- Conditinally create or update registry secret on batchjobs.
- k8s_pgbouncer_selfsigned_certificate_name: add support mounting a Certificate from the k8s_na```¡mespace` to pgBouncer's /etc/pgbouncer/ssl/ directory to enable TLS mode to use for connections from clients (client_tls_sslmode).
- This PR adds support for pgbouncer to help reduce Postgres connection usage and latency.
Manually create a non-expiring
ServiceAccount
tokenSecret
to support Kubernetes v1.24. Relevant release notes:- The
LegacyServiceAccountTokenNoAutoGeneration
feature gate is beta, and enabled by default. When enabled, Secret API objects containing service account tokens are no longer auto-generated for everyServiceAccount
. Use the TokenRequest API to acquire service account tokens, or if a non-expiring token is required, create a Secret API object for the token controller to populate with a service account token by following this guide. - Each service account API key will be regenerated and will require you to rotate the
k8s_auth_api_key
Ansible variable(s).
- The
Switch to
kubernetes.core
for Ansible 6.x+ support and use fully qualified collection names (FQCNs) to be explicit. Thecommunity.kubernetes
collection was renamed tokubernetes.core
in v2.0.0 of the kubernetes.core collection. Since Ansible v3.0.0, both thekubernetes.core
andcommunity.kubernetes
namespaced collections were included for convenience. Ansible v6.0.0 removed thecommunity.kubernetes
convenience package.
- Add support for customizing Deployment strategy for web and worker processes
- Rename
k8s_migration_command
tok8s_migrations_command
(the old name will continue working for now, but update your projects!) - Add
k8s_migrations_timeout
variable - Support further customizing batch jobs run before and after deploys via the new
k8s_predeploy_batchjobs
andk8s_postdeploy_batchjobs
variables
- Removed support for RabbitMQ. See the README if you need to maintain an existing cluster.
- Support running multiple workers using
k8s_worker_containers
- Allow override of
kubernetes.io/ingress.class
usingk8s_ingress_class
- Allow ovverride Service
spec.type
andspec.loadBalancerIP
for Memcache and Redis - Add
podAntiAffinity
to prefer scheduling app and worker pods on different nodes - Update Ingress
apiVersion
tonetworking.k8s.io/v1
(Kubernetes 1.19+) - Fix arg order for Celery 5.x
- Add support for mounting data volumes via Secrets within containers
- Add support for deploying a RabbitMQ cluster. See the README for prerequisites.
Configure the public access block on private S3 bucket using s3_bucket module (requires Ansible 3.0+ or v1.3.0 of the amazon.aws collection)
Add skip_duplicates: false to fix deprecation warnings and set it to the default value for the following tasks:
- aws_s3.yml's Attach inline policy to user
- aws_ci.yml's Attach inline policy to user
Support tagging S3 buckets
- Bumps memcached version to 1.6.9
- Support adding a limited AWS IAM user for CI deploys
BACKWARDS INCOMPATIBLE CHANGES:
- Use updated cert-manager annotation key: cert-manager.io/cluster-issuer
- Must update to [caktus.k8s-web-cluster](https://github.com/caktus/ansible-role-k8s-web-cluster) v1.0.0
- Adds
no_log
to rollout commands to prevent logging of environment vars.
- Fixes migration bug (#35)
- Fixes deploy account lookup bug (#36)
- Fixes elasticsearch bug that did not allow pods to return to running state after deletion.
- Add customizable
k8s_collectstatic_timeout
variable - Suport redirect from www.domain.com to domain.com or vice versa.
- Support environment-specific Amazon S3 bucket creation (#27)
- Allow full customization of the arguments to the celery command. (#17, #23)
- Enable
collectstatic
command to run during deploy (#24)
- Add
fsGroup
to the beat service which allows that service to access the data volume, if it is not running as root.
- Wait until Job-created migration pod returns
Completed
status before continuing deploy - Set celery-beat ImagePullPolicy to match user-configured setting
- If
k8s_rollout_after_deploy
istrue
, use rollout to ensure that pods are restarted when we deploy. This ensures that even if our image tag is unchanged (like if we're using a branch name), we'll still pull the latest image with that tag and be running it when the deploy completes.
Made some changes to simplify setting up a deploy account so this can be run from continuous integration.
If updating from v0.0.1:
k8s_auth_host
is now a required variable - see the README.rst.- After setting that, please run first locally with kubectl set up to access the cluster, and follow any instructions that are output.
- Initial release