- Mar 14, 2017
-
-
Sergii Golovatiuk authored
Closes: #1135 Closes: #1026 Signed-off-by:
Sergii Golovatiuk <sgolovatiuk@mirantis.com>
-
Vincent Schwarzer authored
It is now possible to deactivate selected authentication methods (basic auth, token auth) inside the cluster by adding removing the required arguments to the Kube API Server and generating the secrets accordingly. The x509 authentification is currently not optional because disabling it would affect the kubectl clients deployed on the master nodes.
-
- Mar 06, 2017
-
-
Vincent Schwarzer authored
To use OpenID Connect Authentication beside deploying an OpenID Connect Identity Provider it is necesarry to pass additional arguments to the Kube API Server. These required arguments were added to the kube apiserver manifest.
-
- Feb 28, 2017
-
-
Sergii Golovatiuk authored
Operator can specify any port for kube-api (6443 default) This helps in case where some pods such as Ingress require 443 exclusively. Closes: 820 Signed-off-by:
Sergii Golovatiuk <sgolovatiuk@mirantis.com>
-
Sergii Golovatiuk authored
Closes: #1073 Signed-off-by:
Sergii Golovatiuk <sgolovatiuk@mirantis.com>
-
- Feb 27, 2017
-
-
Jan Jungnickel authored
-
- Feb 24, 2017
-
-
Sergii Golovatiuk authored
all.yaml shouldn't be empty otherwise ansible won't be able to merge 2 dicts. Related bug: ansible/issues/21889
-
Antoine Legrand authored
-
- Feb 23, 2017
-
-
Antoine Legrand authored
-
Antoine Legrand authored
-
Bogdan Dobrelya authored
* Leave all.yml to keep only optional vars * Store groups' specific vars by existing group names * Fix optional vars casted as mandatory (add default()) * Fix missing defaults for an optional IP var * Relink group_vars for terraform to reflect changes Signed-off-by:
Bogdan Dobrelya <bogdando@mail.ru>
-
- Feb 21, 2017
-
-
Sergii Golovatiuk authored
Docker 1.13 changes the behaviour of iptables defaults from allow to drop. This patch disables docker's iptables management as it was in Docker 1.12 [1] [1] https://github.com/docker/docker/pull/28257 Signed-off-by:
Sergii Golovatiuk <sgolovatiuk@mirantis.com>
-
- Feb 20, 2017
-
-
Matthew Mosesohn authored
-
- Feb 15, 2017
-
-
Matthew Mosesohn authored
-
- Feb 14, 2017
-
-
Hung Nguyen Viet authored
-
- Feb 10, 2017
-
-
Alexander Block authored
-
- Feb 09, 2017
-
-
Vladimir Rutsky authored
-
Greg Althaus authored
Update code and docs for that assumption.
-
Greg Althaus authored
kubelet lost the ability to load kernel modules. This puts that back by adding the lib/modules mount to kubelet. The new variable kubelet_load_modules can be set to true to enable this item. It is OFF by default.
-
Josh Conant authored
-
Josh Conant authored
-
- Feb 06, 2017
-
-
Vladimir Rutsky authored
-
Vladimir Rutsky authored
-
Matthew Mosesohn authored
-
- Feb 04, 2017
-
-
Brad Beam authored
-
- Jan 23, 2017
-
-
David Kirstein authored
This makes it a bit more secure. Also the password can now be changed with a (inventory) variable (no need to edit all.yml).
-
- Jan 20, 2017
-
-
Bogdan Dobrelya authored
* Drop linux capabilities for unprivileged containerized worlkoads Kargo configures for deployments. * Configure required securityContext/user/group/groups for kube components' static manifests, etcd, calico-rr and k8s apps, like dnsmasq daemonset. * Rework cloud-init (etcd) users creation for CoreOS. * Fix nologin paths, adjust defaults for addusers role and ensure supplementary groups membership added for users. * Add netplug user for network plugins (yet unused by privileged networking containers though). * Grant the kube and netplug users read access for etcd certs via the etcd certs group. * Grant group read access to kube certs via the kube cert group. * Remove priveleged mode for calico-rr and run it under its uid/gid and supplementary etcd_cert group. * Adjust docs. * Align cpu/memory limits and dropped caps with added rkt support for control plane. Signed-off-by:
Bogdan Dobrelya <bogdando@mail.ru>
-
- Jan 15, 2017
-
-
Greg Althaus authored
the which port the local nginx proxy should listen on for HA local balancer configurations.
-
- Jan 11, 2017
-
-
Bogdan Dobrelya authored
Fix mismatching inventory examples. Add command examples. Clarify groups use cases. Signed-off-by:
Bogdan Dobrelya <bogdando@mail.ru>
-
- Jan 06, 2017
-
-
Alexander Block authored
Also update reset.yml to do more dns/network related cleanup.
-
- Jan 05, 2017
-
-
Bogdan Dobrelya authored
Signed-off-by:
Bogdan Dobrelya <bogdando@mail.ru>
-
- Jan 03, 2017
- Jan 02, 2017
-
-
Bogdan Dobrelya authored
Signed-off-by:
Bogdan Dobrelya <bogdando@mail.ru>
-
- Dec 28, 2016
-
-
Bogdan Dobrelya authored
* Add restart for weave service unit * Reuse docker_bin_dir everythere * Limit systemd managed docker containers by CPU/RAM. Do not configure native systemd limits due to the lack of consensus in the kernel community requires out-of-tree kernel patches. Signed-off-by:
Bogdan Dobrelya <bdobrelia@mirantis.com>
-
- Dec 16, 2016
-
-
Matthew Mosesohn authored
-
- Dec 14, 2016
-
-
Alexander Block authored
https://github.com/kubernetes-incubator/kargo/pull/736 missed this
-
- Dec 13, 2016
-
-
Alexander Block authored
-
Alexander Block authored
Allow to let the cloud provider configure proper routing for nodes.
-
Alexander Block authored
-