You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

166 lines
8.8 KiB

6 years ago
  1. Configurable Parameters in Kubespray
  2. ================================
  3. #### Generic Ansible variables
  4. You can view facts gathered by Ansible automatically
  5. [here](http://docs.ansible.com/ansible/playbooks_variables.html#information-discovered-from-systems-facts).
  6. Some variables of note include:
  7. * *ansible_user*: user to connect to via SSH
  8. * *ansible_default_ipv4.address*: IP address Ansible automatically chooses.
  9. Generated based on the output from the command ``ip -4 route get 8.8.8.8``
  10. #### Common vars that are used in Kubespray
  11. * *calico_version* - Specify version of Calico to use
  12. * *calico_cni_version* - Specify version of Calico CNI plugin to use
  13. * *docker_version* - Specify version of Docker to used (should be quoted
  14. string). Must match one of the keys defined for *docker_versioned_pkg*
  15. in `roles/container-engine/docker/vars/*.yml`.
  16. * *etcd_version* - Specify version of ETCD to use
  17. * *ipip* - Enables Calico ipip encapsulation by default
  18. * *kube_network_plugin* - Sets k8s network plugin (default Calico)
  19. * *kube_proxy_mode* - Changes k8s proxy mode to iptables mode
  20. * *kube_version* - Specify a given Kubernetes hyperkube version
  21. * *searchdomains* - Array of DNS domains to search when looking up hostnames
  22. * *nameservers* - Array of nameservers to use for DNS lookup
  23. * *preinstall_selinux_state* - Set selinux state, permitted values are permissive and disabled.
  24. #### Addressing variables
  25. * *ip* - IP to use for binding services (host var)
  26. * *access_ip* - IP for other hosts to use to connect to. Often required when
  27. deploying from a cloud, such as OpenStack or GCE and you have separate
  28. public/floating and private IPs.
  29. * *ansible_default_ipv4.address* - Not Kubespray-specific, but it is used if ip
  30. and access_ip are undefined
  31. * *loadbalancer_apiserver* - If defined, all hosts will connect to this
  32. address instead of localhost for kube-masters and kube-master[0] for
  33. kube-nodes. See more details in the
  34. [HA guide](https://github.com/kubernetes-sigs/kubespray/blob/master/docs/ha-mode.md).
  35. * *loadbalancer_apiserver_localhost* - makes all hosts to connect to
  36. the apiserver internally load balanced endpoint. Mutual exclusive to the
  37. `loadbalancer_apiserver`. See more details in the
  38. [HA guide](https://github.com/kubernetes-sigs/kubespray/blob/master/docs/ha-mode.md).
  39. #### Cluster variables
  40. Kubernetes needs some parameters in order to get deployed. These are the
  41. following default cluster parameters:
  42. * *cluster_name* - Name of cluster (default is cluster.local)
  43. * *dns_domain* - Name of cluster DNS domain (default is cluster.local)
  44. * *kube_network_plugin* - Plugin to use for container networking
  45. * *kube_service_addresses* - Subnet for cluster IPs (default is
  46. 10.233.0.0/18). Must not overlap with kube_pods_subnet
  47. * *kube_pods_subnet* - Subnet for Pod IPs (default is 10.233.64.0/18). Must not
  48. overlap with kube_service_addresses.
  49. * *kube_network_node_prefix* - Subnet allocated per-node for pod IPs. Remainin
  50. bits in kube_pods_subnet dictates how many kube-nodes can be in cluster.
  51. * *skydns_server* - Cluster IP for DNS (default is 10.233.0.3)
  52. * *skydns_server_secondary* - Secondary Cluster IP for CoreDNS used with coredns_dual deployment (default is 10.233.0.4)
  53. * *cloud_provider* - Enable extra Kubelet option if operating inside GCE or
  54. OpenStack (default is unset)
  55. * *kube_hostpath_dynamic_provisioner* - Required for use of PetSets type in
  56. Kubernetes
  57. * *kube_feature_gates* - A list of key=value pairs that describe feature gates for
  58. alpha/experimental Kubernetes features. (defaults is `[]`)
  59. * *authorization_modes* - A list of [authorization mode](
  60. https://kubernetes.io/docs/admin/authorization/#using-flags-for-your-authorization-module)
  61. that the cluster should be configured for. Defaults to `['Node', 'RBAC']`
  62. (Node and RBAC authorizers).
  63. Note: `Node` and `RBAC` are enabled by default. Previously deployed clusters can be
  64. converted to RBAC mode. However, your apps which rely on Kubernetes API will
  65. require a service account and cluster role bindings. You can override this
  66. setting by setting authorization_modes to `[]`.
  67. Note, if cloud providers have any use of the ``10.233.0.0/16``, like instances'
  68. private addresses, make sure to pick another values for ``kube_service_addresses``
  69. and ``kube_pods_subnet``, for example from the ``172.18.0.0/16``.
  70. #### DNS variables
  71. By default, hosts are set up with 8.8.8.8 as an upstream DNS server and all
  72. other settings from your existing /etc/resolv.conf are lost. Set the following
  73. variables to match your requirements.
  74. * *upstream_dns_servers* - Array of upstream DNS servers configured on host in
  75. addition to Kubespray deployed DNS
  76. * *nameservers* - Array of DNS servers configured for use by hosts
  77. * *searchdomains* - Array of up to 4 search domains
  78. For more information, see [DNS
  79. Stack](https://github.com/kubernetes-sigs/kubespray/blob/master/docs/dns-stack.md).
  80. #### Other service variables
  81. * *docker_options* - Commonly used to set
  82. ``--insecure-registry=myregistry.mydomain:5000``
  83. * *http_proxy/https_proxy/no_proxy* - Proxy variables for deploying behind a
  84. proxy. Note that no_proxy defaults to all internal cluster IPs and hostnames
  85. that correspond to each node.
  86. * *kubelet_deployment_type* - Controls which platform to deploy kubelet on.
  87. Available options are ``host``, ``rkt``, and ``docker``. ``docker`` mode
  88. is unlikely to work on newer releases. Starting with Kubernetes v1.7
  89. series, this now defaults to ``host``. Before v1.7, the default was Docker.
  90. This is because of cgroup [issues](https://github.com/kubernetes/kubernetes/issues/43704).
  91. * *kubelet_load_modules* - For some things, kubelet needs to load kernel modules. For example,
  92. dynamic kernel services are needed for mounting persistent volumes into containers. These may not be
  93. loaded by preinstall kubernetes processes. For example, ceph and rbd backed volumes. Set this variable to
  94. true to let kubelet load kernel modules.
  95. * *kubelet_cgroup_driver* - Allows manual override of the
  96. cgroup-driver option for Kubelet. By default autodetection is used
  97. to match Docker configuration.
  98. * *kubelet_rotate_certificates* - Auto rotate the kubelet client certificates by requesting new certificates
  99. from the kube-apiserver when the certificate expiration approaches.
  100. * *node_labels* - Labels applied to nodes via kubelet --node-labels parameter.
  101. For example, labels can be set in the inventory as variables or more widely in group_vars.
  102. *node_labels* must be defined as a dict:
  103. ```
  104. node_labels:
  105. label1_name: label1_value
  106. label2_name: label2_value
  107. ```
  108. * *node_taints* - Taints applied to nodes via kubelet --register-with-taints parameter.
  109. For example, taints can be set in the inventory as variables or more widely in group_vars.
  110. *node_taints* has to be defined as a list of strings in format `key=value:effect`, e.g.:
  111. ```
  112. node_taints:
  113. - "node.example.com/external=true:NoSchedule"
  114. ```
  115. * *podsecuritypolicy_enabled* - When set to `true`, enables the PodSecurityPolicy admission controller and defines two policies `privileged` (applying to all resources in `kube-system` namespace and kubelet) and `restricted` (applying all other namespaces).
  116. Addons deployed in kube-system namespaces are handled.
  117. * *kubernetes_audit* - When set to `true`, enables Auditing.
  118. The auditing parameters can be tuned via the following variables (which default values are shown below):
  119. * `audit_log_path`: /var/log/audit/kube-apiserver-audit.log
  120. * `audit_log_maxage`: 30
  121. * `audit_log_maxbackups`: 1
  122. * `audit_log_maxsize`: 100
  123. * `audit_policy_file`: "{{ kube_config_dir }}/audit-policy/apiserver-audit-policy.yaml"
  124. By default, the `audit_policy_file` contains [default rules](https://github.com/kubernetes-sigs/kubespray/blob/master/roles/kubernetes/master/templates/apiserver-audit-policy.yaml.j2) that can be overridden with the `audit_policy_custom_rules` variable.
  125. ##### Custom flags for Kube Components
  126. For all kube components, custom flags can be passed in. This allows for edge cases where users need changes to the default deployment that may not be applicable to all deployments. This can be done by providing a list of flags. The `kubelet_node_custom_flags` apply kubelet settings only to nodes and not masters. Example:
  127. ```
  128. kubelet_custom_flags:
  129. - "--eviction-hard=memory.available<100Mi"
  130. - "--eviction-soft-grace-period=memory.available=30s"
  131. - "--eviction-soft=memory.available<300Mi"
  132. ```
  133. The possible vars are:
  134. * *apiserver_custom_flags*
  135. * *controller_mgr_custom_flags*
  136. * *scheduler_custom_flags*
  137. * *kubelet_custom_flags*
  138. * *kubelet_node_custom_flags*
  139. #### User accounts
  140. By default, a user with admin rights is created, named `kube`.
  141. The password can be viewed after deployment by looking at the file
  142. `{{ credentials_dir }}/kube_user.creds` (`credentials_dir` is set to `{{ inventory_dir }}/credentials` by default). This contains a randomly generated
  143. password. If you wish to set your own password, just precreate/modify this
  144. file yourself or change `kube_api_pwd` var.