update
This commit is contained in:
havelight-ee
64
kubespray/roles/network_plugin/weave/defaults/main.yml
Normal file
64
kubespray/roles/network_plugin/weave/defaults/main.yml
Normal file
@@ -0,0 +1,64 @@
|
||||
---
|
||||
|
||||
# Weave's network password for encryption, if null then no network encryption.
|
||||
weave_password: ~
|
||||
|
||||
# If set to 1, disable checking for new Weave Net versions (default is blank,
|
||||
# i.e. check is enabled)
|
||||
weave_checkpoint_disable: false
|
||||
|
||||
# Soft limit on the number of connections between peers. Defaults to 100.
|
||||
weave_conn_limit: 100
|
||||
|
||||
# Weave Net defaults to enabling hairpin on the bridge side of the veth pair
|
||||
# for containers attached. If you need to disable hairpin, e.g. your kernel is
|
||||
# one of those that can panic if hairpin is enabled, then you can disable it by
|
||||
# setting `HAIRPIN_MODE=false`.
|
||||
weave_hairpin_mode: true
|
||||
|
||||
# The range of IP addresses used by Weave Net and the subnet they are placed in
|
||||
# (CIDR format; default 10.32.0.0/12)
|
||||
weave_ipalloc_range: "{{ kube_pods_subnet }}"
|
||||
|
||||
# Set to 0 to disable Network Policy Controller (default is on)
|
||||
weave_expect_npc: "{{ enable_network_policy }}"
|
||||
|
||||
# List of addresses of peers in the Kubernetes cluster (default is to fetch the
|
||||
# list from the api-server)
|
||||
weave_kube_peers: ~
|
||||
|
||||
# Set the initialization mode of the IP Address Manager (defaults to consensus
|
||||
# amongst the KUBE_PEERS)
|
||||
weave_ipalloc_init: ~
|
||||
|
||||
# Set the IP address used as a gateway from the Weave network to the host
|
||||
# network - this is useful if you are configuring the addon as a static pod.
|
||||
weave_expose_ip: ~
|
||||
|
||||
# Address and port that the Weave Net daemon will serve Prometheus-style
|
||||
# metrics on (defaults to 0.0.0.0:6782)
|
||||
weave_metrics_addr: ~
|
||||
|
||||
# Address and port that the Weave Net daemon will serve status requests on
|
||||
# (defaults to disabled)
|
||||
weave_status_addr: ~
|
||||
|
||||
# Weave Net defaults to 1376 bytes, but you can set a smaller size if your
|
||||
# underlying network has a tighter limit, or set a larger size for better
|
||||
# performance if your network supports jumbo frames (e.g. 8916)
|
||||
weave_mtu: 1376
|
||||
|
||||
# Set to 1 to preserve the client source IP address when accessing Service
|
||||
# annotated with `service.spec.externalTrafficPolicy=Local`. The feature works
|
||||
# only with Weave IPAM (default).
|
||||
weave_no_masq_local: true
|
||||
|
||||
# set to nft to use nftables backend for iptables (default is iptables)
|
||||
weave_iptables_backend: ~
|
||||
|
||||
# Extra variables that passing to launch.sh, useful for enabling seed mode, see
|
||||
# https://www.weave.works/docs/net/latest/tasks/ipam/ipam/
|
||||
weave_extra_args: ~
|
||||
|
||||
# Extra variables for weave_npc that passing to launch.sh, useful for change log level, ex --log-level=error
|
||||
weave_npc_extra_args: ~
|
||||
3
kubespray/roles/network_plugin/weave/meta/main.yml
Normal file
3
kubespray/roles/network_plugin/weave/meta/main.yml
Normal file
@@ -0,0 +1,3 @@
|
||||
---
|
||||
dependencies:
|
||||
- role: network_plugin/cni
|
||||
12
kubespray/roles/network_plugin/weave/tasks/main.yml
Normal file
12
kubespray/roles/network_plugin/weave/tasks/main.yml
Normal file
@@ -0,0 +1,12 @@
|
||||
---
|
||||
- name: Weave | Create manifest
|
||||
template:
|
||||
src: weave-net.yml.j2
|
||||
dest: "{{ kube_config_dir }}/weave-net.yml"
|
||||
mode: 0644
|
||||
|
||||
- name: Weave | Fix nodePort for Weave
|
||||
template:
|
||||
src: 10-weave.conflist.j2
|
||||
dest: /etc/cni/net.d/10-weave.conflist
|
||||
mode: 0644
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"cniVersion": "0.3.0",
|
||||
"name": "weave",
|
||||
"plugins": [
|
||||
{
|
||||
"name": "weave",
|
||||
"type": "weave-net",
|
||||
"hairpinMode": {{ weave_hairpin_mode | bool | lower }}
|
||||
},
|
||||
{
|
||||
"type": "portmap",
|
||||
"capabilities": {"portMappings": true},
|
||||
"snat": true
|
||||
}
|
||||
]
|
||||
}
|
||||
297
kubespray/roles/network_plugin/weave/templates/weave-net.yml.j2
Normal file
297
kubespray/roles/network_plugin/weave/templates/weave-net.yml.j2
Normal file
@@ -0,0 +1,297 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: List
|
||||
items:
|
||||
- apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: weave-net
|
||||
labels:
|
||||
name: weave-net
|
||||
namespace: kube-system
|
||||
- apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: weave-net
|
||||
labels:
|
||||
name: weave-net
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- pods
|
||||
- namespaces
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- networkpolicies
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- 'networking.k8s.io'
|
||||
resources:
|
||||
- networkpolicies
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- nodes/status
|
||||
verbs:
|
||||
- patch
|
||||
- update
|
||||
- apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: weave-net
|
||||
labels:
|
||||
name: weave-net
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: weave-net
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: weave-net
|
||||
namespace: kube-system
|
||||
- apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: weave-net
|
||||
namespace: kube-system
|
||||
labels:
|
||||
name: weave-net
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- configmaps
|
||||
resourceNames:
|
||||
- weave-net
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: weave-net
|
||||
namespace: kube-system
|
||||
labels:
|
||||
name: weave-net
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: weave-net
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: weave-net
|
||||
namespace: kube-system
|
||||
- apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: weave-net
|
||||
labels:
|
||||
name: weave-net
|
||||
namespace: kube-system
|
||||
spec:
|
||||
# Wait 5 seconds to let pod connect before rolling next pod
|
||||
selector:
|
||||
matchLabels:
|
||||
name: weave-net
|
||||
minReadySeconds: 5
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
name: weave-net
|
||||
spec:
|
||||
initContainers:
|
||||
- name: weave-init
|
||||
image: {{ weave_kube_image_repo }}:{{ weave_kube_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
command:
|
||||
- /home/weave/init.sh
|
||||
env:
|
||||
securityContext:
|
||||
privileged: true
|
||||
volumeMounts:
|
||||
- name: cni-bin
|
||||
mountPath: /host/opt
|
||||
- name: cni-bin2
|
||||
mountPath: /host/home
|
||||
- name: cni-conf
|
||||
mountPath: /host/etc
|
||||
- name: lib-modules
|
||||
mountPath: /lib/modules
|
||||
- name: xtables-lock
|
||||
mountPath: /run/xtables.lock
|
||||
readOnly: false
|
||||
containers:
|
||||
- name: weave
|
||||
command:
|
||||
- /home/weave/launch.sh
|
||||
env:
|
||||
- name: INIT_CONTAINER
|
||||
value: "true"
|
||||
- name: HOSTNAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: spec.nodeName
|
||||
- name: WEAVE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: weave-net
|
||||
key: WEAVE_PASSWORD
|
||||
- name: CHECKPOINT_DISABLE
|
||||
value: "{{ weave_checkpoint_disable | bool | int }}"
|
||||
- name: CONN_LIMIT
|
||||
value: "{{ weave_conn_limit | int }}"
|
||||
- name: HAIRPIN_MODE
|
||||
value: "{{ weave_hairpin_mode | bool | lower }}"
|
||||
- name: IPALLOC_RANGE
|
||||
value: "{{ weave_ipalloc_range }}"
|
||||
- name: EXPECT_NPC
|
||||
value: "{{ weave_expect_npc | bool | int }}"
|
||||
{% if weave_kube_peers %}
|
||||
- name: KUBE_PEERS
|
||||
value: "{{ weave_kube_peers }}"
|
||||
{% endif %}
|
||||
{% if weave_ipalloc_init %}
|
||||
- name: IPALLOC_INIT
|
||||
value: "{{ weave_ipalloc_init }}"
|
||||
{% endif %}
|
||||
{% if weave_expose_ip %}
|
||||
- name: WEAVE_EXPOSE_IP
|
||||
value: "{{ weave_expose_ip }}"
|
||||
{% endif %}
|
||||
{% if weave_metrics_addr %}
|
||||
- name: WEAVE_METRICS_ADDR
|
||||
value: "{{ weave_metrics_addr }}"
|
||||
{% endif %}
|
||||
{% if weave_status_addr %}
|
||||
- name: WEAVE_STATUS_ADDR
|
||||
value: "{{ weave_status_addr }}"
|
||||
{% endif %}
|
||||
{% if weave_iptables_backend %}
|
||||
- name: IPTABLES_BACKEND
|
||||
value: "{{ weave_iptables_backend }}"
|
||||
{% endif %}
|
||||
- name: WEAVE_MTU
|
||||
value: "{{ weave_mtu | int }}"
|
||||
- name: NO_MASQ_LOCAL
|
||||
value: "{{ weave_no_masq_local | bool | int }}"
|
||||
{% if weave_extra_args %}
|
||||
- name: EXTRA_ARGS
|
||||
value: "{{ weave_extra_args }}"
|
||||
{% endif %}
|
||||
image: {{ weave_kube_image_repo }}:{{ weave_kube_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
host: 127.0.0.1
|
||||
path: /status
|
||||
port: 6784
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
securityContext:
|
||||
privileged: true
|
||||
volumeMounts:
|
||||
- name: weavedb
|
||||
mountPath: /weavedb
|
||||
- name: dbus
|
||||
mountPath: /host/var/lib/dbus
|
||||
readOnly: true
|
||||
- mountPath: /host/etc/machine-id
|
||||
name: cni-machine-id
|
||||
readOnly: true
|
||||
- name: xtables-lock
|
||||
mountPath: /run/xtables.lock
|
||||
readOnly: false
|
||||
- name: weave-npc
|
||||
env:
|
||||
- name: HOSTNAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: spec.nodeName
|
||||
{% if weave_npc_extra_args %}
|
||||
- name: EXTRA_ARGS
|
||||
value: "{{ weave_npc_extra_args }}"
|
||||
{% endif %}
|
||||
image: {{ weave_npc_image_repo }}:{{ weave_npc_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
securityContext:
|
||||
privileged: true
|
||||
volumeMounts:
|
||||
- name: xtables-lock
|
||||
mountPath: /run/xtables.lock
|
||||
readOnly: false
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
hostPID: false
|
||||
restartPolicy: Always
|
||||
securityContext:
|
||||
seLinuxOptions: {}
|
||||
serviceAccountName: weave-net
|
||||
tolerations:
|
||||
- effect: NoSchedule
|
||||
operator: Exists
|
||||
- effect: NoExecute
|
||||
operator: Exists
|
||||
volumes:
|
||||
- name: weavedb
|
||||
hostPath:
|
||||
path: /var/lib/weave
|
||||
- name: cni-bin
|
||||
hostPath:
|
||||
path: /opt
|
||||
- name: cni-bin2
|
||||
hostPath:
|
||||
path: /home
|
||||
- name: cni-conf
|
||||
hostPath:
|
||||
path: /etc
|
||||
- name: cni-machine-id
|
||||
hostPath:
|
||||
path: /etc/machine-id
|
||||
- name: dbus
|
||||
hostPath:
|
||||
path: /var/lib/dbus
|
||||
- name: lib-modules
|
||||
hostPath:
|
||||
path: /lib/modules
|
||||
- name: xtables-lock
|
||||
hostPath:
|
||||
path: /run/xtables.lock
|
||||
type: FileOrCreate
|
||||
priorityClassName: system-node-critical
|
||||
updateStrategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: {{ serial | default('20%') }}
|
||||
type: RollingUpdate
|
||||
- apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: weave-net
|
||||
namespace: kube-system
|
||||
data:
|
||||
WEAVE_PASSWORD: "{{ weave_password | default("") | b64encode }}"
|
||||
Reference in New Issue
Block a user