plus_kube_ingress_handling node_labels documentation and kube-ingress label definition as role_node_label	2018-03-31 18:05:52 +02:00
Wong Hoi Sing Edison	195d6d791a	Integrate jetstack/cert-manager 0.2.3 to Kubespray	2018-03-31 19:29:11 +08:00
avoidik	aa301c31d1	Move credential checks into proper folder	2018-03-31 13:29:00 +03:00
Andreas Krüger	d9418b1dc4	Merge pull request #2554 from georgejdli/fix-sa-token-signing Fix kubespray's ServiceAccount token signing keys	2018-03-31 09:59:22 +02:00
avoidik	15efdf0c16	Move credential checks	2018-03-31 03:26:37 +03:00
avoidik	ab8760cc83	Move credentials pre-check	2018-03-31 03:24:57 +03:00
avoidik	b6da596ec1	Move default configuration parameters for cloud-config	2018-03-31 03:18:23 +03:00
avoidik	3c12c6beb3	Move cloud config configurations to proper location	2018-03-31 02:59:59 +03:00
Erwan Miran	8ece922ef0	node_labels documentation + kube-ingress label handling as role_node_label	2018-03-31 00:36:11 +02:00
Andreas Krüger	887a468d32	Merge pull request #2562 from avoidik/fix-indexes-pr-2251 Fix kubecert_node.results indexes	2018-03-31 00:16:11 +02:00
Andreas Krüger	76cb37d6b5	Merge pull request #2544 from woopstar/cert-fix-2 Update openssl.conf to count better and work with Jinja 2.9	2018-03-30 21:57:17 +02:00
georgejdli	572ab650db	copy dedicated service account token signing key for kubeadm migration	2018-03-30 13:03:32 -05:00
avoidik	72c2a8982b	Fix kubecert_node.results indexes	2018-03-30 17:24:50 +03:00
Matthew Mosesohn	03bcfa7ff5	Stop templating kube-system namespace and creating it (#2545 ) Kubernetes makes this namespace automatically, so there is no need for kubespray to manage it.	2018-03-30 14:29:13 +03:00
Andreas Kruger	af5f376163	Revert	2018-03-30 11:42:20 +02:00
woopstar	004b0a3fcf	Fix merge conflict	2018-03-30 11:38:59 +02:00
Andreas Kruger	4bb7d2b566	Merge branch 'master' of https://github.com/kubernetes-incubator/kubespray into cert-fix-2	2018-03-30 11:34:05 +02:00
Andreas Krüger	f619eb08b1	Merge pull request #2350 from whereismyjetpack/kubeadm-nodename set nodeName to "{{ inventory_hostname }}" in kubeadm-config	2018-03-30 11:15:52 +02:00
RongZhang	5711074c5a	Merge pull request #2290 from mirwan/node_labels_from_inventory Node labels definition in kubelet params from inventory	2018-03-30 03:42:52 -05:00
陈宏	4d85e3765e	remove redundancy code	2018-03-30 09:19:00 +08:00
Kuldip Madnani	daeeae1a91	Added retries in pre-upgrade.yml and retries while applying kube-dns.yml (#2553 ) * Added retries in pre-upgrade.yml and retries while applying kube-dns.yml * Removed trailing spaces	2018-03-29 11:37:32 -05:00
georgejdli	c8f857eae4	configure kubespray to sign service account tokens with a dedicated and stable key	2018-03-29 09:50:31 -05:00
Andreas Krüger	270d21f5c1	Merge pull request #2540 from mattymo/cloud_config_timing Write cloud-config during kubelet configuration	2018-03-29 09:12:18 +02:00
Andreas Kruger	bf29198efd	Fix merge conflict	2018-03-29 09:11:13 +02:00
Kuldip Madnani	9ebbf1c3cd	Added a fix in openssl.conf template to check if IP of loadbalncer is available or not.	2018-03-28 16:34:26 -05:00
woopstar	0b5404b2b7	Fix	2018-03-28 20:28:04 +02:00
woopstar	0df32b03ca	Update openssl.conf to count better and work with Jinja 2.9	2018-03-28 17:48:56 +02:00
Matthew Mosesohn	72a4223884	Write cloud-config during kubelet configuration This file should only be updated during kubelet upgrade so that master components are not accidentally restarted first during preinstall stage.	2018-03-28 16:26:36 +03:00
Andreas Krüger	03117d9572	Merge pull request #2488 from LuckySB/ingress-nginx-node-role Dedicated node for ingress nginx controller	2018-03-28 14:07:40 +02:00
avoidik	e375678674	Set exact user for Kubelet services	2018-03-27 11:13:52 +03:00
Dann Bohn	1d0415a6cf	fixes typo in kube_override_hostname for kubeadm	2018-03-24 13:29:07 -04:00
Dann Bohn	9fa995ac9d	only sets nodeName in kubeadm-config when kube_override_hostname is set	2018-03-23 08:33:25 -04:00
Andreas Krüger	30e4b89837	Merge pull request #2504 from brtknr/patch-1 Update kube-apiserver.manifest.j2 and kubeadm-config.yaml.j2 to incorporate `endpoint-reconciler-type: lease`	2018-03-22 09:15:55 +01:00
Chad Swenson	9949782e96	Merge pull request #2489 from woopstar/token-fix-1 Only copy tokens if tokens_list contains any	2018-03-21 20:28:06 -05:00
Andreas Krüger	ff2b8e5e60	Merge pull request #2503 from woopstar/kubelet-fix-1 Fix duplicate --proxy-client-cert-file and --proxy-client-key-file	2018-03-21 10:03:31 +01:00
Erwan Miran	8b71ef8ceb	Labels from role (node-role.k8s.io/node) and labels from inventory are merged into node-labels parameter in kubelet	2018-03-21 09:19:05 +01:00
mirwan	ee8f678010	Addition of the .creds extension to the credentials files generated by password lookup in order for Ansible not to consider them as inventory files with inventory_ignore_extensions set accordingly (#2446 )	2018-03-21 10:50:32 +03:00
Bharat Kunwar	13e47e73c8	Update kubeadm-config.yaml.j2 As requested	2018-03-20 13:33:36 +00:00
Bharat Kunwar	d2fd7b7462	Update kube-apiserver.manifest.j2	2018-03-20 12:19:53 +00:00
Bharat Kunwar	d9453f323b	Update kube-apiserver.manifest.j2	2018-03-20 12:16:35 +00:00
Bharat Kunwar	b787b76c6c	Update kube-apiserver.manifest.j2 Ensure that kube-apiserver will respond even if one of the nodes are down.	2018-03-20 12:06:34 +00:00
woopstar	a94a407a43	Fix duplicate --proxy-client-cert-file and --proxy-client-key-file	2018-03-20 12:08:36 +01:00
Andreas Krüger	f253691a68	Merge pull request #2347 from hswong3i/multiple_artifacts_dir Support multiple artifacts under individual inventory directory	2018-03-19 12:45:55 +01:00
woopstar	b9a949820a	Only copy tokens if tokens_list contains any	2018-03-18 08:42:38 +01:00
Andreas Krüger	50e5f0d28b	Merge pull request #2468 from LuckySB/master change expirations period for generated certificate from 10y to 100 years	2018-03-17 19:43:40 +01:00
Sergey Bondarev	1481f7d64b	Dedicated node for ingress nginx controller The ability to create dedicated node for ingress nginx controller host type network for nginx controller and add from example https://github.com/kubernetes/ingress-nginx/blob/master/docs/examples/static-ip/nginx-ingress-controller.yaml terminationGracePeriodSeconds: 60	2018-03-17 02:54:46 +03:00
Chad Swenson	7d33650019	Merge pull request #2462 from woopstar/coredns-patch Add CoreDNS support	2018-03-16 18:33:36 -05:00
woopstar	e40368ae2b	Add CoreDNS support with various fixes Added CoreDNS to downloads Updated with labels. Should now work without RBAC too Fix DNS settings on hosts Rename CoreDNS service from kube-dns to coredns Add rotate based on http://edgeofsanity.net/rant/2017/12/20/systemd-resolved-is-broken.html Updated docs with CoreDNS info Added labels and fixed minor settings from official yaml file: https://github.com/kubernetes/kubernetes/blob/release-1.9/cluster/addons/dns/coredns.yaml.sed Added a secondary deployment and secondary service ip. This is to mitigate dns timeouts and create high resitency for failures. See discussion at 'https://github.com/coreos/coreos-kubernetes/issues/641#issuecomment-281174806' Set dns list correct. Thanks to @whereismyjetpack Only download KubeDNS or CoreDNS if selected Move dns cleanup to its own file and import tasks based on dns mode Fix install of KubeDNS when dnsmask_kubedns mode is selected Add new dns option coredns_dual for dual stack deployment. Added variable to configure replicas deployed. Updated docs for dual stack deployment. Removed rotate option in resolv.conf. Run DNS manifests for CoreDNS and KubeDNS Set skydns servers on dual stack deployment Use only one template for CoreDNS dual deployment Set correct cluster ip for the dns server	2018-03-16 21:51:37 +01:00
Sergey Bondarev	3fac550090	Merge remote-tracking branch 'upstream/master'	2018-03-16 14:09:54 +03:00
Andreas Krüger	d29a1db134	Merge pull request #2461 from woopstar/patch-11 Add support to kubeadm too	2018-03-16 08:24:31 +01:00
Andreas Krüger	653d97dda4	Merge pull request #2472 from woopstar/patch-12 Make sure output from extra args is strings	2018-03-16 08:23:50 +01:00
woopstar	40c0f3756b	Encapsulate item instead of casting to string	2018-03-15 20:27:21 +01:00
Andreas Krüger	3d6fd49179	Added option for encrypting secrets to etcd v.2 (#2428 ) * Added option for encrypting secrets to etcd * Fix keylength to 32 * Forgot the default * Rename secrets.yaml to secrets_encryption.yaml * Fix static path for secrets file to use ansible variable * Rename secrets.yaml.j2 to secrets_encryption.yaml.j2 * Base64 encode the token * Fixed merge error * Changed path to credentials dir * Update path to secrets file which is now readable inside the apiserver container. Set better file permissions * Add encryption option to k8s-cluster.yml	2018-03-15 22:20:05 +03:00
Andreas Krüger	788e41a315	Make sure output from extra args is strings Setting the following: ``` kube_kubeadm_controller_extra_args: address: 0.0.0.0 terminated-pod-gc-threshold: "100" ``` Results in `terminated-pod-gc-threshold: 100` in the kubeadm config file. But it has to be a string to work.	2018-03-14 19:23:43 +01:00
Sergey Bondarev	f8fed0f308	change expirations period for generated certificate from 10 years to 100 years	2018-03-14 13:33:36 +03:00
zhengchuan hu	d1e6632e6a	Fix err in kubelet.kubeadm.env.j2 1. 404 link url 2. kubelet_authentication_token_webhook is not work 3. kube_reserved variable set twice	2018-03-14 17:25:21 +08:00
Aivars Sterns	710295bd2f	Merge pull request #2434 from protomech/feature/azure-vnet-resource-group add support for azure vnetResourceGroup	2018-03-13 17:42:09 +02:00
Andreas Krüger	39d247a238	Add support to kubeadm too Explicitly defines the --kubelet-preferred-address-types parameter #2418 Fixes #2453	2018-03-13 10:31:15 +01:00
Dann Bohn	50e3ccfa2b	uses new kube_memory_reserved/kube_cpu_reserved variables in kubelt	2018-03-12 12:46:14 -04:00
Aivars Sterns	436de45dd4	Merge pull request #2295 from manics/supplementary-bugfix Fix indexing of supplementary DNS in openssl.conf	2018-03-12 10:54:56 +02:00
Aivars Sterns	5f186a2835	Merge pull request #2418 from kubernetes-incubator/1439br Explicitly defines the --kubelet-preferred-address-types parameter	2018-03-12 10:53:48 +02:00
Spencer Smith	3a714fd4ac	Merge pull request #2427 from hswong3i/local_volume_provisioner_default FIXUP #2424: local_provisioner directory should be created only if enabled	2018-03-10 09:00:35 -05:00
Spencer Smith	c47fdc9aa0	Merge pull request #2445 from chadswen/kube-cert-directory-fix Fix kubernetes cert permission sync	2018-03-09 15:10:35 -05:00
chadswen	cd153a1fb3	Fix kubernetes cert permission sync Add `state: directory` to `file` task so that `recurse: yes` will actually take effect and ensure certs/keys have the right file mode and owner	2018-03-09 00:11:10 -06:00
Wong Hoi Sing Edison	a086686e9f	Support multiple artifacts under individual inventory directory	2018-03-08 11:57:53 +08:00
Wong Hoi Sing Edison	6402004018	FIXUP #2424 : local_provisioner directory should be created only if enabled	2018-03-08 11:57:46 +08:00
zhengchuan hu	646d473e8e	fix the name of some variable	2018-03-07 18:30:34 +08:00
Michael Beatty	07657aecf4	add support for azure vnetResourceGroup	2018-03-05 13:40:25 -06:00
Ayaz Ahmed Khan	89847d5684	Explicitly defines the --kubelet-preferred-address-types parameter to the API server configuration. This solves the problem where if you have non-resolvable node names, and try to scale the server by adding new nodes, kubectl commands start to fail for newly added nodes, giving a TCP timeout error when trying to resolve the node hostname against a public DNS.	2018-03-05 15:25:14 +01:00
Jonas Kongslund	a800ed094b	Added support for webhook authentication/authorization on the secure kubelet endpoint	2018-03-03 10:00:09 +04:00
Aivars Sterns	8b21034b31	Merge pull request #2344 from hswong3i/local_volume_provisioner_fixup Upgrade Local Volume Provisioner Addon to v2.0.0	2018-03-01 13:12:44 +02:00
RongZhang	67ffd8e923	Add etcd-events cluster for kube-apiserver (#2385 ) Add etcd-events cluster for kube-apiserver	2018-03-01 11:39:14 +03:00
Chad Swenson	af7edf4dff	Merge pull request #2369 from eviln1/fix-insecure-apiserver-port fix apiserver manifest when disabling insecure_port	2018-02-28 17:48:08 -06:00
Matthew Mosesohn	7ef9f4dfdd	Revert "Add pre-upgrade task for moving credentials file" (#2393 )	2018-02-28 22:41:52 +03:00
Brad Beam	ad89d1c876	Update pre_upgrade.yml	2018-02-28 19:07:44 +03:00
Simon Li	6b80ac6500	Fix indexing of supplementary DNS in openssl.conf	2018-02-28 16:04:52 +00:00
Matthew Mosesohn	bb469005b2	Add pre-upgrade task for moving credentials file	2018-02-27 17:35:15 +03:00
RongZhang	128d3ef94c	Fix run kubectl error (#2199 ) * Fix run kubectl error Fix run kubectl error when first master doesn't work * if access_ip is define use first_kube_master else different master use a different ip * Delete set first_kube_master and use kube_apiserver_access_address	2018-02-27 16:32:20 +03:00
Nedim Haveric	2bd3776ddb	fix apiserver manifest when disabling insecure_port	2018-02-22 14:00:32 +01:00
Maxim Krasilnikov	ba91304636	Fixed generate front proxy client certs with vault (#2359 ) * Fixed generate front proxy client certs with vault * fix vault cert management * Distrebute etcd node certs to vault hosts	2018-02-22 15:08:50 +03:00
Andreas Krüger	42a0f46268	Add health check to kube proxy (#2356 ) Adding health checking to kube proxy. Fixes #2308	2018-02-21 23:14:45 +03:00
Andreas Krüger	d84ff06f73	Set filemode to 0640 (#2315 ) * Set filemode to 0640 weave-net.yml file is readable by all users on the host. It however contains the weave_password to encrypt all pod communication. It should only be readable by root. * Set mode 0640 on users_file with basic auth	2018-02-21 23:13:46 +03:00
Wong Hoi Sing Edison	d4c61d2628	Fixup for gce_centos7-flannel-addons	2018-02-21 13:41:25 +08:00
Wong Hoi Sing Edison	deef47c923	Upgrade Local Volume Provisioner Addon to v2.0.0	2018-02-21 13:41:25 +08:00
Chad Swenson	2de6da25a8	Merge pull request #2312 from woopstar/patch-7 Added iptables lock fix and ajusted oom-score	2018-02-19 22:47:07 -06:00
melkosoft	f13e76d022	Added cilium support (#2236 ) * Added cilium support * Fix typo in debian test config * Remove empty lines * Changed cilium version from <latest> to <v1.0.0-rc3> * Add missing changes for cilium * Add cilium to CI pipeline * Fix wrong file name * Check kernel version for cilium * fixed ci error * fixed cilium-ds.j2 template * added waiting for cilium pods to run * Fixed missing EOF * Fixed trailing spaces * Fixed trailing spaces * Fixed trailing spaces * Fixed too many blank lines * Updated tolerations,annotations in cilium DS template * Set cilium_version to iptables-1.9 to see if bug is fixed in CI * Update cilium image tag to v1.0.0-rc4 * Update Cilium test case CI vars filenames * Add optional prometheus flag, adjust initial readiness delay * Update README.md with cilium info	2018-02-16 21:37:47 -06:00
Dann Bohn	95e2bde15b	set nodeName to "{{ inventory_hostname }}" in kubeadm-config	2018-02-16 16:20:08 -05:00
Miouge1	4c280e59d4	Use legacy policy config to apply the scheduler policy	2018-02-16 13:43:35 +01:00
Antoine Legrand	76a89039ad	Merge pull request #2285 from jasdeep-hundal/do_not_install_python_apt Remove redundant python-apt install	2018-02-15 17:04:08 +01:00
Andreas Krüger	41ca67bf54	Added iptables lock fix and ajusted oom-score xtables lock was missing. Added new option for oom-score to make sure it's not killed in an OOM situation before regular pods.	2018-02-12 10:21:38 +01:00
Virgil Chereches	d72232f15b	Increased timeout values for k8s API server restart	2018-02-12 07:35:29 +00:00
Maxim Krasilnikov	03c61685fb	Added apiserver extra args variable for kubeadm config (#2291 )	2018-02-12 10:29:46 +03:00
Chia-liang Kao	338238d086	Fix version comparison `FAILED! => {"changed": false, "msg": "AnsibleFilterError: Version comparison: unorderable types: str() < int()"}`	2018-02-10 03:49:49 +08:00
mlushpenko	4e61fb9cd3	Refactored kubeadm join process and fixed uncrodonng for master nodes	2018-02-09 15:51:47 +01:00
mlushpenko	b472c2df98	Fix safe upgrade Even though there it kubeadm_token_ttl=0 which means that kubeadm token never expires, it is not present in `kubeadm token list` after cluster is provisioned (at least after it is running for some time) and there is issue regarding this https://github.com/kubernetes/kubeadm/issues/335, so we need to create a new temporary token during the cluster upgrade.	2018-02-09 15:51:47 +01:00
jasdeep-hundal	f57abae01e	Remove redundant python-apt install Ansible automatically installs the python-apt package when using the 'apt' Ansible module, if python-apt is not present. This patch removes the (unneeded) explicit installation in the Kubespray 'preinstall' role.	2018-02-08 18:59:37 -08:00
Aivars Sterns	c70c44b07b	Merge pull request #2257 from rzenker/tb/baremetal-tweaks baremetal tweaks	2018-02-08 15:48:55 +00:00
Aivars Sterns	20583e3d15	Merge pull request #2067 from manics/sysctl-net-brfilter Always set net.bridge.bridge-nf-call-* sysctl	2018-02-08 15:43:46 +00:00
Aivars Sterns	9f4588cd0c	Merge pull request #2266 from riverzhang/epel-release Disalbe install epel-release rpm on Centos/Redhat	2018-02-08 15:42:28 +00:00
Antoine Legrand	7bce70339f	Merge pull request #2251 from woopstar/metrics-server-patch-2 Adding metrics-server support for K8s version 1.9	2018-02-08 11:16:44 +01:00
Brad Beam	384e5dd4c4	Merge pull request #2160 from kongslund/disable-read-only-port Make the Kubelet read-only port configurable and disable it by default	2018-02-07 13:06:32 -06:00
woopstar	f9df692056	Issue front proxy certs for vault	2018-02-07 11:03:10 +01:00
woopstar	f193b12059	Kubeadm auto creates this	2018-02-07 10:50:34 +01:00
woopstar	2cd254954c	Remove defaults of allowed names. Updated kubeadm	2018-02-07 10:07:55 +01:00
woopstar	4dab92ce69	Rename from aggregator-proxy-client to front-proxy-client to match kubeadm design. Added kubeadm support too. Changed to use variables set and not hardcode paths. Still missing cert generation for Vault	2018-02-07 09:50:19 +01:00
rong.zhang	47adf4bce6	Disalbe install epel-release rpm on Centos/Redhat 1.Disalbe install epel-release rpm on Centos/Redhat 2.Use yum install epel-release	2018-02-07 14:58:50 +08:00
Ryan Zenker	ad9049a49e	baremetal tweaks * allow installs to not have hostname overriden with fqdn from inventory * calico-config no longer requires local as and will default to global * when cloudprovider is not defined, use the inventory_hostname for cni-calico * allow reset to not restart network (buggy nodes die with this cmd) * default kube_override_hostname to inventory_hostname instead of ansible_hostname	2018-02-06 13:52:22 -05:00
Erwan Miran	8006a6cd82	local_volumes_enabled replaced by local_volume_provisioner_enabled	2018-02-06 17:12:09 +01:00
Antoine Legrand	bb4446e94c	Merge pull request #2226 from manics/supplemental-addresses Enable additional addresses to be added to certificates	2018-02-06 13:51:54 +01:00
Antoine Legrand	d2102671cd	Merge pull request #2214 from woopstar/patch-3 Loadbalancer Apiserver Address is missing	2018-02-06 13:47:55 +01:00
woopstar	b2d30d68e7	Rename CN for aggreator back. Add flags to apiserver when version is >= 1.9	2018-02-05 20:37:14 +01:00
woopstar	82d10b882c	Added fixes from whereismyjetpack	2018-02-05 20:07:12 +01:00
Maxim Krasilnikov	95b8ac5f62	Added optional controller and scheduler extra args to kubeadm config (#2205 )	2018-02-05 16:49:13 +03:00
woopstar	0b4168cad4	WIP. Adding metrics-server support for K8s version 1.9	2018-02-05 10:37:41 +01:00
Chad Swenson	bd1f0bcfd7	Merge pull request #2201 from riverzhang/ipvs Support ipvs mode for kube-proxy	2018-02-01 22:29:52 -06:00
Spencer Smith	f7e8d1149a	Merge pull request #2229 from whereismyjetpack/etcd-quorum-read --etcd-quorum-read is depricated in kube >= 1.9	2018-01-31 17:10:10 -05:00
Spencer Smith	c0a3bcf9b3	Merge pull request #2221 from Xuxe/patch-vcp-v1.9.2 Updated vSphere cloud provider config for Kubernetes >= v1.9.2 and added resource pool deployment variable	2018-01-31 16:06:07 -05:00
Dann Bohn	dc6c703741	--etcd-quorum-read is depricated in kube >= 1.9	2018-01-31 15:49:52 -05:00
Julian Hübenthal	7f79210ed1	reworked vsphere-cloud-config template	2018-01-31 16:51:23 +01:00
Simon Li	27a1a697e7	supplementary_addresses_in_ssl_keys can be a hostname	2018-01-31 15:16:08 +00:00
Aivars Sterns	c1267004ef	Merge pull request #2130 from ArchiFleKs/simplify_os_provider Simplify and update OpenStack cloud provider	2018-01-31 12:02:02 +02:00
Julian Hübenthal	9cdd2214f9	render vsphere_resource_pool only if defined	2018-01-31 09:56:43 +01:00
Julian Hübenthal	989e9174c2	Added vSphere cloud provider config update for Kubernetes >= 1.9.2	2018-01-31 09:15:46 +01:00
Matthew Mosesohn	2df4b6c5d2	Rename default_resolver to cloud_resolver (#2209 ) Cloud resolvers are mandatory for hosts on GCE and OpenStack clouds. The 8.8.8.8 alternative resolver was dropped because there is already a default nameserver. The new var name reflects the purpose better. Also restart apiserver when modifying dns settings.	2018-01-31 00:26:07 +03:00
Andreas Krüger	088d36da09	Increase the idx counter Fix the idx counter to increase too, or you will end up with two same indexes.	2018-01-30 21:48:13 +01:00
Andreas Krüger	6f36faa4f9	Loadbalancer Apiserver Address is missing If you configure your external loadbalancer to do a simple tcp pass-through to the api servers, and you do not use a DNS FQDN but just the ip, then you need to add the ip adress to the certificates too. Example config: ``` ## External LB example config apiserver_loadbalancer_domain_name: "10.50.63.10" loadbalancer_apiserver: address: 10.50.63.10 port: 8383 ```	2018-01-30 17:33:00 +01:00
rong.zhang	b10c308a5a	Support ipvs mode for kube-proxy Support ipvs mode for kube-proxy	2018-01-30 13:09:01 +08:00
Chad Swenson	f4fe9e3421	Merge pull request #2171 from ArchiFleKs/kubeproxy-lvs Add lib/modules to kube-proxy to enable LVS	2018-01-29 22:58:02 -06:00
Matthew Mosesohn	dc6a17e092	Use include/import tasks (#2192 ) import_tasks will consume far less memory, so it should be used whenever it is compatible.	2018-01-29 14:37:48 +03:00
Chad Swenson	c6e0fcea31	Merge pull request #1948 from sgmitchell/secured-etcd Enable etcd secure client to prevent etcdctl access without cert and key	2018-01-25 09:35:51 -06:00
Brad Beam	0c8bed21ee	Merge pull request #2019 from chadswen/disable-api-insecure-port Support for disabling apiserver insecure port (the sequel)	2018-01-24 19:58:53 -06:00
Brad Beam	98300e3165	Merge pull request #2155 from brutus333/fix/pvc Fix for Issue #2141	2018-01-24 16:15:33 -06:00
Matthew Mosesohn	bf1411060e	Add optional manual dns_mode (#2178 )	2018-01-23 14:28:42 +01:00
Virgil Chereches	a4d142368b	Renamed variable from disable_volume_zone_conflict to volume_cross_zone_attachment and removed cloud provider condition; fix identation	2018-01-23 13:14:00 +00:00
Stanislav Makar	ae47b617e3	Fix 'no such host' problem (#2148 ) Fix 'no such host' problem reported by commands kubectl logs and kubectl exec when cloud_provider is OpenStack Closes: #2147	2018-01-22 16:08:24 +03:00
Virgil Chereches	3125f93b3f	Added disable_volume_zone_conflict variable	2018-01-18 10:55:23 +00:00
Spencer Smith	f19c8e8c1d	Merge pull request #2132 from PhilippeChepy/flex-volumes Add support for flex volumes plugins.	2018-01-17 15:00:45 -05:00
ArchiFleKs	637604d08f	Add lib/modules to kube-proxy to enable LVS kube-proxy is complaining of missing modules at startup. There is a plan to also support an LVS implementation of kube-proxy in additon to userspace and iptables	2018-01-17 16:35:53 +01:00
Jonas Kongslund	11844c987c	Make the Kubelet read-only port configurable and disable it by default. Fixes #2159 .	2018-01-16 11:11:41 +04:00
Virgil Chereches	8c45c88d15	Fix for Issue #2141 - added policy file	2018-01-12 07:15:35 +00:00
Virgil Chereches	c87bb2f239	Fix for Issue #2141	2018-01-12 07:07:02 +00:00
Spencer Smith	ccd9cc3dce	Merge pull request #2146 from abelgana/master Manage deprecated kubelet option	2018-01-09 17:19:42 -05:00
Spencer Smith	81867402f6	Merge pull request #2145 from pslijkhuis/master Add kubelet_custom_flags to kubelet.kubeadm.env.j2	2018-01-09 17:19:09 -05:00
Spencer Smith	ef96123482	Merge pull request #2068 from chadswen/remove-container-retries Retry kube container removal during upgrade	2018-01-09 15:03:50 -05:00
abelgana	a9bb72c6fd	require-kubeconfig is depricated since k8s v1.8	2018-01-09 14:35:42 -05:00
abelgana	9506c2e597	require-kubeconfig is deprecated since K8s v1.8	2018-01-09 14:33:05 -05:00
Peter Slijkhuis	32884357ff	Add kubelet_custom_flags to kubelet.kubeadm.env.j2	2018-01-09 14:04:36 +01:00
Philippe Chepy	df9faa1743	Add support for flex volumes plugins.	2018-01-05 17:56:36 +01:00
ArchiFleKs	ce85bcaee7	Simplify and update OpenStack cloud provider Simplify the number of variables necessary to "just" enable OpenStack cloud provider. Also add the new options available in K8s 1.9.	2018-01-05 12:05:24 +01:00
RongZhang	e3b684df21	Remove blank lines Remove blank lines	2018-01-03 00:54:04 -06:00
Steve Mitchell	e45b30d033	Add etcd key and cert environment variables for use with client auth	2018-01-02 13:52:17 -05:00
Matthew Mosesohn	ad6fecefa8	Update Kubernetes to v1.9.0 (#2100 ) Update checksum for kubeadm Use v1.9.0 kubeadm params Include hash of ca.crt for kubeadm join Update tag for testing upgrades Add workaround for testing upgrades Remove scale CI scenarios because of slow inventory parsing in ansible 2.4.x. Change region for tests to us-central1 to improve ansible performance	2017-12-25 08:57:45 +00:00
Jan Jungnickel	3fdb2ccf55	Revert back to using an empty var as default to exclude hostname (#2110 )	2017-12-22 22:09:59 +00:00
Matthew Mosesohn	29f5b55d42	remove unwanted whitespace for kube_override_hostname (#2105 )	2017-12-22 11:31:18 +00:00
Matthew Mosesohn	6bb46e3ecb	Fix param names in preparation for Kubernetes v1.9.0 (#2098 ) This does not update v1.9.0, but fixes two incompatibilities when trying to deploy v1.9.0.	2017-12-20 10:48:09 +00:00
Matthew Mosesohn	127bc01857	Do not override kubelet hostname if cloud_provider is used (#2095 ) Starting with Kubernetes v1.8.4, kubelet ignores the AWS cloud provider string and uses the override hostname, which fails Node admission checks. Fixes #2094	2017-12-19 20:18:20 +00:00
Chad Swenson	e78562830f	Retry kube container removal during upgrade As we have seen with other containers, sometimes container removal fails on the first attempt due to some Docker bugs. Retrying typically corrects the issue.	2017-12-12 12:06:41 -06:00
Simon Li	bef259a6eb	Always set net.bridge.bridge-nf-call-* sysctl	2017-12-12 17:11:35 +00:00
ArchiFleKs	44b9dce134	Fix domain id for OpenStack provider OpenStack authentication does not support using a mix of DomainID and DomainName, only one or the other should be used.	2017-12-11 15:57:33 +01:00
Brad Beam	fed7b97dcb	Merge pull request #2030 from mattymo/removerbaccheck Remove RBAC from boolean checks	2017-12-06 23:41:13 -06:00
Spencer Smith	c4458c9d9a	Merge pull request #1997 from mrbobbytables/feature-keepalived-cloud-provider Add minimal keepalived-cloud-provider support	2017-12-06 23:28:27 -05:00
Kuldip Madnani	fe036cbe77	Adding changes to handle updation of yum Management cache in rhel. (#2026 ) * Adding changes to handle updation of yum cache in rhel. * Removed the redundant spaces	2017-12-06 09:00:41 +00:00
Matthew Mosesohn	952ec65a40	Remove RBAC from boolean checks	2017-12-06 11:57:40 +03:00
Chad Swenson	b8788421d5	Support for disabling apiserver insecure port This allows `kube_apiserver_insecure_port` to be set to 0 (disabled). Rework of #1937 with kubeadm support Also, fixed an issue in `kubeadm-migrate-certs` where the old apiserver cert was copied as the kubeadm key	2017-12-05 09:13:45 -06:00
Brad Beam	c2347db934	Merge pull request #1953 from chadswen/dashboard-refactor Kubernetes Dashboard v1.7.1 Refactor	2017-12-05 08:50:55 -06:00
Steven Hardy	d39a88d63f	Allow setting --bind-address for apiserver hyperkube (#1985 ) * Allow setting --bind-address for apiserver hyperkube This is required if you wish to configure a loadbalancer (e.g haproxy) running on the master nodes without choosing a different port for the vip from that used by the API - in this case you need the API to bind to a specific interface, then haproxy can bind the same port on the VIP: root@overcloud-controller-0 ~]# netstat -taupen \| grep 6443 tcp 0 0 192.168.24.6:6443 0.0.0.0:* LISTEN 0 680613 134504/haproxy tcp 0 0 192.168.24.16:6443 0.0.0.0:* LISTEN 0 653329 131423/hyperkube tcp 0 0 192.168.24.16:6443 192.168.24.16:58404 ESTABLISHED 0 652991 131423/hyperkube tcp 0 0 192.168.24.16:58404 192.168.24.16:6443 ESTABLISHED 0 652986 131423/hyperkube This can be achieved e.g via: kube_apiserver_bind_address: 192.168.24.16 * Address code review feedback * Update kube-apiserver.manifest.j2	2017-11-29 15:24:02 +00:00
unclejack	e5d353d0a7	contiv network support (#1914 ) * Add Contiv support Contiv is a network plugin for Kubernetes and Docker. It supports vlan/vxlan/BGP/Cisco ACI technologies. It support firewall policies, multiple networks and bridging pods onto physical networks. * Update contiv version to 1.1.4 Update contiv version to 1.1.4 and added SVC_SUBNET in contiv-config. * Load openvswitch module to workaround on CentOS7.4 * Set contiv cni version to 0.1.0 Correct contiv CNI version to 0.1.0. * Use kube_apiserver_endpoint for K8S_API_SERVER Use kube_apiserver_endpoint as K8S_API_SERVER to make contiv talks to a available endpoint no matter if there's a loadbalancer or not. * Make contiv use its own etcd Before this commit, contiv is using a etcd proxy mode to k8s etcd, this work fine when the etcd hosts are co-located with contiv etcd proxy, however the k8s peering certs are only in etcd group, as a result the etcd-proxy is not able to peering with the k8s etcd on etcd group, plus the netplugin is always trying to find the etcd endpoint on localhost, this will cause problem for all netplugins not runnign on etcd group nodes. This commit make contiv uses its own etcd, separate from k8s one. on kube-master nodes (where net-master runs), it will run as leader mode and on all rest nodes it will run as proxy mode. * Use cp instead of rsync to copy cni binaries Since rsync has been removed from hyperkube, this commit changes it to use cp instead. * Make contiv-etcd able to run on master nodes * Add rbac_enabled flag for contiv pods * Add contiv into CNI network plugin lists * migrate contiv test to tests/files Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> * Add required rules for contiv netplugin * Better handling json return of fwdMode * Make contiv etcd port configurable * Use default var instead of templating * roles/download/defaults/main.yml: use contiv 1.1.7 Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com>	2017-11-29 14:24:16 +00:00
Di Xu	de422c822d	update nginx tag to use multi-arch docker image (#2009 )	2017-11-29 10:39:52 +00:00
Spencer Smith	43600ffcf8	Merge pull request #1972 from chadswen/master-static-pod-flush Additional flush for static pod master upgrade	2017-11-28 11:36:38 -05:00
Bogdan Dobrelya	8aafe64397	Defaults for apiserver_loadbalancer_domain_name (#1993 ) * Defaults for apiserver_loadbalancer_domain_name When loadbalancer_apiserver is defined, use the apiserver_loadbalancer_domain_name with a given default value. Fix unconsistencies for checking if apiserver_loadbalancer_domain_name is defined AND using it with a default value provided at once. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru> * Define defaults for LB modes in common defaults Adjust the defaults for apiserver_loadbalancer_domain_name and loadbalancer_apiserver_localhost to come from a single source, which is kubespray-defaults. Removes some confusion and simplefies the code. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>	2017-11-23 16:15:48 +00:00
Bob Killen	2140303fcc	add minimal keepalived-cloud-provider support	2017-11-23 08:43:36 -05:00
Chad Swenson	0c6f172e75	Kubernetes Dashboard v1.7.1 Refactor This version required changing the previous access model for dashboard completely but it's a change for the better. Docs were updated. * New login/auth options that use apiserver auth proxying by default * Requires RBAC in `authorization_modes` * Only serves over https * No longer available at https://first_master:6443/ui until apiserver is updated with the https proxy URL: * Can access from https://first_master:6443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/#!/login you will be prompted for credentials * Or you can run 'kubectl proxy' from your local machine to access dashboard in your browser from: http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/ * It is recommended to access dashboard from behind a gateway that enforces an authentication token, details and other access options here: https://github.com/kubernetes/dashboard/wiki/Accessing-Dashboard---1.7.X-and-above	2017-11-15 10:05:48 -06:00
Matthew Mosesohn	f9b68a5d17	Revert "Support for disabling apiserver insecure port" (#1974 )	2017-11-14 13:41:28 +00:00
Chad Swenson	1f99710b21	Additional flush for static pod master upgrade Thought this wasn't required at first but I forgot there's no auto flush at the end of these tasks since the `kubernetes/master` role is not the end of the play.	2017-11-13 18:11:57 -06:00
neith00	5f39efcdfd	adding mount for kubelet to enable rbd mounts (#1957 ) * adding mount for kubelet to enable rbd mounts * fix conditionnal variable name	2017-11-13 14:04:13 +00:00
Spencer Smith	09d85631dc	Merge pull request #1944 from chadswen/reload-master-pods Master component and kubelet container upgrade fixes	2017-11-08 22:23:12 -05:00
Chad Swenson	e9f795c5ce	Master component and kubelet container upgrade fixes * Fixes an issue where apiserver and friends (controller manager, scheduler) were prevented from restarting after manifests/secrets are changed. This occurred when a replaced kubelet doesn't reconcile new master manifests, which caused old master component versions to linger during deployment. In my case this was causing upgrades from k8s 1.6/1.7 -> k8s 1.8 to fail * Improves transitions from kubelet container to host kubelet by preventing issues where kubelet container reappeared during the deployment	2017-11-08 01:40:33 -06:00
Chad Swenson	0c7e1889e4	Support for disabling apiserver insecure port This allows `kube_apiserver_insecure_port` to be set to 0 (disabled). It's working, but so far I have had to: 1. Make the `uri` module "Wait for apiserver up" checks use `kube_apiserver_port` (HTTPS) 2. Add apiserver client cert/key to the "Wait for apiserver up" checks 3. Update apiserver liveness probe to use HTTPS ports 4. Set `kube_api_anonymous_auth` to true to allow liveness probe to hit apiserver's /healthz over HTTPS (livenessProbes can't use client cert/key unfortunately) 5. RBAC has to be enabled. Anonymous requests are in the `system:unauthenticated` group which is granted access to /healthz by one of RBAC's default ClusterRoleBindings. An equivalent ABAC rule could allow this as well. Changes 1 and 2 should work for everyone, but 3, 4, and 5 require new coupling of currently independent configuration settings. So I also added a new settings check. Options: 1. The problem goes away if you have both anonymous-auth and RBAC enabled. This is how kubeadm does it. This may be the best way to go since RBAC is already on by default but anonymous auth is not. 2. Include conditional templates to set a different liveness probe for possible combinations of `kube_apiserver_insecure_port = 0`, RBAC, and `kube_api_anonymous_auth` (won't be possible to cover every case without a guaranteed authorizer for the secure port) 3. Use basic auth headers for the liveness probe (I really don't like this, it adds a new dependency on basic auth which I'd also like to leave independently configurable, and it requires encoded passwords in the apiserver manifest) Option 1 seems like the clear winner to me, but is there a reason we wouldn't want anonymous-auth on by default? The apiserver binary defaults anonymous-auth to true, but kubespray's default was false.	2017-11-06 14:01:10 -06:00
Günther Grill	0d55ed3600	Avoid that some read-only tasks cause an ansible-change (#1910 )	2017-11-06 13:51:07 +00:00
Haiwei Liu	ad0cd6939a	Add support cAdvisor (#1908 ) Signed-off-by: Haiwei Liu <carllhw@gmail.com>	2017-11-06 13:50:28 +00:00
Stanislav Makar	33adb334cd	Fix openstack tenant id variable name (#1932 )	2017-11-05 08:40:41 +00:00
Spencer Smith	ef87a8a1f0	Merge pull request #1916 from vtomasr5/master Fix bad handler directory name in kubeadm role	2017-11-03 18:14:48 -04:00
Matthew Mosesohn	ab3832f3e7	Set host IP for kubelet always (#1924 ) * Set host IP for kubelet always Use ansible default IP if ip var is not set. * Update main.yml	2017-11-03 10:19:37 +00:00
Günther Grill	0195725563	Workaround ansible bug where access var via dict doesn't get real value (#1912 ) * Change deprecated vagrant ansible flag 'sudo' to 'become' * Workaround ansible bug where access var via dict doesn't get real value When accessing a variable via it's name "{{ foo }}" its value is retrieved. But when the variable value is retrieved via the vars-dict "{{ vars['foo'] }}" this doesn't resolve the expression of the variable any more due to a bug. So e.g. a expression foo="{{ 1 == 1 }}" isn't longer resolved but just returned as string "1 == 1". * Make file yamllint complient	2017-11-03 07:11:14 +00:00
Spencer Smith	ec1170bd37	only mount volumes if local_volumes_enabled is true. fix mount flags in rkt. (#1923 )	2017-11-03 07:10:37 +00:00
Spencer Smith	4771716ab2	Merge pull request #1907 from mattymo/disable_anon_auth Block anonymous auth requests to kubelet	2017-11-02 12:01:39 -04:00
Spencer Smith	b156585739	Merge pull request #1917 from chadswen/docker-daemon-graph Fix kubelet container with alternate Docker data paths	2017-11-02 11:58:55 -04:00
Matthew Mosesohn	3e3787de15	Fix local volume provisioner mount point for rkt	2017-11-02 09:45:26 +00:00
Chad Swenson	0c824d5ef1	Fix kubelet container with alternate Docker data paths Some time ago I think the hardcoded `/var/lib/docker` was required, but kubelet running in a container has been aware of the Docker path since at least as far back as k8s 1.6. Without this change, you see a large number of errors in the kubelet logs if you installed with a non-default `docker_daemon_graph`	2017-11-01 13:25:15 -05:00
Matthew Mosesohn	c0e989b17c	New addon: local_volume_provisioner (#1909 )	2017-11-01 14:25:35 +00:00
Vicenç Juan Tomàs Montserrat	5218b3af82	Fix bad handler directory name in kubeadm role	2017-11-01 14:36:28 +01:00
Spencer Smith	ef0a91da27	Merge pull request #1891 from rsmitty/proxy-fixes Improved proxy support	2017-10-31 14:32:12 -04:00
Spencer Smith	19962f6b6a	fix indentation for master template (#1906 )	2017-10-31 06:43:54 +00:00
Matthew Mosesohn	f7703dbca3	Block anonymous auth requests to kubelet	2017-10-30 19:06:54 +00:00
Spencer Smith	b27453d8d8	improved proxy support	2017-10-30 11:42:14 -04:00
Spencer Smith	4470ee4ccf	Merge pull request #1887 from mattymo/fix_indent_apiserver fix indentation for network policy option	2017-10-30 11:33:13 -04:00
abelgana	d738acf638	Update kubelet.kubeadm.env.j2 (#1901 )	2017-10-30 11:33:02 +00:00
tanshanshan	84d92aa3c7	fix-bug (#1900 )	2017-10-30 11:23:24 +00:00
Spencer Smith	591941bd39	Merge pull request #1884 from abelgana/master Sysctl reload if needed after IP forward enabling	2017-10-27 15:12:08 -04:00
Spencer Smith	e90769c869	Merge pull request #1888 from chapsuk/issue_1885 Disable swap in vagrant vms	2017-10-27 15:10:16 -04:00
mkrasilnikov	2c7c956be9	Disable swap in vagrant vms	2017-10-27 19:57:54 +03:00
Matthew Mosesohn	fe81bba08d	Force kubelet certificates to be generated as lowercase (#1886 ) All nodes get converted to lowercase, so certs should set CN with lowercase as well.	2017-10-27 15:58:25 +01:00
Matthew Mosesohn	564de07963	fix indentation for network policy option	2017-10-27 14:56:22 +01:00
abelgana	d9160f19c0	Sysctl reload if needed after IP forward enabling Add reload yes to reload sysctl if the value of net.ipv4.ip_forward changes. - name: Enable ip forwarding sysctl: sysctl_file: "{{sysctl_file_path}}" name: net.ipv4.ip_forward value: 1 state: present reload: yes tags: - bootstrap-os	2017-10-26 13:06:21 -04:00
Brad Beam	ba0a03a8ba	Merge pull request #1880 from mattymo/node_auth_fixes2 Move cluster roles and system namespace to new role	2017-10-26 10:02:24 -05:00
Matthew Mosesohn	b0f04d925a	Update network policy setting for Kubernetes 1.8 (#1879 ) It is now enabled by default in 1.8 with the api changed to networking.k8s.io/v1 instead of extensions/v1beta1.	2017-10-26 15:35:26 +01:00
Matthew Mosesohn	ec53b8b66a	Move cluster roles and system namespace to new role This should be done after kubeconfig is set for admin and before network plugins are up.	2017-10-26 14:36:05 +01:00
Matthew Mosesohn	86fb669fd3	Idempotency fixes (#1838 )	2017-10-25 21:19:40 +01:00
Chiang Fong Lee	5dc56df64e	Fix ordering of kube-apiserver admission control plug-ins (#1841 )	2017-10-24 17:28:07 +01:00
Haiwei Liu	cfea99c4ee	Fix scale.yml to supoort kubeadm (#1863 ) Signed-off-by: Haiwei Liu <carllhw@gmail.com>	2017-10-24 16:08:48 +01:00
Matthew Mosesohn	0b4fcc83bd	Fix up warnings and deprecations (#1848 )	2017-10-20 08:25:57 +01:00
Matthew Mosesohn	fc9a65be2b	Refactor downloads to use download role directly (#1824 ) * Refactor downloads to use download role directly Also disable fact delegation so download delegate works acros OSes. * clean up bools and ansible_os_family conditionals	2017-10-19 09:17:11 +01:00
Jan Jungnickel	49dff97d9c	Relabel controler-manager to kube-controller-manager (#1830 ) Fixes #1129	2017-10-18 17:29:18 +01:00
Hassan Zamani	c9fe8fde59	Use fail-swap-on flag only for kube_version >= 1.8 (#1829 )	2017-10-18 16:32:38 +01:00
Matthew Mosesohn	16462292e1	Properly skip extra SANs when not specified for kubeadm (#1831 )	2017-10-18 12:04:13 +01:00
pmontanari	20d80311f0	Update main.yml (#1822 ) * Update main.yml Needs to set up resolv.conf before updating Yum cache otherwise no name resolution available (resolv.conf empty). * Update main.yml Removing trailing spaces	2017-10-18 11:42:00 +01:00
Tennis Smith	54320c5b09	set to 3 digit version number (#1817 )	2017-10-17 11:14:29 +01:00
Rémi de Passmoilesel	356515222a	Add possibility to insert more ip adresses in certificates (#1678 ) * Add possibility to insert more ip adresses in certificates * Add newline at end of files * Move supp ip parameters to k8s-cluster group file * Add supplementary addresses in kubeadm master role * Improve openssl indexes	2017-10-17 11:06:07 +01:00
neith00	77f1d4b0f1	Revert "Update roadmap" (#1809 ) * Revert "Debian jessie docs (#1806)" This reverts commit `d78577c810`. * Revert "[contrib/network-storage/glusterfs] adds service for glusterfs endpoint (#1800)" This reverts commit `5fb6b2eaf7`. * Revert "[contrib/network-storage/glusterfs] bootstrap for glusterfs nodes (#1799)" This reverts commit `404caa111a`. * Revert "Fixed kubelet standard log environment (#1780)" This reverts commit `b838468500`. * Revert "Add support for fedora atomic host (#1779)" This reverts commit `f2235be1d3`. * Revert "Update network-plugins to use portmap plugin (#1763)" This reverts commit `6ec45b10f1`. * Revert "Update roadmap (#1795)" This reverts commit `d9879d8026`.	2017-10-16 14:09:24 +01:00
Seungkyu Ahn	b838468500	Fixed kubelet standard log environment (#1780 ) Change KUBE_LOGGING to KUBE_LOGTOSTDERR, when installing kubelet as host type.	2017-10-16 08:22:54 +01:00
Jason Brooks	f2235be1d3	Add support for fedora atomic host (#1779 ) * don't try to install this rpm on fedora atomic * add docker 1.13.1 for fedora * built-in docker unit file is sufficient, as tested on both fedora and centos atomic	2017-10-16 08:03:33 +01:00
Matthew Mosesohn	d9879d8026	Update roadmap (#1795 )	2017-10-16 07:06:06 +01:00
Matthew Mosesohn	d487b2f927	Security best practice fixes (#1783 ) * Disable basic and token auth by default * Add recommended security params * allow basic auth to fail in tests * Enable TLS authentication for kubelet	2017-10-15 20:41:17 +01:00
Julian Poschmann	66e5e14bac	Restart kubelet on update in deployment-type host on update (#1759 ) * Restart kubelet on update in deployment-type host on update * Update install_host.yml * Update install_host.yml * Update install_host.yml	2017-10-15 20:22:17 +01:00
Matthew Mosesohn	7e4668859b	Change file used to check kubeadm upgrade method (#1784 ) * Change file used to check kubeadm upgrade method Test for ca.crt instead of admin.conf because admin.conf is created during normal deployment. * more fixes for upgrade	2017-10-15 10:33:22 +01:00
Matthew Mosesohn	ef47a73382	Add new addon Istio (#1744 ) * add istio addon * add addons to a ci job	2017-10-13 15:42:54 +01:00
Julian Poschmann	56763d4288	Persist br_netfilter module loading (#1760 )	2017-10-13 10:50:29 +01:00
Matthew Mosesohn	ee83e874a8	Clear admin kubeconfig when rotating certs (#1772 ) * Clear admin kubeconfig when rotating certs * Update main.yml	2017-10-12 09:55:46 +01:00
Vijay Katam	27ed73e3e3	Rename dns_server, add var for selinux. (#1572 ) * Rename dns_server to dnsmasq_dns_server so that it includes role prefix as the var name is generic and conflicts when integrating with existing ansible automation. * Enable selinux state to be configurable with new var preinstall_selinux_state	2017-10-11 20:40:21 +01:00
Aivars Sterns	e41c0532e3	add possibility to disable fail with swap (#1773 )	2017-10-11 19:49:31 +01:00
Matthew Mosesohn	eeb7274d65	Adjust memory reservation for master nodes (#1769 )	2017-10-11 19:47:42 +01:00
Matthew Mosesohn	eb0dcf6063	Improve proxy (#1771 ) * Set no_proxy to all local ips * Use proxy settings on all necessary tasks	2017-10-11 19:47:27 +01:00
Matthew Mosesohn	fe4ba51d1a	Set node IP correctly (#1770 ) Fixes #1741	2017-10-11 15:28:42 +01:00
Hyunsun Moon	adf575b75e	Set default value for disable_shared_pid (#1710 ) PID namespace sharing is disabled only in Kubernetes 1.7. Explicitily enabling it by default could help reduce unexpected results when upgrading to or downgrading from 1.7.	2017-10-11 14:55:51 +01:00
Spencer Smith	3d09c4be75	Merge pull request #1756 from kubernetes-incubator/fix_bool_assert Fix bool check assert	2017-10-10 10:38:53 -04:00
Spencer Smith	f2db15873d	Merge pull request #1754 from ArchiFleKs/rkt-kubelet-fix add hosts to rkt kubelet	2017-10-10 10:37:36 -04:00
ArchiFleKs	7c663de6c9	add /etc/hosts volume to rkt templates	2017-10-09 16:41:51 +02:00
ant31	1be4c1935a	Fix bool check assert	2017-10-06 17:02:38 +00:00
Matthew Mosesohn	f14f04c5ea	Upgrade to kubernetes v1.8.0 (#1730 ) * Upgrade to kubernetes v1.8.0 hyperkube no longer contains rsync, so now use cp * Enable node authorization mode * change kube-proxy cert group name	2017-10-05 10:51:21 +01:00
Aivars Sterns	9c86da1403	Normalize tags in all places to prepare for tag fixing in future (#1739 )	2017-10-05 08:43:04 +01:00
Spencer Smith	cb611b5ed0	Merge pull request #1742 from mattymo/facts_as_vars Move set_facts to kubespray-defaults defaults	2017-10-04 15:46:39 -04:00
Spencer Smith	ab171a1d6d	don't delegate cert slurp	2017-10-04 13:06:51 -04:00
Matthew Mosesohn	a56738324a	Move set_facts to kubespray-defaults defaults These facts can be generated in defaults with a performance boost. Also cleaned up duplicate etcd var names.	2017-10-04 14:02:47 +01:00
Matthew Mosesohn	e42cb43ca5	add bootstrap for debian (#1726 )	2017-10-03 08:30:45 +01:00
Julian Poschmann	8e1210f96e	Fix cluster-network w/ prefix > 25 not possible with CNI (#1713 )	2017-10-01 10:43:00 +01:00
Peter Slijkhuis	371fa51e82	Make installation of EPEL optional (#1721 )	2017-09-29 13:44:29 +01:00
Matthew Mosesohn	25dd3d476a	Fix error for azure+calico assert (#1717 ) Fixes #1716	2017-09-29 08:17:18 +01:00
Matthew Mosesohn	3ff5f40bdb	fix graceful upgrade (#1704 ) Fix system namespace creation Only rotate tokens when necessary	2017-09-27 14:49:20 +01:00
Matthew Mosesohn	689ded0413	Enable kubeadm upgrades to any version (#1709 )	2017-09-27 14:48:18 +01:00
Matthew Mosesohn	327ed157ef	Verify valid settings before deploy (#1705 ) Also fix yaml lint issues Fixes #1703	2017-09-27 14:47:47 +01:00
tanshanshan	477afa8711	when and run_once are reduplicative (#1694 )	2017-09-26 14:48:05 +01:00
Matthew Mosesohn	bd272e0b3c	Upgrade to kubeadm (#1667 ) * Enable upgrade to kubeadm * fix kubedns upgrade * try upgrade route * use init/upgrade strategy for kubeadm and ignore kubedns svc * Use bin_dir for kubeadm * delete more secrets * fix waiting for terminating pods * Manually enforce kube-proxy for kubeadm deploy * remove proxy. update to kubeadm 1.8.0rc1	2017-09-26 10:38:58 +01:00
Brad Beam	14c232e3c4	Merge pull request #1663 from foxyriver/fix-shell use command module instead of shell module	2017-09-25 13:24:45 -05:00
Matthew Mosesohn	a1cde03b20	Correct master manifest cleanup logic (#1693 ) Fixes #1666	2017-09-25 12:19:04 +01:00
Bogdan Dobrelya	cfce23950a	Merge pull request #1687 from jistr/cgroup-driver-kubeadm Set correct kubelet cgroup-driver also for kubeadm deployments	2017-09-25 11:16:40 +02:00
Deni Bertovic	64740249ab	Adds tags for asserts (#1639 )	2017-09-25 08:41:03 +01:00
Jiri Stransky	70d0235770	Set correct kubelet cgroup-driver also for kubeadm deployments This follows pull request #1677, adding the cgroup-driver autodetection also for kubeadm way of deploying. Info about this and the possibility to override is added to the docs.	2017-09-22 13:19:04 +02:00
foxyriver	30b5493fd6	use command module instead of shell module	2017-09-22 15:47:03 +08:00
Jiri Stransky	dbbe9419e5	Allow setting cgroup driver for kubelet Red Hat family platforms run docker daemon with `--exec-opt native.cgroupdriver=systemd`. When kubespray tried to start kubelet service, it failed with: Error: failed to run Kubelet: failed to create kubelet: misconfiguration: kubelet cgroup driver: "cgroupfs" is different from docker cgroup driver: "systemd" Setting kubelet's cgroup driver to the correct value for the platform fixes this issue. The code utilizes autodetection of docker's cgroup driver, as different RPMs for the same distro may vary in that regard.	2017-09-21 11:58:11 +02:00
Matthew Mosesohn	188bae142b	Fix wait for hosts in CI (#1679 ) Also fix usage of failed_when and handling exit code.	2017-09-20 14:30:09 +01:00
Matthew Mosesohn	ef8e35e39b	Create admin credential kubeconfig (#1647 ) New files: /etc/kubernetes/admin.conf /root/.kube/config $GITDIR/artifacts/{kubectl,admin.conf} Optional method to download kubectl and admin.conf if kubeconfig_lcoalhost is set to true (default false)	2017-09-18 13:30:57 +01:00
Brad Beam	aaa27d0a34	Adding quotes around parameters in cloud_config (#1664 ) This is to help support escapes and special characters	2017-09-16 08:43:47 +01:00
Kevin Lefevre	9302ce0036	Enhanced OpenStack cloud provider (#1627 ) - Enable Cinder API version for block storage - Enable floating IP for LBaaS	2017-09-16 08:43:24 +01:00
Matthew Mosesohn	8e731337ba	Enable HA deploy of kubeadm (#1658 ) * Enable HA deploy of kubeadm * raise delay to 60s for starting gce hosts	2017-09-15 22:28:15 +01:00
Matthew Mosesohn	b294db5aed	fix apply for netchecker upgrade (#1659 ) * fix apply for netchecker upgrade and graceful upgrade * Speed up daemonset upgrades. Make check wait for ds upgrades.	2017-09-15 13:19:37 +01:00
Brad Beam	ac281476c8	Prune unnecessary certs from vault setup (#1652 ) * Cleaning up cert checks for vault * Removing all unnecessary etcd certs from each node * Removing all unnecessary kube certs from each node	2017-09-14 12:28:11 +01:00
Matthew Mosesohn	6744726089	kubeadm support (#1631 ) * kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml	2017-09-13 19:00:51 +01:00
Matthew Mosesohn	75b13caf0b	Fix kube-apiserver status checks when changing insecure bind addr (#1633 )	2017-09-09 23:41:48 +03:00
Matthew Mosesohn	5d99fa0940	Purge old upgrade hooks and unused tasks (#1641 )	2017-09-09 23:41:20 +03:00
Maxim Krasilnikov	e16b57aa05	Store vault users passwords to credentials dir. Create vault and etcd roles after start vault cluster (#1632 )	2017-09-07 23:30:16 +03:00
Chad Swenson	e26aec96b0	Consolidate kube-proxy module and sysctl loading (#1586 ) This sets br_netfilter and net.bridge.bridge-nf-call-iptables sysctl from a single play before kube-proxy is first ran instead of from the flannel and weave network_plugin roles after kube-proxy is started	2017-09-06 15:11:51 +03:00
Brad Beam	a341adb7f3	Updating CN for node certs generated by vault (#1622 ) This allows the node authorization plugin to function correctly	2017-09-06 10:55:08 +03:00
mkrasilnikov	957b7115fe	Remove node name from kube-proxy and admin certificates	2017-09-05 14:40:26 +03:00
mkrasilnikov	bf0af1cd3d	Vault role updates: * using separated vault roles for generate certs with different `O` (Organization) subject field; * configure vault roles for issuing certificates with different `CN` (Common name) subject field; * set `CN` and `O` to `kubernetes` and `etcd` certificates; * vault/defaults vars definition was simplified; * vault dirs variables defined in kubernetes-defaults foles for using shared tasks in etcd and kubernetes/secrets roles; * upgrade vault to 0.8.1; * generate random vault user password for each role by default; * fix `serial` file name for vault certs; * move vault auth request to issue_cert tasks; * enable `RBAC` in vault CI;	2017-09-05 09:07:35 +03:00
Matthew Mosesohn	fc7905653e	Add socat for CoreOS when using host deploy kubelet (#1575 )	2017-09-04 11:30:18 +03:00
Matthew Mosesohn	77602dbb93	Move calico to daemonset (#1605 ) * Drop legacy calico logic * add calico as a daemonset	2017-09-04 11:29:51 +03:00
Brad Beam	8ae77e955e	Adding in certificate serial numbers to manifests (#1392 )	2017-09-01 09:02:23 +03:00
Brad Beam	7a98ad50b4	Fixing CA certificate locations for k8s components	2017-08-30 15:30:40 -05:00

... 7 8 9 10 11 ...

1391 commits