d6fd0d2aca
* Download to delegate and sync files when download_run_once * Fail on error after saving container image * Do not set changed status when downloaded container was up to date * Only sync containers when they are actually required Previously, non-required images (pull_required=false as image existed on target host) were synced to the target hosts. This failed as the image was not downloaded to the download_delegate and hence was not available for syncing. * Sync containers when only missing on some hosts * Consider images with multiple repo tags * Enable kubeadm images pull/syncing with download_delegate * Use kubeadm images list to pull/sync 'kubeadm config images pull' is replaced by collecting the images list with 'kubeadm config images list' and using the commonly used method of pull/syncing the images. * Ensure containers are downloaded and synced for all hosts * Fix download/syncing when download_delegate is a kubernetes host
78 lines
2.1 KiB
YAML
78 lines
2.1 KiB
YAML
---
|
|
- import_tasks: pre-upgrade.yml
|
|
tags:
|
|
- k8s-pre-upgrade
|
|
|
|
- import_tasks: users-file.yml
|
|
when:
|
|
- kube_basic_auth|default(true)
|
|
|
|
- name: Create webhook token auth config
|
|
template:
|
|
src: webhook-token-auth-config.yaml.j2
|
|
dest: "{{ kube_config_dir }}/webhook-token-auth-config.yaml"
|
|
when: kube_webhook_token_auth|default(false)
|
|
|
|
- import_tasks: encrypt-at-rest.yml
|
|
when:
|
|
- kube_encrypt_secret_data
|
|
|
|
- name: Install | Copy kubectl binary from download dir
|
|
synchronize:
|
|
src: "{{ local_release_dir }}/hyperkube-{{ kube_version }}-{{ image_arch }}"
|
|
dest: "{{ bin_dir }}/kubectl"
|
|
compress: no
|
|
perms: yes
|
|
owner: no
|
|
group: no
|
|
changed_when: false
|
|
delegate_to: "{{ inventory_hostname }}"
|
|
tags:
|
|
- hyperkube
|
|
- kubectl
|
|
- upgrade
|
|
|
|
- name: install | Set kubectl binary permissions
|
|
file:
|
|
path: "{{ bin_dir }}/kubectl"
|
|
mode: "0755"
|
|
state: file
|
|
tags:
|
|
- hyperkube
|
|
- kubectl
|
|
- upgrade
|
|
|
|
- name: Make sure bash_completion.d folder exists
|
|
file:
|
|
name: "/etc/bash_completion.d/"
|
|
state: directory
|
|
when: ansible_os_family in ["ClearLinux"]
|
|
tags:
|
|
- kubectl
|
|
|
|
- name: Install kubectl bash completion
|
|
shell: "{{ bin_dir }}/kubectl completion bash >/etc/bash_completion.d/kubectl.sh"
|
|
when: ansible_os_family in ["Debian","RedHat"]
|
|
tags:
|
|
- kubectl
|
|
|
|
- name: Set kubectl bash completion file
|
|
file:
|
|
path: /etc/bash_completion.d/kubectl.sh
|
|
owner: root
|
|
group: root
|
|
mode: 0755
|
|
when: ansible_os_family in ["Debian","RedHat"]
|
|
tags:
|
|
- kubectl
|
|
- upgrade
|
|
|
|
- name: Disable SecurityContextDeny admission-controller and enable PodSecurityPolicy
|
|
set_fact:
|
|
kube_apiserver_admission_control: "{{ kube_apiserver_admission_control | default([]) | difference(['SecurityContextDeny']) | union(['PodSecurityPolicy']) | unique }}"
|
|
kube_apiserver_enable_admission_plugins: "{{ kube_apiserver_enable_admission_plugins | difference(['SecurityContextDeny']) | union(['PodSecurityPolicy']) | unique }}"
|
|
when: podsecuritypolicy_enabled
|
|
|
|
- name: Include kubeadm setup
|
|
import_tasks: kubeadm-setup.yml
|