Skip to content
Snippets Groups Projects
Commit 9c86da14 authored by Aivars Sterns's avatar Aivars Sterns Committed by Matthew Mosesohn
Browse files

Normalize tags in all places to prepare for tag fixing in future (#1739)

parent cb611b5e
No related branches found
No related tags found
No related merge requests found
Showing
with 146 additions and 61 deletions
......@@ -3,7 +3,8 @@
raw: stat /opt/bin/.bootstrapped
register: need_bootstrap
failed_when: false
tags: facts
tags:
- facts
- name: Bootstrap | Run bootstrap.sh
script: bootstrap.sh
......@@ -11,7 +12,8 @@
- set_fact:
ansible_python_interpreter: "/opt/bin/python"
tags: facts
tags:
- facts
- name: Bootstrap | Check if we need to install pip
shell: "{{ansible_python_interpreter}} -m pip --version"
......@@ -20,7 +22,8 @@
changed_when: false
check_mode: no
when: need_bootstrap.rc != 0
tags: facts
tags:
- facts
- name: Bootstrap | Copy get-pip.py
copy:
......
......@@ -8,7 +8,8 @@
with_items:
- python
- pip
tags: facts
tags:
- facts
- name: Bootstrap | Install python 2.x and pip
raw:
......@@ -19,4 +20,5 @@
- set_fact:
ansible_python_interpreter: "/usr/bin/python"
tags: facts
tags:
- facts
......@@ -3,4 +3,6 @@ dependencies:
- role: download
file: "{{ downloads.dnsmasq }}"
when: dns_mode == 'dnsmasq_kubedns' and download_localhost|default(false)
tags: [download, dnsmasq]
tags:
- download
- dnsmasq
......@@ -3,13 +3,15 @@
file:
path: /etc/dnsmasq.d
state: directory
tags: bootstrap-os
tags:
- bootstrap-os
- name: ensure dnsmasq.d-available directory exists
file:
path: /etc/dnsmasq.d-available
state: directory
tags: bootstrap-os
tags:
- bootstrap-os
- name: check system nameservers
shell: awk '/^nameserver/ {print $NF}' /etc/resolv.conf
......
......@@ -12,11 +12,13 @@
paths:
- ../vars
skip: true
tags: facts
tags:
- facts
- include: set_facts_dns.yml
when: dns_mode != 'none' and resolvconf_mode == 'docker_dns'
tags: facts
tags:
- facts
- name: check for minimum kernel version
fail:
......@@ -25,7 +27,8 @@
{{ docker_kernel_min_version }} on
{{ ansible_distribution }}-{{ ansible_distribution_version }}
when: (not ansible_os_family in ["CoreOS", "Container Linux by CoreOS"]) and (ansible_kernel|version_compare(docker_kernel_min_version, "<"))
tags: facts
tags:
- facts
- name: ensure docker repository public key is installed
action: "{{ docker_repo_key_info.pkg_key }}"
......
......@@ -7,7 +7,8 @@
when:
- download.enabled|bool
- not download.container|bool
tags: bootstrap-os
tags:
- bootstrap-os
- name: file_download | Download item
get_url:
......@@ -50,7 +51,8 @@
- set_fact:
download_delegate: "{% if download_localhost|bool %}localhost{% else %}{{groups['kube-master'][0]}}{% endif %}"
run_once: true
tags: facts
tags:
- facts
- name: container_download | Create dest directory for saved/loaded container images
file:
......@@ -62,7 +64,8 @@
when:
- download.enabled|bool
- download.container|bool
tags: bootstrap-os
tags:
- bootstrap-os
# This is required for the download_localhost delegate to work smooth with Container Linux by CoreOS cluster nodes
- name: container_download | Hack python binary path for localhost
......@@ -70,7 +73,8 @@
delegate_to: localhost
when: download_delegate == 'localhost'
failed_when: false
tags: localhost
tags:
- localhost
- name: container_download | create local directory for saved/loaded container images
file:
......@@ -85,7 +89,8 @@
- download.enabled|bool
- download.container|bool
- download_delegate == 'localhost'
tags: localhost
tags:
- localhost
- name: container_download | Make download decision if pull is required by tag or sha256
include: set_docker_image_facts.yml
......@@ -94,7 +99,8 @@
- download.container|bool
delegate_to: "{{ download_delegate if download_run_once|bool or omit }}"
run_once: "{{ download_run_once|bool }}"
tags: facts
tags:
- facts
- name: container_download | Download containers if pull is required or told to always pull
command: "{{ docker_bin_dir }}/docker pull {{ pull_args }}"
......@@ -112,7 +118,8 @@
- set_fact:
fname: "{{local_release_dir}}/containers/{{download.repo|regex_replace('/|\0|:', '_')}}:{{download.tag|default(download.sha256)|regex_replace('/|\0|:', '_')}}.tar"
run_once: true
tags: facts
tags:
- facts
- name: "container_download | Set default value for 'container_changed' to false"
set_fact:
......@@ -126,7 +133,8 @@
- download.container|bool
- pull_required|bool|default(download_always_pull)
run_once: "{{ download_run_once|bool }}"
tags: facts
tags:
- facts
- name: container_download | Stat saved container image
stat:
......@@ -140,7 +148,8 @@
delegate_to: "{{ download_delegate }}"
become: false
run_once: true
tags: facts
tags:
- facts
- name: container_download | save container images
shell: "{{ docker_bin_dir }}/docker save {{ pull_args }} | gzip -{{ download_compress }} > {{ fname }}"
......@@ -188,7 +197,9 @@
- download_run_once|bool
- download.enabled|bool
- download.container|bool
tags: [upload, upgrade]
tags:
- upload
- upgrade
- name: container_download | load container images
shell: "{{ docker_bin_dir }}/docker load < {{ fname }}"
......@@ -198,4 +209,6 @@
- download_run_once|bool
- download.enabled|bool
- download.container|bool
tags: [upload, upgrade]
tags:
- upload
- upgrade
......@@ -3,8 +3,10 @@ dependencies:
- role: adduser
user: "{{ addusers.etcd }}"
when: not (ansible_os_family in ['CoreOS', 'Container Linux by CoreOS'] or is_atomic)
- role: download
file: "{{ downloads.etcd }}"
tags: download
tags:
- download
# NOTE: Dynamic task dependency on Vault Role if cert_management == "vault"
......@@ -6,7 +6,8 @@
changed_when: false
check_mode: no
when: is_etcd_master
tags: facts
tags:
- facts
- name: Configure | Add member to the cluster if it is not there
when: is_etcd_master and etcd_member_in_cluster.rc != 0 and etcd_cluster_is_healthy.rc == 0
......
......@@ -83,7 +83,8 @@
'node-{{ node }}-key.pem',
{% endfor %}]"
my_node_certs: ['ca.pem', 'node-{{ inventory_hostname }}.pem', 'node-{{ inventory_hostname }}-key.pem']
tags: facts
tags:
- facts
- name: Gen_certs | Gather etcd master certs
shell: "tar cfz - -C {{ etcd_cert_dir }} -T /dev/stdin <<< {{ my_master_certs|join(' ') }} {{ all_node_certs|join(' ') }} | base64 --wrap=0"
......
---
- include: sync_etcd_master_certs.yml
when: inventory_hostname in groups.etcd
tags: etcd-secrets
tags:
- etcd-secrets
- include: sync_etcd_node_certs.yml
when: inventory_hostname in etcd_node_cert_hosts
tags: etcd-secrets
tags:
- etcd-secrets
# Issue master certs to Etcd nodes
- include: ../../vault/tasks/shared/issue_cert.yml
......
---
- include: check_certs.yml
when: cert_management == "script"
tags: [etcd-secrets, facts]
tags:
- etcd-secrets
- facts
- include: "gen_certs_{{ cert_management }}.yml"
tags: etcd-secrets
tags:
- etcd-secrets
- include: upd_ca_trust.yml
tags: etcd-secrets
tags:
- etcd-secrets
- name: "Gen_certs | Get etcd certificate serials"
shell: "openssl x509 -in {{ etcd_cert_dir }}/node-{{ inventory_hostname }}.pem -noout -serial | cut -d= -f2"
......@@ -16,7 +20,8 @@
- include: "install_{{ etcd_deployment_type }}.yml"
when: is_etcd_master
tags: upgrade
tags:
- upgrade
- include: set_cluster_health.yml
when: is_etcd_master and etcd_cluster_setup
......
......@@ -6,4 +6,5 @@
changed_when: false
check_mode: no
when: is_etcd_master
tags: facts
tags:
- facts
......@@ -9,7 +9,8 @@
{%- elif ansible_os_family in ["CoreOS", "Container Linux by CoreOS"] -%}
/etc/ssl/certs/etcd-ca.pem
{%- endif %}
tags: facts
tags:
- facts
- name: Gen_certs | add CA to trusted CA dir
copy:
......
......@@ -16,7 +16,8 @@
resource: "{{ item }}"
state: absent
with_items: ['deploy', 'svc']
tags: upgrade
tags:
- upgrade
- name: Kubernetes Apps | Delete kubeadm kubedns
kube:
......@@ -46,7 +47,8 @@
when:
- dns_mode != 'none' and inventory_hostname == groups['kube-master'][0]
- rbac_enabled or item.type not in rbac_resources
tags: dnsmasq
tags:
- dnsmasq
# see https://github.com/kubernetes/kubernetes/issues/45084, only needed for "old" kube-dns
- name: Kubernetes Apps | Patch system:kube-dns ClusterRole
......@@ -64,7 +66,8 @@
when:
- dns_mode != 'none' and inventory_hostname == groups['kube-master'][0]
- rbac_enabled and kubedns_version|version_compare("1.11.0", "<", strict=True)
tags: dnsmasq
tags:
- dnsmasq
- name: Kubernetes Apps | Start Resources
kube:
......@@ -79,14 +82,17 @@
- dns_mode != 'none'
- inventory_hostname == groups['kube-master'][0]
- not item|skipped
tags: dnsmasq
tags:
- dnsmasq
- name: Kubernetes Apps | Netchecker
include: tasks/netchecker.yml
when: deploy_netchecker
tags: netchecker
tags:
- netchecker
- name: Kubernetes Apps | Dashboard
include: tasks/dashboard.yml
when: dashboard_enabled
tags: dashboard
tags:
- dashboard
......@@ -4,7 +4,9 @@
stat:
path: "{{ kube_config_dir }}/netchecker-server-deployment.yml.j2"
register: netchecker_server_manifest
tags: ['facts', 'upgrade']
tags:
- facts
- upgrade
- name: Kubernetes Apps | Apply netchecker-server manifest to update annotations
kube:
......@@ -15,7 +17,8 @@
resource: "deploy"
state: latest
when: inventory_hostname == groups['kube-master'][0] and netchecker_server_manifest.stat.exists
tags: upgrade
tags:
- upgrade
- name: Kubernetes Apps | Lay Down Netchecker Template
template:
......
......@@ -3,16 +3,34 @@ dependencies:
- role: download
file: "{{ downloads.netcheck_server }}"
when: deploy_netchecker
tags: [download, netchecker]
tags:
- download
- netchecker
- role: download
file: "{{ downloads.netcheck_agent }}"
when: deploy_netchecker
tags: [download, netchecker]
- {role: kubernetes-apps/ansible, tags: apps}
- {role: kubernetes-apps/kpm, tags: [apps, kpm]}
tags:
- download
- netchecker
- role: kubernetes-apps/ansible
tags:
- apps
- role: kubernetes-apps/kpm
tags:
- apps
- kpm
- role: kubernetes-apps/efk
when: efk_enabled
tags: [ apps, efk ]
tags:
- apps
- efk
- role: kubernetes-apps/helm
when: helm_enabled
tags: [ apps, helm ]
tags:
- apps
- helm
......@@ -2,13 +2,20 @@
dependencies:
- role: kubernetes-apps/network_plugin/calico
when: kube_network_plugin == 'calico'
tags: calico
tags:
- calico
- role: kubernetes-apps/network_plugin/canal
when: kube_network_plugin == 'canal'
tags: canal
tags:
- canal
- role: kubernetes-apps/network_plugin/flannel
when: kube_network_plugin == 'flannel'
tags: flannel
tags:
- flannel
- role: kubernetes-apps/network_plugin/weave
when: kube_network_plugin == 'weave'
tags: weave
tags:
- weave
......@@ -3,7 +3,9 @@
set_fact:
calico_cert_dir: "{{ canal_cert_dir }}"
when: kube_network_plugin == 'canal'
tags: [facts, canal]
tags:
- facts
- canal
- name: Get calico-policy-controller version if running
shell: "{{ bin_dir }}/kubectl -n {{ system_namespace }} get rs calico-policy-controller -o=jsonpath='{$.spec.template.spec.containers[:1].image}' | cut -d':' -f2"
......
......@@ -2,13 +2,23 @@
dependencies:
- role: download
file: "{{ downloads.calico_policy }}"
when: enable_network_policy and
kube_network_plugin in ['calico', 'canal']
tags: [download, canal, policy-controller]
when:
- enable_network_policy
- kube_network_plugin in ['calico', 'canal']
tags:
- download
- canal
- policy-controller
- role: policy_controller/calico
when: kube_network_plugin == 'calico' and
enable_network_policy
tags: policy-controller
when:
- kube_network_plugin == 'calico'
- enable_network_policy
tags:
- policy-controller
- role: policy_controller/calico
when: kube_network_plugin == 'canal'
tags: policy-controller
when:
- kube_network_plugin == 'canal'
tags:
- policy-controller
......@@ -11,7 +11,8 @@
{%- else -%}
https://{{ first_kube_master }}:{{ kube_apiserver_port }}
{%- endif -%}
tags: facts
tags:
- facts
- name: Gather certs for admin kubeconfig
slurp:
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment