From 1301e69c7d1c3440fe662f77b500c52893ed249f Mon Sep 17 00:00:00 2001 From: holmesb <5072156+holmesb@users.noreply.github.com> Date: Fri, 9 Oct 2020 09:15:07 +0100 Subject: [PATCH] =?UTF-8?q?If=20no=5Fproxy=5Fexclude=5Fworkers=20is=20true?= =?UTF-8?q?,=20workers=20will=20be=20excluded=20from=20the=20no=5Fproxy=20?= =?UTF-8?q?variable.=C2=A0=20This=20prevents=20docker=20engine=20restartin?= =?UTF-8?q?g=20when=20scaling=20workers.=20(#6520)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: holmesb <5072156+holmesb@users.noreply.github.com> --- docs/proxy.md | 7 ++ docs/vars.md | 2 +- inventory/sample/group_vars/all/all.yml | 5 ++ roles/kubespray-defaults/tasks/no_proxy.yml | 71 +++++++++++---------- 4 files changed, 51 insertions(+), 34 deletions(-) mode change 100644 => 100755 roles/kubespray-defaults/tasks/no_proxy.yml diff --git a/docs/proxy.md b/docs/proxy.md index 867b90f4d..cb8472d76 100644 --- a/docs/proxy.md +++ b/docs/proxy.md @@ -14,3 +14,10 @@ If you set http and https proxy, all nodes and loadbalancer will be excluded fro ## Set additional addresses to default no_proxy (all cluster nodes and loadbalancer) `additional_no_proxy: "aditional_host,"` + +## Exclude workers from no_proxy + +Since workers are included in the no_proxy variable, by default, docker engine will be restarted on all nodes (all +pods will restart) when adding or removing workers. To override this behaviour by only including master nodes in the +no_proxy variable, set: +`no_proxy_exclude_workers: true` diff --git a/docs/vars.md b/docs/vars.md index 710695e2b..598fd4d7a 100644 --- a/docs/vars.md +++ b/docs/vars.md @@ -109,7 +109,7 @@ Stack](https://github.com/kubernetes-sigs/kubespray/blob/master/docs/dns-stack.m * *docker_plugins* - This list can be used to define [Docker plugins](https://docs.docker.com/engine/extend/) to install. * *containerd_config* - Controls some parameters in containerd configuration file (usually /etc/containerd/config.toml). [Default config](https://github.com/kubernetes-sigs/kubespray/blob/master/roles/container-engine/containerd/defaults/main.yml) can be overriden in inventory vars. -* *http_proxy/https_proxy/no_proxy* - Proxy variables for deploying behind a +* *http_proxy/https_proxy/no_proxy/no_proxy_exclude_workers/additional_no_proxy* - Proxy variables for deploying behind a proxy. Note that no_proxy defaults to all internal cluster IPs and hostnames that correspond to each node. * *kubelet_deployment_type* - Controls which platform to deploy kubelet on. diff --git a/inventory/sample/group_vars/all/all.yml b/inventory/sample/group_vars/all/all.yml index f3b7042d3..aa517a903 100644 --- a/inventory/sample/group_vars/all/all.yml +++ b/inventory/sample/group_vars/all/all.yml @@ -68,6 +68,11 @@ loadbalancer_apiserver_healthcheck_port: 8081 ## If you need exclude all cluster nodes from proxy and other resources, add other resources here. # additional_no_proxy: "" +## Since workers are included in the no_proxy variable by default, docker engine will be restarted on all nodes (all +## pods will restart) when adding or removing workers. To override this behaviour by only including master nodes in the +## no_proxy variable, set below to true: +no_proxy_exclude_workers: false + ## Certificate Management ## This setting determines whether certs are generated via scripts. ## Chose 'none' if you provide your own certificates. diff --git a/roles/kubespray-defaults/tasks/no_proxy.yml b/roles/kubespray-defaults/tasks/no_proxy.yml old mode 100644 new mode 100755 index 01c6e9ddf..07098c674 --- a/roles/kubespray-defaults/tasks/no_proxy.yml +++ b/roles/kubespray-defaults/tasks/no_proxy.yml @@ -1,33 +1,38 @@ ---- -- name: Set no_proxy to all assigned cluster IPs and hostnames - set_fact: - no_proxy_prepare: >- - {%- if loadbalancer_apiserver is defined -%} - {{ apiserver_loadbalancer_domain_name| default('') }}, - {{ loadbalancer_apiserver.address | default('') }}, - {%- endif -%} - {%- for item in (groups['k8s-cluster'] + groups['etcd'] + groups['calico-rr']|default([]))|unique -%} - {{ hostvars[item]['access_ip'] | default(hostvars[item]['ip'] | default(fallback_ips[item])) }}, - {%- if item != hostvars[item].get('ansible_hostname', '') -%} - {{ hostvars[item]['ansible_hostname'] }}, - {{ hostvars[item]['ansible_hostname'] }}.{{ dns_domain }}, - {%- endif -%} - {{ item }},{{ item }}.{{ dns_domain }}, - {%- endfor -%} - {%- if additional_no_proxy is defined -%} - {{ additional_no_proxy }}, - {%- endif -%} - 127.0.0.1,localhost,{{ kube_service_addresses }},{{ kube_pods_subnet }} - delegate_to: localhost - connection: local - delegate_facts: yes - become: no - run_once: yes - -- name: Populates no_proxy to all hosts - set_fact: - no_proxy: "{{ hostvars.localhost.no_proxy_prepare }}" - proxy_env: "{{ proxy_env | combine({ - 'no_proxy': hostvars.localhost.no_proxy_prepare, - 'NO_PROXY': hostvars.localhost.no_proxy_prepare - }) }}" +--- +- name: Set no_proxy to all assigned cluster IPs and hostnames + set_fact: + no_proxy_prepare: >- + {%- if loadbalancer_apiserver is defined -%} + {{ apiserver_loadbalancer_domain_name| default('') }}, + {{ loadbalancer_apiserver.address | default('') }}, + {%- endif -%} + {%- if ( (no_proxy_exclude_workers is defined) and (no_proxy_exclude_workers) ) -%} + {% set cluster_or_master = 'kube-master' %} + {% else %} + {% set cluster_or_master = 'k8s-cluster' %} + {% endif %} + {%- for item in (groups[cluster_or_master] + groups['etcd'] + groups['calico-rr']|default([]))|unique -%} + {{ hostvars[item]['access_ip'] | default(hostvars[item]['ip'] | default(fallback_ips[item])) }}, + {%- if item != hostvars[item].get('ansible_hostname', '') -%} + {{ hostvars[item]['ansible_hostname'] }}, + {{ hostvars[item]['ansible_hostname'] }}.{{ dns_domain }}, + {%- endif -%} + {{ item }},{{ item }}.{{ dns_domain }}, + {%- endfor -%} + {%- if additional_no_proxy is defined -%} + {{ additional_no_proxy }}, + {%- endif -%} + 127.0.0.1,localhost,{{ kube_service_addresses }},{{ kube_pods_subnet }} + delegate_to: localhost + connection: local + delegate_facts: yes + become: no + run_once: yes + +- name: Populates no_proxy to all hosts + set_fact: + no_proxy: "{{ hostvars.localhost.no_proxy_prepare }}" + proxy_env: "{{ proxy_env | combine({ + 'no_proxy': hostvars.localhost.no_proxy_prepare, + 'NO_PROXY': hostvars.localhost.no_proxy_prepare + }) }}"