|
|
@@ -1,47 +1,129 @@
|
|
|
---
|
|
|
-- name: Check for legacy service
|
|
|
- stat:
|
|
|
- path: /lib/systemd/system/calico.service
|
|
|
- get_checksum: false
|
|
|
- get_attributes: false
|
|
|
- get_mime: false
|
|
|
- register: sym
|
|
|
-- fail:
|
|
|
- msg: You are running a systemd based installation of Calico. Please run the calico upgrade playbook to upgrade to a self-hosted installation.
|
|
|
- when: sym.stat.exists
|
|
|
-
|
|
|
-- name: Configure NetworkManager to ignore Calico interfaces
|
|
|
- copy:
|
|
|
- src: files/calico.conf
|
|
|
- dest: /etc/NetworkManager/conf.d/
|
|
|
- when: using_network_manager | default(true) | bool
|
|
|
- register: nm
|
|
|
-
|
|
|
-- name: restart NetworkManager
|
|
|
- systemd:
|
|
|
- name: NetworkManager
|
|
|
- state: restarted
|
|
|
- when: nm.changed
|
|
|
-
|
|
|
-# TODO: Move into shared vars file
|
|
|
-- name: Load default node image
|
|
|
+- name: Calico | Run kube proxy
|
|
|
+ run_once: true
|
|
|
+ import_role:
|
|
|
+ name: kube_proxy_and_dns
|
|
|
+
|
|
|
+- include_tasks: certs.yml
|
|
|
+
|
|
|
+- name: Calico | Clean Calico etcd data
|
|
|
+ when: calico_cleanup_path is defined and calico_cleanup_path != ""
|
|
|
+ file:
|
|
|
+ state: absent
|
|
|
+ path: "{{ calico_cleanup_path }}"
|
|
|
+
|
|
|
+- name: Calico | oc adm policy add-scc-to-user privileged system:serviceaccount:kube-system:calico-node
|
|
|
+ oc_adm_policy_user:
|
|
|
+ user: system:serviceaccount:kube-system:calico-node
|
|
|
+ resource_kind: scc
|
|
|
+ resource_name: privileged
|
|
|
+ state: present
|
|
|
+
|
|
|
+- name: Calico | oc adm policy add-scc-to-user privileged system:serviceaccount:kube-system:calico-kube-controllers
|
|
|
+ oc_adm_policy_user:
|
|
|
+ user: system:serviceaccount:kube-system:calico-kube-controllers
|
|
|
+ resource_kind: scc
|
|
|
+ resource_name: privileged
|
|
|
+ state: present
|
|
|
+
|
|
|
+- name: Calico | oc adm policy add-scc-to-user privileged system:serviceaccount:kube-system:calico-upgrade-job
|
|
|
+ oc_adm_policy_user:
|
|
|
+ user: system:serviceaccount:kube-system:calico-upgrade-job
|
|
|
+ resource_kind: scc
|
|
|
+ resource_name: privileged
|
|
|
+ state: present
|
|
|
+
|
|
|
+- name: Calico | Set default selector for kube-system
|
|
|
+ command: >
|
|
|
+ {{ openshift_client_binary }}
|
|
|
+ --config={{ openshift.common.config_base }}/master/admin.kubeconfig
|
|
|
+ annotate ns kube-system openshift.io/node-selector="" --overwrite
|
|
|
+
|
|
|
+- name: Calico | Create temp directory
|
|
|
+ command: mktemp -d /tmp/openshift-ansible-XXXXXXX
|
|
|
+ register: mktemp
|
|
|
+ changed_when: False
|
|
|
+
|
|
|
+- name: Calico | Write separate Calico etcd manifest
|
|
|
+ when: use_calico_etcd
|
|
|
+ template:
|
|
|
+ dest: "{{ mktemp.stdout }}/calico-etcd.yml"
|
|
|
+ src: calico-etcd.yml.j2
|
|
|
+
|
|
|
+- name: Calico | Launch separate Calico etcd
|
|
|
+ when: use_calico_etcd
|
|
|
+ command: >
|
|
|
+ {{ openshift_client_binary }} apply
|
|
|
+ -f {{ mktemp.stdout }}/calico-etcd.yml
|
|
|
+ --config={{ openshift.common.config_base }}/master/admin.kubeconfig
|
|
|
+ register: calico_etcd_create_output
|
|
|
+ failed_when: "calico_etcd_create_output.rc != 0"
|
|
|
+ changed_when: "('created' in calico_etcd_create_output.stdout) or ('configured' in calico_etcd_create_output.stdout)"
|
|
|
+
|
|
|
+- name: Calico | Parse node version
|
|
|
+ set_fact:
|
|
|
+ node_version: "{{ calico_node_image | regex_replace('^.*node:v?(.*)$', '\\1') }}"
|
|
|
+ cnx: "{{ calico_node_image | regex_replace('^.*/(.*)-node:.*$', '\\1') }}"
|
|
|
+ use_calico_credentials: "{{ calico_image_credentials is defined | bool }}"
|
|
|
+
|
|
|
+- name: Calico | Encode Docker Credentials
|
|
|
+ shell: >
|
|
|
+ cat {{ calico_image_credentials }} | openssl base64 -A
|
|
|
+ register: calico_encoded_credentials_output
|
|
|
+ failed_when: "calico_encoded_credentials_output.rc != 0 or calico_encoded_credentials_output.stdout == ''"
|
|
|
+ when: use_calico_credentials
|
|
|
+
|
|
|
+- name: Calico | Set Encoded Docker Credentials Fact
|
|
|
set_fact:
|
|
|
- calico_node_image: "quay.io/calico/node:v2.6.7"
|
|
|
- when: calico_node_image is not defined
|
|
|
+ calico_encoded_credentials: "{{ calico_encoded_credentials_output.stdout }}"
|
|
|
+ when: use_calico_credentials
|
|
|
|
|
|
-- name: Prepull Images
|
|
|
- command: "{{ openshift_container_cli }} pull {{ calico_node_image }}"
|
|
|
+- name: Calico | Write Calico Pull Secret
|
|
|
+ template:
|
|
|
+ dest: "{{ mktemp.stdout }}/calico-pull-secret.yml"
|
|
|
+ src: calico-pull-secret.yml.j2
|
|
|
+ when: use_calico_credentials
|
|
|
|
|
|
-- name: Apply node label
|
|
|
- delegate_to: "{{ groups.oo_first_master.0 }}"
|
|
|
+- name: Calico | Create Calico Pull Secret
|
|
|
+ when: use_calico_credentials
|
|
|
command: >
|
|
|
- {{ openshift_client_binary }} --config={{ openshift.common.config_base }}/master/admin.kubeconfig label node {{ openshift.node.nodename | lower }} --overwrite projectcalico.org/ds-ready=true
|
|
|
-
|
|
|
-- name: Wait for node running
|
|
|
- uri:
|
|
|
- url: http://localhost:9099/readiness
|
|
|
- status_code: 204
|
|
|
- delay: 3
|
|
|
- retries: 10
|
|
|
- register: result
|
|
|
- until: result.status == 204
|
|
|
+ {{ openshift_client_binary }} apply
|
|
|
+ -f {{ mktemp.stdout }}/calico-pull-secret.yml
|
|
|
+ --config={{ openshift.common.config_base }}/master/admin.kubeconfig
|
|
|
+ register: calico_pull_secret_create_output
|
|
|
+ failed_when: "calico_pull_secret_create_output.rc != 0"
|
|
|
+ changed_when: "('created' in calico_pull_secret_create_output.stdout) or ('configured' in calico_pull_secret_create_output.stdout)"
|
|
|
+
|
|
|
+- name: Calico | Set the correct liveness and readiness checks
|
|
|
+ set_fact:
|
|
|
+ calico_binary_checks: "{{ (node_version > '3.2.0' and cnx != 'cnx') or (node_version > '2.2.0' and cnx == 'cnx') | bool }}"
|
|
|
+
|
|
|
+- name: Calico | Write Calico v2
|
|
|
+ template:
|
|
|
+ dest: "{{ mktemp.stdout }}/calico.yml"
|
|
|
+ src: calico.yml.j2
|
|
|
+ when:
|
|
|
+ - node_version | regex_search('^[0-9]\.[0-9]\.[0-9]') and node_version < '3.0.0'
|
|
|
+ - cnx != "cnx"
|
|
|
+
|
|
|
+- name: Calico | Write Calico v3
|
|
|
+ template:
|
|
|
+ dest: "{{ mktemp.stdout }}/calico.yml"
|
|
|
+ src: calicov3.yml.j2
|
|
|
+ when: (node_version | regex_search('^[0-9]\.[0-9]\.[0-9]') and node_version >= '3.0.0') or (node_version == 'master') or (cnx == "cnx" and node_version >= '2.0.0')
|
|
|
+
|
|
|
+- name: Calico | Launch Calico
|
|
|
+ run_once: true
|
|
|
+ command: >
|
|
|
+ {{ openshift_client_binary }} apply
|
|
|
+ -f {{ mktemp.stdout }}/calico.yml
|
|
|
+ --config={{ openshift.common.config_base }}/master/admin.kubeconfig
|
|
|
+ register: calico_create_output
|
|
|
+ failed_when: "calico_create_output.rc != 0"
|
|
|
+ changed_when: "('created' in calico_create_output.stdout) or ('configured' in calico_create_output.stdout)"
|
|
|
+
|
|
|
+- name: Calico | Delete temp directory
|
|
|
+ file:
|
|
|
+ name: "{{ mktemp.stdout }}"
|
|
|
+ state: absent
|
|
|
+ changed_when: False
|
matt