- Apr 12, 2018
-
-
Chad Swenson authored
-
- Mar 30, 2018
-
-
Matthew Mosesohn authored
Kubernetes makes this namespace automatically, so there is no need for kubespray to manage it.
-
- Mar 29, 2018
-
-
georgejdli authored
-
- Mar 20, 2018
-
-
Bharat Kunwar authored
-
Bharat Kunwar authored
-
Bharat Kunwar authored
Ensure that kube-apiserver will respond even if one of the nodes are down.
-
woopstar authored
-
- Mar 15, 2018
-
-
Andreas Krüger authored
* Added option for encrypting secrets to etcd * Fix keylength to 32 * Forgot the default * Rename secrets.yaml to secrets_encryption.yaml * Fix static path for secrets file to use ansible variable * Rename secrets.yaml.j2 to secrets_encryption.yaml.j2 * Base64 encode the token * Fixed merge error * Changed path to credentials dir * Update path to secrets file which is now readable inside the apiserver container. Set better file permissions * Add encryption option to k8s-cluster.yml
-
- Mar 05, 2018
-
-
Ayaz Ahmed Khan authored
to the API server configuration. This solves the problem where if you have non-resolvable node names, and try to scale the server by adding new nodes, kubectl commands start to fail for newly added nodes, giving a TCP timeout error when trying to resolve the node hostname against a public DNS.
-
- Mar 01, 2018
-
-
RongZhang authored
Add etcd-events cluster for kube-apiserver
-
- Feb 22, 2018
-
-
Nedim Haveric authored
-
- Feb 12, 2018
-
-
Maxim Krasilnikov authored
-
- Feb 09, 2018
-
-
Chia-liang Kao authored
`FAILED! => {"changed": false, "msg": "AnsibleFilterError: Version comparison: unorderable types: str() < int()"}`
-
- Feb 07, 2018
- Feb 05, 2018
-
-
woopstar authored
-
- Feb 01, 2018
-
-
Dann Bohn authored
-
- Dec 05, 2017
-
-
Chad Swenson authored
This allows `kube_apiserver_insecure_port` to be set to 0 (disabled). Rework of #1937 with kubeadm support Also, fixed an issue in `kubeadm-migrate-certs` where the old apiserver cert was copied as the kubeadm key
-
- Nov 29, 2017
-
-
Steven Hardy authored
* Allow setting --bind-address for apiserver hyperkube This is required if you wish to configure a loadbalancer (e.g haproxy) running on the master nodes without choosing a different port for the vip from that used by the API - in this case you need the API to bind to a specific interface, then haproxy can bind the same port on the VIP: root@overcloud-controller-0 ~]# netstat -taupen | grep 6443 tcp 0 0 192.168.24.6:6443 0.0.0.0:* LISTEN 0 680613 134504/haproxy tcp 0 0 192.168.24.16:6443 0.0.0.0:* LISTEN 0 653329 131423/hyperkube tcp 0 0 192.168.24.16:6443 192.168.24.16:58404 ESTABLISHED 0 652991 131423/hyperkube tcp 0 0 192.168.24.16:58404 192.168.24.16:6443 ESTABLISHED 0 652986 131423/hyperkube This can be achieved e.g via: kube_apiserver_bind_address: 192.168.24.16 * Address code review feedback * Update kube-apiserver.manifest.j2
-
- Nov 14, 2017
-
-
Matthew Mosesohn authored
-
- Nov 07, 2017
-
-
Chad Swenson authored
This allows `kube_apiserver_insecure_port` to be set to 0 (disabled). It's working, but so far I have had to: 1. Make the `uri` module "Wait for apiserver up" checks use `kube_apiserver_port` (HTTPS) 2. Add apiserver client cert/key to the "Wait for apiserver up" checks 3. Update apiserver liveness probe to use HTTPS ports 4. Set `kube_api_anonymous_auth` to true to allow liveness probe to hit apiserver's /healthz over HTTPS (livenessProbes can't use client cert/key unfortunately) 5. RBAC has to be enabled. Anonymous requests are in the `system:unauthenticated` group which is granted access to /healthz by one of RBAC's default ClusterRoleBindings. An equivalent ABAC rule could allow this as well. Changes 1 and 2 should work for everyone, but 3, 4, and 5 require new coupling of currently independent configuration settings. So I also added a new settings check. Options: 1. The problem goes away if you have both anonymous-auth and RBAC enabled. This is how kubeadm does it. This may be the best way to go since RBAC is already on by default but anonymous auth is not. 2. Include conditional templates to set a different liveness probe for possible combinations of `kube_apiserver_insecure_port = 0`, RBAC, and `kube_api_anonymous_auth` (won't be possible to cover every case without a guaranteed authorizer for the secure port) 3. Use basic auth headers for the liveness probe (I really don't like this, it adds a new dependency on basic auth which I'd also like to leave independently configurable, and it requires encoded passwords in the apiserver manifest) Option 1 seems like the clear winner to me, but is there a reason we wouldn't want anonymous-auth on by default? The apiserver binary defaults anonymous-auth to true, but kubespray's default was false.
-
- Oct 31, 2017
-
-
Spencer Smith authored
-
- Oct 27, 2017
-
-
Matthew Mosesohn authored
-
- Oct 26, 2017
-
-
Matthew Mosesohn authored
It is now enabled by default in 1.8 with the api changed to networking.k8s.io/v1 instead of extensions/v1beta1.
-
- Oct 15, 2017
-
-
Matthew Mosesohn authored
* Disable basic and token auth by default * Add recommended security params * allow basic auth to fail in tests * Enable TLS authentication for kubelet
-
- Oct 13, 2017
-
-
Matthew Mosesohn authored
* add istio addon * add addons to a ci job
-
- Oct 04, 2017
-
-
Matthew Mosesohn authored
These facts can be generated in defaults with a performance boost. Also cleaned up duplicate etcd var names.
-
- Sep 13, 2017
-
-
Matthew Mosesohn authored
* kubeadm support * move k8s master to a subtask * disable k8s secrets when using kubeadm * fix etcd cert serial var * move simple auth users to master role * make a kubeadm-specific env file for kubelet * add non-ha CI job * change ci boolean vars to json format * fixup * Update create-gce.yml * Update create-gce.yml * Update create-gce.yml
-
- Sep 01, 2017
-
-
Brad Beam authored
-
- Aug 31, 2017
-
-
Brad Beam authored
-
- Aug 25, 2017
-
-
Hassan Zamani authored
-
- Jul 17, 2017
-
-
jwfang authored
-
- Jun 16, 2017
-
-
Spencer Smith authored
-
- Jun 12, 2017
-
-
Gregory Storme authored
-
- May 31, 2017
-
-
Spencer Smith authored
-
- May 27, 2017
-
-
Spencer Smith authored
-
- Apr 20, 2017
-
-
Sergii Golovatiuk authored
According to code apiserver, scheduler, controller-manager, proxy don't use resolution of objects they created. It's not harmful to change policy to have external resolver. Signed-off-by:
Sergii Golovatiuk <sgolovatiuk@mirantis.com>
-
- Apr 17, 2017
-
-
Spencer Smith authored
-
Spencer Smith authored
-
gbolo authored
-