This is trying to match what the roles/bastion-ssh-config is trying to do. When the setup is going through bastion, we want to ssh private key to be used on the bastion instance.

Network size large deploy documentation

Raise drain timeout to 5m

Enable etcd secure client to prevent etcdctl access without cert and key

Enable flannel hairpin mode

* iptables: flush nat table as well as filter table upon reset

* Indentation fix

Update dashboard version to v1.8.1

Support for disabling apiserver insecure port (the sequel)

Dnsmasq autoscaler image should be a variable

Fix for Issue #2141

Renamed variable from disable_volume_zone_conflict to volume_cross_zone_attachment and removed cloud provider condition; fix identation

Restart docker when http-proxy.conf changed.

Fix 'no such host' problem reported by commands *kubectl logs* and *kubectl exec*
when cloud_provider is OpenStack

Closes: #2147

* Update rpm spec and pbr setup configs

* Rename package to kubespray
* Do not break Fedora's FHS and install to /usr/share instead
* Remove the vendor tag
* Update source0 for better artifacts' names
* Fix missing files build errors
* Make version/release to auto match from git and fit PEP 440

Co-authored-by: Matthias Runge <mrunge@redhat.com>
Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

* Add package paths to roles search in ansible conf

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

* Poke jinja2 requirements in rpm spec file

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

Merge branch 'hardcoded_dnsmasq-autoscaler_image' of github.com:mirwan/kubespray into hardcoded_dnsmasq-autoscaler_image

Add support for flex volumes plugins.

Updated with correct syntax to access default_tags variable.

Manage deprecated kubelet option

Add kubelet_custom_flags to kubelet.kubeadm.env.j2

updated weave to 2.1.3

Retry kube container removal during upgrade

Remove blank lines

fix fluentd template

* Fix HA docs API access endpoints explained

Follow-up commit 81347298a3ef7932cbeb55e877644ca22d1625f1
and fix the endpoint value provided in HA docs.

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

* Clarify internal LB with external LB use case

* Clarify how to use both internal and external, non-cluster aware and
  not managed with Kubespray, LB solutions.
* Clarify the requirements, like TLS/SSL termination, for such an external LB.
  Unlike to the 'cluster-aware' external LB config, endpoints' security must be
  managed by that non-cluster aware external LB.
* Note that masters always contact their local apiservers via https://bip:sp.
  It's highly unlikely to go down and it reduces latency that might be
  introduced when going host->lb->host. Only computes go that path.

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

* Add a note for supplementary_addresses_in_ssl_keys

Explain how to benefit from supplementary_addresses_in_ssl_keys

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>

* Add support for cert alt names for etcd

* Update gen_certs_vault.yml