C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
6708 commits 17 branches 66 tags 141 MiB
Commit graph

671 commits

Author SHA1 Message Date
lijin-union
c4976437a8
Fix typos in docs (#9276) 2022-09-15 00:09:22 -07:00
Kay Yan
97ca2f3c78
add-timezone-support (#9263) 2022-09-14 21:11:22 -07:00
Ho Kim
952cad8d63
Remove mutual exclusivity in calico: NAT and router mode (#9255) 
* Add optional NAT support in calico router mode

* Add a blank line in front of lists

* Remove mutual exclusivity: NAT and router mode

* Ignore router mode from NAT

* Update calico doc
 2022-09-13 00:19:07 -07:00
Kay Yan
e2f1f8d69d
add-Rocky-9-support (#9212) 2022-09-04 16:54:36 -07:00
Michael Schmitz
be2bfd867c
Add Support for Rewrite Plugin to CoreDNS/NodelocalDNS (#9245) 2022-09-03 16:16:35 -07:00
Cristian Calin
6db6c8678c
disable kubelet_authorization_mode_webhook by default (#9238) 2022-08-31 04:53:00 -07:00
Alessio Greggi
acb6f243fd
feat: add kubelet systemd service hardening option (#9194) 
* feat: add kubelet systemd service hardening option

* refactor: move variable name to kubelet_secure_addresses

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>

* docs: add diagram about kubelet_secure_addresses variable

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
 2022-08-30 11:18:55 -07:00
lijin-union
8af86e4c1e Fix typo. 2022-08-30 11:30:57 +02:00
Kay Yan
b46ddf35fc
kube-vip shoud fail if kube_proxy_strict_arp is false in arp mod (#9223) 
* fix-kube-vip-strict-arp

* fix-kube-vip-strict-arp
 2022-08-30 00:21:02 -07:00
Cristian Calin
e6976a54e1
add pre-commit hook to facilitate local testing (#9158) 
* add pre-commit hook configuration

* add tmp.md to .gitignore

* describe the use of pre-commit hook in CONTRIBUTING.md

* fix docs/integration.md errors identified by markdownlint

* fix docs/<file>.md errors identified by markdownlint

* docs/azure-csi.md
* docs/azure.md
* docs/bootstrap-os.md
* docs/calico.md
* docs/debian.md
* docs/fcos.md
* docs/vagrant.md
* docs/gcp-lb.md
* docs/kubernetes-apps/registry.md
* docs/setting-up-your-first-cluster.md
* docs/vagrant.md
* docs/vars.md

* fix contrib/<file>.md errors identified by markdownlint
 2022-08-24 06:54:03 -07:00
Bishal das
aeeae76750
Update vars.md (#9172) 2022-08-22 23:31:24 -07:00
Shelming.Song
30b062fd43
fix one bug in docs/nodes (#9203) 2022-08-22 23:17:23 -07:00
Bishal das
fddff783c8
Update vsphere-csi.md (#9170) 2022-08-22 07:13:43 -07:00
Tristan
bbd1161147
9035: Make Cilium rolling-restart delay/timeout configurable (#9176) 
See #9035
 2022-08-22 02:37:44 -07:00
Ho Kim
e31890806c
Add 'avoid-buggy-ips' support of MetalLB (#9166) 2022-08-18 21:49:51 -07:00
Tomas Zvala
30c77ea4c1
Add the option to enable default Pod Security Configuration (#9017) 
* Add the option to enable default Pod Security Configuration

Enable Pod Security in all namespaces by default with the option to
exempt some namespaces. Without the change only namespaces explicitly
configured will receive the admission plugin treatment.

* Fix the PR according to code review comments

* Revert the latest changes

- leave the empty file when kube_pod_security_use_default, but add comment explaining the empty file
- don't attempt magic at conditionally adding PodSecurity to kube_apiserver_admission_plugins_needs_configuration
 2022-08-18 01:16:36 -07:00
maxgio92
68653c31c0
docs(kube-vip): fix broken links (#9165) 
Signed-off-by: Massimiliano Giovagnoli <me@maxgio.it>

Signed-off-by: Massimiliano Giovagnoli <me@maxgio.it>
 2022-08-18 00:56:55 -07:00
Samuel Liu
b36bb9115a
[calico] calico rr supports multiple groups (#9134) 
* update calico rr

* fix bgppeer conf

* fix yamllint

* fix ansible lint

* fix calico deploy

* fix yamllint

* fix some typo
 2022-08-18 00:52:37 -07:00
ERIK
47050003a0
Add docker support for Kylin V10 (#9144) 
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
 2022-08-03 15:03:46 -07:00
Florian Ruynat
4df6e35270 Move oracle7-canal to centos7-canal 2022-08-02 16:55:52 -07:00
ERIK
f2f9f1d377
Add kylin OS support (#9078) 
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
 2022-08-01 10:44:29 -07:00
Florian Ruynat
9c51ac5157 Switch fedora36se to 35 and 35docker to 36 2022-07-21 23:03:38 -07:00
Florian Ruynat
07eab539a6 Add Fedora 36 support and CI, remove Fedora 34 (eol) 2022-07-21 23:03:38 -07:00
Alessio Greggi
3ce5458f32
hardening: Add SeccompDefault admission plugin for kubelet (#9074) 
* docs(hardening): add SeccompDefault admission plugin to kubelet feature gates

* fix(kubelet-config): enable config through kubelet_feature_gates

* feat(kubelet): add kubelet_seccomp_default variable
 2022-07-19 00:50:07 -07:00
Kenichi Omichi
f3ea8cf45e
Add Rocky Linux 8 support for vagrant (#8905) 
To test Kubespray on Rocky Linux 8 with vagrant, this adds it to
the Vagrantfile.
 2022-07-05 07:50:47 -07:00
Kay Yan
4b03f6c20f
add-managed-ntp-support (#9027) 2022-06-28 13:15:34 -07:00
boeto
d0a2ba37e8
update deprecated syntax (#9040) 
* `ansible.builtin.include` removed in version 2.16

Read the `ansible.builtin.include DEPRECATED` doc:

 https://docs.ansible.com/ansible/latest/collections/ansible/builtin/include_module.html#deprecated

* Update integration.md
 2022-06-28 13:11:34 -07:00
rptaylor
6f82cf12f5
let containerd_default_runtime be undefined by default (#9026) 2022-06-27 10:56:59 -07:00
Calin Cristian Andrei
a22ae6143a [CI] ensure upgrade tests cover defaults (containerd currently) 2022-06-17 08:00:32 -07:00
Alessio Greggi
97b4d79ed5
feat: make kubernetes owner parametrized (#8952) 
* feat: make kubernetes owner parametrized

* docs: update hardening guide with configuration for CIS 1.1.19

* fix: set etcd data directory permissions to be compliant to CIS 1.1.12
 2022-06-17 01:34:32 -07:00
Kay Yan
890fad389d
suggest-to-use-nft-in-centos8 (#8987) 2022-06-17 01:30:32 -07:00
Calin Cristian Andrei
24c8ba832a [kubernetes] drop support for configuring insecure apiserver 2022-06-15 00:57:20 -07:00
Calin Cristian Andrei
fad296616c [docker] use cri-dockerd instead of dockershim for any kubernetes version deployed with docker as the container_manager 2022-06-15 00:57:20 -07:00
Kay Yan
85271fc2e5
add-ci-for-ubuntu2204 (#8958) 2022-06-15 00:47:19 -07:00
Kenichi Omichi
cd7381d8de
Drop Ansible support for v2.9 and v2.10 (#8925) 
Ansible v2.9 and v2.10 are EOL as [1].
This drops those version supports by following the upstream Ansible.

This sets use_ssh_args true always because that is required to use
ssh_args on ansible.cfg on Ansible v2.11 or later[2].

ansible_ssh_host is replaced with ansible_host because ansible_ssh_host
has been deprecated already and cenots7 jobs were failed due to the
deprecated ansible_ssh_host.

[1]: https://docs.ansible.com/ansible/devel/reference_appendices/release_and_maintenance.html#ansible-core-changelogs
[2]: https://docs.ansible.com/ansible/latest/collections/ansible/posix/synchronize_module.html#parameter-use_ssh_args
 2022-06-09 07:07:42 -07:00
Ilya Margolin
cc6cbfbe71
Allow disabling calico CNI logs with calico_cni_log_file_path (#8921) 
* Allow disabling calico CNI logs with calico_cni_log_file_path

Calico CNI logs up to 1G if it log a lot with current default settings:
log_file_max_size	100	Max file size in MB log files can reach before they are rotated.
log_file_max_age	30	Max age in days that old log files will be kept on the host before they are removed.
log_file_max_count	10	Max number of rotated log files allowed on the host before they are cleaned up.

See https://projectcalico.docs.tigera.io/reference/cni-plugin/configuration#logging

To save disk space, make the path configurable and allow disabling this log by setting
`calico_cni_log_file_path: false`

* Fix markdown

* Update roles/network_plugin/canal/templates/cni-canal.conflist.j2

Co-authored-by: Kenichi Omichi <ken1ohmichi@gmail.com>

Co-authored-by: Kenichi Omichi <ken1ohmichi@gmail.com>
 2022-06-07 09:22:56 -07:00
zhougw
14c0f368b6
the KUESPRAYDIR defined but never used (#8930) 
* fix dir error

* the command line should align
 2022-06-06 07:42:23 -07:00
Alessio Greggi
d22204a59f
docs: add hardening guide (#8868) 2022-05-29 12:36:50 -07:00
Kenichi Omichi
0e6b727e53
Update docs for using venv (#8842) 
Due many patterns of Linux distributions, it is difficult to install
ansible dependencies as system-wide stably.
Apart of Kubespray doc[1] recommends to use venv to avoid such issue,
and this applies venv usage to the other parts of the doc.

[1]: https://github.com/kubernetes-sigs/kubespray/blob/master/docs/setting-up-your-first-cluster.md#set-up-kubespray
 2022-05-19 23:39:12 -07:00
Cristian Calin
0c504e4984
[docs] document support for ansible versions (#8827) 
drop note about not supporting ansible 2.9 since we still cover it in
nightly CI
 2022-05-16 00:50:17 -07:00
Kenichi Omichi
0bf070c33b
doc: write how to use kata-container for pods (#8817) 
kata-container is not used by default even if enabling kata_containers_enabled.
This updates the doc for writing how to do that.
 2022-05-13 23:15:18 -07:00
Oogy
5684610a55
Support metallb peer password (#8792) 
* support metallb peer password

* add MetalLB BGP password example
 2022-05-11 21:39:15 -07:00
Necatican Yıldırım
13443b05a6
Overhaul Cilium manifests to match the newer versions (#8717) 
* [cilium] Separate templates for cilium, cilium-operator, and hubble installations

Signed-off-by: necatican <necaticanyildirim@gmail.com>

* [cilium] Update cilium-operator templates

Signed-off-by: necatican <necaticanyildirim@gmail.com>

* [cilium] Allow using custom args and mounting extra volumes for the Cilium Operator

Signed-off-by: necatican <necaticanyildirim@gmail.com>

* [cilium] Update the cilium configmap to filter out the deprecated variables, and add the new variables

Signed-off-by: necatican <necaticanyildirim@gmail.com>

* [cilium] Add an option to use Wireguard encryption on Cilium 1.10 and up

Signed-off-by: necatican <necaticanyildirim@gmail.com>

* [cilium] Update cilium-agent templates

Signed-off-by: necatican <necaticanyildirim@gmail.com>

* [cilium] Bump Cilium version to 1.11.3

Signed-off-by: necatican <necaticanyildirim@gmail.com>
 2022-05-11 06:23:04 -07:00
weizhoublue
1d96f465f4
arm64 support of cilium (#8803) 
when cilium v1.10 , it is ok to support arm64
https://cilium.io/blog/2021/05/20/cilium-110

Signed-off-by: weizhou.lan@daocloud.io <weizhou.lan@daocloud.io>
 2022-05-10 02:55:43 -07:00
Alessio Greggi
37a5271f5a
feat: add variables to manage makeIPTablesUtilChains and streamingConnectionIdleTimeout kubelet parameters (#8796) 2022-05-09 09:25:19 -07:00
Alessio Greggi
e7df4d3dd9
add support for service-account-lookup parameter (#8781) 
* feat: add variable to manage service-account-lookup on kube-apiserver

* docs: add documentation about service-account-lookup variable
 2022-05-06 00:39:07 -07:00
Alessio Greggi
fa1d222eee
add support for EventRateLimit plugin configuration (#8711) 
* feat: add support for EventRateLimit admission plugin

* docs: add documentation about admission_control_config_file and EventRateLimit configuration
 2022-05-02 11:03:15 -07:00
Mathieu Parent
e6c4330e4e
calico: vxlan is the default for calico_network_backend (#8750) 
Since https://github.com/kubernetes-sigs/kubespray/pull/8434
 2022-04-27 02:24:11 -07:00
Kenichi Omichi
1e827f9807
Update kata-containers.md (#8747) 
* kata container related options exist in k8s-cluster.yml,
  not k8s_cluster.yml

* https://github.com/kata-containers/runtime has been archived and
  https://github.com/kata-containers/kata-containers is used today.
 2022-04-26 07:06:53 -07:00
Cristian Calin
45262da726
[calico] call calico checks early on to prevent altering the cluster with bad configuration (#8707) 2022-04-14 01:08:46 -07:00