github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
k3s/cluster/saltbase/salt/top.sls

100 lines
2.9 KiB
Plaintext
Raw Normal View History

First commit
2014-06-06 23:40:48 +00:00
base:
'*':
- base
Turn on auto security updates for debian based systems. Fixes #2008
2014-10-27 20:49:06 +00:00
- debian-auto-upgrades
Salt: support systemd (don't assume Redhat <=> systemd) Also work around problems with Salt & systemd services, in particular that Salt doesn't issue a daemon-reload.
2015-06-29 18:17:17 +00:00
- salt-helpers
AWS: Install ntp daemon on all nodes The AWS API requires a signature on method calls, including the timestamp to prevent replay attacks. A time drift of up to 5 minutes between client and server is tolerated. However, if the client clock drifts by >5 minutes, the server will start to reject API calls (with the cryptic "AWS was not able to validate the provided access credentials"). To prevent this happening, we install ntp on all nodes. Fix #11371
2015-08-01 17:13:53 +00:00
{% if grains.get('cloud') == 'aws' %}
- ntp
{% endif %}
Configure cluster for e2e tests. When KUBE_E2E_STORAGE_TEST_ENVIRONMENT is set to 'true', kube-up.sh script will: - Install the right packages for all storage volumes. - Use devicemapper as docker storage backend. 'aufs', the default one on Debian, does not support extended attibutes required by Ceph RBD and Gluster server containers. Tested on GCE and Vagrant, e2e tests for storage volumes passes without any additional configuration.
2015-10-29 10:03:34 +00:00
{% if pillar.get('e2e_storage_test_environment', '').lower() == 'true' %}
- e2e
{% endif %}
First commit
2014-06-06 23:40:48 +00:00
'roles:kubernetes-pool':
- match: grain
- docker
Turn flannel off by default
2015-11-24 02:11:51 +00:00
{% if pillar.get('network_provider', '').lower() == 'flannel' %}
Salt configuration for flanneld
2015-09-06 18:10:33 +00:00
- flannel
Add new policy_provider option to Salt; supporting Calico installation
2016-05-04 17:54:57 +00:00
{% endif %}
{% if pillar.get('policy_provider', '').lower() == 'calico' %}
- cni
Add a network plugin that duplicates "configureCBR0" functionality
2015-12-16 23:31:10 +00:00
{% elif pillar.get('network_provider', '').lower() == 'kubenet' %}
- cni
Support use of NETWORK_PROVIDER=cni with KUBERNETES_PROVIDER=vagrant for a kube-up. Use of NETWORK_PROVIDER=cni is documented as useable (as well as it's affects on the runtime args of kubelet), however the actual implimentation in the salt automation doesnt seem to exist. this change attempts to fix that for the vagrant usecase.
2016-03-29 18:24:03 +00:00
{% elif pillar.get('network_provider', '').lower() == 'cni' %}
- cni
Turn flannel off by default
2015-11-24 02:11:51 +00:00
{% endif %}
Add safe_format_and_mount script to aws Apache licensed :-)
2015-04-02 19:01:42 +00:00
- helpers
Install the kubectl binary on nodes in addition to the master.
2015-06-30 23:52:17 +00:00
- kube-client-tools
run kube-proxy in a static pod
2015-11-04 18:59:16 +00:00
- kube-node-unpacker
First commit
2014-06-06 23:40:48 +00:00
- kubelet
Add opencontrail networking provisioning support in kubernetes salt based provisioning OpenContrail is an open-source based networking software which provides virtualization support for the cloud. This change-set adds ability to install and provision opencontrail software for networking in kubernetes based cloud environment. There are basically 3 components o kube-network-manager -- plugin between contrail components and kubernets components o provision_master.sh -- OpenContrail software installer and provisioner in master node o provision_minion.sh -- OpenContrail software installer and provisioner in minion node(s) These are driven via salt configuration files One can provision opencontrail by just setting "export NETWORK_PROVIDER=opencontrail" Optionally, OPENCONTRAIL_TAG, and OPENCONTRAIL_KUBERNETES_TAG can be used to specify opencontrail and contrail-kubernetes software versions to install and provision. Public-IP Subnet provided by contrail can be configured via OPENCONTRAIL_PUBLIC_SUBNET environment variable At this moment, plan is to add support for aws, gce and vagrant based platforms For more information on contrail-kubernetes, please visit https://github.com/juniper/contrail-kubernetes For more information on opencontrail, please visit http://www.opencontrail.org
2015-10-03 15:03:02 +00:00
{% if pillar.get('network_provider', '').lower() == 'opencontrail' %}
- opencontrail-networking-minion
{% else %}
First commit
2014-06-06 23:40:48 +00:00
- kube-proxy
Add opencontrail networking provisioning support in kubernetes salt based provisioning OpenContrail is an open-source based networking software which provides virtualization support for the cloud. This change-set adds ability to install and provision opencontrail software for networking in kubernetes based cloud environment. There are basically 3 components o kube-network-manager -- plugin between contrail components and kubernets components o provision_master.sh -- OpenContrail software installer and provisioner in master node o provision_minion.sh -- OpenContrail software installer and provisioner in minion node(s) These are driven via salt configuration files One can provision opencontrail by just setting "export NETWORK_PROVIDER=opencontrail" Optionally, OPENCONTRAIL_TAG, and OPENCONTRAIL_KUBERNETES_TAG can be used to specify opencontrail and contrail-kubernetes software versions to install and provision. Public-IP Subnet provided by contrail can be configured via OPENCONTRAIL_PUBLIC_SUBNET environment variable At this moment, plan is to add support for aws, gce and vagrant based platforms For more information on contrail-kubernetes, please visit https://github.com/juniper/contrail-kubernetes For more information on opencontrail, please visit http://www.opencontrail.org
2015-10-03 15:03:02 +00:00
{% endif %}
Enable log collection from master.
2015-04-03 00:21:13 +00:00
{% if pillar.get('enable_node_logging', '').lower() == 'true' and pillar['logging_destination'] is defined %}
{% if pillar['logging_destination'] == 'elasticsearch' %}
Adjust test in salt file to use boolean value
2014-10-20 18:01:13 +00:00
- fluentd-es
Enable log collection from master.
2015-04-03 00:21:13 +00:00
{% elif pillar['logging_destination'] == 'gcp' %}
Flunentd to GCP logging node level configuration
2014-10-21 00:37:58 +00:00
- fluentd-gcp
standard config opt names: logging
2014-11-14 07:07:43 +00:00
{% endif %}
Launch a cluster-local registry. This registry can be accessed through proxies that run on each node listening on port 5000. We send the proxy images to the nodes directly to avoid requests that hit the network during cluster launch. For now, we continue to pull the registry itself over the network, especially given its large size (we should be able to dramatically shrink the image). On GCE we create a PD and use that for storage, otherwise we use an emptyDir. The registry is not enabled outside of GCE. All communication is currently plain HTTP. In order to use SSL, we will need to be able to request a certificate/key from the apiserver signed by the apiserver's CA cert.
2015-07-27 18:50:31 +00:00
{% endif %}
{% if pillar.get('enable_cluster_registry', '').lower() == 'true' %}
- kube-registry-proxy
Add an e2e image puller static pod
2016-05-18 02:16:32 +00:00
{% endif %}
{% if pillar['prepull_e2e_images'] is defined and pillar['prepull_e2e_images'].lower() == 'true' %}
- e2e-image-puller
Adjust test in salt file to use boolean value
2014-10-20 18:01:13 +00:00
{% endif %}
Add initial logrotate support.
2014-09-09 17:37:56 +00:00
- logrotate
Add support for supervisord as a monit alternative.
2015-08-06 02:37:58 +00:00
- supervisor
Add new policy_provider option to Salt; supporting Calico installation
2016-05-04 17:54:57 +00:00
{% if pillar.get('policy_provider', '').lower() == 'calico' %}
- calico.node
{% endif %}
First commit
2014-06-06 23:40:48 +00:00
'roles:kubernetes-master':
- match: grain
Give the API server access to TLS certs. Moved the cert generation to a separate salt state and put it in a more appropriate sharable location (`/srv/kubernetes/`).
2014-11-13 02:14:24 +00:00
- generate-cert
Initial vagrant setup and e2e testing support
2014-07-14 17:50:04 +00:00
- etcd
Turn flannel off by default
2015-11-24 02:11:51 +00:00
{% if pillar.get('network_provider', '').lower() == 'flannel' %}
Flannel server in static pod with private etcd.
2015-11-22 01:37:32 +00:00
- flannel-server
Salt configuration for flanneld
2015-09-06 18:10:33 +00:00
- flannel
Add a network plugin that duplicates "configureCBR0" functionality
2015-12-16 23:31:10 +00:00
{% elif pillar.get('network_provider', '').lower() == 'kubenet' %}
- cni
Support use of NETWORK_PROVIDER=cni with KUBERNETES_PROVIDER=vagrant for a kube-up. Use of NETWORK_PROVIDER=cni is documented as useable (as well as it's affects on the runtime args of kubelet), however the actual implimentation in the salt automation doesnt seem to exist. this change attempts to fix that for the vagrant usecase.
2016-03-29 18:24:03 +00:00
{% elif pillar.get('network_provider', '').lower() == 'cni' %}
- cni
Add a l7 static pod
2016-04-05 00:28:52 +00:00
{% endif %}
{% if pillar.get('enable_l7_loadbalancing', '').lower() == 'glbc' %}
- l7-gcp
Turn flannel off by default
2015-11-24 02:11:51 +00:00
{% endif %}
rename kube server binaries to kube- apiserver becomes kube-apiserver controller-manager -> kube-controller-manager scheduler and proxy similarly. Only thing I promise is that right now hack/build-go.sh and build/release.sh exit with 0. That's it. Who knows if any of this actually works....
2014-11-11 00:34:21 +00:00
- kube-apiserver
- kube-controller-manager
- kube-scheduler
Add support for supervisord as a monit alternative.
2015-08-06 02:37:58 +00:00
- supervisor
Install client tools on master. We now include kubecfg and kubectl in "server binary" tar and place them into /usr/local/bin on the master.
2014-11-08 00:49:32 +00:00
- kube-client-tools
Load docker images of kubernetes components after docker is installed.
2015-04-07 00:54:06 +00:00
- kube-master-addons
Have default LimitRange created for cluster: 100m cpu.share per container
2015-05-19 00:55:56 +00:00
- kube-admission-controls
Run fluentd on the master node by default. This involves adding the logging-write scope to the master when running on GCE.
2015-07-01 02:05:25 +00:00
{% if pillar.get('enable_node_logging', '').lower() == 'true' and pillar['logging_destination'] is defined %}
{% if pillar['logging_destination'] == 'elasticsearch' %}
- fluentd-es
{% elif pillar['logging_destination'] == 'gcp' %}
- fluentd-gcp
{% endif %}
{% endif %}
Improve vagrant reliablility, fix race condition with openvswitch and docker
2015-02-21 18:31:50 +00:00
{% if grains['cloud'] is defined and grains['cloud'] != 'vagrant' %}
Add initial logrotate support.
2014-09-09 17:37:56 +00:00
- logrotate
Improve vagrant reliablility, fix race condition with openvswitch and docker
2015-02-21 18:31:50 +00:00
{% endif %}
Deferred creation of SkyDNS, monitoring and logging objects This implements phase 1 of the proposal in #3579, moving the creation of the pods, RCs, and services to the master after the apiserver is available. This is such a wide commit because our existing initial config story is special: * Add kube-addons service and associated salt configuration: ** We configure /etc/kubernetes/addons to be a directory of objects that are appropriately configured for the current cluster. ** "/etc/init.d/kube-addons start" slurps up everything in that dir. (Most of the difficult is the business logic in salt around getting that directory built at all.) ** We cheat and overlay cluster/addons into saltbase/salt/kube-addons as config files for the kube-addons meta-service. * Change .yaml.in files to salt templates * Rename {setup,teardown}-{monitoring,logging} to {setup,teardown}-{monitoring,logging}-firewall to properly reflect their real purpose now (the purpose of these functions is now ONLY to bring up the firewall rules, and possibly to relay the IP to the user). * Rework GCE {setup,teardown}-{monitoring,logging}-firewall: Both functions were improperly configuring global rules, yet used lifecycles tied to the cluster. Use $NODE_INSTANCE_PREFIX with the rule. The logging rule needed a $NETWORK specifier. The monitoring rule tried gcloud describe first, but given the instancing, this feels like a waste of time now. * Plumb ENABLE_CLUSTER_MONITORING, ENABLE_CLUSTER_LOGGING, ELASTICSEARCH_LOGGING_REPLICAS and DNS_REPLICAS down to the master, since these are needed there now. (Desperately want just a yaml or json file we can share between providers that has all this crap. Maybe #3525 is an answer?) Huge caveats: I've gone pretty firm testing on GCE, including twiddling the env variables and making sure the objects I expect to come up, come up. I've tested that it doesn't break GKE bringup somehow. But I haven't had a chance to test the other providers.
2015-01-18 23:16:52 +00:00
- kube-addons
Adding cloudprovider support for Openstack kube-up provider. Making the assumption that the person running kube-up has their Openstack environment setup, those same variables are being passed into heat, and then into openstack.conf. The salt codebase was modified to add openstack as well.
2016-04-13 23:40:38 +00:00
{% if grains['cloud'] is defined and grains['cloud'] in [ 'vagrant', 'gce', 'aws', 'vsphere', 'photon-controller', 'openstack'] %}
Configure docker on the master like we do on workers.
2015-03-12 17:37:30 +00:00
- docker
Add kubelet to the master.
2015-03-13 19:03:28 +00:00
- kubelet
Configure docker on the master like we do on workers.
2015-03-12 17:37:30 +00:00
{% endif %}
Add opencontrail networking provisioning support in kubernetes salt based provisioning OpenContrail is an open-source based networking software which provides virtualization support for the cloud. This change-set adds ability to install and provision opencontrail software for networking in kubernetes based cloud environment. There are basically 3 components o kube-network-manager -- plugin between contrail components and kubernets components o provision_master.sh -- OpenContrail software installer and provisioner in master node o provision_minion.sh -- OpenContrail software installer and provisioner in minion node(s) These are driven via salt configuration files One can provision opencontrail by just setting "export NETWORK_PROVIDER=opencontrail" Optionally, OPENCONTRAIL_TAG, and OPENCONTRAIL_KUBERNETES_TAG can be used to specify opencontrail and contrail-kubernetes software versions to install and provision. Public-IP Subnet provided by contrail can be configured via OPENCONTRAIL_PUBLIC_SUBNET environment variable At this moment, plan is to add support for aws, gce and vagrant based platforms For more information on contrail-kubernetes, please visit https://github.com/juniper/contrail-kubernetes For more information on opencontrail, please visit http://www.opencontrail.org
2015-10-03 15:03:02 +00:00
{% if pillar.get('network_provider', '').lower() == 'opencontrail' %}
- opencontrail-networking-master
{% endif %}
Salt configuration for the new Cluster Autoscaler for GCE
2016-05-09 14:23:00 +00:00
{% if pillar.get('enable_node_autoscaler', '').lower() == 'true' %}
- cluster-autoscaler
{% endif %}
Add new policy_provider option to Salt; supporting Calico installation
2016-05-04 17:54:57 +00:00
{% if pillar.get('policy_provider', '').lower() == 'calico' %}
- calico.master
{% endif %}