a70c3b661e
* Add auto-evaluated internal endpoints and clarify the loadbalancer_apiserver vars and usecases. * Add loadbalancer_apiserver_localhost (default false). If enabled, override the external LB and expect localhost:443/8080 to be new internal only frontends. * Add kube_apiserver_multiaccess to ignore loadbalancers, and make clients to access the apiservers as a comma-separated list of access_ip/ip/ansible ip (a default mode). When disabled, allow clients to use the given loadbalancers. * Define connections security mode for kube controllers, schedulers, proxies. It is insecure be default, which is the current deployment choice. * Rework the groups['kube-master'][0] hardcode defining the apiserver endpoints. * Improve grouping of vars and add facts for kube_apiserver. * Define kube_apiserver_insecure_bind_address as a fact, add more facts for ease of use. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
66 lines
3.2 KiB
YAML
66 lines
3.2 KiB
YAML
---
|
|
- set_fact: kube_apiserver_count="{{ groups['kube-master'] | length }}"
|
|
- set_fact: kube_apiserver_address="{{ ip | default(ansible_default_ipv4['address']) }}"
|
|
- set_fact: kube_apiserver_access_address="{{ access_ip | default(kube_apiserver_address) }}"
|
|
- set_fact:
|
|
kube_apiserver_insecure_bind_address: |-
|
|
{% if loadbalancer_apiserver_localhost %}
|
|
{{ kube_apiserver_address }}{% else %}127.0.0.1{% endif %}
|
|
- set_fact:
|
|
apiserver_access_port: |-
|
|
{% if loadbalancer_apiserver is defined and loadbalancer_apiserver.port is defined %}
|
|
{{ loadbalancer_apiserver.port }}{% else %}{{ kube_apiserver_port }}{% endif %}
|
|
- set_fact:
|
|
kube_apiserver_endpoint: |-
|
|
{% if loadbalancer_apiserver_localhost %}
|
|
https://127.0.0.1:{{ apiserver_access_port }}
|
|
{% else -%}
|
|
https://{{ apiserver_loadbalancer_domain_name|default(kube_apiserver_access_address) }}:{{ apiserver_access_port }}
|
|
{%- endif %}
|
|
- set_fact: kube_apiserver_insecure_endpoint="http://{{ kube_apiserver_insecure_bind_address }}:{{ kube_apiserver_insecure_port }}"
|
|
- set_fact:
|
|
kube_apiserver_access_endpoint: |-
|
|
{% if kube_apiserver_multiaccess %}
|
|
{% for host in groups['kube-master'] -%}
|
|
https://{{ hostvars[host].kube_apiserver_access_address }}:{{ kube_apiserver_port }}{% if not loop.last %},{% endif %}
|
|
{%- endfor %}
|
|
{% else %}{{ kube_apiserver_endpoint }}{% endif %}
|
|
- set_fact:
|
|
kube_apiserver_insecure_access_endpoint: |-
|
|
{% if kube_apiserver_multiaccess %}
|
|
{% for host in groups['kube-master'] -%}
|
|
https://{{ hostvars[host].kube_apiserver_insecure_bind_address }}:{{ kube_apiserver_insecure_port }}{% if not loop.last %},{% endif %}
|
|
{%- endfor %}
|
|
{% else %}{{ kube_apiserver_insecure_endpoint }}{% endif %}
|
|
|
|
- set_fact: etcd_address="{{ ip | default(ansible_default_ipv4['address']) }}"
|
|
- set_fact: etcd_access_address="{{ access_ip | default(etcd_address) }}"
|
|
- set_fact: etcd_peer_url="http://{{ etcd_access_address }}:2380"
|
|
- set_fact: etcd_client_url="http://{{ etcd_access_address }}:2379"
|
|
- set_fact: etcd_authority="{{ access_ip|default('127.0.0.1') }}:2379"
|
|
- set_fact: etcd_endpoint="http://{{ etcd_authority }}"
|
|
- set_fact:
|
|
etcd_access_addresses: |-
|
|
{% for item in groups['etcd'] -%}
|
|
http://{{ hostvars[item].etcd_access_address }}:2379{% if not loop.last %},{% endif %}
|
|
{%- endfor %}
|
|
- set_fact: etcd_access_endpoint="{% if etcd_multiaccess %}{{ etcd_access_addresses }}{% else %}{{ etcd_endpoint }}{% endif %}"
|
|
- set_fact:
|
|
etcd_member_name: |-
|
|
{% for host in groups['etcd'] %}
|
|
{% if inventory_hostname == host %}{{"etcd"+loop.index|string }}{% endif %}
|
|
{% endfor %}
|
|
- set_fact:
|
|
etcd_proxy_member_name: |-
|
|
{% for host in groups['k8s-cluster'] %}
|
|
{% if inventory_hostname == host %}{{"etcd-proxy"+loop.index|string }}{% endif %}
|
|
{% endfor %}
|
|
- set_fact:
|
|
is_etcd_proxy: "{{ inventory_hostname in groups['k8s-cluster'] }}"
|
|
- set_fact:
|
|
is_etcd_master: "{{ inventory_hostname in groups['etcd'] }}"
|
|
- set_fact:
|
|
etcd_after_v3: etcd_version | version_compare("v3.0.0", ">=")
|
|
- set_fact:
|
|
etcd_container_bin_dir: "{% if etcd_after_v3 %}/usr/local/bin/{% else %}/{% endif %}"
|