cb2e5ac776
* Drop linux capabilities for unprivileged containerized worlkoads Kargo configures for deployments. * Configure required securityContext/user/group/groups for kube components' static manifests, etcd, calico-rr and k8s apps, like dnsmasq daemonset. * Rework cloud-init (etcd) users creation for CoreOS. * Fix nologin paths, adjust defaults for addusers role and ensure supplementary groups membership added for users. * Add netplug user for network plugins (yet unused by privileged networking containers though). * Grant the kube and netplug users read access for etcd certs via the etcd certs group. * Grant group read access to kube certs via the kube cert group. * Remove priveleged mode for calico-rr and run it under its uid/gid and supplementary etcd_cert group. * Adjust docs. * Align cpu/memory limits and dropped caps with added rkt support for control plane. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
41 lines
1 KiB
YAML
41 lines
1 KiB
YAML
---
|
|
- set_fact:
|
|
standalone_kubelet: >-
|
|
{%- if inventory_hostname in groups['kube-master'] and inventory_hostname not in groups['kube-node'] -%}true{%- else -%}false{%- endif -%}
|
|
tags: facts
|
|
|
|
- include: pre-upgrade.yml
|
|
tags: k8s-pre-upgrade
|
|
|
|
- include: install.yml
|
|
tags: kubelet
|
|
|
|
- include: nginx-proxy.yml
|
|
when: is_kube_master == false and loadbalancer_apiserver_localhost|default(false)
|
|
tags: nginx
|
|
|
|
- name: Write kubelet config file
|
|
template: src=kubelet.j2 dest={{ kube_config_dir }}/kubelet.env backup=yes
|
|
notify: restart kubelet
|
|
tags: kubelet
|
|
|
|
- name: write the kubecfg (auth) file for kubelet
|
|
template: src=node-kubeconfig.yaml.j2 dest={{ kube_config_dir }}/node-kubeconfig.yaml backup=yes
|
|
notify: restart kubelet
|
|
tags: kubelet
|
|
|
|
- name: Write proxy manifest
|
|
template:
|
|
src: manifests/kube-proxy.manifest.j2
|
|
dest: "{{ kube_manifest_dir }}/kube-proxy.manifest"
|
|
tags: kube-proxy
|
|
|
|
# reload-systemd
|
|
- meta: flush_handlers
|
|
|
|
- name: Enable kubelet
|
|
service:
|
|
name: kubelet
|
|
enabled: yes
|
|
state: started
|
|
tags: kubelet
|