kubespray

Commit Graph

Author	SHA1	Message	Date
Arthur Outhenin-Chalandre	5d00b851ce	project: fix var-spacing ansible rule (#10266 ) * project: fix var-spacing ansible rule Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: fix spacing on the beginning/end of jinja template Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: fix spacing of default filter Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: fix spacing between filter arguments Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: fix double space at beginning/end of jinja Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> * project: fix remaining jinja[spacing] ansible-lint warning Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch> --------- Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch>	1 year ago
Samuel Liu	d387d4811f	replace createhome (#9314 )	2 years ago
Alessio Greggi	97b4d79ed5	feat: make kubernetes owner parametrized (#8952 ) * feat: make kubernetes owner parametrized * docs: update hardening guide with configuration for CIS 1.1.19 * fix: set etcd data directory permissions to be compliant to CIS 1.1.12	2 years ago
Florian Ruynat	f437ac0b27	Fix nologin wrong path (#6272 )	4 years ago
YichenWong	8a5434419b	fix useradd etcd (#5281 )	5 years ago
Sergii Golovatiuk	f9ff93c606	Make etcd data dir configurable. Closes: #1073 Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>	8 years ago
Bogdan Dobrelya	712872efba	Rework inventory all by real groups' vars * Leave all.yml to keep only optional vars * Store groups' specific vars by existing group names * Fix optional vars casted as mandatory (add default()) * Fix missing defaults for an optional IP var * Relink group_vars for terraform to reflect changes Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>	8 years ago
Josh Conant	245e05ce61	Vault security hardening and role isolation	8 years ago
Josh Conant	f4ec2d18e5	Adding the Vault role	8 years ago
Matthew Mosesohn	fd30131dc2	Revert "Drop linux capabilities and rework users/groups"	8 years ago
Bogdan Dobrelya	cb2e5ac776	Drop linux capabilities and rework users/groups * Drop linux capabilities for unprivileged containerized worlkoads Kargo configures for deployments. * Configure required securityContext/user/group/groups for kube components' static manifests, etcd, calico-rr and k8s apps, like dnsmasq daemonset. * Rework cloud-init (etcd) users creation for CoreOS. * Fix nologin paths, adjust defaults for addusers role and ensure supplementary groups membership added for users. * Add netplug user for network plugins (yet unused by privileged networking containers though). * Grant the kube and netplug users read access for etcd certs via the etcd certs group. * Grant group read access to kube certs via the kube cert group. * Remove priveleged mode for calico-rr and run it under its uid/gid and supplementary etcd_cert group. * Adjust docs. * Align cpu/memory limits and dropped caps with added rkt support for control plane. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>	8 years ago
Paul Czarkowski	7de87d958e	turn adduser/download roles into meta roles This should make things a little more composable, by making these roles meta roles that perform no actions by default we allow each role to own its own resources.	8 years ago
Smana	fca384e24c	first version of CoreOS on GCE Please enter the commit message for your changes. Lines starting	9 years ago
Antoine Legrand	dd61f685b8	AddUser Role	9 years ago

12 Commits (37d824fd2d42a335373f51b4f6efa2e6e029682b)