48e77cd8bb
* Drop linux capabilities for unprivileged containerized worlkoads Kargo configures for deployments. * Configure required securityContext/user/group/groups for kube components' static manifests, etcd, calico-rr and k8s apps, like dnsmasq daemonset. * Rework cloud-init (etcd) users creation for CoreOS. * Fix nologin paths, adjust defaults for addusers role and ensure supplementary groups membership added for users. * Add netplug user for network plugins (yet unused by privileged networking containers though). * Grant the kube and netplug users read access for etcd certs via the etcd certs group. * Grant group read access to kube certs via the kube cert group. * Remove priveleged mode for calico-rr and run it under its uid/gid and supplementary etcd_cert group. * Adjust docs. * Align cpu/memory limits and dropped caps with added rkt support for control plane. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
53 lines
3 KiB
YAML
53 lines
3 KiB
YAML
---
|
|
- set_fact: kube_apiserver_count="{{ groups['kube-master'] | length }}"
|
|
- set_fact: kube_apiserver_address="{{ ip | default(ansible_default_ipv4['address']) }}"
|
|
- set_fact: kube_apiserver_access_address="{{ access_ip | default(kube_apiserver_address) }}"
|
|
- set_fact: is_kube_master="{{ inventory_hostname in groups['kube-master'] }}"
|
|
- set_fact: first_kube_master="{{ hostvars[groups['kube-master'][0]]['access_ip'] | default(hostvars[groups['kube-master'][0]]['ip'] | default(hostvars[groups['kube-master'][0]]['ansible_default_ipv4']['address'])) }}"
|
|
- set_fact:
|
|
loadbalancer_apiserver_localhost: false
|
|
when: loadbalancer_apiserver is defined
|
|
- set_fact:
|
|
kube_apiserver_endpoint: |-
|
|
{% if not is_kube_master and loadbalancer_apiserver_localhost -%}
|
|
https://localhost:{{ nginx_kube_apiserver_port }}
|
|
{%- elif is_kube_master and loadbalancer_apiserver is not defined -%}
|
|
http://127.0.0.1:{{ kube_apiserver_insecure_port }}
|
|
{%- else -%}
|
|
{%- if loadbalancer_apiserver is defined and loadbalancer_apiserver.port is defined -%}
|
|
https://{{ apiserver_loadbalancer_domain_name|default('lb-apiserver.kubernetes.local') }}:{{ loadbalancer_apiserver.port|default(kube_apiserver_port) }}
|
|
{%- else -%}
|
|
https://{{ first_kube_master }}:{{ kube_apiserver_port }}
|
|
{%- endif -%}
|
|
{%- endif %}
|
|
|
|
- set_fact: etcd_address="{{ ip | default(ansible_default_ipv4['address']) }}"
|
|
- set_fact: etcd_access_address="{{ access_ip | default(etcd_address) }}"
|
|
- set_fact: etcd_peer_url="https://{{ etcd_access_address }}:2380"
|
|
- set_fact: etcd_client_url="https://{{ etcd_access_address }}:2379"
|
|
- set_fact: etcd_authority="127.0.0.1:2379"
|
|
- set_fact: etcd_endpoint="https://{{ etcd_authority }}"
|
|
- set_fact:
|
|
etcd_access_addresses: |-
|
|
{% for item in groups['etcd'] -%}
|
|
https://{{ hostvars[item]['access_ip'] | default(hostvars[item]['ip'] | default(hostvars[item]['ansible_default_ipv4']['address'])) }}:2379{% if not loop.last %},{% endif %}
|
|
{%- endfor %}
|
|
- set_fact: etcd_access_endpoint="{% if etcd_multiaccess %}{{ etcd_access_addresses }}{% else %}{{ etcd_endpoint }}{% endif %}"
|
|
- set_fact:
|
|
etcd_member_name: |-
|
|
{% for host in groups['etcd'] %}
|
|
{% if inventory_hostname == host %}{{"etcd"+loop.index|string }}{% endif %}
|
|
{% endfor %}
|
|
- set_fact:
|
|
etcd_peer_addresses: |-
|
|
{% for item in groups['etcd'] -%}
|
|
{{ "etcd"+loop.index|string }}=https://{{ hostvars[item].access_ip | default(hostvars[item].ip | default(hostvars[item].ansible_default_ipv4['address'])) }}:2380{% if not loop.last %},{% endif %}
|
|
{%- endfor %}
|
|
- set_fact:
|
|
is_etcd_master: "{{ inventory_hostname in groups['etcd'] }}"
|
|
- set_fact:
|
|
etcd_after_v3: etcd_version | version_compare("v3.0.0", ">=")
|
|
- set_fact:
|
|
etcd_container_bin_dir: "{% if etcd_after_v3 %}/usr/local/bin/{% else %}/{% endif %}"
|
|
- set_fact:
|
|
peer_with_calico_rr: "{{ 'calico-rr' in groups and groups['calico-rr']|length > 0 }}"
|