aefe4a99d2
In order to enable offline/intranet installation cases: * Move DNS/resolvconf configuration to preinstall role. Remove skip_dnsmasq_k8s var as not needed anymore. * Preconfigure DNS stack early, which may be the case when downloading artifacts from intranet repositories. Do not configure K8s DNS resolvers for hosts /etc/resolv.conf yet early (as they may be not existing). * Reconfigure K8s DNS resolvers for hosts only after kubedns/dnsmasq was set up and before K8s apps to be created. * Move docker install task to early stage as well and unbind it from the etcd role's specific install path. Fix external flannel dependency on docker role handlers. Also fix the docker restart handlers' steps ordering to match the expected sequence (the socket then the service). * Add default resolver fact, which is the cloud provider specific and remove hardcoded GCE resolver. * Reduce default ndots for hosts /etc/resolv.conf to 2. Multiple search domains combined with high ndots values lead to poor performance of DNS stack and make ansible workers to fail very often with the "Timeout (12s) waiting for privilege escalation prompt:" error. * Update docs. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
165 lines
6.1 KiB
YAML
165 lines
6.1 KiB
YAML
# Valid bootstrap options (required): ubuntu, coreos, none
|
|
bootstrap_os: none
|
|
|
|
# Directory where the binaries will be installed
|
|
bin_dir: /usr/local/bin
|
|
|
|
# Where the binaries will be downloaded.
|
|
# Note: ensure that you've enough disk space (about 1G)
|
|
local_release_dir: "/tmp/releases"
|
|
# Random shifts for retrying failed ops like pushing/downloading
|
|
retry_stagger: 5
|
|
|
|
# Uncomment this line for CoreOS only.
|
|
# Directory where python binary is installed
|
|
# ansible_python_interpreter: "/opt/bin/python"
|
|
|
|
# This is the group that the cert creation scripts chgrp the
|
|
# cert files to. Not really changable...
|
|
kube_cert_group: kube-cert
|
|
|
|
# Cluster Loglevel configuration
|
|
kube_log_level: 2
|
|
|
|
# Users to create for basic auth in Kubernetes API via HTTP
|
|
kube_api_pwd: "changeme"
|
|
kube_users:
|
|
kube:
|
|
pass: "{{kube_api_pwd}}"
|
|
role: admin
|
|
root:
|
|
pass: "changeme"
|
|
role: admin
|
|
|
|
# Kubernetes cluster name, also will be used as DNS domain
|
|
cluster_name: cluster.local
|
|
# Subdomains of DNS domain to be resolved via /etc/resolv.conf for hostnet pods
|
|
ndots: 2
|
|
# Deploy netchecker app to verify DNS resolve as an HTTP service
|
|
deploy_netchecker: false
|
|
|
|
# For some environments, each node has a pubilcally accessible
|
|
# address and an address it should bind services to. These are
|
|
# really inventory level variables, but described here for consistency.
|
|
#
|
|
# When advertising access, the access_ip will be used, but will defer to
|
|
# ip and then the default ansible ip when unspecified.
|
|
#
|
|
# When binding to restrict access, the ip variable will be used, but will
|
|
# defer to the default ansible ip when unspecified.
|
|
#
|
|
# The ip variable is used for specific address binding, e.g. listen address
|
|
# for etcd. This is use to help with environments like Vagrant or multi-nic
|
|
# systems where one address should be preferred over another.
|
|
# ip: 10.2.2.2
|
|
#
|
|
# The access_ip variable is used to define how other nodes should access
|
|
# the node. This is used in flannel to allow other flannel nodes to see
|
|
# this node for example. The access_ip is really useful AWS and Google
|
|
# environments where the nodes are accessed remotely by the "public" ip,
|
|
# but don't know about that address themselves.
|
|
# access_ip: 1.1.1.1
|
|
|
|
# Etcd access modes:
|
|
# Enable multiaccess to configure clients to access all of the etcd members directly
|
|
# as the "http://hostX:port, http://hostY:port, ..." and ignore the proxy loadbalancers.
|
|
# This may be the case if clients support and loadbalance multiple etcd servers natively.
|
|
etcd_multiaccess: true
|
|
|
|
# Assume there are no internal loadbalancers for apiservers exist and listen on
|
|
# kube_apiserver_port (default 443)
|
|
loadbalancer_apiserver_localhost: true
|
|
|
|
# Choose network plugin (calico, weave or flannel)
|
|
kube_network_plugin: flannel
|
|
|
|
# Kubernetes internal network for services, unused block of space.
|
|
kube_service_addresses: 10.233.0.0/18
|
|
|
|
# internal network. When used, it will assign IP
|
|
# addresses from this range to individual pods.
|
|
# This network must be unused in your network infrastructure!
|
|
kube_pods_subnet: 10.233.64.0/18
|
|
|
|
# internal network total size (optional). This is the prefix of the
|
|
# entire network. Must be unused in your environment.
|
|
# kube_network_prefix: 18
|
|
|
|
# internal network node size allocation (optional). This is the size allocated
|
|
# to each node on your network. With these defaults you should have
|
|
# room for 4096 nodes with 254 pods per node.
|
|
kube_network_node_prefix: 24
|
|
|
|
# With calico it is possible to distributed routes with border routers of the datacenter.
|
|
peer_with_router: false
|
|
# Warning : enabling router peering will disable calico's default behavior ('node mesh').
|
|
# The subnets of each nodes will be distributed by the datacenter router
|
|
|
|
# The port the API Server will be listening on.
|
|
kube_apiserver_ip: "{{ kube_service_addresses|ipaddr('net')|ipaddr(1)|ipaddr('address') }}"
|
|
kube_apiserver_port: 443 # (https)
|
|
kube_apiserver_insecure_port: 8080 # (http)
|
|
|
|
# Internal DNS configuration.
|
|
# Kubernetes can create and mainatain its own DNS server to resolve service names
|
|
# into appropriate IP addresses. It's highly advisable to run such DNS server,
|
|
# as it greatly simplifies configuration of your applications - you can use
|
|
# service names instead of magic environment variables.
|
|
# You still must manually configure all your containers to use this DNS server,
|
|
# Kubernetes won't do this for you (yet).
|
|
|
|
# Do not install additional dnsmasq
|
|
skip_dnsmasq: false
|
|
# Upstream dns servers used by dnsmasq
|
|
#upstream_dns_servers:
|
|
# - 8.8.8.8
|
|
# - 8.8.4.4
|
|
#
|
|
# # Use dns server : https://github.com/ansibl8s/k8s-skydns/blob/master/skydns-README.md
|
|
dns_setup: true
|
|
dns_domain: "{{ cluster_name }}"
|
|
#
|
|
# # Ip address of the kubernetes skydns service
|
|
skydns_server: "{{ kube_service_addresses|ipaddr('net')|ipaddr(3)|ipaddr('address') }}"
|
|
dns_server: "{{ kube_service_addresses|ipaddr('net')|ipaddr(2)|ipaddr('address') }}"
|
|
|
|
# There are some changes specific to the cloud providers
|
|
# for instance we need to encapsulate packets with some network plugins
|
|
# If set the possible values are either 'gce', 'aws', 'azure' or 'openstack'
|
|
# When openstack is used make sure to source in the openstack credentials
|
|
# like you would do when using nova-client before starting the playbook.
|
|
# When azure is used, you need to also set the following variables.
|
|
# cloud_provider:
|
|
|
|
# see docs/azure.md for details on how to get these values
|
|
#azure_tenant_id:
|
|
#azure_subscription_id:
|
|
#azure_aad_client_id:
|
|
#azure_aad_client_secret:
|
|
#azure_resource_group:
|
|
#azure_location:
|
|
#azure_subnet_name:
|
|
#azure_security_group_name:
|
|
#azure_vnet_name:
|
|
|
|
|
|
## Set these proxy values in order to update docker daemon to use proxies
|
|
# http_proxy: ""
|
|
# https_proxy: ""
|
|
# no_proxy: ""
|
|
|
|
# Path used to store Docker data
|
|
docker_daemon_graph: "/var/lib/docker"
|
|
|
|
## A string of extra options to pass to the docker daemon.
|
|
## This string should be exactly as you wish it to appear.
|
|
## An obvious use case is allowing insecure-registry access
|
|
## to self hosted registries like so:
|
|
docker_options: "--insecure-registry={{ kube_service_addresses }} --graph={{ docker_daemon_graph }}"
|
|
|
|
# K8s image pull policy (imagePullPolicy)
|
|
k8s_image_pull_policy: IfNotPresent
|
|
|
|
# default packages to install within the cluster
|
|
kpm_packages: []
|
|
# - name: kube-system/grafana
|