This commit is contained in:
28
ansible/roles/node/tasks/amazonLinux2.yml
Normal file
28
ansible/roles/node/tasks/amazonLinux2.yml
Normal file
@ -0,0 +1,28 @@
|
||||
# Copyright 2020 The Kubernetes Authors.
|
||||
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
---
|
||||
- name: Ensure sysstat is running and comes on at reboot
|
||||
service:
|
||||
name: sysstat
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
# images need to be immutable once built
|
||||
# https://aws.amazon.com/amazon-linux-ami/faqs/
|
||||
- name: Disable security updates on boot
|
||||
lineinfile:
|
||||
path: "{{ cloud_cfg_file }}"
|
||||
regexp: "^repo_upgrade: security"
|
||||
line: 'repo_upgrade: none'
|
||||
133
ansible/roles/node/tasks/main.yml
Normal file
133
ansible/roles/node/tasks/main.yml
Normal file
@ -0,0 +1,133 @@
|
||||
# Copyright 2018 The Kubernetes Authors.
|
||||
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
---
|
||||
- import_tasks: photon.yml
|
||||
when: ansible_os_family == "VMware Photon OS"
|
||||
|
||||
- import_tasks: amazonLinux2.yml
|
||||
when: ansible_distribution == "Amazon"
|
||||
|
||||
# This is required until https://github.com/ansible/ansible/issues/77537 is fixed and used.
|
||||
- name: Override Flatcar's OS family
|
||||
set_fact:
|
||||
ansible_os_family: Flatcar
|
||||
when: ansible_os_family == "Flatcar Container Linux by Kinvolk"
|
||||
tags:
|
||||
- facts
|
||||
|
||||
- name: Ensure overlay module is present
|
||||
modprobe:
|
||||
name: overlay
|
||||
state: present
|
||||
|
||||
- name: Ensure br_netfilter module is present
|
||||
modprobe:
|
||||
name: br_netfilter
|
||||
state: present
|
||||
|
||||
- name: Persist required kernel modules
|
||||
copy:
|
||||
content: |
|
||||
overlay
|
||||
br_netfilter
|
||||
dest: /etc/modules-load.d/kubernetes.conf
|
||||
mode: 0644
|
||||
|
||||
- name: Set and persist kernel params
|
||||
sysctl:
|
||||
name: "{{ item.param }}"
|
||||
value: "{{ item.val }}"
|
||||
state: present
|
||||
sysctl_set: yes
|
||||
sysctl_file: "{{ sysctl_conf_file }}"
|
||||
reload: yes
|
||||
loop:
|
||||
- { param: net.bridge.bridge-nf-call-iptables, val: 1 }
|
||||
- { param: net.bridge.bridge-nf-call-ip6tables, val: 1 }
|
||||
- { param: net.ipv4.ip_forward, val: 1 }
|
||||
- { param: net.ipv6.conf.all.forwarding, val: 1 }
|
||||
- { param: net.ipv6.conf.all.disable_ipv6, val: 0 }
|
||||
- { param: net.ipv4.tcp_congestion_control, val: bbr }
|
||||
- { param: vm.overcommit_memory, val: 1 }
|
||||
- { param: kernel.panic, val: 10 }
|
||||
- { param: kernel.panic_on_oops, val: 1 }
|
||||
|
||||
- name: Disable swap memory
|
||||
shell: |
|
||||
swapoff -a
|
||||
when: ansible_memory_mb.swap.total != 0
|
||||
|
||||
- name: Edit fstab file to disable swap
|
||||
shell: sed -ri '/\sswap\s/s/^#?/#/' /etc/fstab
|
||||
when: ansible_memory_mb.swap.total != 0
|
||||
|
||||
- name: Disable conntrackd service
|
||||
systemd:
|
||||
name: conntrackd
|
||||
state: stopped
|
||||
enabled: false
|
||||
when: ansible_os_family != "Debian" and ansible_os_family != "Flatcar"
|
||||
|
||||
- name: Ensure auditd is running and comes on at reboot
|
||||
service:
|
||||
name: auditd
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
- name: configure auditd rules for containerd
|
||||
copy:
|
||||
src: etc/audit/rules.d/containerd.rules
|
||||
dest: /etc/audit/rules.d/containerd.rules
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when: ansible_os_family != "Flatcar"
|
||||
|
||||
- name: configure auditd rules for containerd (Flatcar)
|
||||
copy:
|
||||
src: etc/audit/rules.d/containerd.rules-flatcar
|
||||
dest: /etc/audit/rules.d/containerd.rules
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when: ansible_os_family == "Flatcar"
|
||||
|
||||
- name: Ensure reverse packet filtering is set as strict
|
||||
sysctl:
|
||||
name: net.ipv4.conf.all.rp_filter
|
||||
value: "1"
|
||||
state: present
|
||||
sysctl_set: yes
|
||||
reload: yes
|
||||
when: ansible_distribution == "Ubuntu"
|
||||
|
||||
- name: Set transparent huge pages to madvise
|
||||
lineinfile:
|
||||
path: /etc/default/grub
|
||||
backrefs: yes
|
||||
regexp: "^(?!.*transparent_hugepage=madvise)(GRUB_CMDLINE_LINUX=.*)(\"$)"
|
||||
line: '\1 transparent_hugepage=madvise"'
|
||||
when: ansible_os_family == "RedHat"
|
||||
|
||||
- name: Copy udev etcd network tuning rules
|
||||
template:
|
||||
src: etc/udev/rules.d/90-etcd-tuning.rules
|
||||
dest: /etc/udev/rules.d/90-etcd-tuning.rules
|
||||
mode: 0744
|
||||
|
||||
- name: Copy etcd network tuning script
|
||||
copy:
|
||||
src: usr/local/bin/etcd-network-tuning.sh
|
||||
dest: "{{ external_binary_path }}/etcd-network-tuning.sh"
|
||||
mode: 0755
|
||||
53
ansible/roles/node/tasks/photon.yml
Normal file
53
ansible/roles/node/tasks/photon.yml
Normal file
@ -0,0 +1,53 @@
|
||||
# Copyright 2020 The Kubernetes Authors.
|
||||
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
---
|
||||
- name: Leak mDNS to DNS (cloud-init-nics) (enable .local domain lookups)
|
||||
ini_file:
|
||||
path: /etc/systemd/network/10-cloud-init-nics.network
|
||||
section: Network
|
||||
option: Domains
|
||||
value: "~local"
|
||||
when: leak_local_mdns_to_dns
|
||||
|
||||
- name: Leak mDNS to DNS (dhcp) (enable .local domain lookups)
|
||||
ini_file:
|
||||
path: /etc/systemd/network/99-dhcp-en.network
|
||||
section: Network
|
||||
option: Domains
|
||||
value: "~local"
|
||||
when: leak_local_mdns_to_dns
|
||||
|
||||
- name: Double TCP small queue limit to be the same as Ubuntu
|
||||
sysctl:
|
||||
name: net.ipv4.tcp_limit_output_bytes
|
||||
value: "524288"
|
||||
state: present
|
||||
sysctl_set: yes
|
||||
reload: yes
|
||||
sysctl_file: "{{ sysctl_conf_file }}"
|
||||
|
||||
- name: Disable Apparmor service
|
||||
systemd:
|
||||
name: apparmor
|
||||
daemon_reload: yes
|
||||
enabled: false
|
||||
state: stopped
|
||||
|
||||
- name: Disable Apparmor in kernel
|
||||
lineinfile:
|
||||
path: /boot/photon.cfg
|
||||
backrefs: yes
|
||||
regexp: "^(?!.*apparmor=0)(photon_cmdline.*)"
|
||||
line: '\1 apparmor=0'
|
||||
Reference in New Issue
Block a user