3a39904011
By default Calico CNI does not create any network access policies or profiles if 'policy' is enabled in CNI config. And without any policies/profiles network access to/from PODs is blocked. K8s related policies are created by calico-policy-controller in such case. So we need to start it as soon as possible, before any real workloads. This patch also fixes kube-api port in calico-policy-controller yaml template. Closes #1132
21 lines
660 B
YAML
21 lines
660 B
YAML
- set_fact:
|
|
calico_cert_dir: "{{ canal_cert_dir }}"
|
|
when: kube_network_plugin == 'canal'
|
|
tags: [facts, canal]
|
|
|
|
- name: Write calico-policy-controller yaml
|
|
template:
|
|
src: calico-policy-controller.yml.j2
|
|
dest: "{{kube_config_dir}}/calico-policy-controller.yml"
|
|
when: inventory_hostname == groups['kube-master'][0]
|
|
tags: canal
|
|
|
|
- name: Start of Calico policy controller
|
|
kube:
|
|
name: "calico-policy-controller"
|
|
kubectl: "{{bin_dir}}/kubectl"
|
|
filename: "{{kube_config_dir}}/calico-policy-controller.yml"
|
|
namespace: "{{system_namespace}}"
|
|
resource: "rs"
|
|
when: inventory_hostname == groups['kube-master'][0]
|
|
tags: canal
|