C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
6444 commits 17 branches 66 tags 141 MiB
Commit graph

4283 commits

Author SHA1 Message Date
Samuel Liu
1a69f8c3ad
parameterized snaphot controller namespaces (#8305) 
* Parameterized snaphot controller namespaces

* add ns yml

* add docs

* namespace
 2022-01-14 12:58:26 -08:00
rtsp
ccd3180a69
cert-manager: Allow to change leader election namespace for GKE Autopilot support (#8424) 
More information:

- kubernetes-sigs/kubespray#8393
- jetstack/cert-manager#4102
- jetstack/cert-manager#3717
 2022-01-14 12:54:26 -08:00
cyril-corbon
01dcbc18ac
feat: upgrade metallb to v0.11.0 (#8420) 
Signed-off-by: Cyril Corbon <corboncyril@gmail.com>
 2022-01-14 05:22:28 -08:00
Florian Ruynat
7c67ec4976
Fix kubectl call before installing it (#8412) 2022-01-12 23:12:29 -08:00
Cristian Calin
1337c9c244
[csi-snapshotter] upgrade to 5.0 (#8403) 2022-01-11 09:14:33 -08:00
cyril-corbon
86953b2ac4
fix: add tolerations / affinity to cert-manager (#8389) 
Signed-off-by: Cyril Corbon <corboncyril@gmail.com>
 2022-01-11 09:14:26 -08:00
Mathieu Parent
cfd9873bbc
Allow to choose container manager commands (#8380) 
This allow to workaround #8375 by using image_command_tool=crictl
when containerd_registries is used for containerd.

Also changes image_info_command_on_localhost for docker to return digests.
 2022-01-11 01:13:16 -08:00
Samuel Liu
b2b95cc8f9
fix 0090-etchosts (#7634) 2022-01-11 01:03:16 -08:00
Kenichi Omichi
73c889eb10
Fix failures of ansible-lint (#8401) 
This fixes the following types of failures:
- empty-string-compare
- literal-compare
- risky-file-permissions
- risky-shell-pipe
- var-spacing

In addition, this changes .gitlab-ci/lint.yml to block the same issue
by using the same method at Kubespray CI.
 2022-01-11 00:45:16 -08:00
Victor Morales
642725efe7
Bump containerd version to 1.5.9 (#8402) 2022-01-11 00:05:16 -08:00
Cristian Calin
29aafff2ce
etcd: add 3.5.1 for kubernetes 1.23+ (#8320) 2022-01-10 22:45:15 -08:00
forselli-stratio
df425ac143
Fix etcd certificates reference to support etcd_kubeadm_enabled:true (#7766) 
* Fix etcd certificates reference to support etcd_kubeadm_enabled:true

* Add retries to ETCD Join Member task

* Fix etcd certificates reference when etcd_kubeadm_enabled:true

* Fix conflicts
 2022-01-10 15:24:25 -08:00
Unai Arríen
57a1d18db3
Improve first_kube_control_plane variable management to avoid installation failures due to variable overlapping (#8388) 2022-01-10 01:35:19 -08:00
rtsp
aa4a3d7afd
Fix container engine still installed on dedicated etcd node even if etcd_deployment_type: host (#8386) 2022-01-10 01:35:12 -08:00
Alex
06ad5525b8
replace runc 1.0.3 arm64 hash with 0 (#8391) 2022-01-10 01:31:13 -08:00
Kenichi Omichi
f80fd24a55
Fix risky-file-permissions (#8370) 
When running ansible-lint directly, we can see a lot of warning
message like

  risky-file-permissions File permissions unset or incorrect

This fixes the warning messages.
 2022-01-09 01:51:12 -08:00
Kenichi Omichi
51bd9bee0d
Move containerd_version to defaults/main.yml (#8379) 
All container image versions were defined in download/defaults/main.yml
except containerd.
The inconsistency caused the offline script(generate_list.sh) could not
output the URL of containerd image.
This moves the definition into a valid file.
In addition, this adds host_os to generate_list.sh for downloading
krew from a valid URL.
 2022-01-09 01:47:12 -08:00
Victor Morales
52266406f8
Bump cert-manager version to v1.6.1 (#8377) 2022-01-07 16:45:34 -08:00
cyril-corbon
cd601c77c7
feat: upgrade metrics server to v0.5.2 (#8338) 
Signed-off-by: Cyril Corbon <corboncyril@gmail.com>
 2022-01-07 08:18:33 -08:00
Florian Ruynat
6abae713f7
Update helm / kube-router and coredns (#8382) 
* Update kube-router to 1.4.0

* Update Helm to 3.7.2

* Up coredns to 1.8.6 when k8s is 1.23.x
 2022-01-06 12:14:27 -08:00
Alex
1312f92a8d
adding 0 checksum for kata_containers_version on arm(64) (#8383) 2022-01-06 12:08:27 -08:00
Unai Arríen
92abf26d29
Ensure taint configuration for secondary control-plane nodes (#8363) 2022-01-05 23:56:28 -08:00
Bart Sloeserwij
59f62473c9
Update configuration of registries in cri-o (#7852) 
* Update configuration of registries in cri-o

* Update docs to match new registry configuration
 2022-01-05 07:36:40 -08:00
Choi Yongbeom
dda557ed23
Update config.toml.j2 (#8340) 
* Update config.toml.j2

i think this commit code is not completed works

exam registry address : a.com:5000

insecure registry must be http://a.com:5000

but this code add insecure a.com:5000 (without http://)

If there is no http, containerd accesses with https even if insecure_skip_verify = true

solution is code edit

* Update config.toml.j2

* Update containerd.yml

* Update containerd.yml

* Update containerd.yml

* Update config.toml.j2
 2022-01-05 02:56:33 -08:00
Max Gautier
cb54eb40ce
Use a variable for standardizing kubectl invocation (#8329) 
* Add kubectl variable

* Replace kubectl usage by kubectl variable in roles

* Remove redundant --kubeconfig on kubectl usage

* Replace unecessary shell usage with command
 2022-01-05 02:26:32 -08:00
Cristian Calin
3eab1129b9
CI: Replace CentOS 8 with AlmaLinux 8 before CentOS 8 EOL end of 2021 (#8297) 2022-01-05 02:20:33 -08:00
Choi Yongbeom
24f1402a14
nerdctl insecure registry config (#8339) 
* Update prep_download.yml

nerdctl insecure registry config

* Update prep_download.yml

* Update prep_download.yml

apply conversations advice

* Update prep_download.yml

* Update prep_download.yml

* Update prep_download.yml

* Update prep_download.yml

* Update prep_download.yml

* Update prep_download.yml

* Update main.yml

* Update main.yml

* Update prep_download.yml

* Update prep_download.yml
 2022-01-05 01:14:33 -08:00
Necatican Yıldırım
bf00550388
Upgrade Cilium to 1.11.0 (#8354) 
* Remove kvstore args from Cilium DaemonSet

Co-authored-by: Emin Aktaş <eminaktas34@gmail.com>
Co-authored-by: Yasin Taha Erol <yasintahaerol@gmail.com>
Signed-off-by: necatican <necaticanyildirim@gmail.com>

* Bump Cilium to 1.11.0

Co-authored-by: Emin Aktaş <eminaktas34@gmail.com>
Co-authored-by: Yasin Taha Erol <yasintahaerol@gmail.com>
Signed-off-by: necatican <necaticanyildirim@gmail.com>

Co-authored-by: Emin Aktaş <eminaktas34@gmail.com>
Co-authored-by: Yasin Taha Erol <yasintahaerol@gmail.com>
 2022-01-05 00:36:32 -08:00
Florian Ruynat
6136fa7c49 Update Kubernetes version to 1.23.1 2022-01-04 10:25:00 -08:00
Florian Ruynat
8d2b4ed4a9 Move min k8s version to 1.21 2022-01-04 10:25:00 -08:00
Cristian Calin
4c4c83f0a1
crun update to 1.4 (#8330) 
* [crun] update crun to 1.4

* [crun] drop pre-1.x versions
 2022-01-04 08:30:53 -08:00
Unai Arríen
0e98814732
Configure PriorityClassName for MetalLB deployment (#8362) 2022-01-04 08:20:52 -08:00
Max Gautier
92f25bf267
Simplify usage of pre-remove role (#8334) 
- Use builtin task scheduling of ansible (same task on each host)
  instead of manual looping on master

Benefits:
- One less play in remove-node.yml playbook
- Parralel node drain
- Drain parameters (timeout, grace period, retries,
  allow_ungraceful_removal) can be adjusted separately for each node
  with ansible variables
 2022-01-04 07:10:53 -08:00
Romain ALBON
63a53c79d0
Fix - Search root filesystem device (#8366) 2022-01-04 06:48:52 -08:00
Florian Ruynat
841c61aaa1
Revert "Fix external lb error (#8299)" (#8360) 
This reverts commit 4f2e4524b8.
 2022-01-03 01:37:00 -08:00
Samuel Liu
157942a462
fix resolved config (#8351) 2022-01-03 00:06:59 -08:00
jbpratt
e88a27790c
fix spelling error (#8342) 2022-01-02 23:55:00 -08:00
Cristian Calin
ed3932b7d5
[cni-plugins] upgrade to stable 1.0.1 (#8331) 
* [cni-plugins] upgrade to stable 1.0.1

* [flannel] use binary from dedicated project
 2021-12-23 23:16:15 -08:00
emiran-orange
2b5c185826
calico_pool_blocksize must be cast as well in assertion when defined (#8321) 
* calico_pool_blocksize must be cast as string in assertion when defined

* Cast as int rather than string
 2021-12-23 00:58:37 -08:00
zhengtianbao
c3c128352f
Remove registry-proxy (#8327) 2021-12-21 23:55:35 -08:00
zhengtianbao
02a89543d6
registry: add ingress support (#8311) 2021-12-21 10:20:46 -08:00
Cristian Calin
c1954ff918
Support deploying kubernetes 1.23 (#8323) 
* Ensure entries for 1.23 are added for supported_versions vars

* cri-o: add support for kubernetes 1.23 but still use cri-o 1.22

* kubescheduler-config: diferentiate config versions based on kube_version
 2021-12-21 01:38:46 -08:00
Kenichi Omichi
b49ae8c21d
Delete "kubeadm alpha certs" code (#8322) 
"kubeadm alpha certs" command has been promoted to "kubeadm certs" command,
and "kubeadm alpha certs" has been deprecated since Kubernetes v1.20 as [1].
In addition, Kubespray supports Kubernetes v1.20+.
This delete the deprecated command for cleanup.

[1]: https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.20.md#deprecation
 2021-12-20 12:53:33 -08:00
Calin Cristian Andrei
1a7b4435f3 Bump default version of kubernetes to 1.22.5 2021-12-20 08:56:56 -08:00
Calin Cristian Andrei
db0e458217 Kubernetes: add hashes for v1.23.1, v1.23.0, v1.22.5, v1.21.8 and v1.20.14 2021-12-20 08:56:56 -08:00
Nicolas MASSE
f01f7c54aa
Add support for CRI-O user namespaces (#8268) 
* add support for cri-o user namespaces

* comply with yamllint rules
 2021-12-20 06:37:25 -08:00
kakkotetsu
c59407f105
add support for Calico BGPPeer sourceAddress (#8306) 2021-12-20 01:51:25 -08:00
Cristian Calin
fdc5d7458f
Upgrade to nerdctl 0.15.0 and some fixes (#8315) 
* nerdctl: move to 0.15.0

* nerdctl: reduce verbosity when pulling images

* download: use proxy environment when using nerdctl to download containers
 2021-12-20 00:33:26 -08:00
Antoine Gatineau
6aafb9b2d4
fix bad indentation (#8314) 2021-12-17 07:36:29 -08:00
Samuel Liu
aa9ad1ed60
clean files for kube-ovn (#8310) 2021-12-15 23:39:19 -08:00
zhengtianbao
aa9b8453a0
registry: service add clusterIP, nodePort, loadBalancer support (#8291) 
* registry: service add clusterIP, nodePort, loadBalancer support

* modify camelcase name to underscore

* Add registry service type compatibility check
 2021-12-15 00:18:19 -08:00
singeleaf
4f2e4524b8
Fix external lb error (#8299) 2021-12-13 14:46:27 -08:00
Marat Talipov
4f27c763af
containerd insecure registry support (#8298) 2021-12-13 00:41:58 -08:00
Cristian Calin
0e969c0b72
vSphere-CSI: update to 2.4.0 (#8295) 2021-12-10 11:07:23 -08:00
Steven Reitsma
b396801e28
Update Cinder CSI to v1.22 (#8296) 2021-12-10 10:49:11 -08:00
Cristian Calin
682c8a59c2
containerd: change default resolvconf_mode to host_resolvconf (#8247) 
* containerd: change default resolvconf_mode to host_resolvconf

* Wait for kube-apiserver to come back after pod refresh

* Handle resolv.conf gracefully

* Retain currently configured DNS entries to ensure we don't break the resolvers

* Suse uses wickedd for network management so no dhcp hooks

* Molecule: increase ansible timeout

* CI: Increase ansible timeout to 120s for Packet jobs
 2021-12-09 14:09:06 -08:00
Florian Ruynat
5a25de37ef
Revert "remove no longer present etcd nodes from APIEndpoints list in kubeadm-config configmap (#8244)" (#8287) 
This reverts commit dc767c14b9.
 2021-12-09 08:24:16 -08:00
zhengtianbao
4ef2cf4c28
Registry add TLS and authentication support (#8229) 
* Add registry TLS support

* Add registry configmap and htpasswd auth
 2021-12-07 08:32:00 -08:00
Cristian Calin
990ca38d21
Kata-Containers: add 2.3.0 (#8276) 
* Kata-Containers: add checksums for 2.3.0

* Kata-Containers: version 2.3.0 requires kubernetes 1.22.0+
 2021-12-07 08:18:08 -08:00
Cristian Calin
c7e430573f
Calico: upgrade 3.21.x to 3.21.2 (#8275) 2021-12-07 08:18:01 -08:00
Cristian Calin
a328b64464
runc: upgrade to v1.0.3 (#8274) 2021-12-07 06:10:02 -08:00
zhengtianbao
a16d427536
Set etcd-events listen port to 2383 (#8232) 2021-12-07 00:28:01 -08:00
Cristian Calin
c98a07825b
Use cgroupsv2 where available (fedora) (#8237) 
* Containerd: use cgroupsv2 where available (fedora)

* Docker: use cgroupsv2 where available (fedora)

* cri-o: use cgroupsv2 where available (fedora)
 2021-12-06 11:19:33 -08:00
Samuel Liu
a98ca6fcf3
Update loadbalancers versions (#8272) 
* Update loadbalancers versions

* fix haproxy_config_dir mode
 2021-12-06 09:40:32 -08:00
Samuel Liu
4550f8c50f
calico_flexvol (#8273) 2021-12-06 05:00:32 -08:00
toplordsaito
9afca43807
change dns upstream condition for coredns (#8263) 
upstream_dns_servers should change corefile config even resolvconf_mode=docker_dns
 2021-12-06 02:46:32 -08:00
Alvaro Campesino
27ab364df5
Improve control plane scale flow (#13) (#7989) 
* Improve control plane scale flow (#13)

* Added version 1.20.10 of K8s

* Setting first_kube_control_plane to a existing one

* Setting first_kube_control_plane to a existing one

* change first_kube_master for first_kube_control_plane

* Ansible-lint changes
 2021-12-06 00:16:32 -08:00
Hanna Bledai
615216f397
Fix if bind-address is not set to 0.0.0.0 (#8262) 
* if bind-address is not set to 0.0.0.0

* Update docs and left comments

* fix yamllist check: remove space
 2021-12-05 23:58:32 -08:00
Kenichi Omichi
46b1b7ab34
Fix k8scsi/csi-resizer repo (#8270) 
If trying to pull k8scsi/csi-resizer image from gcr.io, we face the error
like:

 $ docker pull gcr.io/k8scsi/csi-resizer:v1.0.0
 Error response from daemon: Head https://gcr.io/v2/k8scsi/csi-resizer/
 manifests/v1.0.0: unknown: Project 'project:k8scsi' not found or deleted.
 $

We can pull the image from quay.io instead.
This fixes the issue.
 2021-12-05 23:42:32 -08:00
Alvaro Campesino
30d9882851
Add nodelocaldns only if it is enabled (#7731) 2021-12-03 20:36:31 -08:00
Cristian Calin
dfdebda0b6
Calico: remove duplicate values for CALICO_DISABLE_FILE_LOGGING and FELIX_DEFAULTENDPOINTTOHOSTACTION (#8269) 2021-12-03 20:32:31 -08:00
Cristian Calin
9d8a83314b
containerd: add hashes for 1.5.8 and 1.4.12 and make 1.5.8 the new default (#8239) 
* containerd: add hashes for 1.5.8 and 1.4.12 and make 1.5.8 the new default

* containerd: make nerdctl mandatory for container_manager = containerd

* nerdctl: bump to version 0.14.0

* containerd: use nerdctl for image manipulation

* OpenSuSE: install basic nerdctl dependencies
 2021-12-03 12:20:35 -08:00
Florian Ruynat
e19ce27352
Remove ovn4nfv support (#8265) 2021-12-03 11:56:35 -08:00
Cristian Calin
4d711691d0
Fix calico crd archive checksums (#8266) 
v3.20.3 and v3.21.1 were re-released with new checksums
 2021-12-03 04:56:27 -08:00
Samuel Liu
ee0f1e9d58
Update etcd-servers for apiserver (#8253) 2021-12-03 00:28:27 -08:00
Cristian Calin
9f052702e5
containerd: add support for suse distributions (#8261) 2021-12-02 07:51:33 -08:00
Florian Ruynat
b38382a68f
Move cri-o default package to 1.22 (#8258) 2021-12-02 06:21:34 -08:00
zhengtianbao
785324827c
Set ingress-nginx default terminationGracePeriodSeconds to 5 min (#8252) 
* set ingress-nginx default terminationGracePeriodSeconds to 5 min for the drain of connection

* Add ingress_nginx_termination_grace_period_seconds at sample inventory
 2021-12-02 03:23:33 -08:00
Cristian Calin
31c7b6747b
Calico: add dependencies for 3.21.x (#8250) 2021-12-02 01:17:33 -08:00
Alvaro Campesino
dc767c14b9
remove no longer present etcd nodes from APIEndpoints list in kubeadm-config configmap (#8244) 2021-12-01 07:17:15 -08:00
Florian Ruynat
30ec03259d
Remove fedora33 - eol (#8246) 2021-11-30 15:53:17 -08:00
Florian Ruynat
0e22a90579
Update docker to 20.10.11 with containerd 1.4.12 (#8255) 2021-11-30 11:49:01 -08:00
Cristian Calin
ee882fa462
Add capability to use swap, requires Kube 1.22 (#8241) 
* Alpha-NodeSwap: allow nodes to use swap

* CI: Add Fedora 35 with experimental swap job
 2021-11-30 00:52:56 -08:00
Cristian Calin
3431ed9857
containerd: properly pull images with containerd specific tools (#8245) 2021-11-30 00:48:56 -08:00
Florian Ruynat
279808b44e Update minor version for kata/cilium/kube-router/helm 2021-11-29 23:06:56 -08:00
Florian Ruynat
2fd529a993 Update Kubernetes version to v1.22.4 2021-11-29 23:06:56 -08:00
Florian Ruynat
1f6f79c91e Update kubernetes hashes with 1.22.4/1.21.7/1.20.13 2021-11-29 23:06:56 -08:00
Cristian Calin
2f44b40d68
OEL7: Fix CentOS7 Extras for OEL7 (#8219) 
* OEL7: Fix CentOS7 Extras for OEL7

* Molecule: add logs collection for jobs
 2021-11-29 13:39:21 -08:00
Cristian Calin
20157254c3
Update calico versions (#8238) 
* Calico: Bump 3.20.x to 3.20.3

* Calico: Bump 3.18.x to 3.18.6

* Calico: add calico 3.21.1 hashes
 2021-11-29 01:15:22 -08:00
Florian Ruynat
a5f88e14d0
Cleanup tests (#8234) 
* Add Fedora 35 image, support and CI

* Cleanup tests and allow_failure for vagrant
 2021-11-26 09:00:51 -08:00
Cristian Calin
e78bda65fe
Defaults: replace docker with containerd as our default container_manager (#8175) 
* Defaults: replace docker with containerd as our default container_manager

* CI: Use docker for download_localhost test

* Defaults: with container_manager=containerd we need etcd_deployment_type=host

* CI: Run weave jobs with docker

* CI: Vagrant don't download_force_cache

* CI: Fix upgrade tests

* should run compatible with old settings, this means docker
* we need to run with a distro that has at least modern containerd,
  this means move from debian9 to debian10 to allow `containerd_version`
  to match between 2.17 and master
 2021-11-25 06:54:33 -08:00
khatrig
3ea496013f
Create reset.yml (#8227) 2021-11-24 09:44:20 -08:00
ishizuka
7e1873d927
DeprecationWarning occurs when indentfirst=None is specified in coredns-config.yml.j2 (#8224) 2021-11-24 08:56:21 -08:00
zhengtianbao
e35a87e3eb
Update registry template (#8198) 
* Add registry replica setting

* Add registry liveness and readiness probe

* Set the security context for registry

* Add registry pvc access mode option

* registry add replica requirement check

* docs: add registry replicas setting note

* Update docs/kubernetes-apps/registry.md

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
 2021-11-22 02:45:09 -08:00
zhengtianbao
a6fcf2e066
Enable experimental modules when rpm-ostree version >= 2021.9 (#8202) 
* Enable experimental modules when rpm-ostree version >= 2021.9

* cleanup code
 2021-11-22 02:29:09 -08:00
Cristian Calin
c74e1c9db3
CI: use images from quay.io to prevent being throttled by docker hub (#8209) 
* CI: use netchecker images from quay to prevent throttling

* Molecule: use hello-world image from quay.io
 2021-11-19 13:23:40 -08:00
Florian Ruynat
be9de6b9d9
Fix debian 9 check for apt cache update (#8215) 2021-11-19 09:02:51 -08:00
Pasquale Toscano
fe8c843cc8
Fix typo in Containerd configuration (#8206) 2021-11-19 08:40:53 -08:00
Łukasz Żułnowski
83e0b786d4
Fix wrong baseurl for centos extra repo for Oracle Linux (#8208) 2021-11-18 23:44:51 -08:00
Cristian Calin
acd5185ad4
Fix fedora reset (#8205) 
* Reset: Fedora uses NetworkManager

* CI: test reset on fedora
 2021-11-18 16:46:51 -08:00
Mathieu Parent
0263c649f4
Allow to scrape etcd metrics using a service (#8203) 
Signed-off-by: Mathieu Parent <math.parent@gmail.com>
 2021-11-17 23:53:01 -08:00
Lubos Mercl
424163c7d3
add gce support (#8179) 
Author:    lmercl <lubos.mercl@gmail.com>
Date:      Wed Nov 10 15:30:04 2021 +0000

fix markdown
 2021-11-16 08:58:28 -08:00
IKRozhkov
2c87170ccf
Allow setting 'auto-assign' property to 'false' for default IP pool (Metallb addon) (#8193) 
* add metallb auto-assign property for main IP range & update addons.yml for sample inventory

* add new line at the end of file roles\kubernetes-apps\metallb\defaults\main.yml

* set default value for matallb_auto_assign = true
 2021-11-16 05:06:27 -08:00
zhengtianbao
02322c46de
Remove helm duplicate check (#8196) 2021-11-15 12:50:48 -08:00
EDGsheryl
4d79a55904
Remove extra parameter kube_proxy_remove (#8158) 
Signed-off-by: EDGsheryl <edgsheryl@gmail.com>
 2021-11-15 00:02:48 -08:00
Samuel Liu
027cbefb87
change krew uri to krew_download_url (#8190) 2021-11-14 12:08:47 -08:00
zhengtianbao
a08d82d94e
calico add support for container ip forwarding setting (#8184) 2021-11-12 19:06:46 -08:00
zhengtianbao
5f1456337b
Fix krew auto completion command not found at lower version (#8185) 2021-11-12 17:04:46 -08:00
Ajarmar
b5a5478a8a
Added tolerations for cinder-csi-nodeplugin DaemonSet (#8137) 2021-11-11 11:48:07 -08:00
Cristian Calin
b7ae4a2cfd
Kata-Containers: Fix kata-containers runtime (#8068) 
* Kata-containes: Fix for ubuntu and centos sometimes kata containers fail to start because of access errors to /dev/vhost-vsock and /dev/vhost-net

* Kata-containers: use similar testing strategy as gvisor

* Kata-Containers: adjust values for 2.2.0 defaults

Make CI tests actually pass

* Kata-Containers: bump to 2.2.2 to fix sandbox_cgroup_only issue
 2021-11-09 10:01:48 -08:00
Cristian Calin
039205560a
nodelocaldns: allow a secondary pod for nodelocaldns for local-HA (#8100) 
* nodelocaldns: allow a secondary pod for nodelocaldns for local-HA

* CI: add job to test nodelocaldns secondary
 2021-11-09 09:57:47 -08:00
Cristian Calin
801268d5c1
containerd: upgrade versions 1.4.11 and 1.5.7 and make 1.4.11 the default (#8129) 2021-11-09 06:59:47 -08:00
zhengtianbao
46c536d261
Add krew auto completion (#8171) 2021-11-09 02:43:39 -08:00
Cristian Calin
4a8757161e
Docker: replace the use of containerd_version with docker_containerd_version to avoid causing conflicts when bumping containerd_version (#8130) 2021-11-08 15:56:49 -08:00
zhengtianbao
65540c5771
krew: update to v0.4.2 (#8168) 
krew release urls changed since v0.4.2, clearly OS type and arch inside the filename.

from:
  https://github.com/kubernetes-sigs/krew/releases/download/v0.4.1/krew.tar.gz
to:
  https://github.com/kubernetes-sigs/krew/releases/download/v0.4.2/krew-linux_amd64.tar.gz

define `host_os` like `host_architecture` determine which OS is krew
installed at.
 2021-11-08 02:54:59 -08:00
Max Gautier
6c1ab24981
Limit kubectl delete node to k8s nodes (#8101) 
* Limit kubectl delete node to k8s nodes

This avoids the use of `kubectl delete node` when removing etcd nodes
which are not part of the cluser (separate etcd)

* Take errors into account when deleting node

There should not be error now that we're limiting the deletion to nodes
actually in the cluster

* Retrying on error
 2021-11-08 02:22:58 -08:00
Hyojun Jeon
61c2ae5549
Add vxlanEnabled spec in FelixConfiguration (#8167) 2021-11-08 00:06:52 -08:00
zhengtianbao
04711d3b00
Replace path_join to support Ansible 2.9 (#8160) 2021-11-08 00:00:52 -08:00
Kenichi Omichi
cb7c30a4f1
Fix cloud_provider check (#8164) 
This fixes the preinstall check for cloud_provider option based on
inventory/sample/group_vars/all/all.yml
 2021-11-07 23:48:52 -08:00
Álvaro Torres Cogollo
8922c45556
Added ArgoCD kubernetes-app (#7895) 
* Added ArgoCD kubernetes-app

* Update argocd_version to latest
 2021-11-07 02:22:51 -08:00
Emin AKTAS
58390c79d0
Bump crun version 1.2 to 1.3 (#8162) 
Signed-off-by: Emin Aktaş <eminaktas34@gmail.com>
Co-authored-by: Yasin Taha Erol <yasintahaerol@gmail.com>
Co-authored-by: Necatican Yıldırım <necaticanyildirim@gmail.com>

Co-authored-by: Yasin Taha Erol <yasintahaerol@gmail.com>
Co-authored-by: Necatican Yıldırım <necaticanyildirim@gmail.com>
 2021-11-06 02:26:50 -07:00
Antoine Gatineau
b7eb1cf936
cert-manager: add trusted internal ca when configured (#8135) 
* cert-manager: add trusted internal ca when configured

* wrong check for inventory variable

* Update documentation
 2021-11-05 09:43:52 -07:00
Pasquale Toscano
6e5b9e0ebf
Fix Kubelet and Containerd when using cgroupfs as cgroup driver (#8123) 2021-11-05 07:59:54 -07:00
Marcus Fenner
c94291558d
Fix containerd install for fcos (#8107) 
* Fix containerd install for fcos

* rm orphaned runc and containerd binaries
 2021-11-05 07:53:53 -07:00
Florian Ruynat
1c3d082b8d
fix calico crds hashes for 3.20.2 (#8157) 2021-11-04 10:38:04 -07:00
zhengtianbao
9d4cdb7b02
Ensure addon-resizer 1.8.11 only effective at arch amd64. (#8144) 
* Ensure addon-resizer 1.8.11 only effective at arch amd64.

k8s.gcr.io/addon-resizer:1.8.11 returns the amd64 image which is not executable at arm64.

Disable addon-resizer when the platform is not amd64.

When metrics-server upgrade and use addon-resizer:2.3, then revert this
commit and `image_arch` will determine the `addon_resizer_image_tag`.

* Add metrics_server_resizer architectures check
 2021-11-01 08:21:19 -07:00
Florian Ruynat
b353e062c7 Update default k8s version to 1.22.3 2021-10-29 10:43:44 -07:00
Florian Ruynat
d8f9b9b61f Update hashes for version v1.20.12/v1.21.6/v1.22.3 2021-10-29 10:43:44 -07:00
Sergey
0b441ade2c
nginx ingress controller should watch kind:ingress without class (#8128) 2021-10-28 11:48:59 -07:00
Krystian Młynek
6f6fad5a16
Calico: add missing verbs in ClusterRole (#8136) 2021-10-28 11:11:01 -07:00
brainfair
465ffa3c9f
Weave: add extra_args for weave-npc (#8140) 
* add weave_npc_extra_args in template

* add defaults weave_npc_extra_args

* add sample for weave_npc_extra_args
 2021-10-28 08:58:27 -07:00
vatech_seungjin
539c9e0d99
added hirsute in restart network (#8134) 
restarting network in ubuntu 21.04 fails and checked the restart menu and found that hirsute was missing in the argument : )
 2021-10-27 15:19:10 -07:00
irizzant
649f962ac6
Metrics-server Deployment has incongruencies in resources requests/limits (#8088) 
* fix(metrics-server): update defaults

* fix(metrics-server): typo error
 2021-10-27 15:15:11 -07:00
Gheorghe Isak
16bdb3fe51
set check_mode to false (#8133) 2021-10-26 19:36:37 -07:00
Sébastien Masset
7c3369e1b9
Fixed default DNS min replica for single node clusters (#8112) 2021-10-26 16:03:46 -07:00
Florian Ruynat
9eacde212f
Fix quorum check when recovering broken etcd cluster (#8126) 2021-10-26 15:23:09 -07:00
Florian Ruynat
331647f4ab
Remove deprecated Ambassador ingress code (#8086) 2021-10-26 15:19:09 -07:00
Mohamed Zaian
d8d01bf5aa
nginx-ingress: bump to 1.0.4 (#8114) 
* Disable builtin ssl_session_cache solving the problem with OpenSSL consuming memory.
* Print warning only instead of error if no IngressClass permission is available.
 2021-10-24 15:34:22 -07:00
Julio H Morimoto
d42b7228c2
Convert numbers to string for calico's inventory check. (#8120) 
Fix https://github.com/kubernetes-sigs/kubespray/issues/8119

Signed-off-by: Julio Morimoto <julio@morimoto.net.br>
 2021-10-24 11:42:21 -07:00
Damian Szeluga
4db057e9c2
Allow changing metallb default pool name (#8111) 2021-10-22 09:38:39 -07:00
Cristian Calin
ea8e2fc651
containerd: download containerd from upstream instead of using distro specific packages (#7970) 
* Containerd: download containerd from upstream instead of using distro specific packages

split runc download to separate role
make bootstrap-os role deploy container-selinux and seccomp libraries
clean up package manager provided containerd
move variables to docker role that are no longer common with containerd

* Containerd: make molecule testing more relevant

* replace ubuntu18 with ubuntu20
* add centos8 and debian11 to molecule tests
* run kubernetes/preinstall role to ensure relevancy
  of test including dependency packages

* CI: adjust test scenarios for downloaded containerd
 2021-10-20 08:47:58 -07:00
Utku Özdemir
10c30ea5b1
Add fallback to node drain using --disable-eviction flag (#8094) 
* Add fallback to node drain using --disable-eviction flag

Signed-off-by: Utku Ozdemir <uoz@protonmail.com>

* Move drain fallback tasks to separate file

Signed-off-by: Utku Ozdemir <uoz@protonmail.com>

* Add delegate_facts to fix the drain fallback

Signed-off-by: Utku Ozdemir <uoz@protonmail.com>

* Fix ansible-lint error

Signed-off-by: Utku Ozdemir <uoz@protonmail.com>

* Move drain fallback into block

Signed-off-by: Utku Ozdemir <uoz@protonmail.com>
 2021-10-20 00:51:58 -07:00
Kenichi Omichi
19d07a4f2e
Fix ownership related to Calico (#8072) 
kube-bench scan outputs warning related to Calico like:

* text: "Ensure that the Container Network Interface file
  permissions are set to 644 or more restrictive (Manual)"
* text: "Ensure that the Container Network Interface file
  ownership is set to root:root (Manual)"

This fixes these warnings.
 2021-10-19 17:35:57 -07:00
Cristian Calin
6a5b87dda4
netchecker: update images to 1.2.2 from Mirantis (#8074) 
* netchecker: update images to 1.2.2 from Mirantis which is slightly less ancinet than the l23networks images

* Netchecker: use local etcd instead of kubernetes v1beta1 crds which are no longer suported by kube 1.22+
 2021-10-19 10:17:04 -07:00
Omar Aloraini
6aac59394e
Rocky Linux support (#8095) 
* Add Rocky as a known OS

* Make sure Rocky includes bootstrap-centos.yml

* Update docs with Rocky Linux

* Rocky Linux wireguard and EPEL

* Rocky Linux in the list of supported distributions
 2021-10-19 08:29:04 -07:00
Florian Ruynat
f147163b24
Up dashboard version to 2.4.0 - fix forgotten kubeovn version (#8085) 2021-10-15 05:40:54 -07:00
Florian Ruynat
16bf3549c1 Update kube-ovn to 1.8.1 2021-10-14 19:42:54 -07:00
Florian Ruynat
b912dafd7a Update multus to 3.8.0 2021-10-14 19:42:54 -07:00
efrikin
8b3481f511
Add molecule tests for roles (#8080) 
* Add molecule tests for bastion-ssh-config

* Add molecule tests for adduser

* Update .gitignore
 2021-10-14 18:46:54 -07:00
Olivier Levitt
7019c2685d
Increase cpu limit to prevent throttling (#8076) 2021-10-14 11:03:36 -07:00
Mohamed Zaian
d18cc38586
Replcae deprecated --delete-local-data in pre-remove/pre-upgrade tasks (#8081) 2021-10-14 02:25:19 -07:00
Cristian Calin
cee481f63d
cert-manager: upgrade to 1.5.4 (#8069) 
* cert-manager: update to 1.5.4

* cert-manager: remove outdated guidelines on creating an initial ClusterIssuer
 2021-10-12 09:17:47 -07:00
Max Gautier
e4c8c7188e
etcd: deploy container engine if needed (#7532) 
If the etcd cluster is separate and the etcd_deployment_type is "host",
there is no need for a container engine on the etcd nodes

Do not rely on a 'default(true)' filter, but define a proper default in
kubespray-defaults depending on etcd deployment method and if internal
or external etcd is used
 2021-10-12 00:31:47 -07:00
rtsp
6c004efd5f
cert_manager: Remove deprecated ClusterIssuer and its Secret (#8064) 2021-10-11 09:40:40 -07:00
Necatican Yıldırım
1a57780a75
Add kubeadm_join_phases_skip variable (#8067) 
* Add kubeadm_join_phases_skip variable

* Update kubeadm_join_phases_skip comment

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>

* Add kubeadm_join_phases_skip_default variable to follow the same logic with kubeadm_init_phases_skip

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
 2021-10-11 09:36:41 -07:00
Maciej Wereski
ce25e4aa21
MetalLB: update to v0.10.3 (#8071) 
Signed-off-by: Maciej Wereski <m.wereski@partner.samsung.com>
 2021-10-11 08:54:40 -07:00
Rene Luria
ef4044b62f
csi_driver / cinder: implement rescan-on-resize variable via (#8057) 
cinder_csi_rescan_on_resize
 2021-10-11 02:14:40 -07:00
Florian Ruynat
c8d9afce1a
Update a bunch of tools (#8061) 2021-10-08 09:00:59 -07:00
Florian Ruynat
285983a555
Update docker version to 20.10.9 - CVE fixes (#8060) 2021-10-08 08:56:58 -07:00
Cristian Calin
ab4356aa69
Calico: bump default version to 3.20.2 (#8058) 2021-10-07 12:59:33 -07:00
Maxim Pogozhiy
5fcf047191
local-volume-provisioner quay.io -> k8s.gcr.io (#8054) 2021-10-06 17:08:41 -07:00
Rene Luria
e707f78899
After upgrade, allow cilium to be back before uncordoning (#7978) 
* After upgrade, allow cilium to be back before uncordoning

* add eol

* use kube_config_dir variable
resolves https://github.com/kubernetes-sigs/kubespray/pull/7978#discussion_r721685549
 2021-10-05 12:56:58 -07:00
Ilya Margolin
41e0ca3f85
Move kube_feature_gates to kubelet config (#8048) 
to remove deprecation warning:

> Flag --feature-gates has been deprecated, This parameter should be set via the config file specified by the Kubelet's --config flag.
 2021-10-05 06:07:10 -07:00
Iago Santos
43958614e3
Fix kubespray flatcar ansible_os_family and ansible_distribution (#8029) 
Closes https://github.com/kubernetes-sigs/kubespray/issues/8028

Signed-off-by: Iago Santos <iago.santos.pardo@adfinis.com>
 2021-10-01 09:11:23 -07:00
rtsp
af04906b51
Ensure apparmor is installed (#8036) 
Kubespray deployment failed when using containerd backend on nodes that apparmor was not installed or previously removed. This PR ensure apparmor is installed by adding it into required_pkgs var.
 2021-09-29 23:52:08 -07:00
Cristian Calin
c7e17688b9
gVisor: bump release to 20210921 version (#8015) 
* gVisor: bump release to 20210921 version

* gVisor: drop support for 20210518.0 version
 2021-09-29 11:35:20 -07:00
Peter Pan
f5885d05ea
In CentOS 8.x Docker install Step: remove podman when existing (#8016) 2021-09-29 06:32:48 -07:00
Frank Filippone
eee2eb11d8
Update weave template to match source for 2.8.1 (#8013) 2021-09-28 09:16:43 -07:00
Kenichi Omichi
8d3961edbe
Add metrics_server_resizer option (#8018) 
The addon-resizer container can reduce resource limits of cpu and
memory of metrics-server container in the pod, and that caused
OOMKilled.
In addition, the original metrics-server manifest doesn't contain
the addon-resizer container as [1].
So this adds metrics_server_resizer option to control the addon-resizer
container deployment and the default value is false to make it stable
for most environments.

[1]: 527679e5e8/manifests/base/deployment.yaml
 2021-09-28 00:02:42 -07:00
Marcos Lorenzo
4c5328fd1f
Determine root filesistem device and partition before running growpart (#8024) 2021-09-27 23:58:42 -07:00
David Louks
1472528f6d
check if 'plugins' key exists in calico_cni_config object (#7717) 
* check if 'plugins' key exists in calico_cni_config object

* fix whitespace linting error

* fixed when list indentation
 2021-09-27 11:04:20 -07:00
Victor Morales
9416c9aa86
Enable stable and edge Docker CLI versions (#8019) 2021-09-27 10:44:19 -07:00
Kenichi Omichi
da92c7e215
Add proxy for subscription-manager (#8012) 
If using proxy, it is necessary to configure it before running
"subscription-manager status" command.
This adds the step.
 2021-09-27 08:47:35 -07:00
Kenichi Omichi
d27cf375af
Remove allowPrivilegeEscalation from metrics-server (#8014) 
"allowPrivilegeEscalation: false" blocks deploying metrics-server
on CentOS7. In addition, the original metrics-server manifest doesn't
contain it as [1]. This removes it.

[1]: 527679e5e8/manifests/base/deployment.yaml
 2021-09-27 08:43:36 -07:00
Victor Morales
432a312a35
Enable stable and edge containerd versions (#8020) 2021-09-27 08:11:35 -07:00
Cristian Calin
3a6230af6b
Kata-Containers: update versions 2.2.0 (default) and 2.1.1 (#8017) 
* Kata-Containers: add 2.2.0 hashes and make default

* Kata-Containers: replace 2.1.0 with bugfix version 2.1.1

* Kata-Containers: move to q35 a more modern VM architecture as 'pc' is removed in 2.2.0
 2021-09-27 08:07:35 -07:00
Florian Ruynat
ecd267854b
Move ovn4nvf crd from v1beta1 to v1 (#8006) 2021-09-27 01:18:22 -07:00
Hugo Blom
ac846667b7
Check if openstack application credentials are empty since they always exists (#8021) 2021-09-27 01:14:22 -07:00
rtsp
4bace2491d
Ensure apparmor is installed (#8011) 
Kubespray deployment failed when using containerd backend on nodes that apparmor was not installed or previously removed. This PR ensure apparmor is installed by adding it into required_pkgs var.
 2021-09-24 07:55:23 -07:00
Maxim Pogozhiy
22017b7ff0
kube-router 1.3.0 -> 1.3.1 (#8007) 2021-09-23 13:42:55 -07:00
Florian Ruynat
88c11b5946
Revert "etcd: enable v2 api only if needed (#8001)" (#8008) 
This reverts commit c0e1211abe.
 2021-09-23 10:43:14 -07:00
Kenichi Omichi
843252c968
Use kube_config_dir for kubeconfig (#7996) 
The path of kubeconfig should be configurable, and its default value
is /etc/kubernetes/admin.conf. Most paths of the file are configurable
but some were not. This make those configurable.
 2021-09-23 10:19:13 -07:00
Eric Lake
ddea79f0f0
Issue 8004: Fix typha prometheus (#8005) 
The typha prometheus settings were in the `volumeMounts` section of the
spec and not in the `envs` section. This was cauing the deployment to
fail because it was looking for a volumeMount.

```
failed: [controller-001.a2.da.dev.logdna.net] (item=calico-typha.yml) => {"ansible_loop_var": "item", "changed": false, "item": {"ansible_loop_var": "item", "changed": true, "checksum": "598ac79530749e8e2110793b53fc49ac208e7130", "dest": "/etc/kubernetes/calico-typha.yml", "diff": [], "failed": false, "gid": 0, "group": "root", "invocation": {"module_args": {"_original_basename": "calico-typha.yml.j2", "attributes": null, "backup": false, "checksum": "598ac79530749e8e2110793b53fc49ac208e7130", "content": null, "delimiter": null, "dest": "/etc/kubernetes/calico-typha.yml", "directory_mode": null, "follow": false, "force": true, "group": null, "local_follow": null, "mode": null, "owner": null, "regexp": null, "remote_src": null, "selevel": null, "serole": null, "setype": null, "seuser": null, "src": "/home/core/.ansible/tmp/ansible-tmp-1632349768.56-75434-32452975679246/source", "unsafe_writes": null, "validate": null}}, "item": {"file": "calico-typha.yml", "name": "calico", "type": "typha"}, "md5sum": "53c00ac7f562cf9ecbbfd27899ea066d", "mode": "0644", "owner": "root", "size": 5378, "src": "/home/core/.ansible/tmp/ansible-tmp-1632349768.56-75434-32452975679246/source", "state": "file", "uid": 0}, "msg": "error running kubectl (/opt/bin/kubectl --namespace=kube-system apply --force --filename=/etc/kubernetes/calico-typha.yml) command (rc=1), out='service/calico-typha unchanged\n', err='error: error validating \"/etc/kubernetes/calico-typha.yml\": error validating data: [ValidationError(Deployment.spec.template.spec.containers[0].volumeMounts[2]): unknown field \"value\" in io.k8s.api.core.v1.VolumeMount, ValidationError(Deployment.spec.template.spec.containers[0].volumeMounts[2]): missing required field \"mountPath\" in io.k8s.api.core.v1.VolumeMount, ValidationError(Deployment.spec.template.spec.containers[0].volumeMounts[3]): unknown field \"value\" in io.k8s.api.core.v1.VolumeMount, ValidationError(Deployment.spec.template.spec.containers[0].volumeMounts[3]): missing required field \"mountPath\" in io.k8s.api.core.v1.VolumeMount]; if you choose to ignore these errors, turn validation off with --validate=false\n'"}
```
 2021-09-23 08:37:22 -07:00
Max Gautier
c0e1211abe
etcd: enable v2 api only if needed (#8001) 
* etcd: enable v2 api only if needed

Only enable v2 API if we have a consumer (flannel)
This reduce the exposed surface for etcd.

* Fix bad group name
 2021-09-22 12:36:32 -07:00
Florian Ruynat
c8d7f000c9
Remove k8s hooks for versions prior to 1.20 (#7998) 2021-09-22 10:32:01 -07:00
Léopold Jacquot
598f178054
Fix cilium operator metrics activation (#8000) 2021-09-22 10:00:02 -07:00
Florian Ruynat
5d1b34bdcd Move min k8s version to 1.20 2021-09-22 09:50:01 -07:00
Florian Ruynat
8efde799e1 Update kubernetes version to 1.22.2 2021-09-22 09:50:01 -07:00
Cristian Calin
a517a8db01
Drop chech for kubelet_shutdown_grace_period (#7993) 
and kubelet_shutdown_grace_period_critical_pods as ansible cannot do
sane time interval calculations
 2021-09-21 18:34:00 -07:00
Wang Zhen
2211504790
Fix k8s-certs-renew cp path (#7992) 
Signed-off-by: Wang Zhen <lazybetrayer@gmail.com>
 2021-09-21 00:36:22 -07:00
Cristian Calin
fb8662ec19
Calico: update versions 3.20.1, 3.19.3 (#7984) 
* make Calico 3.20.1 the default version
* drop Calico 3.17.x support
 2021-09-20 17:40:23 -07:00
Cristian Calin
6f7911264f
Calico: make calico_min_version check relevant (#7939) 
* Calico: make calico_min_version check relevant

* Calico: only check currently installed version against the oldest supported version by the previous release
 2021-09-20 07:58:09 -07:00
Cristian Calin
ae44aff330
Calico: increase calico node probe timeouts and allow tunning (#7981) 2021-09-17 16:08:07 -07:00
Florian Ruynat
b83e8b020a
Fix default version (#7977) 2021-09-17 07:31:00 -07:00
Hari Hud
30cd91dc6b
Add option to kubeadm upgrade command to control certificates renewal during control plane upgrade (#7976) 
* Add option to kubeadm upgrade command to control certificates renewal during control plane upgrade

* Remove training whitespace
 2021-09-17 04:31:00 -07:00
Florian Ruynat
f2fa9c3b31 Update hashes with new versions 2021-09-17 00:39:02 -07:00
Florian Ruynat
30a7dfa4f8
Fix ubuntu16/centos8 CI jobs (#7972) 2021-09-16 23:39:01 -07:00
Samuel Liu
62ab477838
remove kube_proxy_conntrack_max var (#7971) 2021-09-15 08:22:31 -07:00
rtsp
f8a57f7598
Fix iptables missing on Debian 11 if APT::Install-Recommends=0 (#7964) 
On Debian 11, `ipset` just recommend `iptables` so on the system that apt is configured with `APT::Install-Recommends "0";` iptables will not install automatically.
 2021-09-14 08:19:09 -07:00
Bryan Hundven
35c928798d
Fix missing file mode (risky-file-permissions) (#7959) 
* Fix missing file mode (risky-file-permissions)

Found this using ansible-lint.

Signed-off-by: Bryan Hundven <bryanhundven@gmail.com>

* Fix another missing file mode (risky-file-permissions)

This one fixes `/etc/crio/config.json`

Signed-off-by: Bryan Hundven <bryanhundven@gmail.com>
 2021-09-09 23:35:59 -07:00