Commit graph

1566 commits

Author SHA1 Message Date
Artem Roma
d2e6bd153b Add possibility to enable network policy via Calico network controller
The requirements for network policy feature are described here [1]. In
order to enable it, appropriate configuration must be provided to the CNI
plug in and Calico policy controller must be set up. Beside that
corresponding extensions needed to be enabled in k8s API.

Now to turn on the feature user can define `enable_network_policy`
customization variable for Ansible.

[1] http://kubernetes.io/docs/user-guide/networkpolicies/
2016-10-10 17:22:12 +03:00
Smaine Kahlouch
f3b3d58c2f Merge pull request #537 from xenolog/issues/535
Issues/535
2016-10-07 18:05:14 +02:00
Sergey Vasilenko
fbe7b1cd2c Bump Calico-CNI plugin binaries versions
and correct checksums
2016-10-07 13:14:46 +03:00
Sergey Vasilenko
c410680b34 Changes in Kubernetes and Calico-CNI plugin config files
required for usage of Calico CNI plugin version 1.4.2
2016-10-06 19:33:16 +03:00
Smaine Kahlouch
9df4502909 Merge pull request #528 from kubespray/proxy-nginx
Use nginx proxy on non-master nodes to proxy apiserver traffic
2016-10-05 19:19:32 +02:00
Matthew Mosesohn
73066f308d use nginx proxy on non-master nodes to proxy apiserver traffic
Also adds all masters by hostname and localhost/127.0.0.1 to
apiserver SSL certificate.

Includes documentation update on how localhost loadbalancer works.
2016-10-05 20:09:10 +03:00
Smaine Kahlouch
3faeffc294 Merge pull request #491 from kubespray/calicopools
Allow calico to configure pool if tree exists, but no pools defined
2016-10-05 17:12:26 +02:00
Smaine Kahlouch
4bc31798e0 Merge pull request #522 from anthonyhaussman/KubeVersionDefaults
Move kube_version var to defaults
2016-10-05 17:11:59 +02:00
Smaine Kahlouch
b91df69181 Merge pull request #531 from kubespray/reverselookups
Disable reverse lookups again
2016-10-05 13:49:13 +02:00
Matthew Mosesohn
de543fed5f Merge branch 'master' into reverselookups 2016-10-05 14:46:47 +03:00
Smaine Kahlouch
e1ad4f0309 Merge pull request #533 from kubespray/etcd_quorum_read
Enable quorum read for apiserver
2016-10-05 12:01:04 +02:00
Matthew Mosesohn
5fdfc25657 Enable quorum read for apiserver
This reduces the likelihood of apiserver status updates
timing out due to etcd write conflicts.
2016-10-04 18:31:42 +03:00
Smaine Kahlouch
064f7d8ccf Merge pull request #530 from adidenko/fix-calico-cluster-ip
Add support for --masquerade-all in kube-proxy
2016-10-03 16:49:31 +02:00
Aleksandr Didenko
40a94947c8 Add support for --masquerade-all in kube-proxy
New boolean var `kube_proxy_masquerade_all` which enables/disables
`--masquerade-all` argument for kube-proxy.

Closes #524
2016-10-03 12:24:43 +02:00
Smaine Kahlouch
7eb4b8f5cc Merge pull request #525 from keglevich3/patch-2
changed to the correct link
2016-09-30 12:38:55 +02:00
Smaine Kahlouch
f5df4bd2dc Merge pull request #527 from bogdando/download_binaries
Skip download_run_once for binaries as unimplemented yet
2016-09-30 12:28:53 +02:00
Bogdan Dobrelya
1990f8bec5 Skip download_run_once for binaries as unimplemented yet
Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-30 10:55:02 +02:00
keglevich3
52cdb911f7 changed to the correct link 2016-09-29 17:44:24 +03:00
Matthew Mosesohn
0cbafa2d4b add kube-masters to SSL certificate 2016-09-29 15:12:30 +03:00
Smaine Kahlouch
0bd3081219 Merge pull request #502 from adidenko/custom-calico-hyperkube
Allow to use custom "canalized" calico cni
2016-09-29 13:29:49 +02:00
Smaine Kahlouch
490f613359 Merge pull request #515 from adidenko/fix-delegate-to
Fix delegate_to expression in download tasks
2016-09-29 10:36:44 +02:00
Matthew Mosesohn
fa11a6876c Disable reverse lookups again
Initially this was removed, but it turns out that services that
perform reverse lookups (such as MariaDB) will encounter severe
performance degredation with this disabled.
2016-09-29 10:49:55 +04:00
Aleksandr Didenko
c12b06839a Allow to use custom "canalized" calico cni
- Allow to overwrite calico cni binaries copied from hyperkube
  by the custom ones.
- Fix calico-ipam deployment (it had wrong source in rsync)
- Make copy from hyperkube idempotent (use rsync instead of cp)
- Remove some orphaned comments
2016-09-28 18:09:20 +02:00
Anthony Haussmann
f9a18460d3 Move kube_version var to defaults
Move the variable kube_version to defaults to have the possibility to overwrite it via group_vars inventory if needed.
2016-09-28 16:15:18 +02:00
Smaine Kahlouch
9146b8917d Merge pull request #521 from anthonyhaussman/MethodBoolUseCNI
Change method to set use_hyperkube_cni var bool
2016-09-28 12:24:53 +02:00
Smaine Kahlouch
ffe882315a Merge pull request #518 from bogdando/issues/516
Allow subdomains of dns_domain and fix kubelet restarts
2016-09-28 10:11:44 +02:00
Smaine Kahlouch
fba2995cec Merge pull request #497 from tonycapone/master
Restored gather facts on all hosts
2016-09-27 17:00:39 +02:00
Anthony Haussmann
5b021ed438 Change method to set use_hyperkube_cni var bool
The precedent method returb a string "True\n" or "False\n", it seems to be an Ansible bug.
New method return a boolean
2016-09-27 16:41:09 +02:00
Smaine Kahlouch
63d5ac91ad Merge pull request #519 from bogdando/fix_containers_download
Fix containers download condition
2016-09-27 15:23:50 +02:00
Smaine Kahlouch
eda806ef96 Merge pull request #520 from kubespray/use_dns_name_kubedns
use variable dns_domain instead of cluster_name for kubedns
2016-09-27 14:52:30 +02:00
Bogdan Dobrelya
6ab133d0a3 Allow subdomains of dns_domain and fix kubelet restarts
* Add a var for ndots (default 5) and put it hosts' /etc/resolv.conf.
* Poke kube dns container image to v1.7
* In order to apply changes to kubelet, notify it to
be restarted on changes made to /etc/resolv.conf. Ignore errors as the kubelet
may yet to be present up to the moment of the notification being processed.
* Remove unnecessary kubelet restart for master role as the node role ensures
it is up and running. Notify master static pods waiters for apiserver,
scheduler, controller-manager instead.

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-27 14:32:49 +02:00
Smana
c60d8111f6 use variable dns_domain instead of cluster_name for kubedns 2016-09-27 14:15:27 +02:00
Bogdan Dobrelya
130d66d24d Fix containers download condition
Save/push/load containers if only download.enabled and download.container

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-27 13:44:29 +02:00
Aleksandr Didenko
c7249e1a45 Fix delegate_to expression in download tasks
"else omit" is causing problems in this expression. Replacing
it with more strict "inventory_hostname" fixes the issue and
handles `download_run_once` as expected.

Closes issue #514
2016-09-27 11:25:24 +02:00
Smaine Kahlouch
5a6424d7a2 Merge pull request #507 from anthonyhaussman/KubeDNSCorrection
Correct nslookup command
2016-09-26 13:58:00 +02:00
Smaine Kahlouch
b43db98f4e Merge pull request #510 from bogdando/dns_docs
Add more DNS docs
2016-09-26 13:57:14 +02:00
Smaine Kahlouch
e3fe648de6 Merge pull request #509 from kubespray/cnicopyweave
Copy hyperkube CNI plugins when using weave
2016-09-26 13:54:02 +02:00
Smaine Kahlouch
c6220a955c Merge pull request #500 from kubespray/docker1.12.1
Add Docker 1.12.1 version
2016-09-26 13:53:29 +02:00
Bogdan Dobrelya
14529c1ea3 Add more DNS docs
Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-26 13:47:34 +02:00
Matthew Mosesohn
1494238ab1 Add Docker 1.12.1 version 2016-09-26 12:16:16 +03:00
Matthew Mosesohn
6bf2a80dcd Copy hyperkube CNI plugins when using weave 2016-09-26 12:02:19 +03:00
Anthony Haussmann
83a6c5cf61 Correct nslookup command
Change nslookup command to check the right cluster_name
2016-09-23 17:44:09 +02:00
Smaine Kahlouch
e680e1266a Merge pull request #506 from bogdando/dns_drawing
Adjust DNS picture
2016-09-23 17:26:29 +02:00
Bogdan Dobrelya
8aeeb62719 Adjust DNS picture
Reflect changes made to DNS setup

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-23 17:11:07 +02:00
Smaine Kahlouch
c7aa6441b2 Merge pull request #505 from bogdando/rework_dnsstack
Fix docs and dns servers placement order
2016-09-23 16:25:20 +02:00
Bogdan Dobrelya
2908f92524 Fix docs and dns servers placement order
- Update docs and a drawing to clarify DNS setup.
- Change order of nameservers placement to match
  changes in https://github.com/kubespray/kargo/pull/501

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-23 16:16:00 +02:00
Smaine Kahlouch
c6816caa12 Merge pull request #504 from bogdando/rework_dnsstack
Make dnsmasq daemon set optional
2016-09-23 15:33:34 +02:00
Bogdan Dobrelya
34d0c5c676 Make dnsmasq daemon set optional
Change additional dnsmasq opts:
- Adjust caching size and TTL
- Disable resolve conf to not create loops
- Change dnsPolicy to default (similarly to kubedns's dnsmasq). The
  ClusterFirst should not be used to not create loops
- Disable negative NXDOMAIN replies to be cached
- Make its very installation as optional step (enabled by default).
  If you don't want more than 3 DNS servers, including 1 for K8s, disable
  it.
- Add docs and a drawing to clarify DNS setup.
- Fix stdout logs for dnsmasq/kubedns app configs
- Add missed notifies to resolvconf -u handler
- Fix idempotency of resolvconf head file changes

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-23 12:59:06 +02:00
Smaine Kahlouch
55e02d058a Merge pull request #501 from kubespray/nameserver_update_fix
Improve management of nameservers in resolv.conf
2016-09-22 18:49:29 +02:00
Matthew Mosesohn
abb56c21a7 Improve management of nameservers in resolv.conf
Changing nameservers now will clean up previous entries
2016-09-22 18:11:15 +03:00