- Dec 14, 2016
-
-
Bogdan Dobrelya authored
Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
- Dec 13, 2016
-
-
Alexander Block authored
-
Bogdan Dobrelya authored
Do not repeat options and nameservers in the dhclient hooks. Do not prepend nameservers for dhclient but supersede and fail back to the upstream_dns_resolvers then default_resolver. Fixes order of nameservers placement, which is cluster DNS ip goes always first. Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
- Dec 12, 2016
-
-
Bogdan Dobrelya authored
* For Debian/RedHat OS families (with NetworkManager/dhclient/resolvconf optionally enabled) prepend /etc/resolv.conf with required nameservers, options, and supersede domain and search domains via the dhclient/resolvconf hooks. * Drop (z)nodnsupdate dhclient hook and re-implement it to complement the resolvconf -u command, which is distro/cloud provider specific. Update docs as well. * Enable network restart to apply and persist changes and simplify handlers to rely on network restart only. This fixes DNS resolve for hostnet K8s pods for Red Hat OS family. Skip network restart for canal/calico plugins, unless https://github.com/projectcalico/felix/issues/1185 fixed. * Replace linefiles line plus with_items to block mode as it's faster. Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com> Co-authored-by:
Matthew Mosesohn <mmosesohn@mirantis.com>
-
- Dec 09, 2016
-
-
Bogdan Dobrelya authored
In order to enable offline/intranet installation cases: * Move DNS/resolvconf configuration to preinstall role. Remove skip_dnsmasq_k8s var as not needed anymore. * Preconfigure DNS stack early, which may be the case when downloading artifacts from intranet repositories. Do not configure K8s DNS resolvers for hosts /etc/resolv.conf yet early (as they may be not existing). * Reconfigure K8s DNS resolvers for hosts only after kubedns/dnsmasq was set up and before K8s apps to be created. * Move docker install task to early stage as well and unbind it from the etcd role's specific install path. Fix external flannel dependency on docker role handlers. Also fix the docker restart handlers' steps ordering to match the expected sequence (the socket then the service). * Add default resolver fact, which is the cloud provider specific and remove hardcoded GCE resolver. * Reduce default ndots for hosts /etc/resolv.conf to 2. Multiple search domains combined with high ndots values lead to poor performance of DNS stack and make ansible workers to fail very often with the "Timeout (12s) waiting for privilege escalation prompt:" error. * Update docs. Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
Bogdan Dobrelya authored
Add upload tag allow users to exclude distributing images across nodes when running with the download tag set. Add related tags and update docs as well. Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
Bogdan Dobrelya authored
Add tags to allow more granular tasks filtering. Add generator script for MD formatted tags found. Add docs for tags how-to. Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
- Dec 07, 2016
-
-
Matthew Mosesohn authored
-
Bogdan Dobrelya authored
Override GCE sysctl in /etc/sysctl.d/99-sysctl.conf instead of the /etc/sysctl.d/11-gce-network-security.conf. It is recreated by GCE, f.e. if gcloud CLI invokes some security related changes, thus losing customizations we want to be persistent. Update cloud providers firewall requirements in calico docs. Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
- Dec 06, 2016
-
-
Aleksandr Didenko authored
In new `calicoctl` version nodes peering with routers is broken. We need to use predictable node names for calico-node and the same names in calico `bgpPeer` resources and CNI.
-
- Nov 29, 2016
-
-
Bogdan Dobrelya authored
Reduce the test cases from 15 to 9, bearing in mind that: * Disable weave/coreos gate unless its deployment fixed * If debian/centos7 fails with net plugin X, ubuntu-xenial/rhel-7 will likely fail as well * Canal also covers the flannel plugin deployment, but keep at least one of the flannel plugin deployment, unless it's superseded and removed. * Keep at least one of each OS/plugin family to be tested in the separate nodes layout * Keep at least one of each OS family to be tested against each of the plugin types in default nodes layout * Rebalance GCE regions for instances, replace asia to eu/us as they are the longest running jobs. Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
Bogdan Dobrelya authored
Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
Sebastian Melchior authored
-
- Nov 28, 2016
-
-
Bogdan Dobrelya authored
* Add an option to deploy K8s app to test e2e network connectivity and cluster DNS resolve via Kubedns for nethost/simple pods (defaults to false). * Parametrize existing k8s apps templates with kube_namespace and kube_config_dir instead of hardcode. * For CoreOS, ensure nameservers from inventory to be put in the first place to allow hostnet pods connectivity via short names or FQDN and hostnet agents to pass as well, if netchecker deployed. Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
- Nov 25, 2016
-
-
Bogdan Dobrelya authored
* Add dns_replicas, dns_memory/cpu_limit/requests vars for dns related apps. * When kube_log_level=4, log dnsmasq queries as well. * Add log level control for skydns (part of kubedns app). * Add limits/requests vars for dnsmasq (part of kubedns app) and dnsmasq daemon set. * Drop string defaults for kube_log_level as it is int and is defined in the global vars as well. * Add docs Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
- Nov 24, 2016
-
-
Bogdan Dobrelya authored
When download_run_once with download_localhost is used, docker is expected to be running on the delegate localhost. That may be not the case for a non localhost delegate, which is the kube-master otherwise. Then the dnsmasq role, had it been invoked early before deployment starts, would fail because of the missing docker dependency. * Fix that dependency on docker and do not pre download dnsmasq image for the dnsmasq role, if download_localhost is disabled. * Remove become: false for docker CLI invocation because that's not the common pattern to allow users access docker CLI w/o sudo. * Fix opt bin path hack for localhost delegate to ignore errors when it fails with "sudo password required" otherwise. * Describe download_run_once with download_localhost use case in docs as well. Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
- Nov 18, 2016
-
-
Sergey Vasilenko authored
This patch introduce `calico_network_backend` global variable, which allow to describe alternative network backend. Default behavior is unchanged.
-
- Nov 17, 2016
-
-
Alexandre Bourget authored
-
- Nov 15, 2016
-
-
Bogdan Dobrelya authored
For Travis CI and GCE, add a naive generator script into a markdown table. Add GCE/Travis CI matrix docs. Add CoreOS test cases. Rework existing cases w/o loosing of coverage. Rework postinstall tests to support CoreOS as well. Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
- Nov 10, 2016
-
-
Artem Panchenko authored
Since version 'v1.0.0-beta' calicoctl is written in Go and its API differs from old Python based utility. Added support of both old and new version of the utility.
-
- Nov 09, 2016
-
-
Matthew Mosesohn authored
-
- Oct 18, 2016
-
-
Smana authored
-
Bogdan Dobrelya authored
Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
- Oct 17, 2016
-
-
Bogdan Dobrelya authored
Fix mismatch in code and docs, see https://github.com/kubespray/kargo/pull/528 Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
- Oct 05, 2016
-
-
Matthew Mosesohn authored
Also adds all masters by hostname and localhost/127.0.0.1 to apiserver SSL certificate. Includes documentation update on how localhost loadbalancer works.
-
- Sep 29, 2016
-
-
keglevich3 authored
-
- Sep 27, 2016
-
-
Bogdan Dobrelya authored
* Add a var for ndots (default 5) and put it hosts' /etc/resolv.conf. * Poke kube dns container image to v1.7 * In order to apply changes to kubelet, notify it to be restarted on changes made to /etc/resolv.conf. Ignore errors as the kubelet may yet to be present up to the moment of the notification being processed. * Remove unnecessary kubelet restart for master role as the node role ensures it is up and running. Notify master static pods waiters for apiserver, scheduler, controller-manager instead. Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
- Sep 26, 2016
-
-
Bogdan Dobrelya authored
Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
- Sep 23, 2016
-
-
Bogdan Dobrelya authored
Reflect changes made to DNS setup Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
Bogdan Dobrelya authored
- Update docs and a drawing to clarify DNS setup. - Change order of nameservers placement to match changes in https://github.com/kubespray/kargo/pull/501 Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
Bogdan Dobrelya authored
Change additional dnsmasq opts: - Adjust caching size and TTL - Disable resolve conf to not create loops - Change dnsPolicy to default (similarly to kubedns's dnsmasq). The ClusterFirst should not be used to not create loops - Disable negative NXDOMAIN replies to be cached - Make its very installation as optional step (enabled by default). If you don't want more than 3 DNS servers, including 1 for K8s, disable it. - Add docs and a drawing to clarify DNS setup. - Fix stdout logs for dnsmasq/kubedns app configs - Add missed notifies to resolvconf -u handler - Fix idempotency of resolvconf head file changes Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
- Sep 19, 2016
-
-
Sean M. Collins authored
Filename was a typo
-
- Sep 15, 2016
-
-
Bogdan Dobrelya authored
* Add the retry_stagger var to tweak push and retry time strategies. * Add large deployments related docs. Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
- Aug 24, 2016
-
-
Spencer Smith authored
-
- Jul 25, 2016
-
-
Bogdan Dobrelya authored
* Add HA docs for API server. * Add auto-evaluated internal endpoints and clarify the loadbalancer_apiserver vars and usecases. * Use facts for kube_apiserver to not repeat code and enable LB endpoints use. * Use /healthz check for the wait-for apiserver. * Use the single endpoint for kubelet instead of the list of apiservers * Specify kube_apiserver_count to for HA layout Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
- Jul 22, 2016
-
-
Bogdan Dobrelya authored
Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
- Jul 19, 2016
-
-
Bogdan Dobrelya authored
* Enforce a etcd-proxy role to a k8s-cluster group members. This provides an HA layout for all of the k8s cluster internal clients. * Proxies to be run on each node in the group as a separate etcd instances with a readwrite proxy mode and listen the given endpoint, which is either the access_ip:2379 or the localhost:2379. * A notion for the 'kube_etcd_multiaccess' is: ignore endpoints and loadbalancers and use the etcd members IPs as a comma-separated list. Otherwise, clients shall use the local endpoint provided by a etcd-proxy instances on each etcd node. A Netwroking plugins always use that access mode. * Fix apiserver's etcd servers args to use the etcd_access_endpoint. * Fix networking plugins flannel/calico to use the etcd_endpoint. * Fix name env var for non masters to be set as well. * Fix etcd_client_url was not used anywhere and other etcd_* facts evaluation was duplicated in a few places. * Define proxy modes only in the env file, if not a master. Del an automatic proxy mode decisions for etcd nodes in init/unit scripts. * Use Wants= instead of Requires= as "This is the recommended way to hook start-up of one unit to the start-up of another unit" * Make apiserver/calico Wants= etcd-proxy to keep it always up Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com> Co-authored-by:
Matthew Mosesohn <mmosesohn@mirantis.com>
-
- Jul 08, 2016
-
-
Jean-Christophe Sirot authored
-
Smana authored
-
Smaine Kahlouch authored
-