Make CPU reservations based on CPU allocation
[ta/caas-kubernetes.git] / ansible / roles / kube_master / defaults / main.yaml
1 ---
2 # Copyright 2019 Nokia
3 #
4 # Licensed under the Apache License, Version 2.0 (the "License");
5 # you may not use this file except in compliance with the License.
6 # You may obtain a copy of the License at
7 #
8 #     http://www.apache.org/licenses/LICENSE-2.0
9 #
10 # Unless required by applicable law or agreed to in writing, software
11 # distributed under the License is distributed on an "AS IS" BASIS,
12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 # See the License for the specific language governing permissions and
14 # limitations under the License.
15
16 apiserver_admission_controllers:
17   - DefaultStorageClass
18   - LimitRanger
19   - MutatingAdmissionWebhook
20   - NamespaceExists
21   - NamespaceLifecycle
22   - NodeRestriction
23   - PodSecurityPolicy
24   - ResourceQuota
25   - ServiceAccount
26   - ValidatingAdmissionWebhook
27
28 apiserver_feature_gates:
29   CPUManager: false
30   DevicePlugins: true
31   HugePages: true
32   TokenRequest: true
33
34 apiserver_params:
35   - "--admission-control={{ apiserver_admission_controllers | join(',') }}"
36   - "--advertise-address={{ apiserver }}"
37   - "--allow-privileged=true"
38   - "--anonymous-auth=false"
39   - "--apiserver-count={{ groups['caas_master']|length|int }}"
40   - "--audit-policy-file={{ caas.caas_policy_directory }}/audit-policy.yaml"
41   - "--audit-log-format=json"
42   - "--audit-log-maxbackup=10"
43   - "--audit-log-maxsize=100"
44   - "--audit-log-path=/var/log/audit/kube_apiserver/kube-apiserver-audit.log"
45   - "--authorization-mode=Node,RBAC"
46   - "--bind-address={{ apiserver }}"
47   - "--client-ca-file=/etc/openssl/ca.pem"
48   - "--enable-bootstrap-token-auth=true"
49   - "--etcd-cafile=/etc/etcd/ssl/ca.pem"
50   - "--etcd-certfile=/etc/etcd/ssl/etcd{{ nodeindex }}.pem"
51   - "--etcd-keyfile=/etc/etcd/ssl/etcd{{ nodeindex }}-key.pem"
52   - "--etcd-servers={% for host in groups['caas_master'] %}https://{{ hostvars[host]['networking']['infra_internal']['ip'] }}:{{ caas.etcd_api_port }}{% if not loop.last %},{% endif %}{% endfor %}"
53   - "--experimental-encryption-provider-config={{ caas.cert_path }}/{{ caas._secrets_conf }}"
54   - "--feature-gates={{ apiserver_feature_gates | get_kube_options }}"
55   - "--insecure-port=0"
56   - "--kubelet-certificate-authority=/etc/openssl/ca.pem"
57   - "--kubelet-client-certificate=/etc/kubernetes/ssl/kubelet-server.pem"
58   - "--kubelet-client-key=/etc/kubernetes/ssl/kubelet-server-key.pem"
59   - "--kubelet-https=true"
60   - "--max-requests-inflight=1000"
61   - "--proxy-client-cert-file=/etc/kubernetes/ssl/metrics.crt"
62   - "--proxy-client-key-file=/etc/kubernetes/ssl/metrics.key"
63   - "--requestheader-client-ca-file=/etc/openssl/ca.pem"
64   - "--requestheader-extra-headers-prefix=X-Remote-Extra-"
65   - "--requestheader-group-headers=X-Remote-Group"
66   - "--requestheader-username-headers=X-Remote-User"
67   - "--secure-port={{ apiserver_port }}"
68   - "--service-account-key-file=/etc/kubernetes/ssl/service-account.pem"
69   - "--service-account-lookup=true"
70   - "--service-cluster-ip-range={{ caas.service_cluster_ip_cidr }}"
71   - "--tls-cert-file=/etc/kubernetes/ssl/tls-cert.pem"
72   - "--tls-private-key-file=/etc/kubernetes/ssl/apiserver{{ nodeindex }}-key.pem"
73   - "--token-auth-file={{ caas.cert_path }}/{{ caas.tokenscsv_filename }}"
74
75 controllermanager_feature_gates:
76   CPUManager: false
77   DevicePlugins: true
78   HugePages: true
79
80 scheduler_feature_gates:
81   CPUManager: false
82   DevicePlugins: true
83   HugePages: true