mirror of
https://github.com/kubernetes-sigs/kubespray.git
synced 2025-12-14 13:54:37 +03:00
0d4f57aa22
* Validate systemd unit files This ensure that we fail early if we have a bad systemd unit file (syntax error, using a version not available in the local version, etc) * Hack to check systemd version for service files validation factory-reset.target was introduced in system 250, same version as the aliasing feature we need for verifying systemd services with ansible. So we only actually executes the validation if that target is present. This is an horrible hack which should be reverted as soon as we drop support for distributions with systemd<250.
132 lines
3.9 KiB
YAML
132 lines
3.9 KiB
YAML
---
|
|
- name: Pre-upgrade control plane
|
|
import_tasks: pre-upgrade.yml
|
|
tags:
|
|
- k8s-pre-upgrade
|
|
|
|
- name: Create webhook token auth config
|
|
template:
|
|
src: webhook-token-auth-config.yaml.j2
|
|
dest: "{{ kube_config_dir }}/webhook-token-auth-config.yaml"
|
|
mode: 0640
|
|
when: kube_webhook_token_auth | default(false)
|
|
|
|
- name: Create webhook authorization config
|
|
template:
|
|
src: webhook-authorization-config.yaml.j2
|
|
dest: "{{ kube_config_dir }}/webhook-authorization-config.yaml"
|
|
mode: 0640
|
|
when: kube_webhook_authorization | default(false)
|
|
|
|
- name: Create kube-scheduler config
|
|
template:
|
|
src: kubescheduler-config.yaml.j2
|
|
dest: "{{ kube_config_dir }}/kubescheduler-config.yaml"
|
|
mode: 0644
|
|
|
|
- name: Apply Kubernetes encrypt at rest config
|
|
import_tasks: encrypt-at-rest.yml
|
|
when:
|
|
- kube_encrypt_secret_data
|
|
tags:
|
|
- kube-apiserver
|
|
|
|
- name: Install | Copy kubectl binary from download dir
|
|
copy:
|
|
src: "{{ downloads.kubectl.dest }}"
|
|
dest: "{{ bin_dir }}/kubectl"
|
|
mode: 0755
|
|
remote_src: true
|
|
tags:
|
|
- kubectl
|
|
- upgrade
|
|
|
|
- name: Install kubectl bash completion
|
|
shell: "{{ bin_dir }}/kubectl completion bash >/etc/bash_completion.d/kubectl.sh"
|
|
when: ansible_os_family in ["Debian","RedHat"]
|
|
tags:
|
|
- kubectl
|
|
ignore_errors: true # noqa ignore-errors
|
|
|
|
- name: Set kubectl bash completion file permissions
|
|
file:
|
|
path: /etc/bash_completion.d/kubectl.sh
|
|
owner: root
|
|
group: root
|
|
mode: 0755
|
|
when: ansible_os_family in ["Debian","RedHat"]
|
|
tags:
|
|
- kubectl
|
|
- upgrade
|
|
ignore_errors: true # noqa ignore-errors
|
|
|
|
- name: Set bash alias for kubectl
|
|
blockinfile:
|
|
path: /etc/bash_completion.d/kubectl.sh
|
|
block: |-
|
|
alias {{ kubectl_alias }}=kubectl
|
|
if [[ $(type -t compopt) = "builtin" ]]; then
|
|
complete -o default -F __start_kubectl {{ kubectl_alias }}
|
|
else
|
|
complete -o default -o nospace -F __start_kubectl {{ kubectl_alias }}
|
|
fi
|
|
state: present
|
|
marker: "# Ansible entries {mark}"
|
|
when:
|
|
- ansible_os_family in ["Debian","RedHat"]
|
|
- kubectl_alias is defined and kubectl_alias != ""
|
|
tags:
|
|
- kubectl
|
|
- upgrade
|
|
ignore_errors: true # noqa ignore-errors
|
|
|
|
- name: Disable SecurityContextDeny admission-controller and enable PodSecurityPolicy
|
|
set_fact:
|
|
kube_apiserver_enable_admission_plugins: "{{ kube_apiserver_enable_admission_plugins | difference(['SecurityContextDeny']) | union(['PodSecurityPolicy']) | unique }}"
|
|
when: podsecuritypolicy_enabled
|
|
|
|
- name: Define nodes already joined to existing cluster and first_kube_control_plane
|
|
import_tasks: define-first-kube-control.yml
|
|
|
|
- name: Include kubeadm setup
|
|
import_tasks: kubeadm-setup.yml
|
|
|
|
- name: Include kubeadm etcd extra tasks
|
|
include_tasks: kubeadm-etcd.yml
|
|
when: etcd_deployment_type == "kubeadm"
|
|
|
|
- name: Include kubeadm secondary server apiserver fixes
|
|
include_tasks: kubeadm-fix-apiserver.yml
|
|
|
|
- name: Include kubelet client cert rotation fixes
|
|
include_tasks: kubelet-fix-client-cert-rotation.yml
|
|
when: kubelet_rotate_certificates
|
|
|
|
- name: Install script to renew K8S control plane certificates
|
|
template:
|
|
src: k8s-certs-renew.sh.j2
|
|
dest: "{{ bin_dir }}/k8s-certs-renew.sh"
|
|
mode: 0755
|
|
|
|
- name: Renew K8S control plane certificates monthly 1/2
|
|
template:
|
|
src: "{{ item }}.j2"
|
|
dest: "/etc/systemd/system/{{ item }}"
|
|
mode: 0644
|
|
validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:{{item}}'"
|
|
# FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
|
|
# Remove once we drop support for systemd < 250
|
|
with_items:
|
|
- k8s-certs-renew.service
|
|
- k8s-certs-renew.timer
|
|
register: k8s_certs_units
|
|
when: auto_renew_certificates
|
|
|
|
- name: Renew K8S control plane certificates monthly 2/2
|
|
systemd:
|
|
name: k8s-certs-renew.timer
|
|
enabled: yes
|
|
state: started
|
|
daemon_reload: "{{ k8s_certs_units is changed }}"
|
|
when: auto_renew_certificates
|