c3f369d5b8
Generate SSL cert/key for kubelet and configure it to use those instead of generating self-signed ones. Closes #1035
53 lines
3 KiB
Django/Jinja
53 lines
3 KiB
Django/Jinja
# logging to stderr means we get it in the systemd journal
|
|
KUBE_LOGGING="--logtostderr=true"
|
|
KUBE_LOG_LEVEL="--v={{ kube_log_level }}"
|
|
# The address for the info server to serve on (set to 0.0.0.0 or "" for all interfaces)
|
|
KUBELET_ADDRESS="--address={{ ip | default("0.0.0.0") }}"
|
|
# The port for the info server to serve on
|
|
# KUBELET_PORT="--port=10250"
|
|
# You may leave this blank to use the actual hostname
|
|
KUBELET_HOSTNAME="--hostname-override={{ ansible_hostname }}"
|
|
|
|
{# Base kubelet args #}
|
|
{% set kubelet_args_base %}--pod-manifest-path={{ kube_manifest_dir }} \
|
|
--pod-infra-container-image={{ pod_infra_image_repo }}:{{ pod_infra_image_tag }} \
|
|
--kube-reserved cpu={{ kubelet_cpu_limit }},memory={{ kubelet_memory_limit|regex_replace('Mi', 'M') }} \
|
|
--tls-cert-file={{ kube_cert_dir }}/node-{{ inventory_hostname }}.pem \
|
|
--tls-private-key-file={{ kube_cert_dir }}/node-{{ inventory_hostname }}-key.pem \
|
|
--node-status-update-frequency={{ kubelet_status_update_frequency }}{% endset %}
|
|
|
|
{# DNS settings for kubelet #}
|
|
{% if dns_mode == 'kubedns' %}
|
|
{% set kubelet_args_cluster_dns %}--cluster_dns={{ skydns_server }}{% endset %}
|
|
{% elif dns_mode == 'dnsmasq_kubedns' %}
|
|
{% set kubelet_args_cluster_dns %}--cluster_dns={{ dns_server }}{% endset %}
|
|
{% else %}
|
|
{% set kubelet_args_cluster_dns %}{% endset %}
|
|
{% endif %}
|
|
{% set kubelet_args_dns %}{{ kubelet_args_cluster_dns }} --cluster_domain={{ dns_domain }} --resolv-conf={{ kube_resolv_conf }}{% endset %}
|
|
|
|
{# Location of the apiserver #}
|
|
{% set kubelet_args_kubeconfig %}--kubeconfig={{ kube_config_dir}}/node-kubeconfig.yaml --require-kubeconfig{% endset %}
|
|
{% if standalone_kubelet|bool %}
|
|
{# We are on a master-only host. Make the master unschedulable in this case. #}
|
|
{% set kubelet_args_kubeconfig %}{{ kubelet_args_kubeconfig }} --register-schedulable=false{% endset %}
|
|
{% endif %}
|
|
|
|
KUBELET_ARGS="{{ kubelet_args_base }} {{ kubelet_args_dns }} {{ kubelet_args_kubeconfig }}"
|
|
{% if kube_network_plugin is defined and kube_network_plugin in ["calico", "weave", "canal"] %}
|
|
KUBELET_NETWORK_PLUGIN="--network-plugin=cni --network-plugin-dir=/etc/cni/net.d"
|
|
{% elif kube_network_plugin is defined and kube_network_plugin == "weave" %}
|
|
DOCKER_SOCKET="--docker-endpoint=unix:/var/run/weave/weave.sock"
|
|
{% elif kube_network_plugin is defined and kube_network_plugin == "cloud" %}
|
|
# Please note that --reconcile-cidr is deprecated and a no-op in Kubernetes 1.5 but still required in 1.4
|
|
KUBELET_NETWORK_PLUGIN="--hairpin-mode=promiscuous-bridge --network-plugin=kubenet --reconcile-cidr=true"
|
|
{% endif %}
|
|
# Should this cluster be allowed to run privileged docker containers
|
|
KUBE_ALLOW_PRIV="--allow-privileged=true"
|
|
{% if cloud_provider is defined and cloud_provider in ["openstack", "azure"] %}
|
|
KUBELET_CLOUDPROVIDER="--cloud-provider={{ cloud_provider }} --cloud-config={{ kube_config_dir }}/cloud_config"
|
|
{% elif cloud_provider is defined and cloud_provider == "aws" %}
|
|
KUBELET_CLOUDPROVIDER="--cloud-provider={{ cloud_provider }}"
|
|
{% else %}
|
|
KUBELET_CLOUDPROVIDER=""
|
|
{% endif %}
|