This commit is contained in:
118
ansible/roles/node/defaults/main.yml
Normal file
118
ansible/roles/node/defaults/main.yml
Normal file
@ -0,0 +1,118 @@
|
||||
# Copyright 2018 The Kubernetes Authors.
|
||||
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
---
|
||||
common_rpms:
|
||||
- audit
|
||||
- ca-certificates
|
||||
- conntrack-tools
|
||||
- chrony
|
||||
- curl
|
||||
- jq
|
||||
- python3-pip
|
||||
- socat
|
||||
- sysstat
|
||||
- yum-utils
|
||||
|
||||
# Used for AmazonLinux-2 distributions
|
||||
al2_rpms:
|
||||
- ebtables
|
||||
- python-netifaces
|
||||
- python-requests
|
||||
|
||||
# Used for RedHat based distributions == 7 (ex. RHEL-7, CentOS-7 etc.)
|
||||
rh7_rpms:
|
||||
- ebtables
|
||||
- python-netifaces
|
||||
- python-requests
|
||||
|
||||
# Used for RedHat based distributions == 8 (ex. RHEL-8, RockyLinux-8 etc.)
|
||||
rh8_rpms:
|
||||
- nftables
|
||||
- python3-netifaces
|
||||
- python3-requests
|
||||
|
||||
common_debs:
|
||||
- auditd
|
||||
- apt-transport-https
|
||||
- conntrack
|
||||
- chrony
|
||||
- curl
|
||||
- ebtables
|
||||
- jq
|
||||
- gnupg
|
||||
- libnetfilter-acct1
|
||||
- libnetfilter-cttimeout1
|
||||
- libnetfilter-log1
|
||||
- python3-distutils
|
||||
- python3-netifaces
|
||||
- python3-pip
|
||||
- socat
|
||||
|
||||
common_photon_rpms:
|
||||
- audit
|
||||
- apparmor-parser
|
||||
- conntrack-tools
|
||||
- chrony
|
||||
- dbus-python3
|
||||
- distrib-compat
|
||||
- ebtables
|
||||
- net-tools
|
||||
- openssl-c_rehash
|
||||
- python3-pygobject
|
||||
- python3-pip
|
||||
- rng-tools
|
||||
- socat
|
||||
- tar
|
||||
- unzip
|
||||
- curl
|
||||
|
||||
photon_3_rpms:
|
||||
- python-netifaces
|
||||
- python-requests
|
||||
- jq
|
||||
|
||||
# Creating photon_4_rpms for adding future packages if needed.
|
||||
# Since empty list errors out, jq is added.
|
||||
photon_4_rpms:
|
||||
- jq
|
||||
|
||||
common_virt_rpms:
|
||||
- open-vm-tools
|
||||
|
||||
common_virt_debs:
|
||||
- linux-cloud-tools-virtual
|
||||
- linux-tools-virtual
|
||||
- open-vm-tools
|
||||
|
||||
common_virt_photon_rpms:
|
||||
- open-vm-tools
|
||||
|
||||
common_raw_rpms: []
|
||||
|
||||
common_raw_debs:
|
||||
- linux-cloud-tools-generic
|
||||
- linux-tools-generic
|
||||
|
||||
common_raw_photon_rpms: []
|
||||
|
||||
#photon does not have backward compatibility for legacy distro behavior for sysctl.conf by default
|
||||
#as it uses systemd-sysctl. set this var so we can use for sysctl conf file value.
|
||||
sysctl_conf_file: "{{ '/etc/sysctl.d/99-sysctl.conf' if ansible_os_family == 'VMware Photon OS' else '/etc/sysctl.conf' }}"
|
||||
|
||||
pause_image: "registry.k8s.io/pause:3.9"
|
||||
containerd_additional_settings: null
|
||||
leak_local_mdns_to_dns: false
|
||||
build_target: "virt"
|
||||
cloud_cfg_file: "/etc/cloud/cloud.cfg"
|
||||
external_binary_path: "{{ '/opt/bin' if ansible_os_family == 'Flatcar' else '/usr/local/bin' }}"
|
10
ansible/roles/node/files/etc/audit/rules.d/containerd.rules
Normal file
10
ansible/roles/node/files/etc/audit/rules.d/containerd.rules
Normal file
@ -0,0 +1,10 @@
|
||||
-w /var/lib/containerd/ -p rwxa -k containerd
|
||||
-w /etc/containerd/ -p rwxa -k containerd
|
||||
-w /etc/systemd/system/containerd.service -p rwxa -k containerd
|
||||
-w /etc/systemd/system/containerd.service.d/ -p rwxa -k containerd
|
||||
-w /run/containerd/ -p rwxa -k containerd
|
||||
-w /usr/local/bin/containerd-shim -p rwxa -k containerd
|
||||
-w /usr/local/bin/containerd-shim-runc-v1 -p rwxa -k containerd
|
||||
-w /usr/local/bin/containerd-shim-runc-v2 -p rwxa -k containerd
|
||||
-w /usr/local/sbin/runc -p rwxa -k containerd
|
||||
-w /usr/local/bin/containerd -p rwxa -k containerd
|
@ -0,0 +1,10 @@
|
||||
-w /var/lib/containerd/ -p rwxa -k containerd
|
||||
-w /etc/containerd/ -p rwxa -k containerd
|
||||
-w /etc/systemd/system/containerd.service -p rwxa -k containerd
|
||||
-w /etc/systemd/system/containerd.service.d/ -p rwxa -k containerd
|
||||
-w /run/containerd/ -p rwxa -k containerd
|
||||
-w /opt/bin/containerd-shim -p rwxa -k containerd
|
||||
-w /opt/bin/containerd-shim-runc-v1 -p rwxa -k containerd
|
||||
-w /opt/bin/containerd-shim-runc-v2 -p rwxa -k containerd
|
||||
-w /opt/bin/runc -p rwxa -k containerd
|
||||
-w /opt/bin/containerd -p rwxa -k containerd
|
38
ansible/roles/node/files/usr/local/bin/etcd-network-tuning.sh
Executable file
38
ansible/roles/node/files/usr/local/bin/etcd-network-tuning.sh
Executable file
@ -0,0 +1,38 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2022 The Kubernetes Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o errexit # exits immediately on any unexpected error (does not bypass traps)
|
||||
set -o nounset # will error if variables are used without first being defined
|
||||
set -o pipefail # any non-zero exit code in a piped command causes the pipeline to fail with that code
|
||||
|
||||
trap on_exit ERR
|
||||
on_exit() {
|
||||
echo "Error setting etcd network tuning parameters for interface: ${DEV}" | systemd-cat -p emerg -t etcd-tuning
|
||||
}
|
||||
|
||||
if [ "$#" -ne 1 ]; then
|
||||
echo "Error: Usage: $0 <dev>" | systemd-cat -p emerg -t etcd-tuning
|
||||
exit 1
|
||||
fi
|
||||
|
||||
DEV=$1
|
||||
echo "Setting etcd network tuning parameters for interface: ${DEV}" | systemd-cat -p info -t etcd-tuning
|
||||
tc qdisc add dev ${DEV} root handle 1: prio bands 3
|
||||
tc filter add dev ${DEV} parent 1: protocol ip prio 1 u32 match ip sport 2380 0xffff flowid 1:1
|
||||
tc filter add dev ${DEV} parent 1: protocol ip prio 1 u32 match ip dport 2380 0xffff flowid 1:1
|
||||
tc filter add dev ${DEV} parent 1: protocol ip prio 2 u32 match ip sport 2379 0xffff flowid 1:1
|
||||
tc filter add dev ${DEV} parent 1: protocol ip prio 2 u32 match ip dport 2379 0xffff flowid 1:1
|
||||
|
38
ansible/roles/node/meta/main.yml
Normal file
38
ansible/roles/node/meta/main.yml
Normal file
@ -0,0 +1,38 @@
|
||||
# Copyright 2020 The Kubernetes Authors.
|
||||
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
---
|
||||
dependencies:
|
||||
- role: setup
|
||||
vars:
|
||||
rpms: "{{ common_rpms + al2_rpms + lookup('vars', 'common_' + build_target + '_rpms') }}"
|
||||
debs: "{{ common_debs }}"
|
||||
when: ansible_distribution == "Amazon"
|
||||
|
||||
- role: setup
|
||||
vars:
|
||||
rpms: "{{ common_rpms }}"
|
||||
debs: "{{ common_debs }}"
|
||||
when: packer_builder_type == "oracle-oci" and ansible_architecture == "aarch64"
|
||||
|
||||
- role: setup
|
||||
vars:
|
||||
rpms: "{{ ( common_photon_rpms + photon_3_rpms + lookup('vars', 'common_' + build_target + '_photon_rpms') ) if (ansible_os_family == 'VMware Photon OS' and ansible_distribution_major_version == '3') else (common_photon_rpms + photon_4_rpms + lookup('vars', 'common_' + build_target + '_photon_rpms')) }}"
|
||||
when: ansible_distribution == "VMware Photon OS"
|
||||
|
||||
- role: setup
|
||||
vars:
|
||||
rpms: "{{ ( ( common_rpms + rh7_rpms + lookup('vars', 'common_' + build_target + '_rpms') ) if (ansible_os_family == 'RedHat' and ansible_distribution_major_version == '7') else ( common_rpms + rh8_rpms + lookup('vars', 'common_' + build_target + '_rpms') ) ) }}"
|
||||
debs: "{{ common_debs + lookup('vars', 'common_' + build_target + '_debs') }}"
|
||||
when: ansible_distribution != "VMware Photon OS" and ansible_distribution != "Amazon" and not (packer_builder_type == "oracle-oci" and ansible_architecture == "aarch64") and
|
||||
not packer_builder_type is search('qemu')
|
28
ansible/roles/node/tasks/amazonLinux2.yml
Normal file
28
ansible/roles/node/tasks/amazonLinux2.yml
Normal file
@ -0,0 +1,28 @@
|
||||
# Copyright 2020 The Kubernetes Authors.
|
||||
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
---
|
||||
- name: Ensure sysstat is running and comes on at reboot
|
||||
service:
|
||||
name: sysstat
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
# images need to be immutable once built
|
||||
# https://aws.amazon.com/amazon-linux-ami/faqs/
|
||||
- name: Disable security updates on boot
|
||||
lineinfile:
|
||||
path: "{{ cloud_cfg_file }}"
|
||||
regexp: "^repo_upgrade: security"
|
||||
line: 'repo_upgrade: none'
|
133
ansible/roles/node/tasks/main.yml
Normal file
133
ansible/roles/node/tasks/main.yml
Normal file
@ -0,0 +1,133 @@
|
||||
# Copyright 2018 The Kubernetes Authors.
|
||||
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
---
|
||||
- import_tasks: photon.yml
|
||||
when: ansible_os_family == "VMware Photon OS"
|
||||
|
||||
- import_tasks: amazonLinux2.yml
|
||||
when: ansible_distribution == "Amazon"
|
||||
|
||||
# This is required until https://github.com/ansible/ansible/issues/77537 is fixed and used.
|
||||
- name: Override Flatcar's OS family
|
||||
set_fact:
|
||||
ansible_os_family: Flatcar
|
||||
when: ansible_os_family == "Flatcar Container Linux by Kinvolk"
|
||||
tags:
|
||||
- facts
|
||||
|
||||
- name: Ensure overlay module is present
|
||||
modprobe:
|
||||
name: overlay
|
||||
state: present
|
||||
|
||||
- name: Ensure br_netfilter module is present
|
||||
modprobe:
|
||||
name: br_netfilter
|
||||
state: present
|
||||
|
||||
- name: Persist required kernel modules
|
||||
copy:
|
||||
content: |
|
||||
overlay
|
||||
br_netfilter
|
||||
dest: /etc/modules-load.d/kubernetes.conf
|
||||
mode: 0644
|
||||
|
||||
- name: Set and persist kernel params
|
||||
sysctl:
|
||||
name: "{{ item.param }}"
|
||||
value: "{{ item.val }}"
|
||||
state: present
|
||||
sysctl_set: yes
|
||||
sysctl_file: "{{ sysctl_conf_file }}"
|
||||
reload: yes
|
||||
loop:
|
||||
- { param: net.bridge.bridge-nf-call-iptables, val: 1 }
|
||||
- { param: net.bridge.bridge-nf-call-ip6tables, val: 1 }
|
||||
- { param: net.ipv4.ip_forward, val: 1 }
|
||||
- { param: net.ipv6.conf.all.forwarding, val: 1 }
|
||||
- { param: net.ipv6.conf.all.disable_ipv6, val: 0 }
|
||||
- { param: net.ipv4.tcp_congestion_control, val: bbr }
|
||||
- { param: vm.overcommit_memory, val: 1 }
|
||||
- { param: kernel.panic, val: 10 }
|
||||
- { param: kernel.panic_on_oops, val: 1 }
|
||||
|
||||
- name: Disable swap memory
|
||||
shell: |
|
||||
swapoff -a
|
||||
when: ansible_memory_mb.swap.total != 0
|
||||
|
||||
- name: Edit fstab file to disable swap
|
||||
shell: sed -ri '/\sswap\s/s/^#?/#/' /etc/fstab
|
||||
when: ansible_memory_mb.swap.total != 0
|
||||
|
||||
- name: Disable conntrackd service
|
||||
systemd:
|
||||
name: conntrackd
|
||||
state: stopped
|
||||
enabled: false
|
||||
when: ansible_os_family != "Debian" and ansible_os_family != "Flatcar"
|
||||
|
||||
- name: Ensure auditd is running and comes on at reboot
|
||||
service:
|
||||
name: auditd
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
- name: configure auditd rules for containerd
|
||||
copy:
|
||||
src: etc/audit/rules.d/containerd.rules
|
||||
dest: /etc/audit/rules.d/containerd.rules
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when: ansible_os_family != "Flatcar"
|
||||
|
||||
- name: configure auditd rules for containerd (Flatcar)
|
||||
copy:
|
||||
src: etc/audit/rules.d/containerd.rules-flatcar
|
||||
dest: /etc/audit/rules.d/containerd.rules
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when: ansible_os_family == "Flatcar"
|
||||
|
||||
- name: Ensure reverse packet filtering is set as strict
|
||||
sysctl:
|
||||
name: net.ipv4.conf.all.rp_filter
|
||||
value: "1"
|
||||
state: present
|
||||
sysctl_set: yes
|
||||
reload: yes
|
||||
when: ansible_distribution == "Ubuntu"
|
||||
|
||||
- name: Set transparent huge pages to madvise
|
||||
lineinfile:
|
||||
path: /etc/default/grub
|
||||
backrefs: yes
|
||||
regexp: "^(?!.*transparent_hugepage=madvise)(GRUB_CMDLINE_LINUX=.*)(\"$)"
|
||||
line: '\1 transparent_hugepage=madvise"'
|
||||
when: ansible_os_family == "RedHat"
|
||||
|
||||
- name: Copy udev etcd network tuning rules
|
||||
template:
|
||||
src: etc/udev/rules.d/90-etcd-tuning.rules
|
||||
dest: /etc/udev/rules.d/90-etcd-tuning.rules
|
||||
mode: 0744
|
||||
|
||||
- name: Copy etcd network tuning script
|
||||
copy:
|
||||
src: usr/local/bin/etcd-network-tuning.sh
|
||||
dest: "{{ external_binary_path }}/etcd-network-tuning.sh"
|
||||
mode: 0755
|
53
ansible/roles/node/tasks/photon.yml
Normal file
53
ansible/roles/node/tasks/photon.yml
Normal file
@ -0,0 +1,53 @@
|
||||
# Copyright 2020 The Kubernetes Authors.
|
||||
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
---
|
||||
- name: Leak mDNS to DNS (cloud-init-nics) (enable .local domain lookups)
|
||||
ini_file:
|
||||
path: /etc/systemd/network/10-cloud-init-nics.network
|
||||
section: Network
|
||||
option: Domains
|
||||
value: "~local"
|
||||
when: leak_local_mdns_to_dns
|
||||
|
||||
- name: Leak mDNS to DNS (dhcp) (enable .local domain lookups)
|
||||
ini_file:
|
||||
path: /etc/systemd/network/99-dhcp-en.network
|
||||
section: Network
|
||||
option: Domains
|
||||
value: "~local"
|
||||
when: leak_local_mdns_to_dns
|
||||
|
||||
- name: Double TCP small queue limit to be the same as Ubuntu
|
||||
sysctl:
|
||||
name: net.ipv4.tcp_limit_output_bytes
|
||||
value: "524288"
|
||||
state: present
|
||||
sysctl_set: yes
|
||||
reload: yes
|
||||
sysctl_file: "{{ sysctl_conf_file }}"
|
||||
|
||||
- name: Disable Apparmor service
|
||||
systemd:
|
||||
name: apparmor
|
||||
daemon_reload: yes
|
||||
enabled: false
|
||||
state: stopped
|
||||
|
||||
- name: Disable Apparmor in kernel
|
||||
lineinfile:
|
||||
path: /boot/photon.cfg
|
||||
backrefs: yes
|
||||
regexp: "^(?!.*apparmor=0)(photon_cmdline.*)"
|
||||
line: '\1 apparmor=0'
|
@ -0,0 +1,15 @@
|
||||
# Copyright 2022 The Kubernetes Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
ACTION=="add", SUBSYSTEM=="net", SUBSYSTEMS=="pci|xen|vmbus" RUN+="{{ external_binary_path }}/etcd-network-tuning.sh $name"
|
Reference in New Issue
Block a user