diff options
Diffstat (limited to 'roles/kubernetes/kubeadm/master/tasks')
6 files changed, 0 insertions, 290 deletions
diff --git a/roles/kubernetes/kubeadm/master/tasks/main.yml b/roles/kubernetes/kubeadm/master/tasks/main.yml deleted file mode 100644 index 04df760f..00000000 --- a/roles/kubernetes/kubeadm/master/tasks/main.yml +++ /dev/null @@ -1,77 +0,0 @@ ---- -- name: create direcotry for encryption config - file: - name: /etc/kubernetes/encryption - state: directory - mode: 0700 - -- name: install encryption config - template: - src: encryption-config.j2 - dest: /etc/kubernetes/encryption/config - mode: 0600 - - -- name: install primary master - include_tasks: primary-master.yml - when: "'_kubernetes_primary_master_' in group_names" - -- name: install secondary masters - include_tasks: secondary-masters.yml - when: "'_kubernetes_primary_master_' not in group_names" - - -- name: check if master is tainted (1/2) - command: "kubectl --kubeconfig /etc/kubernetes/admin.conf get node {{ inventory_hostname }} -o json" - check_mode: no - register: kubectl_get_node - changed_when: False - -- name: check if master is tainted (2/2) - set_fact: - kube_node_taints: "{% set node_info = kubectl_get_node.stdout | from_json %}{%if node_info.spec.taints is defined %}{{ node_info.spec.taints | map(attribute='key') | list }}{% endif %}" - -- name: remove taint from master/control-plane node - when: not kubernetes.dedicated_master - block: - - name: remove master taint from node - when: "'node-role.kubernetes.io/master' in kube_node_taints" - command: "kubectl --kubeconfig /etc/kubernetes/admin.conf taint nodes {{ inventory_hostname }} node-role.kubernetes.io/master-" - - - name: remove control-plane taint from node - when: "'node-role.kubernetes.io/control-plane' in kube_node_taints" - command: "kubectl --kubeconfig /etc/kubernetes/admin.conf taint nodes {{ inventory_hostname }} node-role.kubernetes.io/control-plane-" - -- name: add taint from master/control-plane node - when: kubernetes.dedicated_master - block: - - name: add master taint from node - when: "'node-role.kubernetes.io/master' not in kube_node_taints" - command: "kubectl --kubeconfig /etc/kubernetes/admin.conf taint nodes {{ inventory_hostname }} node-role.kubernetes.io/master='':NoSchedule" - - ## TODO: enable this once all needed addons and workloads have tolerations set accordingly - # - name: add control-plane taint from node - # when: "'node-role.kubernetes.io/control-plane' not in kube_node_taints" - # command: "kubectl --kubeconfig /etc/kubernetes/admin.conf taint nodes {{ inventory_hostname }} node-role.kubernetes.io/control-plane='':NoSchedule" - -- name: prepare kubectl (1/2) - file: - name: /root/.kube - state: directory - -- name: prepare kubectl (2/2) - file: - dest: /root/.kube/config - src: /etc/kubernetes/admin.conf - state: link - -- name: add kubectl completion config for shells - loop: - - zsh - - bash - blockinfile: - path: "/root/.{{ item }}rc" - create: yes - marker: "### {mark} ANSIBLE MANAGED BLOCK for kubectl ###" - content: | - source <(kubectl completion {{ item }}) diff --git a/roles/kubernetes/kubeadm/master/tasks/net_kube-router.yml b/roles/kubernetes/kubeadm/master/tasks/net_kube-router.yml deleted file mode 100644 index 0a216414..00000000 --- a/roles/kubernetes/kubeadm/master/tasks/net_kube-router.yml +++ /dev/null @@ -1,11 +0,0 @@ ---- -- name: generate kube-router configuration - template: - src: "net_kube-router/config.{{ kubernetes_network_plugin_version }}.yml.j2" - dest: /etc/kubernetes/network-plugin.yml - - ## TODO: move to server-side apply (GA since 1.22) -- name: install kube-router on to the cluster - command: kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f /etc/kubernetes/network-plugin.yml - register: kube_router_apply_result - changed_when: (kube_router_apply_result.stdout_lines | reject("regex", " unchanged$") | list | length) > 0 diff --git a/roles/kubernetes/kubeadm/master/tasks/net_kubeguard.yml b/roles/kubernetes/kubeadm/master/tasks/net_kubeguard.yml deleted file mode 100644 index a572ca89..00000000 --- a/roles/kubernetes/kubeadm/master/tasks/net_kubeguard.yml +++ /dev/null @@ -1,14 +0,0 @@ ---- -- name: install kube-router variant - when: "kubernetes_network_plugin_variant == 'with-kube-router'" - block: - - name: generate kubeguard (kube-router) configuration - template: - src: "net_kubeguard/kube-router.{{ kubernetes_network_plugin_version }}.yml.j2" - dest: /etc/kubernetes/network-plugin.yml - - ## TODO: move to server-side apply (GA since 1.22) - - name: install kubeguard (kube-router) on to the cluster - command: kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f /etc/kubernetes/network-plugin.yml - register: kubeguard_apply_result - changed_when: (kubeguard_apply_result.stdout_lines | reject("regex", " unchanged$") | list | length) > 0 diff --git a/roles/kubernetes/kubeadm/master/tasks/net_none.yml b/roles/kubernetes/kubeadm/master/tasks/net_none.yml deleted file mode 100644 index bf1a16d5..00000000 --- a/roles/kubernetes/kubeadm/master/tasks/net_none.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -## this "plugin" is for testing purposes only diff --git a/roles/kubernetes/kubeadm/master/tasks/primary-master.yml b/roles/kubernetes/kubeadm/master/tasks/primary-master.yml deleted file mode 100644 index 6fb63d09..00000000 --- a/roles/kubernetes/kubeadm/master/tasks/primary-master.yml +++ /dev/null @@ -1,131 +0,0 @@ ---- -- name: check if kubeconfig kubelet.conf already exists - stat: - path: /etc/kubernetes/kubelet.conf - register: kubeconfig_kubelet_stats - - ## TODO: switch to kubeadm config version v1beta3 (available since 1.22) -- name: generate kubeadm.config - template: - src: kubeadm.config.j2 - dest: /etc/kubernetes/kubeadm.config - register: kubeadm_config - -### cluster not yet initialized - -- name: create new cluster - when: not kubeconfig_kubelet_stats.stat.exists - block: - - #### kubeadm wants token to come from --config if --config is used - #### i think this is stupid -> TODO: send bug report - # - name: generate bootstrap token for new cluster - # command: kubeadm token generate - # changed_when: False - # check_mode: no - # register: kubeadm_token_generate - - - name: initialize kubernetes master and store log - block: - - name: initialize kubernetes master - command: "kubeadm init --config /etc/kubernetes/kubeadm.config --node-name {{ inventory_hostname }}{% if kubernetes_network_plugin_replaces_kube_proxy %} --skip-phases addon/kube-proxy{% endif %} --skip-token-print" - # command: "kubeadm init --config /etc/kubernetes/kubeadm.config --node-name {{ inventory_hostname }}{% if kubernetes_network_plugin_replaces_kube_proxy %} --skip-phases addon/kube-proxy{% endif %} --token '{{ kubeadm_token_generate.stdout }}' --token-ttl 42m --skip-token-print" - args: - creates: /etc/kubernetes/pki/ca.crt - register: kubeadm_init - - always: - - name: dump output of kubeadm init to log file - when: kubeadm_init.changed - copy: - content: "{{ kubeadm_init.stdout }}\n" - dest: /etc/kubernetes/kubeadm-init.log - - - name: dump error output of kubeadm init to log file - when: kubeadm_init.changed and kubeadm_init.stderr - copy: - content: "{{ kubeadm_init.stderr }}\n" - dest: /etc/kubernetes/kubeadm-init.errors - - - name: create bootstrap token for existing cluster - command: kubeadm token create --ttl 42m - check_mode: no - register: kubeadm_token_generate - - -### cluster is already initialized but config has changed - -- name: upgrade cluster config - when: kubeconfig_kubelet_stats.stat.exists and kubeadm_config is changed - block: - - - name: fail for cluster upgrades - fail: - msg: "upgrading cluster config is currently not supported!" - - -### cluster is already initialized - -- name: prepare cluster for new nodes - when: kubeconfig_kubelet_stats.stat.exists and kubeadm_config is not changed - block: - - - name: fetch list of current nodes - command: kubectl --kubeconfig /etc/kubernetes/admin.conf get nodes -o name - changed_when: False - check_mode: no - register: kubectl_node_list - - - name: save list of current nodes - set_fact: - kubernetes_current_nodes: "{{ kubectl_node_list.stdout_lines | map('replace', 'node/', '') | list }}" - - - name: create bootstrap token for existing cluster - when: "groups['_kubernetes_nodes_'] | difference(kubernetes_current_nodes) | length > 0" - command: kubeadm token create --ttl 42m - check_mode: no - register: kubeadm_token_create - - -## calculate certificate digest - -- name: install openssl - apt: - name: openssl - state: present - -- name: get ca certificate digest - shell: "set -o pipefail && openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'" - args: - executable: /bin/bash - check_mode: no - register: kube_ca_openssl - changed_when: False - -- name: set variables needed by kubernetes/nodes to join the cluster - set_fact: - kube_bootstrap_token: "{% if kubeadm_token_generate.stdout is defined %}{{ kubeadm_token_generate.stdout }}{% elif kubeadm_token_create.stdout is defined %}{{ kubeadm_token_create.stdout }}{% endif %}" - kube_bootstrap_ca_cert_hash: "sha256:{{ kube_ca_openssl.stdout }}" - delegate_to: "{{ item }}" - delegate_facts: True - loop: "{{ groups['_kubernetes_nodes_'] }}" - - -## install node-local-dns - -- name: generate node-local dns cache config - template: - src: node-local-dns.yml.j2 - dest: /etc/kubernetes/node-local-dns.yml - - ## TODO: move to server-side apply (GA since 1.22) -- name: install node-local dns cache - command: kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f /etc/kubernetes/node-local-dns.yml - register: kube_node_local_dns_apply_result - changed_when: (kube_node_local_dns_apply_result.stdout_lines | reject("regex", " unchanged$") | list | length) > 0 - - -## Network Plugin - -- name: install network plugin - include_tasks: "net_{{ kubernetes_network_plugin }}.yml" diff --git a/roles/kubernetes/kubeadm/master/tasks/secondary-masters.yml b/roles/kubernetes/kubeadm/master/tasks/secondary-masters.yml deleted file mode 100644 index 4759b7fd..00000000 --- a/roles/kubernetes/kubeadm/master/tasks/secondary-masters.yml +++ /dev/null @@ -1,55 +0,0 @@ ---- -- name: fetch secrets needed for secondary master - run_once: true - delegate_to: "{{ groups['_kubernetes_primary_master_'] | first }}" - block: - - - name: fetch list of current nodes - command: kubectl --kubeconfig /etc/kubernetes/admin.conf get nodes -o name - changed_when: False - check_mode: no - register: kubectl_node_list - - - name: save list of current nodes - set_fact: - kubernetes_current_nodes: "{{ kubectl_node_list.stdout_lines | map('replace', 'node/', '') | list }}" - - - name: upload certs - when: "groups['_kubernetes_masters_'] | difference(kubernetes_current_nodes) | length > 0" - command: kubeadm init phase upload-certs --upload-certs - check_mode: no - register: kubeadm_upload_certs - - -- name: extracting encryption key for certs - set_fact: - kubeadm_upload_certs_key: "{% if kubeadm_upload_certs.stdout is defined %}{{ kubeadm_upload_certs.stdout_lines | last }}{% endif %}" - -- name: join kubernetes secondary master node and store log - block: - - name: join kubernetes secondary master node - throttle: 1 - command: "kubeadm join 127.0.0.1:6443 --node-name {{ inventory_hostname }} --apiserver-bind-port 6442{% if kubernetes_overlay_node_ip is defined %} --apiserver-advertise-address {{ kubernetes_overlay_node_ip }}{% endif %} --cri-socket {{ kubernetes_cri_socket }} --token '{{ kube_bootstrap_token }}' --discovery-token-ca-cert-hash '{{ kube_bootstrap_ca_cert_hash }}' --control-plane --certificate-key {{ kubeadm_upload_certs_key }}" - args: - creates: /etc/kubernetes/kubelet.conf - register: kubeadm_join - - always: - - name: dump output of kubeadm join to log file - when: kubeadm_join is changed - # This is not a handler by design to make sure this action runs at this point of the play. - copy: # noqa 503 - content: "{{ kubeadm_join.stdout }}\n" - dest: /etc/kubernetes/kubeadm-join.log - - - name: dump error output of kubeadm join to log file - when: kubeadm_join.changed and kubeadm_join.stderr - copy: - content: "{{ kubeadm_join.stderr }}\n" - dest: /etc/kubernetes/kubeadm-join.errors - - # TODO: acutally check if node has registered -- name: give the new master(s) a moment to register - when: kubeadm_join is changed - pause: # noqa 503 - seconds: 5 |