32cd6e99b2
* Enforce a etcd-proxy role to a k8s-cluster group members. This provides an HA layout for all of the k8s cluster internal clients. * Proxies to be run on each node in the group as a separate etcd instances with a readwrite proxy mode and listen the given endpoint, which is either the access_ip:2379 or the localhost:2379. * A notion for the 'kube_etcd_multiaccess' is: ignore endpoints and loadbalancers and use the etcd members IPs as a comma-separated list. Otherwise, clients shall use the local endpoint provided by a etcd-proxy instances on each etcd node. A Netwroking plugins always use that access mode. * Fix apiserver's etcd servers args to use the etcd_access_endpoint. * Fix networking plugins flannel/calico to use the etcd_endpoint. * Fix name env var for non masters to be set as well. * Fix etcd_client_url was not used anywhere and other etcd_* facts evaluation was duplicated in a few places. * Define proxy modes only in the env file, if not a master. Del an automatic proxy mode decisions for etcd nodes in init/unit scripts. * Use Wants= instead of Requires= as "This is the recommended way to hook start-up of one unit to the start-up of another unit" * Make apiserver/calico Wants= etcd-proxy to keep it always up Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com> Co-authored-by: Matthew Mosesohn <mmosesohn@mirantis.com>
59 lines
2.6 KiB
Django/Jinja
59 lines
2.6 KiB
Django/Jinja
###
|
|
# kubernetes system config
|
|
#
|
|
# The following values are used to configure the kube-apiserver
|
|
|
|
{% if ansible_service_mgr in ["sysvinit","upstart"] %}
|
|
# Logging directory
|
|
KUBE_LOGGING="--log-dir={{ kube_log_dir }} --logtostderr=true"
|
|
{% else %}
|
|
# logging to stderr means we get it in the systemd journal
|
|
KUBE_LOGGING="--logtostderr=true"
|
|
{% endif %}
|
|
|
|
# Apiserver Log level, 0 is debug
|
|
KUBE_LOG_LEVEL="--v={{ kube_log_level | default('2') }}"
|
|
|
|
# Should this cluster be allowed to run privileged docker containers
|
|
KUBE_ALLOW_PRIV="--allow_privileged=true"
|
|
|
|
# The port on the local server to listen on.
|
|
KUBE_API_PORT="--insecure-port={{kube_apiserver_insecure_port}} --secure-port={{ kube_apiserver_port }}"
|
|
|
|
# Insecure API address (default is localhost)
|
|
KUBE_API_INSECURE_BIND="--insecure-bind-address={{ kube_apiserver_insecure_bind_address | default('127.0.0.1') }}"
|
|
|
|
# Address range to use for services
|
|
KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range={{ kube_service_addresses }}"
|
|
|
|
# Location of the etcd cluster
|
|
KUBE_ETCD_SERVERS="--etcd_servers={{ etcd_access_endpoint }}"
|
|
|
|
# Bind address for secure endpoint
|
|
KUBE_API_ADDRESS="--bind-address={{ ip | default(ansible_default_ipv4.address) }}"
|
|
|
|
# default admission control policies
|
|
KUBE_ADMISSION_CONTROL="--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,ResourceQuota"
|
|
|
|
# RUNTIME API CONFIGURATION (e.g. enable extensions)
|
|
KUBE_RUNTIME_CONFIG="{% if kube_api_runtime_config is defined %}{% for conf in kube_api_runtime_config %}--runtime-config={{ conf }} {% endfor %}{% endif %}"
|
|
|
|
# TLS CONFIGURATION
|
|
KUBE_TLS_CONFIG="--tls_cert_file={{ kube_cert_dir }}/apiserver.pem --tls_private_key_file={{ kube_cert_dir }}/apiserver-key.pem --client_ca_file={{ kube_cert_dir }}/ca.pem"
|
|
|
|
# Add you own!
|
|
KUBE_API_ARGS="--token_auth_file={{ kube_token_dir }}/known_tokens.csv --basic-auth-file={{ kube_users_dir }}/known_users.csv --service_account_key_file={{ kube_cert_dir }}/apiserver-key.pem --advertise-address={{ ip | default(ansible_default_ipv4.address) }}"
|
|
|
|
{% if cloud_provider is defined and cloud_provider == "openstack" %}
|
|
KUBELET_CLOUDPROVIDER="--cloud-provider={{ cloud_provider }} --cloud-config={{ kube_config_dir }}/cloud_config"
|
|
{% else %}
|
|
{# TODO: gce and aws don't need the cloud provider to be set? #}
|
|
KUBELET_CLOUDPROVIDER=""
|
|
{% endif %}
|
|
|
|
{% if ansible_service_mgr in ["sysvinit","upstart"] %}
|
|
DAEMON_ARGS="$KUBE_LOGGING $KUBE_LOG_LEVEL $KUBE_ALLOW_PRIV $KUBE_API_PORT $KUBE_API_INSECURE_BIND \
|
|
$KUBE_SERVICE_ADDRESSES $KUBE_ETCD_SERVERS $KUBE_ADMISSION_CONTROL $KUBE_RUNTIME_CONFIG \
|
|
$KUBE_TLS_CONFIG $KUBE_API_ARGS $KUBELET_CLOUDPROVIDER"
|
|
{% endif %}
|