Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Proxy small fixes #7102

Merged
merged 3 commits into from
Jan 7, 2021
Merged

Proxy small fixes #7102

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
242b33f
Improve how we set 'proxy=' in yum.conf or dnf.conf
champtar Jan 4, 2021
40f1ac2
Fixup spaces in no_proxy
champtar Jan 5, 2021
c311ab4
Add svc,svc.{{ dns_domain }} to no_proxy
champtar Jan 5, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/proxy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ If you set http and https proxy, all nodes and loadbalancer will be excluded fro

## Set additional addresses to default no_proxy (all cluster nodes and loadbalancer)

`additional_no_proxy: "aditional_host,"`
`additional_no_proxy: "aditional_host1,aditional_host2"`

## Exclude workers from no_proxy

Expand Down
22 changes: 11 additions & 11 deletions roles/bootstrap-os/tasks/bootstrap-centos.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,17 @@
gather_subset: '!all'
filter: ansible_distribution_*version

- name: Add proxy to yum.conf or dnf.conf if http_proxy is defined
ini_file:
path: "{{ ( (ansible_distribution_major_version | int) < 8) | ternary('/etc/yum.conf','/etc/dnf/dnf.conf') }}"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

note for me: dnf is newer package management system than yum and it is available on centos8.

section: main
option: proxy
value: "{{ http_proxy | default(omit) }}"
state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
no_extra_spaces: true
become: true
when: not skip_http_proxy_on_os_packages

# For Oracle Linux install public repo
- name: Download Oracle Linux public yum repo
get_url:
Expand Down Expand Up @@ -69,17 +80,6 @@
- fastestmirror.stat.exists
- not centos_fastestmirror_enabled

- name: Add proxy to /etc/yum.conf if http_proxy is defined
ini_file:
path: "/etc/yum.conf"
section: main
option: proxy
value: "{{ http_proxy | default(omit) }}"
state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
no_extra_spaces: true
become: true
when: not skip_http_proxy_on_os_packages

# libselinux-python is required on SELinux enabled hosts
# See https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#managed-node-requirements
- name: Install libselinux python package
Expand Down
28 changes: 9 additions & 19 deletions roles/bootstrap-os/tasks/bootstrap-fedora.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,26 +10,16 @@
tags:
- facts

- name: Check if a proxy is set in /etc/dnf/dnf.conf
raw: grep -qs 'proxy=' /etc/dnf/dnf.conf
register: need_http_proxy
failed_when: false
changed_when: false
# This command should always run, even in check mode
check_mode: false
environment: {}
when:
- http_proxy is defined
- not skip_http_proxy_on_os_packages

- name: Add http_proxy to /etc/dnf/dnf.conf if http_proxy is defined
raw: echo 'proxy={{ http_proxy }}' >> /etc/dnf/dnf.conf
- name: Add proxy to dnf.conf if http_proxy is defined
ini_file:
path: "/etc/dnf/dnf.conf"
section: main
option: proxy
value: "{{ http_proxy | default(omit) }}"
state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
no_extra_spaces: true
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

consistent configuration way as the same as centos one.

become: true
environment: {}
when:
- http_proxy is defined
- need_http_proxy.rc != 0
- not skip_http_proxy_on_os_packages
when: not skip_http_proxy_on_os_packages

- name: Install python3 on fedora
raw: "dnf install --assumeyes --quiet python3"
Expand Down
21 changes: 11 additions & 10 deletions roles/bootstrap-os/tasks/bootstrap-redhat.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,17 @@
gather_subset: '!all'
filter: ansible_distribution_*version

- name: Add proxy to yum.conf or dnf.conf if http_proxy is defined
ini_file:
path: "{{ ( (ansible_distribution_major_version | int) < 8) | ternary('/etc/yum.conf','/etc/dnf/dnf.conf') }}"
section: main
option: proxy
value: "{{ http_proxy | default(omit) }}"
state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
no_extra_spaces: true
become: true
when: not skip_http_proxy_on_os_packages

- name: Check RHEL subscription-manager status
command: /sbin/subscription-manager status
register: rh_subscription_status
Expand Down Expand Up @@ -66,16 +77,6 @@
- fastestmirror.stat.exists
- not centos_fastestmirror_enabled

- name: Add proxy to /etc/yum.conf if http_proxy is defined
ini_file:
path: "/etc/yum.conf"
section: main
option: proxy
value: "{{ http_proxy | default(omit) }}"
state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
no_extra_spaces: true
become: true

# libselinux-python is required on SELinux enabled hosts
# See https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#managed-node-requirements
- name: Install libselinux python package
Expand Down
8 changes: 4 additions & 4 deletions roles/kubespray-defaults/tasks/no_proxy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,11 @@
{{ apiserver_loadbalancer_domain_name| default('') }},
{{ loadbalancer_apiserver.address | default('') }},
{%- endif -%}
{%- if ( (no_proxy_exclude_workers is defined) and (no_proxy_exclude_workers) ) -%}
{%- if no_proxy_exclude_workers | default(false) -%}
{% set cluster_or_master = 'kube-master' %}
{% else %}
{%- else -%}
{% set cluster_or_master = 'k8s-cluster' %}
{% endif %}
{%- endif -%}
{%- for item in (groups[cluster_or_master] + groups['etcd']|default([]) + groups['calico-rr']|default([]))|unique -%}
{{ hostvars[item]['access_ip'] | default(hostvars[item]['ip'] | default(fallback_ips[item])) }},
{%- if item != hostvars[item].get('ansible_hostname', '') -%}
Expand All @@ -22,7 +22,7 @@
{%- if additional_no_proxy is defined -%}
{{ additional_no_proxy }},
{%- endif -%}
127.0.0.1,localhost,{{ kube_service_addresses }},{{ kube_pods_subnet }}
127.0.0.1,localhost,{{ kube_service_addresses }},{{ kube_pods_subnet }},svc,svc.{{ dns_domain }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

note: this additional svc non_proxy configuration is for avoiding http proxy on k8s internal communication.

delegate_to: localhost
connection: local
delegate_facts: yes
Expand Down