Commit Graph

20 Commits (8f4643d85ce9d5d8ad7442a0534e4e5f84fb8c48)

Author SHA1 Message Date
Rick Cano 419a228503 Fixing CoreOS driver
Decoding ca on nodes

Change-Id: I4a30a348c1c0a62cb1a7b429b05878f321db92ed
5 years ago
Lingxian Kong 2cc57c5386 Use Octavia for LoadBalancer type service
In the OpenStack deployment with Octavia service enabled, the octavia
service should be used not only for master nodes high availability, but
also for k8s LoadBalancer type service implementation as well.

Change-Id: Ib61f59507510253794a4780a91e49aa6682c8039
Closes-Bug: #1770133
5 years ago
Feilong Wang be0609ce88 Support soft-anti-affinity policy for nodes
Currently, there is no guarantee to make sure all nodes of one cluster are
created on different compute hosts. So it would be nice if we can create
a server group and set it with anti-affinity policy to get a better HA
for cluster. This patch is proposing to create a server group for master
and minion nodes with soft-anti-affinity policy by default.

Closes-Bug: #1737802

Change-Id: Icc7a73ef55296a58bf00719ca4d1cdcc304fab86
5 years ago
Spyros Trigazis 65dfb2009f Add openstack_ca_file configuration option
In the drivers section of magnum.conf add openstack_ca_file.
This file is expected to be a CA Certificate OR CA bundle
which will be passed on every node and it will be installed
on the host's CA bundle.

Update devstack plugin to use the ssl bundle if tls-proxy is

Install the CA for drivers:

Add doc in troubleshooting-guide.

Add release notes.

Closes-Bug: #1580704
Partially-Implements: blueprint heat-agent
Change-Id: Id48fbea187da667a5e7334694c3ec17c8e2504db
5 years ago
Kirsten G b07b6f34d5 Add verify_ca configuration parameter
Added configuration parameter, verify_ca, to magnum.conf with default
value of True. This parameter is passed to the heat templates to
indicate whether the cluster nodes validate the Certificate Authority
when making requests to the OpenStack APIs (Keystone, Magnum, Heat).
This configuration parameter can be set to False to disable CA

Co-Authored-By: Vijendar Komalla <>

Change-Id: Iab02cb1338b811dac0c147378dbd0e63c83f0413
Partial-Bug: #1663757
6 years ago
Mohammed Naser 5153d912b2
Clean-up server names in drivers
The instance type of servers at the moment can become quite long
due to the Heat autogenerated names.  This patch cleans up the names
so that they are shorter yet contain all the info needed to be able
to know where they belong to.

Change-Id: I5bcbe73f08844242d049b8408221da40d22cd3dc
6 years ago
Kevin Lefevre 1260590b4e [k8s_coreos] enable CoreDNS addon
Enable option to specify a custom cluster domain name.
Enable Kubelet integration with DNS.

Change-Id: I76f837c950ab9111d5a43fa522829d5034cd5ee8
6 years ago
ArchiFleKs ff18982505 Fix CoreOS cluster creation and heat notify
Also fix the label issue introduced with

Closes-Bug: #1679663

Change-Id: Ic1ca4ebef96a796f22acb06722f209477b7db934
6 years ago
ArchiFleKs c270539b16 Prepare Kubelet for multiple container runtime
This change introduces default recommended values for Kubelet on CoreOS:
- Usage of CNI (Container Networking Interface) with Flannel
- Update deprecated Kubelet Args (--config)
- Bind mount recommended CoreOS folders in Kubelet

It also introduces a new parameter: CONTAINER_RUNTIME which will allow to
switch between rkt and docker as container runtime. For now only docker
is used.

Partially-Implements: blueprint coreos-best-pratice
Change-Id: I1db1c3c06198b41098472f5c28405c533b91b41e
6 years ago
ArchiFleKs 7117ff28ca Make INSECURE_REGISTRY_URL works for CoreOS
Parent commit allow custom secure HYPERKUBE_IMAGE_REPO (which can also
be a local registry). Here we implement INSECURE_REGISTRY_URL which
allow settings custom insecure registry for Kubernetes infra components.

It also enable the insecure registry for Docker daemon.

Partially-Implements: blueprint coreos-best-pratice
Partially-Implements: blueprint support-insecure-registry
Change-Id: If00afa2e8a9100546301f9a1f161daed6e3ffc4f
6 years ago
Kevin Lefevre 8b3ebbe8bf Use variables for hyperkube and kube version
Introduce HYPERKUBE_IMAGE_REPO variable which is set to CoreOS
hyperkube by default. Also remove "_coreos.0" from script as it can be a
different build number. This number should be included in the kubernetes
version parameters and not in scripts.

With this, it is possible to use any combination of hyperkube image with
any tags. by default we use the CoreOS one.

Partially-Implements: blueprint support-insecure-registry
Partially-Implements: blueprint coreos-best-pratice
Change-Id: Ie0fbed4b160fa972cfe130c252e87765690e2f5f
6 years ago
Kevin Lefevre fb0aa7d3e1 Improve consistency for SSL PATH accross template
Multiple variables names where used in different fragments. This commit
makes KUBE_CERTS_PATH and HOST_CERTS_PATH hardcoded values in heat-params
fragment and use them inside fragments instead of hardcoded value and
different variables names

Implements: blueprint coreos-best-pratice
Change-Id: I8c7856601096672890ab5a1318db0177d582e53d
6 years ago
yatin 03e7aee236 [k8s_coreos] Enable TLS in Etcd cluster
With this patch following are done:-
- Configure Etcd with TLS support

Configure Following to commuicate with TLS enabled Etcd:-
- Flannel

Etcd also listens at, so on master nodes
etcdctl can communicate without using certificates.

if TLS_DISABLED="True" then TLS is not enabled for etcd.

Change-Id: I7691ca328c4e1bc0738937b62cd813b5ad7df959
Implements: blueprint secure-etcd-cluster-coe
7 years ago
Mathieu Velten 004e0cd742 Remove underscores from Nova server names
It creates a mismatch between the generated Nova name
and its hostname which can lead to weird problems.

Closes-Bug: 1645730
Change-Id: I1c7dd459caefacaf41dd77e59c1a6e1df3ef0d42
7 years ago
Chetna Khullar 8d6bf7c621 Reduce security groups # for k8s coreos cluster
This patch allows two security groups to be created for k8s coreos
cluster(one for master and one for minion)

Change-Id: Id12cba8fbe060ced017ea0c402aab77325f71b09
Closes-bug: 1642752
7 years ago
yatin 40c1e2de6f [coreos] Allow k8s cluster without floating ip
This patch allows k8s coreos cluster to be created
without Floating IP resources.

Depends-on: I51feb6ccdc0fab91a591568866e6801f2bbb319b
Change-Id: Ifc8b6bde5a9bc3dd8c7e965e0450e2aa0d243263
Partially-Implements: blueprint bay-with-no-floating-ips
Closes-Bug: #1630189
Partial-Bug: #1490334
7 years ago
Jaycen Grant 729c2d0ab4 Rename Bay DB, Object, and internal usage to Cluster
This is patch 3 of 3 to change the internal usage of the terms
Bay and BayModel.  This patch updates Bay to Cluster in DB and
Object as well as all the usages.  No functionality should be
changed by this patch, just naming and db updates.

Change-Id: Ife04b0f944ded03ca932d70e09e6766d09cf5d9f
Implements: blueprint rename-bay-to-cluster
7 years ago
Hieu LE 6cb748d780 Align k8s CoreOS with atomic: add proxy config
Adding http_proxy, https_proxy and no_proxy config for
k8s CoreOS template file.

Change-Id: I070d6584f26b40f1f0fb77af7dc096a490b0cc72
Partial-Bug: #1490334
7 years ago
Hongbin Lu 883ce8ee47 Correct the get_file patch in CoreOS template
In CoreOS templates, the pathes provided to get_file has a extra 's'.
This caused an error on creating CoreOS bay.

Change-Id: I8d49df913fc169ce573365c5ca485cb56806e49e
Closes-Bug: #1611065
7 years ago
Eli Qiao f081cf18e5 k8s_coreos_driver: cleanup file naming
Since we have seperate template files to different driver directory, we
can cleanup -coreos suffix from template.

1. Remove unused shell scripts.
2. Remove kube-examples.yaml and kube-user.yaml which is never used.

Closes-bug: #1606655
Change-Id: I6ac93ad23e7ae30ad1eb9be1c79c2cf36af8db0c
7 years ago