From cb848fa7cb4c4e4599e344d746e263a1016a1b42 Mon Sep 17 00:00:00 2001
From: jandres - moscardo <titansmc@gmail.com>
Date: Tue, 12 Dec 2023 14:51:26 +0100
Subject: [PATCH] New PR default node selector (#10607)
---
docs/hardening.md | 5 +++++
roles/kubernetes/control-plane/defaults/main/main.yml | 2 ++
roles/kubernetes/control-plane/tasks/kubeadm-setup.yml | 9 +++++++++
.../control-plane/templates/podnodeselector.yaml.j2 | 2 ++
4 files changed, 18 insertions(+)
create mode 100644 roles/kubernetes/control-plane/templates/podnodeselector.yaml.j2
diff --git a/docs/hardening.md b/docs/hardening.md
index b485c036c..77a010047 100644
--- a/docs/hardening.md
+++ b/docs/hardening.md
@@ -54,6 +54,11 @@ kube_apiserver_enable_admission_plugins:
- PodNodeSelector
- PodSecurity
kube_apiserver_admission_control_config_file: true
+# Creates config file for PodNodeSelector
+# kube_apiserver_admission_plugins_needs_configuration: [PodNodeSelector]
+# Define the default node selector, by default all the workloads will be scheduled on nodes
+# with label network=srv1
+# kube_apiserver_admission_plugins_podnodeselector_default_node_selector: "network=srv1"
# EventRateLimit plugin configuration
kube_apiserver_admission_event_rate_limits:
limit_1:
diff --git a/roles/kubernetes/control-plane/defaults/main/main.yml b/roles/kubernetes/control-plane/defaults/main/main.yml
index 22f4886cb..195038170 100644
--- a/roles/kubernetes/control-plane/defaults/main/main.yml
+++ b/roles/kubernetes/control-plane/defaults/main/main.yml
@@ -141,6 +141,8 @@ kube_webhook_token_auth_url_skip_tls_verify: false
kube_webhook_authorization: false
kube_webhook_authorization_url_skip_tls_verify: false
+# Default podnodeselector
+kube_apiserver_admission_plugins_podnodeselector_default_node_selector: ""
## Variables for OpenID Connect Configuration https://kubernetes.io/docs/admin/authentication/
## To use OpenID you have to deploy additional an OpenID Provider (e.g Dex, Keycloak, ...)
diff --git a/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml b/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml
index 57baf411a..dbc38ad81 100644
--- a/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml
+++ b/roles/kubernetes/control-plane/tasks/kubeadm-setup.yml
@@ -108,6 +108,15 @@
- item in kube_apiserver_admission_plugins_needs_configuration
loop: "{{ kube_apiserver_enable_admission_plugins }}"
+- name: Kubeadm | Configure default cluster podnodeslector
+ template:
+ src: "podnodeselector.yaml.j2"
+ dest: "{{ kube_config_dir }}/admission-controls/podnodeselector.yaml"
+ mode: 0640
+ when:
+ - kube_apiserver_admission_plugins_podnodeselector_default_node_selector is defined
+ - kube_apiserver_admission_plugins_podnodeselector_default_node_selector | length > 0
+
- name: Kubeadm | Check apiserver.crt SANs
vars:
apiserver_ips: "{{ apiserver_sans | map('ansible.utils.ipaddr') | reject('equalto', False) | list }}"
diff --git a/roles/kubernetes/control-plane/templates/podnodeselector.yaml.j2 b/roles/kubernetes/control-plane/templates/podnodeselector.yaml.j2
new file mode 100644
index 000000000..a44457f37
--- /dev/null
+++ b/roles/kubernetes/control-plane/templates/podnodeselector.yaml.j2
@@ -0,0 +1,2 @@
+podNodeSelectorPluginConfig:
+ clusterDefaultNodeSelector: {{ kube_apiserver_admission_plugins_podnodeselector_default_node_selector }}
--
GitLab