Ansible variables

Inventory

The inventory is composed of 3 groups:

• kube-node : list of kubernetes nodes where the pods will run.
• kube-master : list of servers where kubernetes master components (apiserver, scheduler, controller) will run.
• etcd: list of servers to compose the etcd server. You should have at least 3 servers for failover purpose.

Note: do not modify the children of k8s-cluster, like puttingthe etcd group into the k8s-cluster, unless you are certainto do that and you have it fully contained in the latter:

k8s-cluster ⊂ etcd => kube-node ∩ etcd = etcd

When kube-node contains etcd, you define your etcd cluster to be as well schedulable for Kubernetes workloads.If you want it a standalone, make sure those groups do not intersect.If you want the server to act both as master and node, the server must be definedon both groups kube-master and kube-node. If you want a standalone andunschedulable master, the server must be defined only in the kube-master andnot kube-node.

There are also two special groups:

• calico-rr : explained for advanced Calico networking cases
• bastion : configure a bastion host if your nodes are not directly reachable

Below is a complete inventory example:

## Configure 'ip' variable to bind kubernetes services on a
## different ip than the default iface
node1 ansible_host=95.54.0.12 ip=10.3.0.1
node2 ansible_host=95.54.0.13 ip=10.3.0.2
node3 ansible_host=95.54.0.14 ip=10.3.0.3
node4 ansible_host=95.54.0.15 ip=10.3.0.4
node5 ansible_host=95.54.0.16 ip=10.3.0.5
node6 ansible_host=95.54.0.17 ip=10.3.0.6
[kube-master]
node1
node2
[etcd]
node1
node2
node3
[kube-node]
node2
node3
node4
node5
node6
[k8s-cluster:children]
kube-node
kube-master

Group vars and overriding variables precedence

The group variables to control main deployment options are located in the directory inventory/sample/group_vars.Optional variables are located in the inventory/sample/group_vars/all.yml.Mandatory variables that are common for at least one role (or a node group) can be found in theinventory/sample/group_vars/k8s-cluster.yml.There are also role vars for docker, kubernetes preinstall and master roles.According to the ansible docs,those cannot be overridden from the group vars. In order to override, one should usethe -e runtime flags (most simple way) or other layers described in the docs.

Kubespray uses only a few layers to override things (or expect them tobe overridden for roles):

Ansible tags

The following tags are defined in playbooks:

Note: Use the bash scripts/gen_tags.sh command to generate a list of alltags found in the codebase. New tags will be listed with the empty “Used for”field.

Example commands

Example command to filter and apply only DNS configuration tasks and skipeverything else related to host OS configuration and downloading images of containers:

ansible-playbook -i inventory/sample/hosts.ini cluster.yml --tags preinstall,facts --skip-tags=download,bootstrap-os

And this play only removes the K8s cluster DNS resolver IP from hosts’ /etc/resolv.conf files:

ansible-playbook -i inventory/sample/hosts.ini -e dns_mode='none' cluster.yml --tags resolvconf

And this prepares all container images locally (at the ansible runner node) without installingor upgrading related stuff or trying to upload container to K8s cluster nodes:

ansible-playbook -i inventory/sample/hosts.ini cluster.yml \
    -e download_run_once=true -e download_localhost=true \
    --tags download --skip-tags upload,upgrade

Note: use --tags and --skip-tags wise and only if you’re 100% sure what you’re doing.

Bastion host

If you prefer to not make your nodes publicly accessible (nodes with private IPs only),you can use a so called bastion host to connect to your nodes. To specify and use a bastion,simply add a line to your inventory, where you have to replace x.x.x.x with the public IP of thebastion host.

[bastion]
bastion ansible_host=x.x.x.x

For more information about Ansible and bastion hosts, readRunning Ansible Through an SSH Bastion Host