Commit graph

6417 commits

Author SHA1 Message Date
Etienne Champetier
8800b5c01d Remove rotate_tokens logic
kubeadm never rotates sa.key/sa.pub, so there is no need to delete tokens/restart pods

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-04 23:42:22 -08:00
Etienne Champetier
280036fad6 Remove admin.conf removal
kubeadm is the default for a long time now,
and admin.conf is created by it, so let kubeadm handle it

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-04 23:42:22 -08:00
Etienne Champetier
a6e1f5ece9 Remove useless call to 'kubeadm version'
Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-04 23:42:22 -08:00
Etienne Champetier
fedd671d68 Remove pre kubeadm cert migration tasks
apiserver.pem is not used since ddffdb63bf

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-04 23:42:22 -08:00
Du9L.com
b7c22659e3
kubeadm-config.v1beta2.yaml.j2: etcd log level arg (#7339)
According to [etcd's docs](https://etcd.io/docs/v3.4.0/op-guide/configuration/#--log-package-levels), argument 'log-package-levels' should not contain underscores.
2021-03-03 11:39:50 -08:00
Etienne Champetier
c9c0c01de0
Stop using kubeadm to update server in kubeconfigs (#7338)
Using `kubeadm init phase kubeconfig all` breaks kubelet client certificate rotation
as we are missing `kubeadm init phase kubelet-finalize all` to point to `kubelet-client-current.pem`

kubeconfig format is stable so let's just use lineinfile,
this will avoid other future breakage

This revert to the logic before 6fe2248314

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-03 09:39:20 -08:00
Etienne Champetier
e442b1d2b9
Add kube-ipvs0/nodelocaldns to NetworkManager unmanaged-devices (#7315)
On CentOS 8 they seem to be ignored by default, but better be extra safe
This also make it easy to exclude other network plugin interfaces

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-03 07:27:20 -08:00
yydzhou
e9f4ff227e
fix master node taint removal bug (#7336)
code improvement
2021-03-03 05:35:20 -08:00
Florian Ruynat
668bbe0528 Update Kubernetes dashboard and metrics-server 2021-03-02 08:33:19 -08:00
Florian Ruynat
e045a45e48 Update docker & docker-cli to 20.10.4 2021-03-02 08:33:19 -08:00
Sergey
2c9fc18903
template crun manifest (#7305)
add missing else to if inline
2021-03-02 01:57:19 -08:00
Emil
d4eecac108
add option to use calico with azure when using calico in vxlan (#7300) 2021-03-02 01:03:19 -08:00
Kenichi Omichi
ef351e0234
Update dashboard_enabled on sample (#7316)
Since https://github.com/kubernetes-sigs/kubespray/pull/6804
dashboard_enabled has been false by default.
However we forgot to update it on sample inventory and it made
confusion.
This updates the sample inventory.
2021-03-02 00:59:19 -08:00
Florian Ruynat
05adeed1fa
Fix recover-control-plane undefined 'proxy_disable_env' variable (#7326) 2021-03-01 13:38:16 -08:00
stress-t
15f1b19136
Fix: added string to bool conversion for use_localhost_as_kube api load balancer (#7324) 2021-03-01 11:53:36 -08:00
wangxf
154fa45422
fix: the filename </etc/vault> is Duplicate in the reset role. (#7313) 2021-03-01 11:53:25 -08:00
Florian Ruynat
e35becebf8
Move centos7-crio CI job to centos8 (#7327) 2021-03-01 09:57:26 -08:00
Viktor
bdd36c2d34
Update default exoscale master with more RAM (#7328)
The default master size for exoscale is 2cpu and 2GB ram.
I have found this to be too low, so this increases it to
2cpu and 4GB ram.
2021-03-01 09:41:25 -08:00
Jakub Krzywda
0a0156c946
Vsphere (#7306)
* Add terraform scripts for vSphere

* Fixup: Add terraform scripts for vSphere

* Add inventory generation

* Use machines var to provide IPs

* Add README file

* Add default.tfvars file

* Fix newlines at the end of files

* Remove master.count and worker.count variables

* Fixup cloud-init formatting

* Fixes after initial review

* Add warning about disabled DHCP

* Fixes after second review

* Add sample-inventory
2021-02-26 04:20:15 -08:00
Florian Ruynat
100d9333ca
Add configmaps to local-path-provisioner CR (#7323) 2021-02-25 16:22:17 -08:00
Sergey Mikhaltsov
a4cc416511
use external_openstack_lbaas_use_octavia for template openstack-cloud… (#7298)
* use external_openstack_lbaas_use_octavia for template openstack-cloud-config

* Delete external_openstack_lbaas_use_octavia from default values. Added description and default values of variables to docs

* markdown fix

* make this simple

* set external_openstack_lbaas_use_octavia in default values

* duplicated variable in doc
2021-02-25 11:25:25 -08:00
Kenichi Omichi
2ea5793782
Replace KUBE_MASTERS with KUBE_CONTROL_HOSTS (#7257)
This replaces KUBE_MASTERS with KUBE_CONTROL_HOSTS because of [1]:

```
  The Kubernetes project is moving away from wording that is
  considered offensive. A new working group WG Naming was created
  to track this work, and the word "master" was declared as offensive.
  A proposal was formalized for replacing the word "master" with
  "control plane". This means it should be removed from source code,
  documentation, and user-facing configuration from Kubernetes and
  its sub-projects.
```

[1]: https://github.com/kubernetes/enhancements/blob/master/keps/sig-cluster-lifecycle/kubeadm/2067-rename-master-label-taint/README.md#motivation
2021-02-23 10:00:03 -08:00
Kenichi Omichi
0ddf915027
Update Ansible to v2.9.17 (#7291)
This updates Ansible version to the latest stable version 2.9.17.
2021-02-23 09:54:03 -08:00
Etienne Champetier
067db686f6
Fix proxy usage when *_PROXY are present in environment (#7309)
Since a790935d02 all proxy users
should be properly configured

Now when you have *_PROXY vars in your environment it can leads to failure
if NO_PROXY is not correct, or to persistent configuration changes
as seen with kubeadm in 1c5391dda7

Instead of playing constant whack-a-bug, inject empty *_PROXY vars everywhere
at the play level, and override at the task level when needed

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-02-23 09:44:02 -08:00
Etienne Champetier
ed2b4b805e
Fix reset when using containerd (#7308)
Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-02-22 12:44:03 -08:00
Hugo Blom
8375aa72e2
[Openstack] Update Cinder CSI driver to v1.20.0 (#7280)
* update Cinder CSI to v1.19.0

* Update Cinder CSI to v1.20
2021-02-22 10:09:42 -08:00
Florian Ruynat
6334e4bd84 Set Kubernetes default version to 1.20.4 2021-02-22 08:45:42 -08:00
Florian Ruynat
86ce8aac85 Add hashes for Kubernetes 1.18.16/1.19.8/1.20.4 2021-02-22 08:45:42 -08:00
Florian Ruynat
de46f86137 Minor update to cilium and calico 2021-02-22 08:45:42 -08:00
FedericoHeichou
5616b08229
Adding else in the inline if-expression (#7292)
Fix "AnsibleUndefinedVariable: the inline if-expression on line xx evaluated to false and no else section was defined."
2021-02-20 02:05:41 -08:00
Hugo Blom
8682a57ea3
use image id instad of name (#7293) 2021-02-19 09:16:25 -08:00
Etienne Champetier
662a37ab4f
Fix "api is up" check (#7295)
Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-02-19 09:12:25 -08:00
Sergey
42947c9840
return the ability to update calico from 3.x.x version (#7290)
version check fixed
2021-02-17 00:07:06 -08:00
Etienne Champetier
3749729d5a
Remove calico-upgrade leftovers (#7282)
This is dead code since 28073c76ac

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-02-16 11:24:58 -08:00
Etienne Champetier
fb8b075110
facts.yaml: reduce the number of setup calls by ~7x (#7286)
Before this commit, we were gathering:
1 !all
7 network
7 hardware

After we are gathering:
1 !all
1 network
1 hardware

ansible_distribution_major_version is gathered by '!all'

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-02-16 09:34:58 -08:00
Etienne Champetier
1c5391dda7
Ensure kubeadm doesn't use proxy (#7275)
* Move proxy_env to kubespray-defaults/defaults

There is no reasons to use set_facts here

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>

* Ensure kubeadm doesn't use proxy

*_proxy variables might be present in the environment (/etc/environment, bash profile, ...)
When this is the case we end up with those proxy configuration in /etc/kubernetes/manifests/kube-*.yaml manifests

We cannot unset env variables, but kubeadm is nice enough to ignore empty vars
93d288e2a4/cmd/kubeadm/app/util/env.go (L27)

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-02-16 08:44:58 -08:00
Hugo Blom
f2d10e9465
allow users to set image_uuid instead of name, this allows the use of openstack community images (#7283) 2021-02-16 07:05:06 -08:00
stress-t
796d3fb975
Improving PR 6473 (#7259) 2021-02-16 05:19:05 -08:00
Etienne Champetier
5c04bdd52b
Fixup cri-o metacopy mount options (#7287)
Ubuntu 18.04 crio package ships with 'mountopt = "nodev,metacopy=on"'
even if GA kernel is 4.15 (HWE Kernel can be more recent)

Fedora package ships without metacopy=on

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-02-15 20:51:07 -08:00
Hugo Blom
17143dbc51
write openstack controller manifests with correct perms (#7284) 2021-02-15 00:53:05 -08:00
Hugo Blom
1c8bba36db
make sure worker rules is applied on workers (#7279) 2021-02-12 12:43:05 -08:00
Etienne Champetier
95b329b64d
bootstrap-os: match on os-release ID / VARIANT_ID (#7269)
This fixes deployment with CentOS 8 Streams and make detection more reliable

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-02-11 08:14:16 -08:00
Etienne Champetier
de1d9df787
Only use stat get_checksum: yes when needed (#7270)
By default Ansible stat module compute checksum, list extended attributes and find mime type
To find all stat invocations that really use one of those:
git grep -F stat. | grep -vE 'stat.(islnk|exists|lnk_source|writeable)'

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-02-10 05:36:59 -08:00
Cristian Calin
6450207713
add containerd.io to dpkg_selection (#7273)
`containerd.io` is the companion package of `docker-ce` and is the
proper package name. This is needed to avoid apt upgrade/dist-upgrade
from breaking kubernetes.
2021-02-10 04:48:59 -08:00
Florian Ruynat
edc4bb4a49
Update kube-ovn to 1.6.0 (#7240) 2021-02-10 02:25:01 -08:00
Sergey
a21ee33180
fix typo error in role ingress-nginx (#7272) 2021-02-09 07:53:13 -08:00
Takashi IIGUNI
bcaa31ae33
fix: Restart network doesn't work on Fedora CoreOS (#7271)
Running remove-node.yml tasks for clean up cluster on Fedora CoreOS.
The task failed to restart network daemon (task name: "reset | Restart network").
Fedora CoreOS is essentially using NetworkManager, but this task returns network.

Signed-off-by: Takashi IIGUNI <iiguni.tks@gmail.com>
2021-02-09 06:35:04 -08:00
David Louks
0cc1726781
Remove deletion of coredns deployment. (#7211)
* Add unique annotation on coredns deployment and only remove existing deployment if annotation is missing.

* Ignore errors when gathering coredns deployment details to handle case where it doesn't exist yet

* Remove run_once, deletegate_to and add to when statement
2021-02-09 06:02:40 -08:00
David Louks
aad78840a0
Updated etcd cert check tasks to detect when new cert gen is required (#7219)
* Added force_etcd_cert_refresh var to maintain existing functionality. Broke out etcd node cert syncing from member and admin cert sync logic. Now first etcd will sync node certs to other etcd members on every run to keep all etcds up to date after adding additional worker nodes to the cluster

* Updated etcd cert check tasks to better detect when new certificates need to be generated

* Move usage of force_etcd_cert_refresh var to gen_certs fact set

* Force etcd cert generation per server if force_etcd_cert_refresh is set to true

* Include gathering of node certs even if k8s-cluster member and in etcd group.

* Removed run_once due to when statement
2021-02-09 01:53:22 -08:00
Vyacheslav
e3ab665e90
Update main.yml (#7267)
````
TASK [bootstrap-os : Enable RHEL 8 repos] ***************************************************************************************************************************************************************************************************
fatal: [node6]: FAILED! => {"changed": false, "msg": "This system has no repositories available through subscriptions"}
fatal: [node7]: FAILED! => {"changed": false, "msg": "This system has no repositories available through subscriptions"}
fatal: [node1]: FAILED! => {"changed": false, "msg": "This system has no repositories available through subscriptions"}


root@node1:/kubespray# cat /etc/os-release
NAME="Ubuntu"
VERSION="18.04.5 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.5 LTS"
VERSION_ID="18.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=bionic
UBUNTU_CODENAME=bionic
root@node1:/kubespray#
```
2021-02-08 10:25:37 -08:00