mirror of
https://github.com/kubernetes-sigs/kubespray.git
synced 2026-02-28 09:39:12 +03:00
[calico] add calico apiserver (#8690)
* [calico] add calico apiserver * fix yamllint * remove addext argument * Configure API server with the CA bundle * add check kdd
This commit is contained in:
Samuel Liu
@@ -0,0 +1,10 @@
|
||||
# This is a tech-preview manifest which installs the Calico API server. Note that this manifest is liable to change
|
||||
# or be removed in future releases without further warning.
|
||||
#
|
||||
# Namespace and namespace-scoped resources.
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
labels:
|
||||
name: calico-apiserver
|
||||
name: calico-apiserver
|
||||
320
roles/network_plugin/calico/templates/calico-apiserver.yml.j2
Normal file
320
roles/network_plugin/calico/templates/calico-apiserver.yml.j2
Normal file
@@ -0,0 +1,320 @@
|
||||
# Policy to ensure the API server isn't cut off. Can be modified, but ensure
|
||||
# that the main API server is always able to reach the Calico API server.
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: allow-apiserver
|
||||
namespace: calico-apiserver
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
apiserver: "true"
|
||||
ingress:
|
||||
- ports:
|
||||
- protocol: TCP
|
||||
port: 5443
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: calico-api
|
||||
namespace: calico-apiserver
|
||||
spec:
|
||||
ports:
|
||||
- name: apiserver
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 5443
|
||||
selector:
|
||||
apiserver: "true"
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
apiserver: "true"
|
||||
k8s-app: calico-apiserver
|
||||
name: calico-apiserver
|
||||
namespace: calico-apiserver
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
apiserver: "true"
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
apiserver: "true"
|
||||
k8s-app: calico-apiserver
|
||||
name: calico-apiserver
|
||||
namespace: calico-apiserver
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- --secure-port=5443
|
||||
- -v=5
|
||||
env:
|
||||
- name: DATASTORE_TYPE
|
||||
value: kubernetes
|
||||
image: {{ calico_apiserver_image_repo }}:{{ calico_apiserver_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /version
|
||||
port: 5443
|
||||
scheme: HTTPS
|
||||
initialDelaySeconds: 90
|
||||
periodSeconds: 10
|
||||
name: calico-apiserver
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /code/filecheck
|
||||
failureThreshold: 5
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
securityContext:
|
||||
privileged: false
|
||||
runAsUser: 0
|
||||
volumeMounts:
|
||||
- mountPath: /code/apiserver.local.config/certificates
|
||||
name: calico-apiserver-certs
|
||||
dnsPolicy: ClusterFirst
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
restartPolicy: Always
|
||||
serviceAccount: calico-apiserver
|
||||
serviceAccountName: calico-apiserver
|
||||
tolerations:
|
||||
- effect: NoSchedule
|
||||
key: node-role.kubernetes.io/master
|
||||
volumes:
|
||||
- name: calico-apiserver-certs
|
||||
secret:
|
||||
secretName: calico-apiserver-certs
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: calico-apiserver
|
||||
namespace: calico-apiserver
|
||||
|
||||
---
|
||||
|
||||
# Cluster-scoped resources below here.
|
||||
apiVersion: apiregistration.k8s.io/v1
|
||||
kind: APIService
|
||||
metadata:
|
||||
name: v3.projectcalico.org
|
||||
spec:
|
||||
group: projectcalico.org
|
||||
groupPriorityMinimum: 1500
|
||||
caBundle: {{ calico_apiserver_cabundle }}
|
||||
service:
|
||||
name: calico-api
|
||||
namespace: calico-apiserver
|
||||
port: 443
|
||||
version: v3
|
||||
versionPriority: 200
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: calico-crds
|
||||
rules:
|
||||
- apiGroups:
|
||||
- extensions
|
||||
- networking.k8s.io
|
||||
- ""
|
||||
resources:
|
||||
- networkpolicies
|
||||
- nodes
|
||||
- namespaces
|
||||
- pods
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- crd.projectcalico.org
|
||||
resources:
|
||||
- globalnetworkpolicies
|
||||
- networkpolicies
|
||||
- clusterinformations
|
||||
- hostendpoints
|
||||
- globalnetworksets
|
||||
- networksets
|
||||
- bgpconfigurations
|
||||
- bgppeers
|
||||
- felixconfigurations
|
||||
- kubecontrollersconfigurations
|
||||
- ippools
|
||||
- ipreservations
|
||||
- ipamblocks
|
||||
- blockaffinities
|
||||
- caliconodestatuses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
- apiGroups:
|
||||
- policy
|
||||
resourceNames:
|
||||
- calico-apiserver
|
||||
resources:
|
||||
- podsecuritypolicies
|
||||
verbs:
|
||||
- use
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: calico-extension-apiserver-auth-access
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- extension-apiserver-authentication
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- get
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- clusterroles
|
||||
- clusterrolebindings
|
||||
- roles
|
||||
- rolebindings
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: calico-webhook-reader
|
||||
rules:
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- mutatingwebhookconfigurations
|
||||
- validatingwebhookconfigurations
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: calico-apiserver-access-crds
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: calico-crds
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: calico-apiserver
|
||||
namespace: calico-apiserver
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: calico-apiserver-delegate-auth
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: system:auth-delegator
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: calico-apiserver
|
||||
namespace: calico-apiserver
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: calico-apiserver-webhook-reader
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: calico-webhook-reader
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: calico-apiserver
|
||||
namespace: calico-apiserver
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: calico-extension-apiserver-auth-access
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: calico-extension-apiserver-auth-access
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: calico-apiserver
|
||||
namespace: calico-apiserver
|
||||
|
||||
---
|
||||
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
|
||||
name: calico-apiserver
|
||||
spec:
|
||||
allowPrivilegeEscalation: false
|
||||
fsGroup:
|
||||
ranges:
|
||||
- max: 65535
|
||||
min: 1
|
||||
rule: MustRunAs
|
||||
hostPorts:
|
||||
- max: 65535
|
||||
min: 0
|
||||
requiredDropCapabilities:
|
||||
- ALL
|
||||
runAsUser:
|
||||
rule: RunAsAny
|
||||
seLinux:
|
||||
rule: RunAsAny
|
||||
supplementalGroups:
|
||||
ranges:
|
||||
- max: 65535
|
||||
min: 1
|
||||
rule: MustRunAs
|
||||
volumes:
|
||||
- secret
|
||||
@@ -43,6 +43,7 @@ spec:
|
||||
# upgraded to use calico-ipam.
|
||||
- name: upgrade-ipam
|
||||
image: {{ calico_cni_image_repo }}:{{ calico_cni_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
@@ -71,6 +72,7 @@ spec:
|
||||
# and CNI network config file on each node.
|
||||
- name: install-cni
|
||||
image: {{ calico_cni_image_repo }}:{{ calico_cni_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
command: ["/opt/cni/bin/install"]
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
@@ -108,6 +110,7 @@ spec:
|
||||
# to communicate with Felix over the Policy Sync API.
|
||||
- name: flexvol-driver
|
||||
image: {{ calico_flexvol_image_repo }}:{{ calico_flexvol_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
volumeMounts:
|
||||
- name: flexvol-driver-host
|
||||
mountPath: /host/driver
|
||||
@@ -119,6 +122,7 @@ spec:
|
||||
# host.
|
||||
- name: calico-node
|
||||
image: {{ calico_node_image_repo }}:{{ calico_node_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
# Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
|
||||
|
||||
@@ -70,6 +70,7 @@ spec:
|
||||
fsGroup: 65534
|
||||
containers:
|
||||
- image: {{ calico_typha_image_repo }}:{{ calico_typha_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
name: calico-typha
|
||||
ports:
|
||||
- containerPort: 5473
|
||||
|
||||
102
roles/network_plugin/calico/templates/make-ssl-calico.sh.j2
Normal file
102
roles/network_plugin/calico/templates/make-ssl-calico.sh.j2
Normal file
@@ -0,0 +1,102 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Author: Smana smainklh@gmail.com
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
usage()
|
||||
{
|
||||
cat << EOF
|
||||
Create self signed certificates
|
||||
|
||||
Usage : $(basename $0) -f <config> [-d <ssldir>]
|
||||
-h | --help : Show this message
|
||||
-f | --config : Openssl configuration file
|
||||
-d | --ssldir : Directory where the certificates will be installed
|
||||
-c | --cadir : Directory where the existing CA is located
|
||||
-s | --service : Service for the ca
|
||||
|
||||
ex :
|
||||
$(basename $0) -f openssl.conf -d /srv/ssl
|
||||
EOF
|
||||
}
|
||||
|
||||
# Options parsing
|
||||
while (($#)); do
|
||||
case "$1" in
|
||||
-h | --help) usage; exit 0;;
|
||||
-f | --config) CONFIG=${2}; shift 2;;
|
||||
-d | --ssldir) SSLDIR="${2}"; shift 2;;
|
||||
-c | --cadir) CADIR="${2}"; shift 2;;
|
||||
-s | --service) SERVICE="${2}"; shift 2;;
|
||||
*)
|
||||
usage
|
||||
echo "ERROR : Unknown option"
|
||||
exit 3
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [ -z ${CONFIG} ]; then
|
||||
echo "ERROR: the openssl configuration file is missing. option -f"
|
||||
exit 1
|
||||
fi
|
||||
if [ -z ${SSLDIR} ]; then
|
||||
SSLDIR="/etc/calico/certs"
|
||||
fi
|
||||
|
||||
tmpdir=$(mktemp -d /tmp/calico_${SERVICE}_certs.XXXXXX)
|
||||
trap 'rm -rf "${tmpdir}"' EXIT
|
||||
cd "${tmpdir}"
|
||||
|
||||
mkdir -p ${SSLDIR} ${CADIR}
|
||||
|
||||
# Root CA
|
||||
if [ -e "$CADIR/ca.key" ]; then
|
||||
# Reuse existing CA
|
||||
cp $CADIR/{ca.crt,ca.key} .
|
||||
else
|
||||
openssl genrsa -out ca.key {{certificates_key_size}} > /dev/null 2>&1
|
||||
openssl req -x509 -new -nodes -key ca.key -days {{certificates_duration}} -out ca.crt -subj "/CN=calico-${SERVICE}-ca" > /dev/null 2>&1
|
||||
fi
|
||||
|
||||
if [ $SERVICE == "typha" ]; then
|
||||
# Typha server
|
||||
openssl genrsa -out typha-server.key {{certificates_key_size}} > /dev/null 2>&1
|
||||
openssl req -new -key typha-server.key -out typha-server.csr -subj "/CN=typha-server" -config ${CONFIG} > /dev/null 2>&1
|
||||
openssl x509 -req -in typha-server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out typha-server.crt -days {{certificates_duration}} -extensions ssl_client -extfile ${CONFIG} > /dev/null 2>&1
|
||||
|
||||
# Typha client
|
||||
openssl genrsa -out typha-client.key {{certificates_key_size}} > /dev/null 2>&1
|
||||
openssl req -new -key typha-client.key -out typha-client.csr -subj "/CN=typha-client" -config ${CONFIG} > /dev/null 2>&1
|
||||
openssl x509 -req -in typha-client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out typha-client.crt -days {{certificates_duration}} -extensions ssl_client -extfile ${CONFIG} > /dev/null 2>&1
|
||||
|
||||
elif [ $SERVICE == "apiserver" ]; then
|
||||
# calico-apiserver
|
||||
openssl genrsa -out apiserver.key {{certificates_key_size}} > /dev/null 2>&1
|
||||
openssl req -new -key apiserver.key -out apiserver.csr -subj "/CN=calico-apiserver" -config ${CONFIG} > /dev/null 2>&1
|
||||
openssl x509 -req -in apiserver.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out apiserver.crt -days {{certificates_duration}} -extensions ssl_client -extfile ${CONFIG} > /dev/null 2>&1
|
||||
else
|
||||
echo "ERROR: the openssl configuration file is missing. option -s"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Install certs
|
||||
if [ -e "$CADIR/ca.key" ]; then
|
||||
# No pass existing CA
|
||||
rm -f ca.crt ca.key
|
||||
fi
|
||||
|
||||
mv {*.crt,*.key} ${SSLDIR}/
|
||||
Reference in New Issue
Block a user