e2f1f8d69d
add-Rocky-9-support ( #9212 )
2 years ago
be2bfd867c
Add Support for Rewrite Plugin to CoreDNS/NodelocalDNS ( #9245 )
2 years ago
6db6c8678c
disable kubelet_authorization_mode_webhook by default ( #9238 )
2 years ago
acb6f243fd
feat: add kubelet systemd service hardening option ( #9194 )
* feat: add kubelet systemd service hardening option
* refactor: move variable name to kubelet_secure_addresses
Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
* docs: add diagram about kubelet_secure_addresses variable
Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
2 years ago
8af86e4c1e
Fix typo.
2 years ago
b46ddf35fc
kube-vip shoud fail if kube_proxy_strict_arp is false in arp mod ( #9223 )
* fix-kube-vip-strict-arp
* fix-kube-vip-strict-arp
2 years ago
e6976a54e1
add pre-commit hook to facilitate local testing ( #9158 )
* add pre-commit hook configuration
* add tmp.md to .gitignore
* describe the use of pre-commit hook in CONTRIBUTING.md
* fix docs/integration.md errors identified by markdownlint
* fix docs/<file>.md errors identified by markdownlint
* docs/azure-csi.md
* docs/azure.md
* docs/bootstrap-os.md
* docs/calico.md
* docs/debian.md
* docs/fcos.md
* docs/vagrant.md
* docs/gcp-lb.md
* docs/kubernetes-apps/registry.md
* docs/setting-up-your-first-cluster.md
* docs/vagrant.md
* docs/vars.md
* fix contrib/<file>.md errors identified by markdownlint
2 years ago
aeeae76750
Update vars.md ( #9172 )
2 years ago
30b062fd43
fix one bug in docs/nodes ( #9203 )
2 years ago
fddff783c8
Update vsphere-csi.md ( #9170 )
2 years ago
bbd1161147
9035: Make Cilium rolling-restart delay/timeout configurable ( #9176 )
See #9035
2 years ago
e31890806c
Add 'avoid-buggy-ips' support of MetalLB ( #9166 )
2 years ago
30c77ea4c1
Add the option to enable default Pod Security Configuration ( #9017 )
* Add the option to enable default Pod Security Configuration
Enable Pod Security in all namespaces by default with the option to
exempt some namespaces. Without the change only namespaces explicitly
configured will receive the admission plugin treatment.
* Fix the PR according to code review comments
* Revert the latest changes
- leave the empty file when kube_pod_security_use_default, but add comment explaining the empty file
- don't attempt magic at conditionally adding PodSecurity to kube_apiserver_admission_plugins_needs_configuration
2 years ago
68653c31c0
docs(kube-vip): fix broken links ( #9165 )
Signed-off-by: Massimiliano Giovagnoli <me@maxgio.it>
Signed-off-by: Massimiliano Giovagnoli <me@maxgio.it>
2 years ago
b36bb9115a
[calico] calico rr supports multiple groups ( #9134 )
* update calico rr
* fix bgppeer conf
* fix yamllint
* fix ansible lint
* fix calico deploy
* fix yamllint
* fix some typo
2 years ago
47050003a0
Add docker support for Kylin V10 ( #9144 )
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2 years ago
4df6e35270
Move oracle7-canal to centos7-canal
2 years ago
f2f9f1d377
Add kylin OS support ( #9078 )
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2 years ago
9c51ac5157
Switch fedora36se to 35 and 35docker to 36
2 years ago
07eab539a6
Add Fedora 36 support and CI, remove Fedora 34 (eol)
2 years ago
3ce5458f32
hardening: Add `SeccompDefault` admission plugin for kubelet ( #9074 )
* docs(hardening): add SeccompDefault admission plugin to kubelet feature gates
* fix(kubelet-config): enable config through kubelet_feature_gates
* feat(kubelet): add kubelet_seccomp_default variable
2 years ago
f3ea8cf45e
Add Rocky Linux 8 support for vagrant ( #8905 )
To test Kubespray on Rocky Linux 8 with vagrant, this adds it to
the Vagrantfile.
2 years ago
4b03f6c20f
add-managed-ntp-support ( #9027 )
2 years ago
d0a2ba37e8
update deprecated syntax ( #9040 )
* `ansible.builtin.include` removed in version 2.16
Read the `ansible.builtin.include DEPRECATED` doc:
https://docs.ansible.com/ansible/latest/collections/ansible/builtin/include_module.html#deprecated
* Update integration.md
2 years ago
6f82cf12f5
let containerd_default_runtime be undefined by default ( #9026 )
2 years ago
a22ae6143a
[CI] ensure upgrade tests cover defaults (containerd currently)
2 years ago
97b4d79ed5
feat: make kubernetes owner parametrized ( #8952 )
* feat: make kubernetes owner parametrized
* docs: update hardening guide with configuration for CIS 1.1.19
* fix: set etcd data directory permissions to be compliant to CIS 1.1.12
2 years ago
890fad389d
suggest-to-use-nft-in-centos8 ( #8987 )
2 years ago
24c8ba832a
[kubernetes] drop support for configuring insecure apiserver
2 years ago
fad296616c
[docker] use cri-dockerd instead of dockershim for any kubernetes version deployed with docker as the container_manager
2 years ago
85271fc2e5
add-ci-for-ubuntu2204 ( #8958 )
2 years ago
cd7381d8de
Drop Ansible support for v2.9 and v2.10 ( #8925 )
Ansible v2.9 and v2.10 are EOL as [1].
This drops those version supports by following the upstream Ansible.
This sets use_ssh_args true always because that is required to use
ssh_args on ansible.cfg on Ansible v2.11 or later[2].
ansible_ssh_host is replaced with ansible_host because ansible_ssh_host
has been deprecated already and cenots7 jobs were failed due to the
deprecated ansible_ssh_host.
[1]: https://docs.ansible.com/ansible/devel/reference_appendices/release_and_maintenance.html#ansible-core-changelogs
[2]: https://docs.ansible.com/ansible/latest/collections/ansible/posix/synchronize_module.html#parameter-use_ssh_args
2 years ago
cc6cbfbe71
Allow disabling calico CNI logs with calico_cni_log_file_path ( #8921 )
* Allow disabling calico CNI logs with calico_cni_log_file_path
Calico CNI logs up to 1G if it log a lot with current default settings:
log_file_max_size 100 Max file size in MB log files can reach before they are rotated.
log_file_max_age 30 Max age in days that old log files will be kept on the host before they are removed.
log_file_max_count 10 Max number of rotated log files allowed on the host before they are cleaned up.
See https://projectcalico.docs.tigera.io/reference/cni-plugin/configuration#logging
To save disk space, make the path configurable and allow disabling this log by setting
`calico_cni_log_file_path: false`
* Fix markdown
* Update roles/network_plugin/canal/templates/cni-canal.conflist.j2
Co-authored-by: Kenichi Omichi <ken1ohmichi@gmail.com>
Co-authored-by: Kenichi Omichi <ken1ohmichi@gmail.com>
2 years ago
14c0f368b6
the KUESPRAYDIR defined but never used ( #8930 )
* fix dir error
* the command line should align
2 years ago
d22204a59f
docs: add hardening guide ( #8868 )
2 years ago
0e6b727e53
Update docs for using venv ( #8842 )
Due many patterns of Linux distributions, it is difficult to install
ansible dependencies as system-wide stably.
Apart of Kubespray doc[1] recommends to use venv to avoid such issue,
and this applies venv usage to the other parts of the doc.
[1]: https://github.com/kubernetes-sigs/kubespray/blob/master/docs/setting-up-your-first-cluster.md#set-up-kubespray
2 years ago
0c504e4984
[docs] document support for ansible versions ( #8827 )
drop note about not supporting ansible 2.9 since we still cover it in
nightly CI
2 years ago
0bf070c33b
doc: write how to use kata-container for pods ( #8817 )
kata-container is not used by default even if enabling kata_containers_enabled.
This updates the doc for writing how to do that.
2 years ago
5684610a55
Support metallb peer password ( #8792 )
* support metallb peer password
* add MetalLB BGP password example
2 years ago
13443b05a6
Overhaul Cilium manifests to match the newer versions ( #8717 )
* [cilium] Separate templates for cilium, cilium-operator, and hubble installations
Signed-off-by: necatican <necaticanyildirim@gmail.com>
* [cilium] Update cilium-operator templates
Signed-off-by: necatican <necaticanyildirim@gmail.com>
* [cilium] Allow using custom args and mounting extra volumes for the Cilium Operator
Signed-off-by: necatican <necaticanyildirim@gmail.com>
* [cilium] Update the cilium configmap to filter out the deprecated variables, and add the new variables
Signed-off-by: necatican <necaticanyildirim@gmail.com>
* [cilium] Add an option to use Wireguard encryption on Cilium 1.10 and up
Signed-off-by: necatican <necaticanyildirim@gmail.com>
* [cilium] Update cilium-agent templates
Signed-off-by: necatican <necaticanyildirim@gmail.com>
* [cilium] Bump Cilium version to 1.11.3
Signed-off-by: necatican <necaticanyildirim@gmail.com>
2 years ago
1d96f465f4
arm64 support of cilium ( #8803 )
when cilium v1.10 , it is ok to support arm64
https://cilium.io/blog/2021/05/20/cilium-110
Signed-off-by: weizhou.lan@daocloud.io <weizhou.lan@daocloud.io>
2 years ago
37a5271f5a
feat: add variables to manage makeIPTablesUtilChains and streamingConnectionIdleTimeout kubelet parameters ( #8796 )
2 years ago
e7df4d3dd9
add support for `service-account-lookup` parameter ( #8781 )
* feat: add variable to manage service-account-lookup on kube-apiserver
* docs: add documentation about service-account-lookup variable
2 years ago
fa1d222eee
add support for `EventRateLimit` plugin configuration ( #8711 )
* feat: add support for EventRateLimit admission plugin
* docs: add documentation about admission_control_config_file and EventRateLimit configuration
2 years ago
e6c4330e4e
calico: vxlan is the default for calico_network_backend ( #8750 )
Since https://github.com/kubernetes-sigs/kubespray/pull/8434
2 years ago
1e827f9807
Update kata-containers.md ( #8747 )
* kata container related options exist in k8s-cluster.yml,
not k8s_cluster.yml
* https://github.com/kata-containers/runtime has been archived and
https://github.com/kata-containers/kata-containers is used today.
2 years ago
45262da726
[calico] call calico checks early on to prevent altering the cluster with bad configuration ( #8707 )
2 years ago
996ef98b87
Add support for kube-vip ( #8669 )
Signed-off-by: Mathieu Parent <math.parent@gmail.com>
2 years ago
bba91a7524
split kube_feature_gates variable for different kubernetes components ( #8677 )
* feat: split kube_feature_gates variable for different kubernetes components
* docs: add kube_feaute_gates componet variables
2 years ago
6cc9da6b0a
Update vagrant.md ( #8663 )
To read it easily, this puts new lines.
2 years ago
Kay Yan
Michael Schmitz
Cristian Calin
Alessio Greggi
lijin-union
Bishal das
Shelming.Song
Tristan
Ho Kim
Tomas Zvala
maxgio92
Samuel Liu
ERIK
Florian Ruynat
Kenichi Omichi
boeto
rptaylor
Calin Cristian Andrei
Ilya Margolin
zhougw
Oogy
Necatican Yıldırım
weizhoublue
Mathieu Parent
Mathieu Parent