bump rpm based docker versions to docker-ce-18.06.3.ce-3 (#4925 )

Update ansible version (#4883 )
Fixing mandatory check of docker_version that breaks bastion host (#4395 )
2025-12-14 13:54:37 +03:00 · 2019-07-08 05:52:35 -07:00 · 2019-06-14 01:22:21 -07:00 · 2019-04-11 04:56:10 -07:00 · 2019-04-10 04:30:15 -07:00 · 2019-04-09 01:07:06 -07:00
15 changed files with 72 additions and 47 deletions
--- a/README.md
+++ b/README.md
@@ -114,7 +114,7 @@ Supported Components
 --------------------

 -   Core
-    -   [kubernetes](https://github.com/kubernetes/kubernetes) v1.12.5
+    -   [kubernetes](https://github.com/kubernetes/kubernetes) v1.12.7
    -   [etcd](https://github.com/coreos/etcd) v3.2.24
    -   [docker](https://www.docker.com/) v18.06 (see note)
    -   [rkt](https://github.com/rkt/rkt) v1.21.0 (see Note 2)
--- a/inventory/sample/group_vars/k8s-cluster/k8s-cluster.yml
+++ b/inventory/sample/group_vars/k8s-cluster/k8s-cluster.yml
@@ -19,7 +19,7 @@ kube_users_dir: "{{ kube_config_dir }}/users"
 kube_api_anonymous_auth: true

 ## Change this to use another Kubernetes version, e.g. a current beta release
-kube_version: v1.12.5
+kube_version: v1.12.7

 # kubernetes image repo define
 kube_image_repo: "gcr.io/google-containers"
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,4 +1,4 @@
-ansible>=2.5.0,!=2.7.0
+ansible>=2.5.0,<2.7
 jinja2>=2.9.6
 netaddr
 pbr>=1.6
--- a/roles/container-engine/docker/vars/debian.yml
+++ b/roles/container-engine/docker/vars/debian.yml
@@ -13,8 +13,8 @@ docker_versioned_pkg:
  '17.09': docker-ce=17.09.0~ce-0~debian
  '17.12': docker-ce=17.12.1~ce-0~debian
  '18.03': docker-ce=18.03.1~ce-0~debian
-  '18.06': docker-ce=18.06.1~ce~3-0~debian
-  'stable': docker-ce=18.06.1~ce~3-0~debian
+  '18.06': docker-ce=18.06.2~ce~3-0~debian
+  'stable': docker-ce=18.06.2~ce~3-0~debian
  'edge': docker-ce=17.12.1~ce-0~debian

 docker_package_info:
--- a/roles/container-engine/docker/vars/fedora.yml
+++ b/roles/container-engine/docker/vars/fedora.yml
@@ -6,7 +6,7 @@ docker_kernel_min_version: '0'
 docker_versioned_pkg:
  'latest': docker-ce
  '18.03': docker-ce-18.03.1.ce-3.fc28
-  '18.06': docker-ce-18.06.1.ce-3.fc28
+  '18.06': docker-ce-18.06.3.ce-3.fc28

 #
 # This is due to the fact that the docker
--- a/roles/container-engine/docker/vars/redhat.yml
+++ b/roles/container-engine/docker/vars/redhat.yml
@@ -14,8 +14,8 @@ docker_versioned_pkg:
  '17.09': docker-ce-17.09.0.ce-1.el7.centos
  '17.12': docker-ce-17.12.1.ce-1.el7.centos
  '18.03': docker-ce-18.03.1.ce-1.el7.centos
-  '18.06': docker-ce-18.06.1.ce-3.el7
-  'stable': docker-ce-18.06.1.ce-3.el7
+  '18.06': docker-ce-18.06.3.ce-3.el7
+  'stable': docker-ce-18.06.3.ce-3.el7
  'edge': docker-ce-17.12.1.ce-1.el7.centos

 docker_selinux_versioned_pkg:
--- a/roles/container-engine/docker/vars/ubuntu-amd64.yml
+++ b/roles/container-engine/docker/vars/ubuntu-amd64.yml
@@ -10,9 +10,9 @@ docker_versioned_pkg:
  '17.03': docker-ce=17.03.2~ce-0~ubuntu-{{ ansible_distribution_release|lower }}
  '17.09': docker-ce=17.09.0~ce-0~ubuntu-{{ ansible_distribution_release|lower }}
  '17.12': docker-ce=17.12.1~ce-0~ubuntu-{{ ansible_distribution_release|lower }}
-  '18.06': docker-ce=18.06.1~ce~3-0~ubuntu
-  'stable': docker-ce=18.06.1~ce~3-0~ubuntu
-  'edge': docker-ce=18.06.1~ce~3-0~ubuntu
+  '18.06': docker-ce=18.06.2~ce~3-0~ubuntu
+  'stable': docker-ce=18.06.2~ce~3-0~ubuntu
+  'edge': docker-ce=18.06.2~ce~3-0~ubuntu

 docker_package_info:
  pkg_mgr: apt
--- a/roles/container-engine/docker/vars/ubuntu-arm64.yml
+++ b/roles/container-engine/docker/vars/ubuntu-arm64.yml
@@ -6,9 +6,9 @@ docker_versioned_pkg:
  'latest': docker-ce
  '17.09': docker-ce=17.09.1~ce-0~ubuntu
  '17.12': docker-ce=17.12.1~ce-0~ubuntu-{{ ansible_distribution_release|lower }}
-  '18.06': docker-ce=18.06.1~ce~3-0~ubuntu
-  'stable': docker-ce=18.06.1~ce~3-0~ubuntu
-  'edge': docker-ce=18.06.1~ce~3-0~ubuntu
+  '18.06': docker-ce=18.06.2~ce~3-0~ubuntu
+  'stable': docker-ce=18.06.2~ce~3-0~ubuntu
+  'edge': docker-ce=18.06.2~ce~3-0~ubuntu

 docker_package_info:
  pkg_mgr: apt
--- a/roles/container-engine/docker/vars/ubuntu-bionic.yml
+++ b/roles/container-engine/docker/vars/ubuntu-bionic.yml
@@ -6,9 +6,9 @@ use_docker_engine: false
 docker_versioned_pkg:
  'latest': docker-ce
  '18.03': docker-ce=18.03.1~ce-3-0~ubuntu
-  '18.06': docker-ce=18.06.1~ce~3-0~ubuntu
-  'stable': docker-ce=18.06.1~ce~3-0~ubuntu
-  'edge': docker-ce=18.06.1~ce~3-0~ubuntu
+  '18.06': docker-ce=18.06.2~ce~3-0~ubuntu
+  'stable': docker-ce=18.06.2~ce~3-0~ubuntu
+  'edge': docker-ce=18.06.2~ce~3-0~ubuntu

 docker_package_info:
  pkg_mgr: apt
--- a/roles/download/defaults/main.yml
+++ b/roles/download/defaults/main.yml
@@ -35,7 +35,7 @@ download_delegate: "{% if download_localhost %}localhost{% else %}{{groups['kube
 image_arch: "{{host_architecture | default('amd64')}}"

 # Versions
-kube_version: v1.12.5
+kube_version: v1.12.7
 kubeadm_version: "{{ kube_version }}"
 etcd_version: v3.2.24

@@ -70,6 +70,8 @@ cni_download_url: "https://github.com/containernetworking/plugins/releases/downl

 # Checksums
 hyperkube_checksums:
+  v1.12.7: cfcee7cadc18ffb40f87bcb21bc33e98d17a3bf97e1d75f0c63642d9e3b1ec65
+  v1.12.6: eb7bd0c21977bca7071c65fa0ef60d5e09c9e9a16c4fd8435be5bd7f5b0d1221
  v1.12.5: f8b651816b2caa33e8b25a666e5c370e9786356d59f89579bba772f28370ed00
  v1.12.4: a4697d8f3791f0408fcdb97b3de187e47d7b39a63332c75f68f95e25f4891cc9
  v1.12.3: 600aad3f0d016716abd85931239806193ffbe95f2edfdcea11532d518ae5cdb1
@@ -90,6 +92,8 @@ hyperkube_checksums:
  v1.10.1: 6e0642ad6bae68dc81b8d1c9efa18e265e17e23da1895862823cafac08c0344c
  v1.10.0: b5575b2fb4266754c1675b8cd5d9b6cac70f3fee7a05c4e80da3a9e83e58c57e
 kubeadm_checksums:
+  v1.12.7: 8a16dea17c1f7aa5b72d9abdc4c3f0e50b52f325084647d71acdd0361eec5f6a
+  v1.12.6: 9048031930be9cb0506940c04f6ce67408d9caa9384b32d65d7aa5b6f1ad58ec
  v1.12.5: d61730b3deb4d9825af0cc1e452a4be2292400507128279770c39669f6599af9
  v1.12.4: 674ad5892ff2403f492c9042c3cea3fa0bfa3acf95bc7d1777c3645f0ddf64d7
  v1.12.3: c675aa3be82754b3f8dfdde2a1526a72986713312d46d898e65cb564c6aa8ad4
--- a/roles/kubernetes/master/tasks/kubeadm-setup.yml
+++ b/roles/kubernetes/master/tasks/kubeadm-setup.yml
@@ -42,29 +42,21 @@

 - name: kubeadm | aggregate all SANs
  set_fact:
-    apiserver_sans: >-
-      kubernetes
-      kubernetes.default
-      kubernetes.default.svc
-      kubernetes.default.svc.{{ dns_domain }}
-      {{ kube_apiserver_ip }}
-      localhost
-      127.0.0.1
-      {{ ' '.join(groups['kube-master']) }}
-      {%- if loadbalancer_apiserver is defined %}
-      {{ apiserver_loadbalancer_domain_name }}
-      {%- endif %}
-      {% for host in groups['kube-master'] -%}
-      {%- if hostvars[host]['access_ip'] is defined -%}
-      {{ hostvars[host]['access_ip'] }}
-      {%- endif %}
-      {{ hostvars[host]['ip'] | default(hostvars[host]['ansible_default_ipv4']['address']) }}
-      {%- endfor %}
-      {%- if supplementary_addresses_in_ssl_keys is defined -%}
-      {% for addr in supplementary_addresses_in_ssl_keys -%}
-      {{ addr }}
-      {%- endfor %}
-      {%- endif %}
+    apiserver_sans: "{{ (sans_base + groups['kube-master'] + sans_lb + sans_supp + sans_access_ip + sans_ip + sans_address) | unique }}"
+  vars:
+    sans_base:
+      - "kubernetes"
+      - "kubernetes.default"
+      - "kubernetes.default.svc"
+      - "kubernetes.default.svc.{{ dns_domain }}"
+      - "{{ kube_apiserver_ip }}"
+      - "localhost"
+      - "127.0.0.1"
+    sans_lb: "{{ [apiserver_loadbalancer_domain_name] if apiserver_loadbalancer_domain_name is defined else [] }}"
+    sans_supp: "{{ supplementary_addresses_in_ssl_keys if supplementary_addresses_in_ssl_keys is defined else [] }}"
+    sans_access_ip: "{{ groups['kube-master'] | map('extract', hostvars, 'access_ip') | list | select('defined') | list }}"
+    sans_ip: "{{ groups['kube-master'] | map('extract', hostvars, 'ip') | list | select('defined') | list }}"
+    sans_address: "{{ groups['kube-master'] | map('extract', hostvars, ['ansible_default_ipv4', 'address']) | list | select('defined') | list }}"
  tags: facts

 - name: kubeadm | Copy etcd cert dir under k8s cert dir
--- a/roles/kubernetes/master/templates/kubeadm-config.v1alpha1.yaml.j2
+++ b/roles/kubernetes/master/templates/kubeadm-config.v1alpha1.yaml.j2
@@ -98,6 +98,12 @@ apiServerExtraArgs:
 {%   if kube_oidc_groups_claim is defined %}
  oidc-groups-claim: {{ kube_oidc_groups_claim }}
 {%   endif %}
+{%   if kube_oidc_username_prefix is defined %}
+  oidc-username-prefix: {{ kube_oidc_username_prefix }}
+{%   endif %}
+{%   if kube_oidc_groups_prefix is defined %}
+  oidc-groups-prefix: {{ kube_oidc_groups_prefix }}
+{%   endif %}
 {% endif %}
 {% if kube_encrypt_secret_data %}
  experimental-encryption-provider-config: {{ kube_config_dir }}/ssl/secrets_encryption.yaml
@@ -171,7 +177,7 @@ apiServerExtraVolumes:
 {% endif %}
 {% endif %}
 apiServerCertSANs:
-{% for san in  apiserver_sans.split() | unique %}
+{% for san in apiserver_sans %}
  - {{ san }}
 {% endfor %}
 certificatesDir: {{ kube_config_dir }}/ssl
--- a/roles/kubernetes/master/templates/kubeadm-config.v1alpha2.yaml.j2
+++ b/roles/kubernetes/master/templates/kubeadm-config.v1alpha2.yaml.j2
@@ -83,6 +83,12 @@ apiServerExtraArgs:
 {%   if kube_oidc_groups_claim is defined %}
  oidc-groups-claim: {{ kube_oidc_groups_claim }}
 {%   endif %}
+{%   if kube_oidc_username_prefix is defined %}
+  oidc-username-prefix: {{ kube_oidc_username_prefix }}
+{%   endif %}
+{%   if kube_oidc_groups_prefix is defined %}
+  oidc-groups-prefix: {{ kube_oidc_groups_prefix }}
+{%   endif %}
 {% endif %}
 {% if kube_encrypt_secret_data %}
  experimental-encryption-provider-config: {{ kube_config_dir }}/ssl/secrets_encryption.yaml
@@ -146,7 +152,7 @@ controllerManagerExtraVolumes:
  mountPath: {{ kube_config_dir }}/cloud_config
 {% endif %}
 {% endif %}
-{% if kubernetes_audit or kube_basic_auth|default(true) or kube_token_auth|default(true) %}
+{% if kubernetes_audit or kube_basic_auth|default(true) or kube_token_auth|default(true) or apiserver_extra_volumes or (cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "external"]) %}
 apiServerExtraVolumes:
 {% if kube_basic_auth|default(true) %}
 - name: basic-auth-config
@@ -168,6 +174,17 @@ apiServerExtraVolumes:
  mountPath: {{ audit_log_mountpath }}
  writable: true
 {% endif %}
+{% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "external"] %}
+- name: cloud-config
+  hostPath: {{ kube_config_dir }}/cloud_config
+  mountPath: {{ kube_config_dir }}/cloud_config
+{% endif %}
+{% for volume in apiserver_extra_volumes %}
+- name: {{ volume.name }}
+  hostPath: {{ volume.hostPath }}
+  mountPath: {{ volume.mountPath }}
+  writable: {{ volume.writable | default(false)}}
+{% endfor %}
 {% endif %}
 {% endif %}
 {% if cloud_provider is defined and cloud_provider in ["openstack", "azure", "vsphere", "aws", "external"] %}
@@ -189,7 +206,7 @@ schedulerExtraArgs:
 {% endfor %}
 {% endif %}
 apiServerCertSANs:
-{% for san in apiserver_sans.split() | unique %}
+{% for san in apiserver_sans %}
  - {{ san }}
 {% endfor %}
 certificatesDir: {{ kube_config_dir }}/ssl
--- a/roles/kubernetes/master/templates/kubeadm-config.v1alpha3.yaml.j2
+++ b/roles/kubernetes/master/templates/kubeadm-config.v1alpha3.yaml.j2
@@ -43,7 +43,7 @@ controlPlaneEndpoint: {{ kubeadm_config_api_fqdn }}:{{ loadbalancer_apiserver.po
 controlPlaneEndpoint: {{ ip | default(ansible_default_ipv4.address) }}:{{ kube_apiserver_port }}
 {% endif %}
 apiServerCertSANs:
-{% for san in apiserver_sans.split() | unique %}
+{% for san in apiserver_sans %}
  - {{ san }}
 {% endfor %}
 certificatesDir: {{ kube_config_dir }}/ssl
@@ -93,6 +93,12 @@ apiServerExtraArgs:
 {%   if kube_oidc_groups_claim is defined %}
  oidc-groups-claim: {{ kube_oidc_groups_claim }}
 {%   endif %}
+{%   if kube_oidc_username_prefix is defined %}
+  oidc-username-prefix: {{ kube_oidc_username_prefix }}
+{%   endif %}
+{%   if kube_oidc_groups_prefix is defined %}
+  oidc-groups-prefix: {{ kube_oidc_groups_prefix }}
+{%   endif %}
 {% endif %}
 {% if kube_encrypt_secret_data %}
  experimental-encryption-provider-config: {{ kube_config_dir }}/ssl/secrets_encryption.yaml
--- a/roles/kubespray-defaults/defaults/main.yaml
+++ b/roles/kubespray-defaults/defaults/main.yaml
@@ -12,7 +12,7 @@ is_atomic: false
 disable_swap: true

 ## Change this to use another Kubernetes version, e.g. a current beta release
-kube_version: v1.12.5
+kube_version: v1.12.7

 ## Kube Proxy mode One of ['iptables','ipvs']
 kube_proxy_mode: ipvs
@@ -213,7 +213,7 @@ docker_options: >-
  {% if docker_registry_mirrors is defined %}
  {{ docker_registry_mirrors | map('regex_replace', '^(.*)$', '--registry-mirror=\1' ) | list | join(' ') }}
  {%- endif %}
-  {%- if docker_version is version('17.05', '<') %}
+  {%- if docker_version is defined and docker_version is version('17.05', '<') %}
  --graph={{ docker_daemon_graph }} {{ docker_log_opts }}
  {%- else %}
  --data-root={{ docker_daemon_graph }} {{ docker_log_opts }}
Author	SHA1	Message	Date
awalker125	d3f6079991	bump rpm based docker versions to docker-ce-18.06.3.ce-3 (#4925 )	2019-07-08 05:52:35 -07:00
Mateus Caruccio	7aa8b82512	Update ansible version (#4883 )	2019-06-14 01:22:21 -07:00
Prabal Deb	ec974e16fa	Fixing mandatory check of docker_version that breaks bastion host (#4395 )	2019-04-11 04:56:10 -07:00
rptaylor	6f97687d19	Release 2.8 robust san handling (#4478 ) * robust handling of API server SANs for 2.8 branch * use apiserver_loadbalancer_domain_name if it is defined, according to PR 3977	2019-04-10 04:30:15 -07:00
Daniel Werdermann	447605ca0e	Add oidc prefixes to kubeadm templates (#4462 )	2019-04-09 01:07:06 -07:00
Bort Verwilst	3901480bc1	go to k8s 1.12.7 (#4400 )	2019-03-28 06:20:46 -07:00
Rong Zhang	c42cb8f9b2	Merge pull request #4373 from prabdeb/prabdeb-fix-2.8-volume-mount-apiServer Fixing volume mount issue for apiServerExtraVolumes in kubeadm-config.v1alpha2.yaml.j2	2019-03-27 14:59:45 +08:00
Prabal Deb (prabdeb)	5c28bb0679	Fixing volume issue	2019-03-20 21:34:44 +05:30
Bort Verwilst	6d53229986	Make 1.12.6 the default k8s release (#4306 )	2019-03-04 00:38:56 -08:00
Xavi	1e57d2e21a	[SECURITY] Docker patches for CVE-2019-5736 Ubuntu Bionic (#4267 )	2019-02-19 03:19:36 -08:00
Bort Verwilst	ea41fc5e74	backport cve-2019-5736 to release-2.8 (#4234 ) * [SECURITY] Docker patches for CVE-2019-5736 (#4223) This updates docker 18.06 and 18.09 with the two patches released yesterday to address the new runc exploit. Details here: https://kubernetes.io/blog/2019/02/11/runc-and-cve-2019-5736/ * keep edge versions to same minor * keep edge versions to same minor	2019-02-14 00:55:54 -08:00