Update to lastest version

defaults/main.yml

@@ -6,4 +6,4 @@ ingress_domain: "local.dataminem.net"
 #  - 192.168.140.0/24
 basic_auth: false
 
-scope_version: 1.9.1
+scope_version: 1.11.6

tasks/main.yml

@@ -28,18 +28,21 @@
       - basic_auth == true
     tags: weave
 
+# file found https://github.com/weaveworks/scope/tree/master/examples/k8s/
   - name: Weave Scope files
     k8s:
       state: present
       context: "{{ my_context }}"
       resource_definition: "{{ lookup('template', item) | from_yaml }}"
     with_items:
-    - scope-clusterrolebinding.yaml.j2
+    - psp.yaml.j2
-    - scope-clusterrole.yaml.j2
+    - cluster-role-binding.yaml.j2
-    - scope-sa.yaml.j2
+    - cluster-role.yaml.j2
-    - scope-svc.yaml.j2
+    - sa.yaml.j2
-    - scope-ds.yaml.j2
+    - svc.yaml.j2
-    - scope.yaml.j2
+    - ds.yaml.j2
+    - probe-deploy.yaml.j2
+    - deploy.yaml.j2
     - weave_ingress.yaml.j2
     tags: weave
 

templates/cluster-role-binding.yaml.j2

@@ -0,0 +1,16 @@
+# borrowed from https://cloud.weave.works/k8s/scope.yaml?k8s-version=1.9.3
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: weave-scope
+  labels:
+    name: weave-scope
+  namespace: weave
+roleRef:
+  kind: ClusterRole
+  name: weave-scope
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: weave-scope
+    namespace: weave

templates/cluster-role.yaml.j2

@@ -0,0 +1,88 @@
+# borrowed from https://cloud.weave.works/k8s/scope.yaml?k8s-version=1.9.3
+# with little modificatios to reduce permissions
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    name: weave-scope
+  name: weave-scope
+  namespace: weave
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/log
+  - replicationcontrollers
+  - services
+  - nodes
+  - persistentvolumes
+  - persistentvolumeclaims
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - delete
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - statefulsets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - batch
+  resources:
+  - cronjobs
+  - jobs
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - extensions
+  resources:
+  - daemonsets
+  - deployments
+  - deployments/scale
+  - replicasets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - extensions
+  resources:
+  - deployments/scale
+  verbs:
+  - update
+- apiGroups:
+  - storage.k8s.io
+  resources:
+  - storageclasses
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - extensions
+  resourceNames:
+  - weave-scope
+  resources:
+  - podsecuritypolicies
+  verbs:
+  - use
+- apiGroups:
+  - volumesnapshot.external-storage.k8s.io
+  resources:
+  - volumesnapshots
+  - volumesnapshotdatas
+  verbs:
+  - list
+  - watch

templates/deploy.yaml.j2

@@ -0,0 +1,39 @@
+# borrowed from https://cloud.weave.works/k8s/scope.yaml?k8s-version=1.9.3
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: weave-scope-app
+  labels:
+    name: weave-scope-app
+    app: weave-scope
+    weave-cloud-component: scope
+    weave-scope-component: app
+  namespace: weave
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: weave-scope
+  revisionHistoryLimit: 2
+  template:
+    metadata:
+      labels:
+        name: weave-scope-app
+        app: weave-scope
+        weave-cloud-component: scope
+        weave-scope-component: app
+    spec:
+      containers:
+        - name: app
+          args:
+            - '--no-probe'
+          env: []
+          image: weaveworks/scope:{{ scope_version }}
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 4040
+              protocol: TCP
+          resources:
+            requests:
+              cpu: 200m
+              memory: 200Mi

templates/ds.yaml.j2

@@ -1,16 +1,8 @@
-apiVersion: extensions/v1beta1
+# borrowed from https://cloud.weave.works/k8s/scope.yaml?k8s-version=1.9.3
+apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: weave-scope-agent
-  annotations:
-    cloud.weave.works/launcher-info: |-
-      {
-        "original-request": {
-          "url": "/k8s/v1.10/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxMSIsIEdpdFZlcnNpb246InYxLjExLjIiLCBHaXRDb21taXQ6ImJiOWZmYjE2NTRkNGE3MjliYjRjZWMxOGZmMDg4ZWFjYzE1M2MyMzkiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE4LTA4LTA3VDIzOjE3OjI4WiIsIEdvVmVyc2lvbjoiZ28xLjEwLjMiLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQpTZXJ2ZXIgVmVyc2lvbjogdmVyc2lvbi5JbmZve01ham9yOiIxIiwgTWlub3I6IjExIiwgR2l0VmVyc2lvbjoidjEuMTEuMSIsIEdpdENvbW1pdDoiYjFiMjk5NzgyNzBkYzIyZmVjYzU5MmFjNTVkOTAzMzUwNDU0MzEwYSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMTgtMDctMTdUMTg6NDM6MjZaIiwgR29WZXJzaW9uOiJnbzEuMTAuMyIsIENvbXBpbGVyOiJnYyIsIFBsYXRmb3JtOiJsaW51eC9hbWQ2NCJ9Cg==",
-          "date": "Tue Sep 18 2018 08:36:39 GMT+0000 (UTC)"
-        },
-        "email-address": "support@weave.works"
-      }
   labels:
     name: weave-scope-agent
     app: weave-scope
@@ -19,6 +11,9 @@ metadata:
   namespace: weave
 spec:
   minReadySeconds: 5
+  selector:
+    matchLabels:
+      app: weave-scope
   template:
     metadata:
       labels:
@@ -32,45 +27,41 @@ spec:
           args:
             - '--mode=probe'
             - '--probe-only'
-            - '--probe.kubernetes=true'
+            - '--probe.kubernetes.role=host'
             - '--probe.docker.bridge=docker0'
             - '--probe.docker=true'
-            - 'weave-scope-app.weave.svc.cluster.local:80'
+            - 'weave-scope-app.weave.svc.cluster.local.:80'
-          command:
+          image: weaveworks/scope:{{ scope_version }}
-            - /home/weave/scope
-          env:
-            - name: KUBERNETES_NODENAME
-              valueFrom:
-                fieldRef:
-                  apiVersion: v1
-                  fieldPath: spec.nodeName
-          image: 'docker.io/weaveworks/scope:{{ scope_version }}'
           imagePullPolicy: IfNotPresent
+          resources:
+            requests:
+              cpu: 100m
+              memory: 100Mi
           securityContext:
             privileged: true
           volumeMounts:
+            - name: docker-socket
+              mountPath: /var/run/docker.sock
             - name: scope-plugins
               mountPath: /var/run/scope/plugins
             - name: sys-kernel-debug
               mountPath: /sys/kernel/debug
-            - name: docker-socket
-              mountPath: /var/run/docker.sock
       dnsPolicy: ClusterFirstWithHostNet
       hostNetwork: true
       hostPID: true
-      serviceAccountName: weave-scope
       tolerations:
         - effect: NoSchedule
           operator: Exists
       volumes:
+        - name: docker-socket
+          hostPath:
+            path: /var/run/docker.sock
         - name: scope-plugins
           hostPath:
             path: /var/run/scope/plugins
         - name: sys-kernel-debug
           hostPath:
             path: /sys/kernel/debug
-        - name: docker-socket
-          hostPath:
-            path: /var/run/docker.sock
   updateStrategy:
-    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1

templates/probe-deploy.yaml.j2

@@ -0,0 +1,44 @@
+# borrowed from https://cloud.weave.works/k8s/scope.yaml?k8s-version=1.9.3
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: weave-scope-cluster-agent
+  labels:
+    name: weave-scope-cluster-agent
+    app: weave-scope
+    weave-cloud-component: scope
+    weave-scope-component: cluster-agent
+  namespace: weave
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      name: weave-scope-cluster-agent
+      app: weave-scope
+      weave-cloud-component: scope
+      weave-scope-component: cluster-agent
+  revisionHistoryLimit: 2
+  template:
+    metadata:
+      labels:
+        name: weave-scope-cluster-agent
+        app: weave-scope
+        weave-cloud-component: scope
+        weave-scope-component: cluster-agent
+    spec:
+      containers:
+        - name: scope-cluster-agent
+          args:
+            - '--mode=probe'
+            - '--probe-only'
+            - '--probe.kubernetes.role=cluster'
+            - 'weave-scope-app.weave.svc.cluster.local.:80'
+          command:
+            - /home/weave/scope
+          image: 'docker.io/weaveworks/scope:{{ scope_version }}'
+          imagePullPolicy: IfNotPresent
+          resources:
+            requests:
+              cpu: 100m
+              memory: 100Mi
+      serviceAccountName: weave-scope

templates/psp.yaml.j2

@@ -0,0 +1,21 @@
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: weave-scope
+spec:
+  privileged: true
+  hostPID: true
+  hostNetwork: true
+  allowedCapabilities:
+  - 'NET_ADMIN'
+  fsGroup:
+    rule: RunAsAny
+  runAsUser:
+    rule: RunAsAny
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  volumes:
+  - secret
+  - hostPath

templates/sa.yaml.j2

@@ -0,0 +1,8 @@
+# borrowed from https://cloud.weave.works/k8s/scope.yaml?k8s-version=1.9.3
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: weave-scope
+  labels:
+    name: weave-scope
+  namespace: weave

templates/scope-clusterrole.yaml.j2

@@ -1,79 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
-metadata:
-  name: weave-scope
-  annotations:
-    cloud.weave.works/launcher-info: |-
-      {
-        "original-request": {
-          "url": "/k8s/v1.10/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxMSIsIEdpdFZlcnNpb246InYxLjExLjIiLCBHaXRDb21taXQ6ImJiOWZmYjE2NTRkNGE3MjliYjRjZWMxOGZmMDg4ZWFjYzE1M2MyMzkiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE4LTA4LTA3VDIzOjE3OjI4WiIsIEdvVmVyc2lvbjoiZ28xLjEwLjMiLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQpTZXJ2ZXIgVmVyc2lvbjogdmVyc2lvbi5JbmZve01ham9yOiIxIiwgTWlub3I6IjExIiwgR2l0VmVyc2lvbjoidjEuMTEuMSIsIEdpdENvbW1pdDoiYjFiMjk5NzgyNzBkYzIyZmVjYzU5MmFjNTVkOTAzMzUwNDU0MzEwYSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMTgtMDctMTdUMTg6NDM6MjZaIiwgR29WZXJzaW9uOiJnbzEuMTAuMyIsIENvbXBpbGVyOiJnYyIsIFBsYXRmb3JtOiJsaW51eC9hbWQ2NCJ9Cg==",
-          "date": "Tue Sep 18 2018 08:36:39 GMT+0000 (UTC)"
-        },
-        "email-address": "support@weave.works"
-      }
-  labels:
-    name: weave-scope
-rules:
-  - apiGroups:
-      - ''
-    resources:
-      - pods
-    verbs:
-      - get
-      - list
-      - watch
-      - delete
-  - apiGroups:
-      - ''
-    resources:
-      - pods/log
-      - services
-      - nodes
-      - namespaces
-      - persistentvolumes
-      - persistentvolumeclaims
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - apps
-    resources:
-      - statefulsets
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - batch
-    resources:
-      - cronjobs
-      - jobs
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - extensions
-    resources:
-      - deployments
-      - daemonsets
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - extensions
-    resources:
-      - deployments/scale
-    verbs:
-      - get
-      - update
-  - apiGroups:
-      - storage.k8s.io
-    resources:
-      - storageclasses
-    verbs:
-      - get
-      - list
-      - watch

templates/scope-clusterrolebinding.yaml.j2

@@ -1,23 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRoleBinding
-metadata:
-  name: weave-scope
-  annotations:
-    cloud.weave.works/launcher-info: |-
-      {
-        "original-request": {
-          "url": "/k8s/v1.10/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxMSIsIEdpdFZlcnNpb246InYxLjExLjIiLCBHaXRDb21taXQ6ImJiOWZmYjE2NTRkNGE3MjliYjRjZWMxOGZmMDg4ZWFjYzE1M2MyMzkiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE4LTA4LTA3VDIzOjE3OjI4WiIsIEdvVmVyc2lvbjoiZ28xLjEwLjMiLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQpTZXJ2ZXIgVmVyc2lvbjogdmVyc2lvbi5JbmZve01ham9yOiIxIiwgTWlub3I6IjExIiwgR2l0VmVyc2lvbjoidjEuMTEuMSIsIEdpdENvbW1pdDoiYjFiMjk5NzgyNzBkYzIyZmVjYzU5MmFjNTVkOTAzMzUwNDU0MzEwYSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMTgtMDctMTdUMTg6NDM6MjZaIiwgR29WZXJzaW9uOiJnbzEuMTAuMyIsIENvbXBpbGVyOiJnYyIsIFBsYXRmb3JtOiJsaW51eC9hbWQ2NCJ9Cg==",
-          "date": "Tue Sep 18 2018 08:36:39 GMT+0000 (UTC)"
-        },
-        "email-address": "support@weave.works"
-      }
-  labels:
-    name: weave-scope
-roleRef:
-  kind: ClusterRole
-  name: weave-scope
-  apiGroup: rbac.authorization.k8s.io
-subjects:
-  - kind: ServiceAccount
-    name: weave-scope
-    namespace: weave

templates/scope-sa.yaml.j2

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: weave-scope
-  annotations:
-    cloud.weave.works/launcher-info: |-
-      {
-        "original-request": {
-          "url": "/k8s/v1.10/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxMSIsIEdpdFZlcnNpb246InYxLjExLjIiLCBHaXRDb21taXQ6ImJiOWZmYjE2NTRkNGE3MjliYjRjZWMxOGZmMDg4ZWFjYzE1M2MyMzkiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE4LTA4LTA3VDIzOjE3OjI4WiIsIEdvVmVyc2lvbjoiZ28xLjEwLjMiLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQpTZXJ2ZXIgVmVyc2lvbjogdmVyc2lvbi5JbmZve01ham9yOiIxIiwgTWlub3I6IjExIiwgR2l0VmVyc2lvbjoidjEuMTEuMSIsIEdpdENvbW1pdDoiYjFiMjk5NzgyNzBkYzIyZmVjYzU5MmFjNTVkOTAzMzUwNDU0MzEwYSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMTgtMDctMTdUMTg6NDM6MjZaIiwgR29WZXJzaW9uOiJnbzEuMTAuMyIsIENvbXBpbGVyOiJnYyIsIFBsYXRmb3JtOiJsaW51eC9hbWQ2NCJ9Cg==",
-          "date": "Tue Sep 18 2018 08:36:39 GMT+0000 (UTC)"
-        },
-        "email-address": "support@weave.works"
-      }
-  labels:
-    name: weave-scope
-  namespace: weave

templates/scope-svc.yaml.j2

@@ -1,30 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: weave-scope-app
-  annotations:
-    cloud.weave.works/launcher-info: |-
-      {
-        "original-request": {
-          "url": "/k8s/v1.10/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxMSIsIEdpdFZlcnNpb246InYxLjExLjIiLCBHaXRDb21taXQ6ImJiOWZmYjE2NTRkNGE3MjliYjRjZWMxOGZmMDg4ZWFjYzE1M2MyMzkiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE4LTA4LTA3VDIzOjE3OjI4WiIsIEdvVmVyc2lvbjoiZ28xLjEwLjMiLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQpTZXJ2ZXIgVmVyc2lvbjogdmVyc2lvbi5JbmZve01ham9yOiIxIiwgTWlub3I6IjExIiwgR2l0VmVyc2lvbjoidjEuMTEuMSIsIEdpdENvbW1pdDoiYjFiMjk5NzgyNzBkYzIyZmVjYzU5MmFjNTVkOTAzMzUwNDU0MzEwYSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMTgtMDctMTdUMTg6NDM6MjZaIiwgR29WZXJzaW9uOiJnbzEuMTAuMyIsIENvbXBpbGVyOiJnYyIsIFBsYXRmb3JtOiJsaW51eC9hbWQ2NCJ9Cg==",
-          "date": "Tue Sep 18 2018 08:36:39 GMT+0000 (UTC)"
-        },
-        "email-address": "support@weave.works"
-      }
-  labels:
-    name: weave-scope-app
-    app: weave-scope
-    weave-cloud-component: scope
-    weave-scope-component: app
-  namespace: weave
-spec:
-  ports:
-    - name: app
-      port: 80
-      protocol: TCP
-      targetPort: 4040
-  selector:
-    name: weave-scope-app
-    app: weave-scope
-    weave-cloud-component: scope
-    weave-scope-component: app

templates/scope.yaml.j2

@@ -1,42 +0,0 @@
-apiVersion: apps/v1beta1
-kind: Deployment
-metadata:
-  name: weave-scope-app
-  annotations:
-    cloud.weave.works/launcher-info: |-
-      {
-        "original-request": {
-          "url": "/k8s/v1.10/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxMSIsIEdpdFZlcnNpb246InYxLjExLjIiLCBHaXRDb21taXQ6ImJiOWZmYjE2NTRkNGE3MjliYjRjZWMxOGZmMDg4ZWFjYzE1M2MyMzkiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE4LTA4LTA3VDIzOjE3OjI4WiIsIEdvVmVyc2lvbjoiZ28xLjEwLjMiLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQpTZXJ2ZXIgVmVyc2lvbjogdmVyc2lvbi5JbmZve01ham9yOiIxIiwgTWlub3I6IjExIiwgR2l0VmVyc2lvbjoidjEuMTEuMSIsIEdpdENvbW1pdDoiYjFiMjk5NzgyNzBkYzIyZmVjYzU5MmFjNTVkOTAzMzUwNDU0MzEwYSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMTgtMDctMTdUMTg6NDM6MjZaIiwgR29WZXJzaW9uOiJnbzEuMTAuMyIsIENvbXBpbGVyOiJnYyIsIFBsYXRmb3JtOiJsaW51eC9hbWQ2NCJ9Cg==",
-          "date": "Tue Sep 18 2018 08:36:39 GMT+0000 (UTC)"
-        },
-        "email-address": "support@weave.works"
-      }
-  labels:
-    name: weave-scope-app
-    app: weave-scope
-    weave-cloud-component: scope
-    weave-scope-component: app
-  namespace: weave
-spec:
-  replicas: 1
-  revisionHistoryLimit: 2
-  template:
-    metadata:
-      labels:
-        name: weave-scope-app
-        app: weave-scope
-        weave-cloud-component: scope
-        weave-scope-component: app
-    spec:
-      containers:
-        - name: app
-          args:
-            - '--mode=app'
-          command:
-            - /home/weave/scope
-          env: []
-          image: 'docker.io/weaveworks/scope:{{ scope_version }}'
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 4040
-              protocol: TCP

templates/svc.yaml.j2

@@ -0,0 +1,22 @@
+# borrowed from https://cloud.weave.works/k8s/scope.yaml?k8s-version=1.9.3
+apiVersion: v1
+kind: Service
+metadata:
+  name: weave-scope-app
+  labels:
+    name: weave-scope-app
+    app: weave-scope
+    weave-cloud-component: scope
+    weave-scope-component: app
+  namespace: weave
+spec:
+  ports:
+    - name: app
+      port: 80
+      protocol: TCP
+      targetPort: 4040
+  selector:
+    name: weave-scope-app
+    app: weave-scope
+    weave-cloud-component: scope
+    weave-scope-component: app