You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

362 lines
13 KiB

7 years ago
contiv network support (#1914) * Add Contiv support Contiv is a network plugin for Kubernetes and Docker. It supports vlan/vxlan/BGP/Cisco ACI technologies. It support firewall policies, multiple networks and bridging pods onto physical networks. * Update contiv version to 1.1.4 Update contiv version to 1.1.4 and added SVC_SUBNET in contiv-config. * Load openvswitch module to workaround on CentOS7.4 * Set contiv cni version to 0.1.0 Correct contiv CNI version to 0.1.0. * Use kube_apiserver_endpoint for K8S_API_SERVER Use kube_apiserver_endpoint as K8S_API_SERVER to make contiv talks to a available endpoint no matter if there's a loadbalancer or not. * Make contiv use its own etcd Before this commit, contiv is using a etcd proxy mode to k8s etcd, this work fine when the etcd hosts are co-located with contiv etcd proxy, however the k8s peering certs are only in etcd group, as a result the etcd-proxy is not able to peering with the k8s etcd on etcd group, plus the netplugin is always trying to find the etcd endpoint on localhost, this will cause problem for all netplugins not runnign on etcd group nodes. This commit make contiv uses its own etcd, separate from k8s one. on kube-master nodes (where net-master runs), it will run as leader mode and on all rest nodes it will run as proxy mode. * Use cp instead of rsync to copy cni binaries Since rsync has been removed from hyperkube, this commit changes it to use cp instead. * Make contiv-etcd able to run on master nodes * Add rbac_enabled flag for contiv pods * Add contiv into CNI network plugin lists * migrate contiv test to tests/files Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> * Add required rules for contiv netplugin * Better handling json return of fwdMode * Make contiv etcd port configurable * Use default var instead of templating * roles/download/defaults/main.yml: use contiv 1.1.7 Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com>
7 years ago
contiv network support (#1914) * Add Contiv support Contiv is a network plugin for Kubernetes and Docker. It supports vlan/vxlan/BGP/Cisco ACI technologies. It support firewall policies, multiple networks and bridging pods onto physical networks. * Update contiv version to 1.1.4 Update contiv version to 1.1.4 and added SVC_SUBNET in contiv-config. * Load openvswitch module to workaround on CentOS7.4 * Set contiv cni version to 0.1.0 Correct contiv CNI version to 0.1.0. * Use kube_apiserver_endpoint for K8S_API_SERVER Use kube_apiserver_endpoint as K8S_API_SERVER to make contiv talks to a available endpoint no matter if there's a loadbalancer or not. * Make contiv use its own etcd Before this commit, contiv is using a etcd proxy mode to k8s etcd, this work fine when the etcd hosts are co-located with contiv etcd proxy, however the k8s peering certs are only in etcd group, as a result the etcd-proxy is not able to peering with the k8s etcd on etcd group, plus the netplugin is always trying to find the etcd endpoint on localhost, this will cause problem for all netplugins not runnign on etcd group nodes. This commit make contiv uses its own etcd, separate from k8s one. on kube-master nodes (where net-master runs), it will run as leader mode and on all rest nodes it will run as proxy mode. * Use cp instead of rsync to copy cni binaries Since rsync has been removed from hyperkube, this commit changes it to use cp instead. * Make contiv-etcd able to run on master nodes * Add rbac_enabled flag for contiv pods * Add contiv into CNI network plugin lists * migrate contiv test to tests/files Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> * Add required rules for contiv netplugin * Better handling json return of fwdMode * Make contiv etcd port configurable * Use default var instead of templating * roles/download/defaults/main.yml: use contiv 1.1.7 Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com>
7 years ago
contiv network support (#1914) * Add Contiv support Contiv is a network plugin for Kubernetes and Docker. It supports vlan/vxlan/BGP/Cisco ACI technologies. It support firewall policies, multiple networks and bridging pods onto physical networks. * Update contiv version to 1.1.4 Update contiv version to 1.1.4 and added SVC_SUBNET in contiv-config. * Load openvswitch module to workaround on CentOS7.4 * Set contiv cni version to 0.1.0 Correct contiv CNI version to 0.1.0. * Use kube_apiserver_endpoint for K8S_API_SERVER Use kube_apiserver_endpoint as K8S_API_SERVER to make contiv talks to a available endpoint no matter if there's a loadbalancer or not. * Make contiv use its own etcd Before this commit, contiv is using a etcd proxy mode to k8s etcd, this work fine when the etcd hosts are co-located with contiv etcd proxy, however the k8s peering certs are only in etcd group, as a result the etcd-proxy is not able to peering with the k8s etcd on etcd group, plus the netplugin is always trying to find the etcd endpoint on localhost, this will cause problem for all netplugins not runnign on etcd group nodes. This commit make contiv uses its own etcd, separate from k8s one. on kube-master nodes (where net-master runs), it will run as leader mode and on all rest nodes it will run as proxy mode. * Use cp instead of rsync to copy cni binaries Since rsync has been removed from hyperkube, this commit changes it to use cp instead. * Make contiv-etcd able to run on master nodes * Add rbac_enabled flag for contiv pods * Add contiv into CNI network plugin lists * migrate contiv test to tests/files Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> * Add required rules for contiv netplugin * Better handling json return of fwdMode * Make contiv etcd port configurable * Use default var instead of templating * roles/download/defaults/main.yml: use contiv 1.1.7 Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com>
7 years ago
  1. ---
  2. local_release_dir: /tmp
  3. # Used to only evaluate vars from download role
  4. skip_downloads: false
  5. # if this is set to true will only download files once. Doesn't work
  6. # on Container Linux by CoreOS unless the download_localhost is true and localhost
  7. # is running another OS type. Default compress level is 1 (fastest).
  8. download_run_once: False
  9. download_compress: 1
  10. # if this is set to true, uses the localhost for download_run_once mode
  11. # (requires docker and sudo to access docker). You may want this option for
  12. # local caching of docker images or for Container Linux by CoreOS cluster nodes.
  13. # Otherwise, uses the first node in the kube-master group to store images
  14. # in the download_run_once mode.
  15. download_localhost: False
  16. # Always pull images if set to True. Otherwise check by the repo's tag/digest.
  17. download_always_pull: False
  18. # Use the first kube-master if download_localhost is not set
  19. download_delegate: "{% if download_localhost %}localhost{% else %}{{groups['kube-master'][0]}}{% endif %}"
  20. # Versions
  21. kube_version: v1.9.3
  22. kubeadm_version: "{{ kube_version }}"
  23. etcd_version: v3.2.4
  24. # TODO(mattymo): Move calico versions to roles/network_plugins/calico/defaults
  25. # after migration to container download
  26. calico_version: "v2.6.2"
  27. calico_ctl_version: "v1.6.1"
  28. calico_cni_version: "v1.11.0"
  29. calico_policy_version: "v1.0.0"
  30. calico_rr_version: "v0.4.0"
  31. flannel_version: "v0.9.1"
  32. flannel_cni_version: "v0.3.0"
  33. istio_version: "0.2.6"
  34. vault_version: 0.8.1
  35. weave_version: 2.2.0
  36. pod_infra_version: 3.0
  37. contiv_version: 1.1.7
  38. cilium_version: "v1.0.0-rc4"
  39. # Download URLs
  40. istioctl_download_url: "https://storage.googleapis.com/istio-release/releases/{{ istio_version }}/istioctl/istioctl-linux"
  41. kubeadm_download_url: "https://storage.googleapis.com/kubernetes-release/release/{{ kubeadm_version }}/bin/linux/amd64/kubeadm"
  42. vault_download_url: "https://releases.hashicorp.com/vault/{{ vault_version }}/vault_{{ vault_version }}_linux_amd64.zip"
  43. # Checksums
  44. istioctl_checksum: fd703063c540b8c0ab943f478c05ab257d88ae27224c746a27d0526ddbf7c370
  45. kubeadm_checksum: 9ebbb1fbf3a9e72d7df3f0dc02500dc8f957f39489b22cf577498c8a7c6b39b1
  46. vault_binary_checksum: 3c4d70ba71619a43229e65c67830e30e050eab7a81ac6b28325ff707e5914188
  47. # Containers
  48. etcd_image_repo: "quay.io/coreos/etcd"
  49. etcd_image_tag: "{{ etcd_version }}"
  50. flannel_image_repo: "quay.io/coreos/flannel"
  51. flannel_image_tag: "{{ flannel_version }}"
  52. flannel_cni_image_repo: "quay.io/coreos/flannel-cni"
  53. flannel_cni_image_tag: "{{ flannel_cni_version }}"
  54. calicoctl_image_repo: "quay.io/calico/ctl"
  55. calicoctl_image_tag: "{{ calico_ctl_version }}"
  56. calico_node_image_repo: "quay.io/calico/node"
  57. calico_node_image_tag: "{{ calico_version }}"
  58. calico_cni_image_repo: "quay.io/calico/cni"
  59. calico_cni_image_tag: "{{ calico_cni_version }}"
  60. calico_policy_image_repo: "quay.io/calico/kube-controllers"
  61. calico_policy_image_tag: "{{ calico_policy_version }}"
  62. calico_rr_image_repo: "quay.io/calico/routereflector"
  63. calico_rr_image_tag: "{{ calico_rr_version }}"
  64. hyperkube_image_repo: "quay.io/coreos/hyperkube"
  65. hyperkube_image_tag: "{{ kube_version }}_coreos.0"
  66. pod_infra_image_repo: "gcr.io/google_containers/pause-amd64"
  67. pod_infra_image_tag: "{{ pod_infra_version }}"
  68. install_socat_image_repo: "xueshanf/install-socat"
  69. install_socat_image_tag: "latest"
  70. netcheck_version: "v1.0"
  71. netcheck_agent_img_repo: "quay.io/l23network/k8s-netchecker-agent"
  72. netcheck_agent_tag: "{{ netcheck_version }}"
  73. netcheck_server_img_repo: "quay.io/l23network/k8s-netchecker-server"
  74. netcheck_server_tag: "{{ netcheck_version }}"
  75. weave_kube_image_repo: "weaveworks/weave-kube"
  76. weave_kube_image_tag: "{{ weave_version }}"
  77. weave_npc_image_repo: "weaveworks/weave-npc"
  78. weave_npc_image_tag: "{{ weave_version }}"
  79. contiv_image_repo: "contiv/netplugin"
  80. contiv_image_tag: "{{ contiv_version }}"
  81. contiv_auth_proxy_image_repo: "contiv/auth_proxy"
  82. contiv_auth_proxy_image_tag: "{{ contiv_version }}"
  83. cilium_image_repo: "docker.io/cilium/cilium"
  84. cilium_image_tag: "{{ cilium_version }}"
  85. nginx_image_repo: nginx
  86. nginx_image_tag: 1.13
  87. dnsmasq_version: 2.78
  88. dnsmasq_image_repo: "andyshinn/dnsmasq"
  89. dnsmasq_image_tag: "{{ dnsmasq_version }}"
  90. kubedns_version: 1.14.8
  91. kubedns_image_repo: "gcr.io/google_containers/k8s-dns-kube-dns-amd64"
  92. kubedns_image_tag: "{{ kubedns_version }}"
  93. dnsmasq_nanny_image_repo: "gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64"
  94. dnsmasq_nanny_image_tag: "{{ kubedns_version }}"
  95. dnsmasq_sidecar_image_repo: "gcr.io/google_containers/k8s-dns-sidecar-amd64"
  96. dnsmasq_sidecar_image_tag: "{{ kubedns_version }}"
  97. dnsmasqautoscaler_version: 1.1.2
  98. dnsmasqautoscaler_image_repo: "gcr.io/google_containers/cluster-proportional-autoscaler-amd64"
  99. dnsmasqautoscaler_image_tag: "{{ dnsmasqautoscaler_version }}"
  100. kubednsautoscaler_version: 1.1.2
  101. kubednsautoscaler_image_repo: "gcr.io/google_containers/cluster-proportional-autoscaler-amd64"
  102. kubednsautoscaler_image_tag: "{{ kubednsautoscaler_version }}"
  103. test_image_repo: busybox
  104. test_image_tag: latest
  105. elasticsearch_version: "v2.4.1"
  106. elasticsearch_image_repo: "gcr.io/google_containers/elasticsearch"
  107. elasticsearch_image_tag: "{{ elasticsearch_version }}"
  108. fluentd_version: "1.22"
  109. fluentd_image_repo: "gcr.io/google_containers/fluentd-elasticsearch"
  110. fluentd_image_tag: "{{ fluentd_version }}"
  111. kibana_version: "v4.6.1"
  112. kibana_image_repo: "gcr.io/google_containers/kibana"
  113. kibana_image_tag: "{{ kibana_version }}"
  114. helm_version: "v2.8.1"
  115. helm_image_repo: "lachlanevenson/k8s-helm"
  116. helm_image_tag: "{{ helm_version }}"
  117. tiller_image_repo: "gcr.io/kubernetes-helm/tiller"
  118. tiller_image_tag: "{{ helm_version }}"
  119. vault_image_repo: "vault"
  120. vault_image_tag: "{{ vault_version }}"
  121. downloads:
  122. netcheck_server:
  123. enabled: "{{ deploy_netchecker }}"
  124. container: true
  125. repo: "{{ netcheck_server_img_repo }}"
  126. tag: "{{ netcheck_server_tag }}"
  127. sha256: "{{ netcheck_server_digest_checksum|default(None) }}"
  128. netcheck_agent:
  129. enabled: "{{ deploy_netchecker }}"
  130. container: true
  131. repo: "{{ netcheck_agent_img_repo }}"
  132. tag: "{{ netcheck_agent_tag }}"
  133. sha256: "{{ netcheck_agent_digest_checksum|default(None) }}"
  134. etcd:
  135. enabled: true
  136. container: true
  137. repo: "{{ etcd_image_repo }}"
  138. tag: "{{ etcd_image_tag }}"
  139. sha256: "{{ etcd_digest_checksum|default(None) }}"
  140. kubeadm:
  141. enabled: "{{ kubeadm_enabled }}"
  142. file: true
  143. version: "{{ kubeadm_version }}"
  144. dest: "kubeadm"
  145. sha256: "{{ kubeadm_checksum }}"
  146. source_url: "{{ kubeadm_download_url }}"
  147. url: "{{ kubeadm_download_url }}"
  148. unarchive: false
  149. owner: "root"
  150. mode: "0755"
  151. istioctl:
  152. enabled: "{{ istio_enabled }}"
  153. file: true
  154. version: "{{ istio_version }}"
  155. dest: "istio/istioctl"
  156. sha256: "{{ istioctl_checksum }}"
  157. source_url: "{{ istioctl_download_url }}"
  158. url: "{{ istioctl_download_url }}"
  159. unarchive: false
  160. owner: "root"
  161. mode: "0755"
  162. hyperkube:
  163. enabled: true
  164. container: true
  165. repo: "{{ hyperkube_image_repo }}"
  166. tag: "{{ hyperkube_image_tag }}"
  167. sha256: "{{ hyperkube_digest_checksum|default(None) }}"
  168. cilium:
  169. enabled: "{{ kube_network_plugin == 'cilium' }}"
  170. container: true
  171. repo: "{{ cilium_image_repo }}"
  172. tag: "{{ cilium_image_tag }}"
  173. sha256: "{{ cilium_digest_checksum|default(None) }}"
  174. flannel:
  175. enabled: "{{ kube_network_plugin == 'flannel' or kube_network_plugin == 'canal' }}"
  176. container: true
  177. repo: "{{ flannel_image_repo }}"
  178. tag: "{{ flannel_image_tag }}"
  179. sha256: "{{ flannel_digest_checksum|default(None) }}"
  180. flannel_cni:
  181. enabled: "{{ kube_network_plugin == 'flannel' }}"
  182. container: true
  183. repo: "{{ flannel_cni_image_repo }}"
  184. tag: "{{ flannel_cni_image_tag }}"
  185. sha256: "{{ flannel_cni_digest_checksum|default(None) }}"
  186. calicoctl:
  187. enabled: "{{ kube_network_plugin == 'calico' or kube_network_plugin == 'canal' }}"
  188. container: true
  189. repo: "{{ calicoctl_image_repo }}"
  190. tag: "{{ calicoctl_image_tag }}"
  191. sha256: "{{ calicoctl_digest_checksum|default(None) }}"
  192. calico_node:
  193. enabled: "{{ kube_network_plugin == 'calico' or kube_network_plugin == 'canal' }}"
  194. container: true
  195. repo: "{{ calico_node_image_repo }}"
  196. tag: "{{ calico_node_image_tag }}"
  197. sha256: "{{ calico_node_digest_checksum|default(None) }}"
  198. calico_cni:
  199. enabled: "{{ kube_network_plugin == 'calico' or kube_network_plugin == 'canal' }}"
  200. container: true
  201. repo: "{{ calico_cni_image_repo }}"
  202. tag: "{{ calico_cni_image_tag }}"
  203. sha256: "{{ calico_cni_digest_checksum|default(None) }}"
  204. calico_policy:
  205. enabled: "{{ enable_network_policy or kube_network_plugin == 'canal' }}"
  206. container: true
  207. repo: "{{ calico_policy_image_repo }}"
  208. tag: "{{ calico_policy_image_tag }}"
  209. sha256: "{{ calico_policy_digest_checksum|default(None) }}"
  210. calico_rr:
  211. enabled: "{{ peer_with_calico_rr is defined and peer_with_calico_rr}} and kube_network_plugin == 'calico'"
  212. container: true
  213. repo: "{{ calico_rr_image_repo }}"
  214. tag: "{{ calico_rr_image_tag }}"
  215. sha256: "{{ calico_rr_digest_checksum|default(None) }}"
  216. weave_kube:
  217. enabled: "{{ kube_network_plugin == 'weave' }}"
  218. container: true
  219. repo: "{{ weave_kube_image_repo }}"
  220. tag: "{{ weave_kube_image_tag }}"
  221. sha256: "{{ weave_kube_digest_checksum|default(None) }}"
  222. weave_npc:
  223. enabled: "{{ kube_network_plugin == 'weave' }}"
  224. container: true
  225. repo: "{{ weave_npc_image_repo }}"
  226. tag: "{{ weave_npc_image_tag }}"
  227. sha256: "{{ weave_npc_digest_checksum|default(None) }}"
  228. contiv:
  229. enabled: "{{ kube_network_plugin == 'contiv' }}"
  230. container: true
  231. repo: "{{ contiv_image_repo }}"
  232. tag: "{{ contiv_image_tag }}"
  233. sha256: "{{ contiv_digest_checksum|default(None) }}"
  234. contiv_auth_proxy:
  235. enabled: "{{ kube_network_plugin == 'contiv' }}"
  236. container: true
  237. repo: "{{ contiv_auth_proxy_image_repo }}"
  238. tag: "{{ contiv_auth_proxy_image_tag }}"
  239. sha256: "{{ contiv_auth_proxy_digest_checksum|default(None) }}"
  240. pod_infra:
  241. enabled: true
  242. container: true
  243. repo: "{{ pod_infra_image_repo }}"
  244. tag: "{{ pod_infra_image_tag }}"
  245. sha256: "{{ pod_infra_digest_checksum|default(None) }}"
  246. install_socat:
  247. enabled: "{{ ansible_os_family in ['CoreOS', 'Container Linux by CoreOS'] }}"
  248. container: true
  249. repo: "{{ install_socat_image_repo }}"
  250. tag: "{{ install_socat_image_tag }}"
  251. sha256: "{{ install_socat_digest_checksum|default(None) }}"
  252. nginx:
  253. enabled: true
  254. container: true
  255. repo: "{{ nginx_image_repo }}"
  256. tag: "{{ nginx_image_tag }}"
  257. sha256: "{{ nginx_digest_checksum|default(None) }}"
  258. dnsmasq:
  259. enabled: "{{ dns_mode == 'dnsmasq_kubedns' }}"
  260. container: true
  261. repo: "{{ dnsmasq_image_repo }}"
  262. tag: "{{ dnsmasq_image_tag }}"
  263. sha256: "{{ dnsmasq_digest_checksum|default(None) }}"
  264. kubedns:
  265. enabled: true
  266. container: true
  267. repo: "{{ kubedns_image_repo }}"
  268. tag: "{{ kubedns_image_tag }}"
  269. sha256: "{{ kubedns_digest_checksum|default(None) }}"
  270. dnsmasq_nanny:
  271. enabled: true
  272. container: true
  273. repo: "{{ dnsmasq_nanny_image_repo }}"
  274. tag: "{{ dnsmasq_nanny_image_tag }}"
  275. sha256: "{{ dnsmasq_nanny_digest_checksum|default(None) }}"
  276. dnsmasq_sidecar:
  277. enabled: true
  278. container: true
  279. repo: "{{ dnsmasq_sidecar_image_repo }}"
  280. tag: "{{ dnsmasq_sidecar_image_tag }}"
  281. sha256: "{{ dnsmasq_sidecar_digest_checksum|default(None) }}"
  282. kubednsautoscaler:
  283. enabled: true
  284. container: true
  285. repo: "{{ kubednsautoscaler_image_repo }}"
  286. tag: "{{ kubednsautoscaler_image_tag }}"
  287. sha256: "{{ kubednsautoscaler_digest_checksum|default(None) }}"
  288. testbox:
  289. enabled: true
  290. container: true
  291. repo: "{{ test_image_repo }}"
  292. tag: "{{ test_image_tag }}"
  293. sha256: "{{ testbox_digest_checksum|default(None) }}"
  294. elasticsearch:
  295. enabled: "{{ efk_enabled }}"
  296. container: true
  297. repo: "{{ elasticsearch_image_repo }}"
  298. tag: "{{ elasticsearch_image_tag }}"
  299. sha256: "{{ elasticsearch_digest_checksum|default(None) }}"
  300. fluentd:
  301. enabled: "{{ efk_enabled }}"
  302. container: true
  303. repo: "{{ fluentd_image_repo }}"
  304. tag: "{{ fluentd_image_tag }}"
  305. sha256: "{{ fluentd_digest_checksum|default(None) }}"
  306. kibana:
  307. enabled: "{{ efk_enabled }}"
  308. container: true
  309. repo: "{{ kibana_image_repo }}"
  310. tag: "{{ kibana_image_tag }}"
  311. sha256: "{{ kibana_digest_checksum|default(None) }}"
  312. helm:
  313. enabled: "{{ helm_enabled }}"
  314. container: true
  315. repo: "{{ helm_image_repo }}"
  316. tag: "{{ helm_image_tag }}"
  317. sha256: "{{ helm_digest_checksum|default(None) }}"
  318. tiller:
  319. enabled: "{{ helm_enabled }}"
  320. container: true
  321. repo: "{{ tiller_image_repo }}"
  322. tag: "{{ tiller_image_tag }}"
  323. sha256: "{{ tiller_digest_checksum|default(None) }}"
  324. vault:
  325. enabled: "{{ cert_management == 'vault' }}"
  326. container: "{{ vault_deployment_type != 'host' }}"
  327. file: "{{ vault_deployment_type == 'host' }}"
  328. dest: "vault/vault_{{ vault_version }}_linux_amd64.zip"
  329. mode: "0755"
  330. owner: "vault"
  331. repo: "{{ vault_image_repo }}"
  332. sha256: "{{ vault_binary_checksum if vault_deployment_type == 'host' else vault_digest_checksum|d(none) }}"
  333. source_url: "{{ vault_download_url }}"
  334. tag: "{{ vault_image_tag }}"
  335. unarchive: true
  336. url: "{{ vault_download_url }}"
  337. version: "{{ vault_version }}"
  338. download_defaults:
  339. container: false
  340. file: false
  341. repo: None
  342. tag: None
  343. enabled: false
  344. dest: None
  345. version: None
  346. url: None
  347. unarchive: false
  348. owner: kube
  349. mode: None