update
This commit is contained in:
havelight-ee
@@ -0,0 +1,65 @@
|
||||
---
|
||||
|
||||
podsecuritypolicy_restricted_spec:
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
requiredDropCapabilities:
|
||||
- ALL
|
||||
volumes:
|
||||
- 'configMap'
|
||||
- 'emptyDir'
|
||||
- 'projected'
|
||||
- 'secret'
|
||||
- 'downwardAPI'
|
||||
- 'persistentVolumeClaim'
|
||||
hostNetwork: false
|
||||
hostIPC: false
|
||||
hostPID: false
|
||||
runAsUser:
|
||||
rule: 'MustRunAsNonRoot'
|
||||
seLinux:
|
||||
rule: 'RunAsAny'
|
||||
runAsGroup:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1
|
||||
max: 65535
|
||||
supplementalGroups:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1
|
||||
max: 65535
|
||||
fsGroup:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1
|
||||
max: 65535
|
||||
readOnlyRootFilesystem: false
|
||||
|
||||
podsecuritypolicy_privileged_spec:
|
||||
privileged: true
|
||||
allowPrivilegeEscalation: true
|
||||
allowedCapabilities:
|
||||
- '*'
|
||||
volumes:
|
||||
- '*'
|
||||
hostNetwork: true
|
||||
hostPorts:
|
||||
- min: 0
|
||||
max: 65535
|
||||
hostIPC: true
|
||||
hostPID: true
|
||||
runAsUser:
|
||||
rule: 'RunAsAny'
|
||||
seLinux:
|
||||
rule: 'RunAsAny'
|
||||
runAsGroup:
|
||||
rule: 'RunAsAny'
|
||||
supplementalGroups:
|
||||
rule: 'RunAsAny'
|
||||
fsGroup:
|
||||
rule: 'RunAsAny'
|
||||
readOnlyRootFilesystem: false
|
||||
# This will fail if allowed-unsafe-sysctls is not set accordingly in kubelet flags
|
||||
allowedUnsafeSysctls:
|
||||
- '*'
|
||||
@@ -0,0 +1,8 @@
|
||||
---
|
||||
apiVersion: scheduling.k8s.io/v1
|
||||
kind: PriorityClass
|
||||
metadata:
|
||||
name: k8s-cluster-critical
|
||||
value: 1000000000
|
||||
globalDefault: false
|
||||
description: "This priority class should only be used by the pods installed using kubespray."
|
||||
@@ -0,0 +1,124 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: cloud-controller-manager
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: system:cloud-controller-manager
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- '*'
|
||||
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes/status
|
||||
verbs:
|
||||
- patch
|
||||
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- patch
|
||||
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services/status
|
||||
verbs:
|
||||
- update
|
||||
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- update
|
||||
|
||||
# For leader election
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- endpoints
|
||||
verbs:
|
||||
- create
|
||||
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- endpoints
|
||||
resourceNames:
|
||||
- "cloud-controller-manager"
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
resourceNames:
|
||||
- "cloud-controller-manager"
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
|
||||
# For the PVL
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- persistentvolumes
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- patch
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: oci-cloud-controller-manager
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: system:cloud-controller-manager
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: cloud-controller-manager
|
||||
namespace: kube-system
|
||||
@@ -0,0 +1,109 @@
|
||||
---
|
||||
- name: Kubernetes Apps | Wait for kube-apiserver
|
||||
uri:
|
||||
url: "{{ kube_apiserver_endpoint }}/healthz"
|
||||
validate_certs: no
|
||||
client_cert: "{{ kube_apiserver_client_cert }}"
|
||||
client_key: "{{ kube_apiserver_client_key }}"
|
||||
register: result
|
||||
until: result.status == 200
|
||||
retries: 10
|
||||
delay: 6
|
||||
when: inventory_hostname == groups['kube_control_plane'][0]
|
||||
|
||||
- name: Kubernetes Apps | Add ClusterRoleBinding to admit nodes
|
||||
template:
|
||||
src: "node-crb.yml.j2"
|
||||
dest: "{{ kube_config_dir }}/node-crb.yml"
|
||||
mode: 0640
|
||||
register: node_crb_manifest
|
||||
when:
|
||||
- rbac_enabled
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
|
||||
- name: Apply workaround to allow all nodes with cert O=system:nodes to register
|
||||
kube:
|
||||
name: "kubespray:system:node"
|
||||
kubectl: "{{ bin_dir }}/kubectl"
|
||||
resource: "clusterrolebinding"
|
||||
filename: "{{ kube_config_dir }}/node-crb.yml"
|
||||
state: latest
|
||||
register: result
|
||||
until: result is succeeded
|
||||
retries: 10
|
||||
delay: 6
|
||||
when:
|
||||
- rbac_enabled
|
||||
- node_crb_manifest.changed
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
|
||||
- name: Kubernetes Apps | Add webhook ClusterRole that grants access to proxy, stats, log, spec, and metrics on a kubelet
|
||||
template:
|
||||
src: "node-webhook-cr.yml.j2"
|
||||
dest: "{{ kube_config_dir }}/node-webhook-cr.yml"
|
||||
mode: 0640
|
||||
register: node_webhook_cr_manifest
|
||||
when:
|
||||
- rbac_enabled
|
||||
- kubelet_authorization_mode_webhook
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
tags: node-webhook
|
||||
|
||||
- name: Apply webhook ClusterRole
|
||||
kube:
|
||||
name: "system:node-webhook"
|
||||
kubectl: "{{ bin_dir }}/kubectl"
|
||||
resource: "clusterrole"
|
||||
filename: "{{ kube_config_dir }}/node-webhook-cr.yml"
|
||||
state: latest
|
||||
when:
|
||||
- rbac_enabled
|
||||
- kubelet_authorization_mode_webhook
|
||||
- node_webhook_cr_manifest.changed
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
tags: node-webhook
|
||||
|
||||
- name: Kubernetes Apps | Add ClusterRoleBinding for system:nodes to webhook ClusterRole
|
||||
template:
|
||||
src: "node-webhook-crb.yml.j2"
|
||||
dest: "{{ kube_config_dir }}/node-webhook-crb.yml"
|
||||
mode: 0640
|
||||
register: node_webhook_crb_manifest
|
||||
when:
|
||||
- rbac_enabled
|
||||
- kubelet_authorization_mode_webhook
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
tags: node-webhook
|
||||
|
||||
- name: Grant system:nodes the webhook ClusterRole
|
||||
kube:
|
||||
name: "system:node-webhook"
|
||||
kubectl: "{{ bin_dir }}/kubectl"
|
||||
resource: "clusterrolebinding"
|
||||
filename: "{{ kube_config_dir }}/node-webhook-crb.yml"
|
||||
state: latest
|
||||
when:
|
||||
- rbac_enabled
|
||||
- kubelet_authorization_mode_webhook
|
||||
- node_webhook_crb_manifest.changed
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
tags: node-webhook
|
||||
|
||||
- include_tasks: oci.yml
|
||||
tags: oci
|
||||
when:
|
||||
- cloud_provider is defined
|
||||
- cloud_provider == 'oci'
|
||||
|
||||
- name: PriorityClass | Copy k8s-cluster-critical-pc.yml file
|
||||
copy: src=k8s-cluster-critical-pc.yml dest={{ kube_config_dir }}/k8s-cluster-critical-pc.yml mode=0640
|
||||
when: inventory_hostname == groups['kube_control_plane']|last
|
||||
|
||||
- name: PriorityClass | Create k8s-cluster-critical
|
||||
kube:
|
||||
name: k8s-cluster-critical
|
||||
kubectl: "{{ bin_dir }}/kubectl"
|
||||
resource: "PriorityClass"
|
||||
filename: "{{ kube_config_dir }}/k8s-cluster-critical-pc.yml"
|
||||
state: latest
|
||||
when: inventory_hostname == groups['kube_control_plane']|last
|
||||
@@ -0,0 +1,19 @@
|
||||
---
|
||||
- name: Copy OCI RBAC Manifest
|
||||
copy:
|
||||
src: "oci-rbac.yml"
|
||||
dest: "{{ kube_config_dir }}/oci-rbac.yml"
|
||||
mode: 0640
|
||||
when:
|
||||
- cloud_provider is defined
|
||||
- cloud_provider == 'oci'
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
|
||||
- name: Apply OCI RBAC
|
||||
kube:
|
||||
kubectl: "{{ bin_dir }}/kubectl"
|
||||
filename: "{{ kube_config_dir }}/oci-rbac.yml"
|
||||
when:
|
||||
- cloud_provider is defined
|
||||
- cloud_provider == 'oci'
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: "kube-system"
|
||||
@@ -0,0 +1,17 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
annotations:
|
||||
rbac.authorization.kubernetes.io/autoupdate: "true"
|
||||
labels:
|
||||
kubernetes.io/bootstrapping: rbac-defaults
|
||||
name: kubespray:system:node
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: system:node
|
||||
subjects:
|
||||
- apiGroup: rbac.authorization.k8s.io
|
||||
kind: Group
|
||||
name: system:nodes
|
||||
@@ -0,0 +1,20 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
annotations:
|
||||
rbac.authorization.kubernetes.io/autoupdate: "true"
|
||||
labels:
|
||||
kubernetes.io/bootstrapping: rbac-defaults
|
||||
name: system:node-webhook
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes/proxy
|
||||
- nodes/stats
|
||||
- nodes/log
|
||||
- nodes/spec
|
||||
- nodes/metrics
|
||||
verbs:
|
||||
- "*"
|
||||
@@ -0,0 +1,17 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
annotations:
|
||||
rbac.authorization.kubernetes.io/autoupdate: "true"
|
||||
labels:
|
||||
kubernetes.io/bootstrapping: rbac-defaults
|
||||
name: system:node-webhook
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: system:node-webhook
|
||||
subjects:
|
||||
- apiGroup: rbac.authorization.k8s.io
|
||||
kind: Group
|
||||
name: system:nodes
|
||||
@@ -0,0 +1,35 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: system:vsphere-cloud-provider
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- update
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: system:vsphere-cloud-provider
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: system:vsphere-cloud-provider
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: vsphere-cloud-provider
|
||||
namespace: kube-system
|
||||
Reference in New Issue
Block a user