DevAndTools/kubespray
1
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-06-02 01:27:58 +00:00
Code Issues Packages Projects Releases Wiki Activity
6,833 Commits 56 Branches 90 Tags
ed0acd8027c6861ba849ccbb4d1a40f273cb5ec4
Commit Graph

1666 Commits

Author SHA1 Message Date
ERIK b9a690463d Add docker support for openEuler linux (#9498) 
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>

Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
 2022-11-17 18:18:30 -08:00
ERIK 8795cf6494 Add support for the OpenEuler Linux (#9494) 
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>

Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
 2022-11-16 00:48:49 -08:00
ERIK 40261fdf14 Fix iputils install failure in Kylin OS (#9453) 
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>

Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
 2022-11-06 17:54:16 -08:00
Jiffs Maverick 4aa1ef28ea Don't use coredns_server in dhclient.conf if nodelocaldns is enabled (#9392) 2022-11-03 02:45:36 -07:00
lijin-union c272421910 Add UOS linux support (#9432) 2022-10-30 17:16:43 -07:00
蒋航 990f87acc8 Update kube-vip to v0.5.5 (#9437) 
Signed-off-by: hang.jiang <hang.jiang@daocloud.io>

Signed-off-by: hang.jiang <hang.jiang@daocloud.io>
 2022-10-26 19:28:32 -07:00
William Turner eeb376460d Fix inconsistent handling of admission plugin list (#9407) 
* Fix inconsistent handling of admission plugin list

* Adjust hardening doc with the normalized admission plugin list

* Add pre-check for admission plugins format change

* Ignore checking admission plugins value when variable is not defined
 2022-10-26 00:28:37 -07:00
Wouter Goedhart 1901b512d2 Make the port of kube-vip dynamic based on the kube_apiserver_port (#9414) 
variable

Fix wrong referenced variable on bgp_peers

Fix bgp_peeras field to be a string

Set default value for bgp_peeras
 2022-10-23 18:00:24 -07:00
ERIK 9fdda7eca8 Fix iputils install failure in Kylin OS (#9416) 
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>

Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
 2022-10-21 04:53:51 -07:00
Cristian Calin 1530411218 use cri-o from upstream instead of kubic/OBS (#9374) 
* [cri-o] use cri-o from upstream instead of kubic/OBS

* [cri-o] add proper molecule coverage

* [skopeo] download skopeo from upstream build

* [cri-o] clean up legacy deployments

* disable cri-o per-distribution variables
 2022-10-19 05:47:05 -07:00
Cristian Calin 23716b0eff don't define kubeadm_patches by default (#9372) 2022-10-14 01:20:46 -07:00
Kay Yan 131bd933a6 Fix ensure ping package error in fedora CoreOS & Flatcar (#9370) 
* fix-ensure-package-in-coreos

* clean blank line
 2022-10-13 16:54:46 -07:00
Kenichi Omichi 24632ae81b Add check_typo job (#9361) 
To block merging pull requests which contain typo automatically.
 2022-10-07 02:21:53 -07:00
Huang Chen-Yi d689f57c94 Features/support kubeadm patches v1beta3 (#9326) 
* Support kubeadm patches in v1beta3

* Update kubeadm patches sample files in inventory

* Fix pre-commit syntax

* Set kubeadm_patches  enabled to false in sample inventory
 2022-10-06 00:39:52 -07:00
William Turner ad3f503c0c Fix default value for kubelet_secure_addresses (#9355) 2022-10-06 00:35:51 -07:00
Eugene Artemenko 8b9cd3959a Add possibility to skip adding load balancer name in the hosts file (#9331) 2022-10-04 06:26:16 -07:00
Emin AKTAS dffeab320e feat: add a paramater to disable host nameservers (#9357) 
Signed-off-by: eminaktas <eminaktas34@gmail.com>

Signed-off-by: eminaktas <eminaktas34@gmail.com>
 2022-10-04 06:22:17 -07:00
Kay Yan 999586a110 sysctl_additional (#9351) 2022-10-02 23:06:14 -07:00
Florian Ruynat 841e2f44c0 Remove references to 1.22 (#9342) 2022-09-28 14:10:29 -07:00
Zhong Jianxin 6dff39344b preinstall: Add nodelocaldns to supersede_nameserver if enabled (#9282) 
When a machine that use dhclient and resolvconf reboots, this will make /etc/resolv.conf
remain close to the one before reboot
 2022-09-25 20:19:44 -07:00
Kei Kori 467dc19cbd support removing options in resolvconf with tab separator (#9304) 2022-09-23 10:42:27 -07:00
Emin AKTAS 9468642269 feat: allows users to have more control on DNS (#9270) 
Signed-off-by: eminaktas <eminaktas34@gmail.com>

Signed-off-by: eminaktas <eminaktas34@gmail.com>
 2022-09-23 10:28:26 -07:00
Kay Yan 5d3326b93f add-ping-package (#9284) 2022-09-21 23:55:05 -07:00
Kay Yan 97ca2f3c78 add-timezone-support (#9263) 2022-09-14 21:11:22 -07:00
cleverhu fc57c0b27e fix number node name can't be added (#9266) 
Signed-off-by: cleverhu <shouping.hu@daocloud.io>

Signed-off-by: cleverhu <shouping.hu@daocloud.io>
 2022-09-13 00:09:05 -07:00
Krystian Młynek 6386ec029c add retries for restart of kube-apiserver (#9256) 
* add retries for restart of kube-apiserver

* change var name
 2022-09-07 16:48:49 -07:00
Alessio Greggi acb6f243fd feat: add kubelet systemd service hardening option (#9194) 
* feat: add kubelet systemd service hardening option

* refactor: move variable name to kubelet_secure_addresses

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>

* docs: add diagram about kubelet_secure_addresses variable

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>
 2022-08-30 11:18:55 -07:00
Kay Yan b46ddf35fc kube-vip shoud fail if kube_proxy_strict_arp is false in arp mod (#9223) 
* fix-kube-vip-strict-arp

* fix-kube-vip-strict-arp
 2022-08-30 00:21:02 -07:00
Shelming.Song c8a61ec98c optimize the format of evictionHard in kubelet-config.yaml template (#9204) 2022-08-23 01:55:24 -07:00
Tomas Zvala 30c77ea4c1 Add the option to enable default Pod Security Configuration (#9017) 
* Add the option to enable default Pod Security Configuration

Enable Pod Security in all namespaces by default with the option to
exempt some namespaces. Without the change only namespaces explicitly
configured will receive the admission plugin treatment.

* Fix the PR according to code review comments

* Revert the latest changes

- leave the empty file when kube_pod_security_use_default, but add comment explaining the empty file
- don't attempt magic at conditionally adding PodSecurity to kube_apiserver_admission_plugins_needs_configuration
 2022-08-18 01:16:36 -07:00
Ho Kim be5fdab3aa Disable DNSStubListener for Flatcar Linux (#9160) 
* Disable DNSStubListener for Flatcar Linux

* Fix missing "Flatcar" condition of os_family
 2022-08-18 00:56:49 -07:00
Kay Yan 0088fe0ab7 add-tar-in-common-package (#9184) 2022-08-16 05:17:18 -07:00
ERIK 47050003a0 Add docker support for Kylin V10 (#9144) 
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
 2022-08-03 15:03:46 -07:00
ERIK f2f9f1d377 Add kylin OS support (#9078) 
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
 2022-08-01 10:44:29 -07:00
Samuel Liu e73803c72c pid reserved must be str (#9124) 2022-07-30 20:14:27 -07:00
Kay Yan f592fa1235 add kube-vip sans (#9099) 2022-07-19 13:11:28 -07:00
Alessio Greggi 3ce5458f32 hardening: Add SeccompDefault admission plugin for kubelet (#9074) 
* docs(hardening): add SeccompDefault admission plugin to kubelet feature gates

* fix(kubelet-config): enable config through kubelet_feature_gates

* feat(kubelet): add kubelet_seccomp_default variable
 2022-07-19 00:50:07 -07:00
Kenichi Omichi c01656b1e3 Allow "openSUSE Tumbleweed" to be run (#9072) 
The commit 1ce2f04 tried to merge multiple SUSE OS checks including
"openSUSE Leap" and "openSUSE Tumbleweed" into a single SUSE, but
that was a perfect change.
Then the commit c16efc9 tried to fix it for "openSUSE Leap", but it
didn't take care of "openSUSE Tumbleweed".
Then this adds "openSUSE Tumbleweed" to the OS check.
 2022-07-08 04:55:47 -07:00
h9-HSFRQDH 3bb9542606 Adding support for node & pod pid limit (#9038) 2022-07-05 00:20:48 -07:00
Kay Yan 1d0b3829ed remove-etcd-unsupported-arch (#9049) 2022-07-04 05:39:24 -07:00
Kay Yan 4b03f6c20f add-managed-ntp-support (#9027) 2022-06-28 13:15:34 -07:00
Kay Yan d4de9d096f fix-the-issue-of-miss-the-etcd-user (#9016) 2022-06-28 09:13:58 -07:00
Florian Ruynat 6bf3306401 Fixed concatenate str & int in auto_renew_certificates_systemd_calendar var (#8979) 2022-06-22 11:55:43 -07:00
Citrullin e7729daefc Add assertion for IPv6 in verify settings 
Co-authored-by: Kenichi Omichi <ken1ohmichi@gmail.com>
 2022-06-17 10:36:43 +02:00
Alessio Greggi 97b4d79ed5 feat: make kubernetes owner parametrized (#8952) 
* feat: make kubernetes owner parametrized

* docs: update hardening guide with configuration for CIS 1.1.19

* fix: set etcd data directory permissions to be compliant to CIS 1.1.12
 2022-06-17 01:34:32 -07:00
Calin Cristian Andrei 24c8ba832a [kubernetes] drop support for configuring insecure apiserver 2022-06-15 00:57:20 -07:00
Calin Cristian Andrei 2cd8c51a07 [kubeadm] use v1beta3 configuration version 
* extra admission controls now don't have a version in their file names
  eventratelimit.v1beta2.yaml.j2 -> eventratelimit.yaml.j2
* cri_socket variable includes the unix:// prefix to be conformat with
  upstream
 2022-06-15 00:57:20 -07:00
Calin Cristian Andrei 589823bdc1 [CI] remove docker stand-alone molecule test 2022-06-15 00:57:20 -07:00
Calin Cristian Andrei fad296616c [docker] use cri-dockerd instead of dockershim for any kubernetes version deployed with docker as the container_manager 2022-06-15 00:57:20 -07:00
Calin Cristian Andrei 6380483e8b [kubeconfig] generate admin kube config from /etc/kubernetes/admin.conf instead of the workaround of using kubeadm init phase kubeadm admin which fails with cri-dockerd 2022-06-15 00:57:20 -07:00