feat: Buncha shit
This commit is contained in:
Lino Silva
@@ -0,0 +1,27 @@
|
||||
---
|
||||
- name: Create argocd namespace
|
||||
kubernetes.core.k8s:
|
||||
name: argocd
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
api_version: v1
|
||||
kind: Namespace
|
||||
state: present
|
||||
|
||||
- name: Install argocd
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
namespace: argocd
|
||||
definition: "{{ lookup('template', 'install.yml') | from_yaml }}"
|
||||
|
||||
- name: Deploy forwardauth middleware
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'middleware-forwardauth.yml') | from_yaml }}"
|
||||
|
||||
- name: Deploy argocd - ingress
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'ingress.yml') | from_yaml }}"
|
||||
@@ -0,0 +1,37 @@
|
||||
---
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: argocd
|
||||
namespace: argocd
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: traefik-external
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`argocd.lino.cooking`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: argocd-server
|
||||
port: 80
|
||||
middlewares:
|
||||
- name: argocd-forwardauth
|
||||
namespace: argocd
|
||||
- match: Host(`argocd.lino.cooking`) && Headers(`Content-Type`, `application/grpc`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: argocd-server
|
||||
port: 80
|
||||
scheme: h2c
|
||||
- match: "Host(`argocd.lino.cooking`) && PathPrefix(`/outpost.goauthentik.io/`)"
|
||||
kind: Rule
|
||||
priority: 15
|
||||
services:
|
||||
- kind: Service
|
||||
# Or, to use an external Outpost, create an ExternalName service and reference that here.
|
||||
# See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
|
||||
name: authentik
|
||||
port: 9000
|
||||
tls:
|
||||
secretName: lino-cooking-tls
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,21 @@
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: argocd-forwardauth
|
||||
namespace: argocd
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: https://argocd.lino.cooking/outpost.goauthentik.io/auth/traefik
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- X-authentik-username
|
||||
- X-authentik-groups
|
||||
- X-authentik-email
|
||||
- X-authentik-name
|
||||
- X-authentik-uid
|
||||
- X-authentik-jwt
|
||||
- X-authentik-meta-jwks
|
||||
- X-authentik-meta-outpost
|
||||
- X-authentik-meta-provider
|
||||
- X-authentik-meta-app
|
||||
- X-authentik-meta-version
|
||||
@@ -0,0 +1,64 @@
|
||||
---
|
||||
# - name: Create a arr-apps namespace
|
||||
# kubernetes.core.k8s:
|
||||
# name: arr-apps
|
||||
# kubeconfig: /Users/lino.silva/.kube/config
|
||||
# api_version: v1
|
||||
# kind: Namespace
|
||||
# state: present
|
||||
|
||||
- name: Deploy arr - deployment
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'deployment.yml') | from_yaml }}"
|
||||
loop:
|
||||
- { name: 'radarr', port: 7878 }
|
||||
- { name: 'prowlarr', port: 9696 }
|
||||
- { name: 'sonarr', port: 8989 }
|
||||
- { name: 'overseerr', port: 5055 }
|
||||
- { name: 'transmission', port: 9091 }
|
||||
- { name: 'bazarr', port: 6767 }
|
||||
- { name: 'lidarr', port: 8686 }
|
||||
|
||||
- name: Deploy arr services
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'service.yml') | from_yaml }}"
|
||||
loop:
|
||||
- { name: 'radarr', port: 7878 }
|
||||
- { name: 'prowlarr', port: 9696 }
|
||||
- { name: 'sonarr', port: 8989 }
|
||||
- { name: 'overseerr', port: 5055 }
|
||||
- { name: 'transmission', port: 9091 }
|
||||
- { name: 'bazarr', port: 6767 }
|
||||
- { name: 'lidarr', port: 8686 }
|
||||
|
||||
- name: Deploy forwardauth middleware
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'middleware-forwardauth.yml') | from_yaml }}"
|
||||
loop:
|
||||
- radarr
|
||||
- prowlarr
|
||||
- sonarr
|
||||
- overseerr
|
||||
- transmission
|
||||
- bazarr
|
||||
- lidarr
|
||||
|
||||
- name: Deploy arr - ingress
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'ingress.yml') | from_yaml }}"
|
||||
loop:
|
||||
- { name: 'radarr', port: 7878 }
|
||||
- { name: 'prowlarr', port: 9696 }
|
||||
- { name: 'sonarr', port: 8989 }
|
||||
- { name: 'overseerr', port: 5055 }
|
||||
- { name: 'transmission', port: 9091 }
|
||||
- { name: 'bazarr', port: 6767 }
|
||||
- { name: 'lidarr', port: 8686 }
|
||||
@@ -0,0 +1,30 @@
|
||||
---
|
||||
- kind: Deployment
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
name: {{ item.name }}
|
||||
namespace: default
|
||||
labels:
|
||||
app: {{ item.name }}
|
||||
spec:
|
||||
replicas: 1
|
||||
progressDeadlineSeconds: 600
|
||||
revisionHistoryLimit: 2
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ item.name }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ item.name }}
|
||||
spec:
|
||||
containers:
|
||||
- name: {{ item.name }}
|
||||
image: linuxserver/{{ item.name }}
|
||||
ports:
|
||||
- name: app-port
|
||||
containerPort: {{ item.port }}
|
||||
hostPort: {{ item.port }}
|
||||
protocol: TCP
|
||||
@@ -0,0 +1,32 @@
|
||||
---
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: {{ item.name }}
|
||||
namespace: default
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: traefik-external
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`{{ item.name }}.lino.cooking`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: {{ item.name }}
|
||||
port: {{ item.port }}
|
||||
middlewares:
|
||||
- name: default-headers
|
||||
- name: {{ item.name }}-forwardauth
|
||||
namespace: traefik
|
||||
- match: "Host(`{{ item.name }}.lino.cooking`) && PathPrefix(`/outpost.goauthentik.io/`)"
|
||||
kind: Rule
|
||||
priority: 15
|
||||
services:
|
||||
- kind: Service
|
||||
# Or, to use an external Outpost, create an ExternalName service and reference that here.
|
||||
# See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
|
||||
name: authentik
|
||||
port: 9000
|
||||
tls:
|
||||
secretName: lino-cooking-tls
|
||||
@@ -0,0 +1,21 @@
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: {{ item }}-forwardauth
|
||||
namespace: traefik
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: https://{{ item }}.lino.cooking/outpost.goauthentik.io/auth/traefik
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- X-authentik-username
|
||||
- X-authentik-groups
|
||||
- X-authentik-email
|
||||
- X-authentik-name
|
||||
- X-authentik-uid
|
||||
- X-authentik-jwt
|
||||
- X-authentik-meta-jwks
|
||||
- X-authentik-meta-outpost
|
||||
- X-authentik-meta-provider
|
||||
- X-authentik-meta-app
|
||||
- X-authentik-meta-version
|
||||
@@ -0,0 +1,13 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ item.name }}
|
||||
namespace: default
|
||||
spec:
|
||||
selector:
|
||||
app: {{ item.name }}
|
||||
ports:
|
||||
- name: http
|
||||
targetPort: {{ item.port }}
|
||||
port: {{ item.port }}
|
||||
@@ -0,0 +1,21 @@
|
||||
---
|
||||
- name: Add authentik helm repo
|
||||
kubernetes.core.helm_repository:
|
||||
name: authentik
|
||||
repo_url: "https://charts.goauthentik.io"
|
||||
|
||||
- name: Update the repository cache
|
||||
kubernetes.core.helm:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
name: dummy
|
||||
namespace: kube-system
|
||||
state: absent
|
||||
update_repo_cache: true
|
||||
|
||||
- name: Deploy latest version of Authentik chart inside
|
||||
kubernetes.core.helm:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
name: authentik
|
||||
namespace: traefik
|
||||
chart_ref: authentik/authentik
|
||||
values: "{{ lookup('template', 'values.yml') | from_yaml }}"
|
||||
@@ -0,0 +1,22 @@
|
||||
authentik:
|
||||
secret_key: "fKkVEXDoUdGYwoNb$97xQuG9uw7zu$rFDe6y7!UZ&6$5*cyx6h"
|
||||
# This sends anonymous usage-data, stack traces on errors and
|
||||
# performance data to sentry.io, and is fully opt-in
|
||||
error_reporting:
|
||||
enabled: true
|
||||
postgresql:
|
||||
password: "uNP9W3zMpp4853QF9f@mpJDEXprca@tX@cEj3#BLFR&WFZVBU^"
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- host: auth.lino.cooking
|
||||
paths:
|
||||
- path: "/"
|
||||
pathType: Prefix
|
||||
|
||||
postgresql:
|
||||
enabled: true
|
||||
postgresqlPassword: "uNP9W3zMpp4853QF9f@mpJDEXprca@tX@cEj3#BLFR&WFZVBU^"
|
||||
redis:
|
||||
enabled: true
|
||||
@@ -0,0 +1,65 @@
|
||||
---
|
||||
# From repository
|
||||
- name: Add traefik helm repo
|
||||
kubernetes.core.helm_repository:
|
||||
name: jetstack
|
||||
repo_url: "https://charts.jetstack.io"
|
||||
|
||||
- name: Update the repository cache
|
||||
kubernetes.core.helm:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
name: dummy
|
||||
namespace: kube-system
|
||||
state: absent
|
||||
update_repo_cache: true
|
||||
|
||||
- name: Download cert-manager.crds manifest to the cluster.
|
||||
ansible.builtin.get_url:
|
||||
url: https://github.com/cert-manager/cert-manager/releases/download/v1.10.0/cert-manager.crds.yaml
|
||||
dest: /tmp/cert-manager.crds.yaml
|
||||
mode: "0664"
|
||||
|
||||
- name: Apply cert-manager.crds manifest to the cluster.
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
src: /tmp/cert-manager.crds.yaml
|
||||
|
||||
- name: Deploy latest version of cert-manager chart inside cert-manager namespace (and create it)
|
||||
kubernetes.core.helm:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
name: cert-manager
|
||||
chart_ref: jetstack/cert-manager
|
||||
release_namespace: cert-manager
|
||||
create_namespace: true
|
||||
values: "{{ lookup('template', 'values.yml') | from_yaml }}"
|
||||
|
||||
- name: Deploy cert-manager secret - Cloudflare
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'secret-cf-token.yml') | from_yaml }}"
|
||||
|
||||
- name: Deploy lets encrypt staging
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'letsencrypt-staging.yml') | from_yaml }}"
|
||||
|
||||
- name: Deploy cert-manager staging
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'lino-cooking.staging.yml') | from_yaml }}"
|
||||
|
||||
- name: Deploy lets encrypt production
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'letsencrypt-production.yml') | from_yaml }}"
|
||||
|
||||
- name: Deploy cert-manager production
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'lino-cooking.prod.yml') | from_yaml }}"
|
||||
@@ -0,0 +1,21 @@
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-production
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
email: letsencrypt@lino.cooking
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-production
|
||||
solvers:
|
||||
- dns01:
|
||||
cloudflare:
|
||||
email: D5&YbHe&oKx82uuTQ^AfW#$*D8GsDE#K3x^446S^wvH#8T@W2C
|
||||
apiTokenSecretRef:
|
||||
name: cloudflare-api-token-secret
|
||||
key: cloudflare-token
|
||||
selector:
|
||||
dnsZones:
|
||||
- "lino.cooking"
|
||||
@@ -0,0 +1,21 @@
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-staging
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
email: letsencrypt@lino.cooking
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-staging
|
||||
solvers:
|
||||
- dns01:
|
||||
cloudflare:
|
||||
email: okulto+cloudflare@gmail.com
|
||||
apiTokenSecretRef:
|
||||
name: cloudflare-api-token-secret
|
||||
key: api-token
|
||||
selector:
|
||||
dnsZones:
|
||||
- "lino.cooking"
|
||||
@@ -0,0 +1,15 @@
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: lino-cooking
|
||||
namespace: default
|
||||
spec:
|
||||
secretName: lino-cooking-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
commonName: "*.lino.cooking"
|
||||
dnsNames:
|
||||
- "lino.cooking"
|
||||
- "*.lino.cooking"
|
||||
@@ -0,0 +1,15 @@
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: lino-cooking
|
||||
namespace: default
|
||||
spec:
|
||||
secretName: lino-cooking-staging-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-staging
|
||||
kind: ClusterIssuer
|
||||
commonName: "*.lino.cooking"
|
||||
dnsNames:
|
||||
- "lino.cooking"
|
||||
- "*.lino.cooking"
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: cloudflare-api-token-secret
|
||||
namespace: cert-manager
|
||||
type: Opaque
|
||||
stringData:
|
||||
cloudflare-token: "{{ cloudflare_api_key }}"
|
||||
@@ -0,0 +1,10 @@
|
||||
installCRDs: false
|
||||
replicaCount: 3
|
||||
extraArgs:
|
||||
- --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
|
||||
- --dns01-recursive-nameservers-only
|
||||
podDnsPolicy: None
|
||||
podDnsConfig:
|
||||
nameservers:
|
||||
- "1.1.1.1"
|
||||
- "9.9.9.9"
|
||||
@@ -0,0 +1,36 @@
|
||||
---
|
||||
|
||||
- name: Download k3s binary x64
|
||||
get_url:
|
||||
url: https://github.com/k3s-io/k3s/releases/download/{{ k3s_version }}/k3s
|
||||
checksum: sha256:https://github.com/k3s-io/k3s/releases/download/{{ k3s_version }}/sha256sum-amd64.txt
|
||||
dest: /usr/local/bin/k3s
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
when: ansible_facts.architecture == "x86_64"
|
||||
|
||||
- name: Download k3s binary arm64
|
||||
get_url:
|
||||
url: https://github.com/k3s-io/k3s/releases/download/{{ k3s_version }}/k3s-arm64
|
||||
checksum: sha256:https://github.com/k3s-io/k3s/releases/download/{{ k3s_version }}/sha256sum-arm64.txt
|
||||
dest: /usr/local/bin/k3s
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
when:
|
||||
- ( ansible_facts.architecture is search("arm") and
|
||||
ansible_facts.userspace_bits == "64" ) or
|
||||
ansible_facts.architecture is search("aarch64")
|
||||
|
||||
- name: Download k3s binary armhf
|
||||
get_url:
|
||||
url: https://github.com/k3s-io/k3s/releases/download/{{ k3s_version }}/k3s-armhf
|
||||
checksum: sha256:https://github.com/k3s-io/k3s/releases/download/{{ k3s_version }}/sha256sum-arm.txt
|
||||
dest: /usr/local/bin/k3s
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
when:
|
||||
- ansible_facts.architecture is search("arm")
|
||||
- ansible_facts.userspace_bits == "32"
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
- name: Store kube configuration
|
||||
ansible.builtin.fetch:
|
||||
src: ~/.kube/config
|
||||
dest: ~/.kube/config
|
||||
flat: true
|
||||
when: ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname']
|
||||
@@ -0,0 +1,12 @@
|
||||
---
|
||||
- name: Deploy admin user
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'dashboard.admin-user.yml') | from_yaml }}"
|
||||
|
||||
- name: Deploy admin user role
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'dashboard.admin-user-role.yml') | from_yaml }}"
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: admin-user
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cluster-admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: admin-user
|
||||
namespace: kubernetes-dashboard
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: admin-user
|
||||
namespace: kubernetes-dashboard
|
||||
@@ -0,0 +1,12 @@
|
||||
---
|
||||
ansible_user: root
|
||||
server_init_args: >-
|
||||
{% if groups['master'] | length > 1 %}
|
||||
{% if ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname'] %}
|
||||
--cluster-init
|
||||
{% else %}
|
||||
--server https://{{ hostvars[groups['master'][0]].ansible_host }}:6443
|
||||
{% endif %}
|
||||
--token {{ k3s_token }}
|
||||
{% endif %}
|
||||
{{ extra_server_args | default('') }}
|
||||
@@ -0,0 +1,28 @@
|
||||
---
|
||||
# Download logs of k3s-init.service from the nodes to localhost.
|
||||
# Note that log_destination must be set.
|
||||
|
||||
- name: Fetch k3s-init.service logs
|
||||
ansible.builtin.command:
|
||||
cmd: journalctl --all --unit=k3s-init.service
|
||||
changed_when: false
|
||||
register: k3s_init_log
|
||||
|
||||
- name: Create {{ log_destination }}
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
become: false
|
||||
ansible.builtin.file:
|
||||
path: "{{ log_destination }}"
|
||||
state: directory
|
||||
mode: "0755"
|
||||
|
||||
- name: Store logs to {{ log_destination }}
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
ansible.builtin.template:
|
||||
src: content.j2
|
||||
dest: "{{ log_destination }}/k3s-init@{{ ansible_hostname }}.log"
|
||||
mode: 0644
|
||||
vars:
|
||||
content: "{{ k3s_init_log.stdout }}"
|
||||
@@ -0,0 +1,200 @@
|
||||
---
|
||||
- name: Clean previous runs of k3s-init
|
||||
systemd:
|
||||
name: k3s-init
|
||||
state: stopped
|
||||
failed_when: false
|
||||
|
||||
- name: Clean previous runs of k3s-init
|
||||
command: systemctl reset-failed k3s-init
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
args:
|
||||
warn: false # The ansible systemd module does not support reset-failed
|
||||
|
||||
- name: Create manifests directory on first master
|
||||
file:
|
||||
path: /var/lib/rancher/k3s/server/manifests
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when: ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname']
|
||||
|
||||
- name: Copy vip rbac manifest to first master
|
||||
template:
|
||||
src: "vip.rbac.yaml.j2"
|
||||
dest: "/var/lib/rancher/k3s/server/manifests/vip-rbac.yaml"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when: ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname']
|
||||
|
||||
- name: Copy vip manifest to first master
|
||||
template:
|
||||
src: "vip.yaml.j2"
|
||||
dest: "/var/lib/rancher/k3s/server/manifests/vip.yaml"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when: ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname']
|
||||
|
||||
# these will be copied and installed now, then tested later and apply config
|
||||
- name: Copy metallb namespace to first master
|
||||
template:
|
||||
src: "metallb.namespace.j2"
|
||||
dest: "/var/lib/rancher/k3s/server/manifests/metallb-namespace.yaml"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when: ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname']
|
||||
|
||||
- name: Copy metallb namespace to first master
|
||||
template:
|
||||
src: "metallb.crds.j2"
|
||||
dest: "/var/lib/rancher/k3s/server/manifests/metallb-crds.yaml"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when: ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname']
|
||||
|
||||
- name: Init cluster inside the transient k3s-init service
|
||||
command:
|
||||
cmd: "systemd-run -p RestartSec=2 \
|
||||
-p Restart=on-failure \
|
||||
--unit=k3s-init \
|
||||
k3s server {{ server_init_args }}"
|
||||
creates: "{{ systemd_dir }}/k3s.service"
|
||||
args:
|
||||
warn: false # The ansible systemd module does not support transient units
|
||||
|
||||
- name: Verification
|
||||
block:
|
||||
- name: Verify that all nodes actually joined (check k3s-init.service if this fails)
|
||||
command:
|
||||
cmd: k3s kubectl get nodes -l "node-role.kubernetes.io/master=true" -o=jsonpath="{.items[*].metadata.name}"
|
||||
register: nodes
|
||||
until: nodes.rc == 0 and (nodes.stdout.split() | length) == (groups['master'] | length)
|
||||
retries: "{{ retry_count | default(40) }}"
|
||||
delay: 20
|
||||
changed_when: false
|
||||
always:
|
||||
- name: Save logs of k3s-init.service
|
||||
include_tasks: fetch_k3s_init_logs.yml
|
||||
when: log_destination
|
||||
vars:
|
||||
log_destination: >-
|
||||
{{ lookup('ansible.builtin.env', 'ANSIBLE_K3S_LOG_DIR', default=True) }}
|
||||
- name: Kill the temporary service used for initialization
|
||||
systemd:
|
||||
name: k3s-init
|
||||
state: stopped
|
||||
failed_when: false
|
||||
when: not ansible_check_mode
|
||||
|
||||
- name: Copy K3s service file
|
||||
register: k3s_service
|
||||
template:
|
||||
src: "k3s.service.j2"
|
||||
dest: "{{ systemd_dir }}/k3s.service"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
|
||||
- name: Enable and check K3s service
|
||||
systemd:
|
||||
name: k3s
|
||||
daemon_reload: yes
|
||||
state: restarted
|
||||
enabled: yes
|
||||
|
||||
- name: Wait for node-token
|
||||
wait_for:
|
||||
path: /var/lib/rancher/k3s/server/node-token
|
||||
|
||||
- name: Register node-token file access mode
|
||||
stat:
|
||||
path: /var/lib/rancher/k3s/server
|
||||
register: p
|
||||
|
||||
- name: Change file access node-token
|
||||
file:
|
||||
path: /var/lib/rancher/k3s/server
|
||||
mode: "g+rx,o+rx"
|
||||
|
||||
- name: Read node-token from master
|
||||
slurp:
|
||||
src: /var/lib/rancher/k3s/server/node-token
|
||||
register: node_token
|
||||
|
||||
- name: Store Master node-token
|
||||
set_fact:
|
||||
token: "{{ node_token.content | b64decode | regex_replace('\n', '') }}"
|
||||
|
||||
- name: Restore node-token file access
|
||||
file:
|
||||
path: /var/lib/rancher/k3s/server
|
||||
mode: "{{ p.stat.mode }}"
|
||||
|
||||
- name: Create directory .kube
|
||||
file:
|
||||
path: ~{{ ansible_user }}/.kube
|
||||
state: directory
|
||||
owner: "{{ ansible_user }}"
|
||||
mode: "u=rwx,g=rx,o="
|
||||
|
||||
- name: Copy config file to user home directory
|
||||
copy:
|
||||
src: /etc/rancher/k3s/k3s.yaml
|
||||
dest: ~{{ ansible_user }}/.kube/config
|
||||
remote_src: yes
|
||||
owner: "{{ ansible_user }}"
|
||||
mode: "u=rw,g=,o="
|
||||
|
||||
- name: Configure kubectl cluster to {{ endpoint_url }}
|
||||
command: >-
|
||||
k3s kubectl config set-cluster default
|
||||
--server={{ endpoint_url }}
|
||||
--kubeconfig ~{{ ansible_user }}/.kube/config
|
||||
changed_when: true
|
||||
vars:
|
||||
endpoint_url: >-
|
||||
https://{{ apiserver_endpoint | ansible.utils.ipwrap }}:6443
|
||||
# Deactivated linter rules:
|
||||
# - jinja[invalid]: As of version 6.6.0, ansible-lint complains that the input to ipwrap
|
||||
# would be undefined. This will not be the case during playbook execution.
|
||||
# noqa jinja[invalid]
|
||||
|
||||
- name: Create kubectl symlink
|
||||
file:
|
||||
src: /usr/local/bin/k3s
|
||||
dest: /usr/local/bin/kubectl
|
||||
state: link
|
||||
|
||||
- name: Create crictl symlink
|
||||
file:
|
||||
src: /usr/local/bin/k3s
|
||||
dest: /usr/local/bin/crictl
|
||||
state: link
|
||||
|
||||
- name: Get contents of manifests folder
|
||||
find:
|
||||
paths: /var/lib/rancher/k3s/server/manifests
|
||||
file_type: file
|
||||
register: k3s_server_manifests
|
||||
|
||||
- name: Get sub dirs of manifests folder
|
||||
find:
|
||||
paths: /var/lib/rancher/k3s/server/manifests
|
||||
file_type: directory
|
||||
register: k3s_server_manifests_directories
|
||||
|
||||
- name: Remove manifests and folders that are only needed for bootstrapping cluster so k3s doesn't auto apply on start
|
||||
file:
|
||||
path: "{{ item.path }}"
|
||||
state: absent
|
||||
with_items:
|
||||
- "{{ k3s_server_manifests.files }}"
|
||||
- "{{ k3s_server_manifests_directories.files }}"
|
||||
loop_control:
|
||||
label: "{{ item.path }}"
|
||||
@@ -0,0 +1,5 @@
|
||||
{#
|
||||
This is a really simple template that just outputs the
|
||||
value of the "content" variable.
|
||||
#}
|
||||
{{ content }}
|
||||
@@ -0,0 +1,24 @@
|
||||
[Unit]
|
||||
Description=Lightweight Kubernetes
|
||||
Documentation=https://k3s.io
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
ExecStartPre=-/sbin/modprobe br_netfilter
|
||||
ExecStartPre=-/sbin/modprobe overlay
|
||||
ExecStart=/usr/local/bin/k3s server {{ extra_server_args | default("") }}
|
||||
KillMode=process
|
||||
Delegate=yes
|
||||
# Having non-zero Limit*s causes performance problems due to accounting overhead
|
||||
# in the kernel. We recommend using cgroups to do container-local accounting.
|
||||
LimitNOFILE=1048576
|
||||
LimitNPROC=infinity
|
||||
LimitCORE=infinity
|
||||
TasksMax=infinity
|
||||
TimeoutStartSec=0
|
||||
Restart=always
|
||||
RestartSec=5s
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,6 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: metallb-system
|
||||
labels:
|
||||
app: metallb
|
||||
@@ -0,0 +1,32 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: kube-vip
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
annotations:
|
||||
rbac.authorization.kubernetes.io/autoupdate: "true"
|
||||
name: system:kube-vip-role
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["services", "services/status", "nodes", "endpoints"]
|
||||
verbs: ["list","get","watch", "update"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["list", "get", "watch", "update", "create"]
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: system:kube-vip-binding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: system:kube-vip-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kube-vip
|
||||
namespace: kube-system
|
||||
@@ -0,0 +1,77 @@
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: kube-vip-ds
|
||||
namespace: kube-system
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
name: kube-vip-ds
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
name: kube-vip-ds
|
||||
spec:
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: node-role.kubernetes.io/master
|
||||
operator: Exists
|
||||
- matchExpressions:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
containers:
|
||||
- args:
|
||||
- manager
|
||||
env:
|
||||
- name: vip_arp
|
||||
value: "true"
|
||||
- name: port
|
||||
value: "6443"
|
||||
- name: vip_interface
|
||||
value: {{ flannel_iface }}
|
||||
- name: vip_cidr
|
||||
value: "{{ apiserver_endpoint | ansible.utils.ipsubnet | ansible.utils.ipaddr('prefix') }}"
|
||||
- name: cp_enable
|
||||
value: "true"
|
||||
- name: cp_namespace
|
||||
value: kube-system
|
||||
- name: vip_ddns
|
||||
value: "false"
|
||||
- name: svc_enable
|
||||
value: "false"
|
||||
- name: vip_leaderelection
|
||||
value: "true"
|
||||
- name: vip_leaseduration
|
||||
value: "15"
|
||||
- name: vip_renewdeadline
|
||||
value: "10"
|
||||
- name: vip_retryperiod
|
||||
value: "2"
|
||||
- name: address
|
||||
value: {{ apiserver_endpoint }}
|
||||
image: ghcr.io/kube-vip/kube-vip:{{ kube_vip_tag_version }}
|
||||
imagePullPolicy: Always
|
||||
name: kube-vip
|
||||
resources: {}
|
||||
securityContext:
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
- SYS_TIME
|
||||
hostNetwork: true
|
||||
serviceAccountName: kube-vip
|
||||
tolerations:
|
||||
- effect: NoSchedule
|
||||
operator: Exists
|
||||
- effect: NoExecute
|
||||
operator: Exists
|
||||
updateStrategy: {}
|
||||
status:
|
||||
currentNumberScheduled: 0
|
||||
desiredNumberScheduled: 0
|
||||
numberMisscheduled: 0
|
||||
numberReady: 0
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
|
||||
- name: Copy K3s service file
|
||||
template:
|
||||
src: "k3s.service.j2"
|
||||
dest: "{{ systemd_dir }}/k3s-node.service"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
|
||||
- name: Enable and check K3s service
|
||||
systemd:
|
||||
name: k3s-node
|
||||
daemon_reload: yes
|
||||
state: restarted
|
||||
enabled: yes
|
||||
@@ -0,0 +1,24 @@
|
||||
[Unit]
|
||||
Description=Lightweight Kubernetes
|
||||
Documentation=https://k3s.io
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
ExecStartPre=-/sbin/modprobe br_netfilter
|
||||
ExecStartPre=-/sbin/modprobe overlay
|
||||
ExecStart=/usr/local/bin/k3s agent --server https://{{ apiserver_endpoint | ansible.utils.ipwrap }}:6443 --token {{ hostvars[groups['master'][0]]['token'] | default(k3s_token) }} {{ extra_agent_args | default("") }}
|
||||
KillMode=process
|
||||
Delegate=yes
|
||||
# Having non-zero Limit*s causes performance problems due to accounting overhead
|
||||
# in the kernel. We recommend using cgroups to do container-local accounting.
|
||||
LimitNOFILE=1048576
|
||||
LimitNPROC=infinity
|
||||
LimitCORE=infinity
|
||||
TasksMax=infinity
|
||||
TimeoutStartSec=0
|
||||
Restart=always
|
||||
RestartSec=5s
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,3 @@
|
||||
---
|
||||
# Timeout to wait for MetalLB services to come up
|
||||
metal_lb_available_timeout: 120s
|
||||
@@ -0,0 +1,94 @@
|
||||
---
|
||||
- name: Create manifests directory for temp configuration
|
||||
file:
|
||||
path: /tmp/k3s
|
||||
state: directory
|
||||
owner: "{{ ansible_user }}"
|
||||
mode: 0755
|
||||
with_items: "{{ groups['master'] }}"
|
||||
run_once: true
|
||||
|
||||
- name: Copy metallb CRs manifest to first master
|
||||
template:
|
||||
src: "metallb.crs.j2"
|
||||
dest: "/tmp/k3s/metallb-crs.yaml"
|
||||
owner: "{{ ansible_user }}"
|
||||
mode: 0755
|
||||
with_items: "{{ groups['master'] }}"
|
||||
run_once: true
|
||||
|
||||
- name: Test metallb-system namespace
|
||||
command: >-
|
||||
k3s kubectl -n metallb-system
|
||||
changed_when: false
|
||||
with_items: "{{ groups['master'] }}"
|
||||
run_once: true
|
||||
|
||||
- name: Wait for MetalLB resources
|
||||
command: >-
|
||||
k3s kubectl wait {{ item.resource }}
|
||||
--namespace='metallb-system'
|
||||
{% if item.name | default(False) -%}{{ item.name }}{%- endif %}
|
||||
{% if item.selector | default(False) -%}--selector='{{ item.selector }}'{%- endif %}
|
||||
{% if item.condition | default(False) -%}{{ item.condition }}{%- endif %}
|
||||
--timeout='{{ metal_lb_available_timeout }}'
|
||||
changed_when: false
|
||||
run_once: true
|
||||
with_items:
|
||||
- description: controller
|
||||
resource: deployment
|
||||
name: controller
|
||||
condition: --for condition=Available=True
|
||||
- description: webhook service
|
||||
resource: pod
|
||||
selector: component=controller
|
||||
condition: --for=jsonpath='{.status.phase}'=Running
|
||||
- description: pods in replica sets
|
||||
resource: pod
|
||||
selector: component=controller,app=metallb
|
||||
condition: --for condition=Ready
|
||||
- description: ready replicas of controller
|
||||
resource: replicaset
|
||||
selector: component=controller,app=metallb
|
||||
condition: --for=jsonpath='{.status.readyReplicas}'=1
|
||||
- description: fully labeled replicas of controller
|
||||
resource: replicaset
|
||||
selector: component=controller,app=metallb
|
||||
condition: --for=jsonpath='{.status.fullyLabeledReplicas}'=1
|
||||
- description: available replicas of controller
|
||||
resource: replicaset
|
||||
selector: component=controller,app=metallb
|
||||
condition: --for=jsonpath='{.status.availableReplicas}'=1
|
||||
loop_control:
|
||||
label: "{{ item.description }}"
|
||||
|
||||
- name: Test metallb-system webhook-service endpoint
|
||||
command: >-
|
||||
k3s kubectl -n metallb-system get endpoints webhook-service
|
||||
changed_when: false
|
||||
with_items: "{{ groups['master'] }}"
|
||||
run_once: true
|
||||
|
||||
- name: Apply metallb CRs
|
||||
command: >-
|
||||
k3s kubectl apply -f /tmp/k3s/metallb-crs.yaml
|
||||
--timeout='{{ metal_lb_available_timeout }}'
|
||||
register: this
|
||||
changed_when: false
|
||||
run_once: true
|
||||
until: this.rc == 0
|
||||
retries: 5
|
||||
|
||||
- name: Test metallb-system resources
|
||||
command: >-
|
||||
k3s kubectl -n metallb-system get {{ item }}
|
||||
changed_when: false
|
||||
run_once: true
|
||||
with_items:
|
||||
- IPAddressPool
|
||||
- L2Advertisement
|
||||
|
||||
- name: Remove tmp directory used for manifests
|
||||
file:
|
||||
path: /tmp/k3s
|
||||
state: absent
|
||||
@@ -0,0 +1,21 @@
|
||||
apiVersion: metallb.io/v1beta1
|
||||
kind: IPAddressPool
|
||||
metadata:
|
||||
name: first-pool
|
||||
namespace: metallb-system
|
||||
spec:
|
||||
addresses:
|
||||
{% if metal_lb_ip_range is string %}
|
||||
{# metal_lb_ip_range was used in the legacy way: single string instead of a list #}
|
||||
{# => transform to list with single element #}
|
||||
{% set metal_lb_ip_range = [metal_lb_ip_range] %}
|
||||
{% endif %}
|
||||
{% for range in metal_lb_ip_range %}
|
||||
- {{ range }}
|
||||
{% endfor %}
|
||||
---
|
||||
apiVersion: metallb.io/v1beta1
|
||||
kind: L2Advertisement
|
||||
metadata:
|
||||
name: default
|
||||
namespace: metallb-system
|
||||
@@ -0,0 +1,24 @@
|
||||
---
|
||||
- name: Add cgroup rule
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/pve/nodes/{{ ansible_hostname }}/lxc/{{ hostvars[ansible_hostname]['k3s_vmid'] }}.conf
|
||||
state: present
|
||||
line: lxc.apparmor.profile{{":"}} unconfined
|
||||
|
||||
- name: Add cgroup rule
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/pve/nodes/{{ ansible_hostname }}/lxc/{{ hostvars[ansible_hostname]['k3s_vmid'] }}.conf
|
||||
state: present
|
||||
line: lxc.cap.drop{{":"}}
|
||||
|
||||
- name: Add cgroup rule
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/pve/nodes/{{ ansible_hostname }}/lxc/{{ hostvars[ansible_hostname]['k3s_vmid'] }}.conf
|
||||
state: present
|
||||
line: lxc.mount.auto"{{":"}}" "proc{{":"}}rw sys{{":"}}rw"
|
||||
|
||||
- name: Add cgroup rule
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/pve/nodes/{{ ansible_hostname }}/lxc/{{ hostvars[ansible_hostname]['k3s_vmid'] }}.conf
|
||||
state: present
|
||||
line: lxc.cgroup2.devices.allow{{":"}} c 10{{":"}}200 rwm
|
||||
@@ -0,0 +1,21 @@
|
||||
---
|
||||
- name: Configure cloud-init - IP
|
||||
ansible.builtin.command: qm set "{{ k3s_vmid }}" --ipconfig0 ip="{{ k3s_vm_host }}"/21,gw=10.0.0.1
|
||||
|
||||
- name: Configure cloud-init - User
|
||||
ansible.builtin.command: qm set "{{ k3s_vmid }}" --ciuser "root"
|
||||
|
||||
- name: Configure cloud-init - Password
|
||||
ansible.builtin.command: qm set "{{ k3s_vmid }}" --cipassword "{{ ansible_ssh_pass }}"
|
||||
|
||||
- name: Copy SSH Pub key
|
||||
ansible.builtin.copy:
|
||||
src: ~/.ssh/id_rsa.pub
|
||||
dest: /tmp/ansible_controller-key.pub
|
||||
mode: 0600
|
||||
|
||||
- name: Configure cloud-init - SSH Key
|
||||
ansible.builtin.command: qm set "{{ k3s_vmid }}" --sshkey /tmp/ansible_controller-key.pub
|
||||
|
||||
- name: Configure networking
|
||||
ansible.builtin.command: qm set "{{ k3s_vmid }}" --net0 virtio={{ k3s_mac_addr }},bridge=vmbr0
|
||||
@@ -0,0 +1,51 @@
|
||||
---
|
||||
- name: Create containers
|
||||
# community.general.proxmox:
|
||||
# vmid: "{{ hostvars[item]['k3s_vmid'] }}"
|
||||
# node: "{{ item }}"
|
||||
# api_user: root@pam
|
||||
# api_password: "{{ proxmox_api_password }}"
|
||||
# api_host: 10.0.2.2
|
||||
# password: "{{ lxc_password }}"
|
||||
# hostname: "{{ hostvars[item]['k3s_hostname'] }}"
|
||||
# ostemplate: "hyrule-8tb-nfs:vztmpl/debian-11-standard_11.3-1_amd64.tar.zst"
|
||||
# netif: "{'net0':'name=eth0,\
|
||||
# gw=10.0.0.1,\
|
||||
# ip={{ hostvars[item]['k3s_lxc_host'] }}/21,\
|
||||
# hwaddr={{ hostvars[item]['k3s_mac_addr'] }},\
|
||||
# bridge=vmbr0'}"
|
||||
# cores: "{{ hostvars[item]['k3s_cores'] }}"
|
||||
# memory: "{{ hostvars[item]['k3s_memory'] }}"
|
||||
# unprivileged: no
|
||||
# swap: 0
|
||||
# searchdomain: "home"
|
||||
# onboot: 1
|
||||
# features:
|
||||
# - nesting=1
|
||||
# disk: local-lvm:{{ hostvars[item]['k3s_disk'] }}
|
||||
# force: yes
|
||||
# loop: "{{ groups['k3s_hosts'] }}"
|
||||
proxmox_kvm:
|
||||
api_user: root@pam
|
||||
api_password: "{{ proxmox_api_password }}"
|
||||
api_host: 10.0.2.2
|
||||
name: "{{ hostvars[item]['k3s_hostname'] }}"
|
||||
node: "{{ item }}"
|
||||
newid: "{{ hostvars[item]['k3s_vmid'] }}"
|
||||
clone: debian-10-openstack-amd64
|
||||
vmid: "{{ hostvars[item]['k3s_template_id'] }}"
|
||||
timeout: 900
|
||||
loop: "{{ groups['k3s_hosts'] }}"
|
||||
|
||||
- name: Update VMs
|
||||
proxmox_kvm:
|
||||
api_user: root@pam
|
||||
api_password: "{{ proxmox_api_password }}"
|
||||
api_host: 10.0.2.2
|
||||
memory: "{{ hostvars[item]['k3s_memory'] }}"
|
||||
cores: "{{ hostvars[item]['k3s_cores'] }}"
|
||||
vmid: "{{ hostvars[item]['k3s_vmid'] }}"
|
||||
node: "{{ item }}"
|
||||
update: yes
|
||||
agent: yes
|
||||
loop: "{{ groups['k3s_hosts'] }}"
|
||||
@@ -0,0 +1,44 @@
|
||||
---
|
||||
- name: Stop containers
|
||||
# community.general.proxmox:
|
||||
# vmid: "{{ hostvars[item]['k3s_vmid'] }}"
|
||||
# api_user: root@pam
|
||||
# api_password: "{{ proxmox_api_password }}"
|
||||
# api_host: 10.0.2.2
|
||||
# state: stopped
|
||||
proxmox_kvm:
|
||||
api_user: root@pam
|
||||
api_password: "{{ proxmox_api_password }}"
|
||||
api_host: 10.0.2.2
|
||||
name: "{{ hostvars[item]['k3s_hostname'] }}"
|
||||
node: "{{ item }}"
|
||||
state: stopped
|
||||
timeout: 240
|
||||
loop: "{{ groups['k3s_hosts'] }}"
|
||||
ignore_errors: true
|
||||
|
||||
- name: Remove containers
|
||||
# community.general.proxmox:
|
||||
# vmid: "{{ hostvars[item]['k3s_vmid'] }}"
|
||||
# api_user: root@pam
|
||||
# api_password: "{{ proxmox_api_password }}"
|
||||
# api_host: "{{ hostvars[item]['ip_addr'] }}"
|
||||
# state: absent
|
||||
proxmox_kvm:
|
||||
api_user: root@pam
|
||||
api_password: "{{ proxmox_api_password }}"
|
||||
api_host: 10.0.2.2
|
||||
name: "{{ hostvars[item]['k3s_hostname'] }}"
|
||||
node: "{{ item }}"
|
||||
state: absent
|
||||
timeout: 90
|
||||
loop: "{{ groups['k3s_hosts'] }}"
|
||||
ignore_errors: true
|
||||
|
||||
- name: Remove .ssh/known_hosts lines
|
||||
ansible.builtin.lineinfile:
|
||||
path: /Users/lino.silva/.ssh/known_hosts
|
||||
state: absent
|
||||
# regexp: '^{{ hostvars[item]["k3s_lxc_host"] }}'
|
||||
regexp: '^{{ hostvars[item]["k3s_vm_host"] }}'
|
||||
loop: "{{ groups['k3s_hosts'] }}"
|
||||
@@ -0,0 +1,8 @@
|
||||
---
|
||||
# Unable to use ansible.builtin.lineinfile, because we need to run this through the proxmox host (because SSH is not enabled duh)
|
||||
|
||||
- name: Allow SSH into LXC
|
||||
ansible.builtin.command: lxc-attach -n "{{ k3s_vmid }}" -- sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" /etc/ssh/sshd_config
|
||||
|
||||
- name: Restart SSH Service
|
||||
ansible.builtin.command: lxc-attach -n "{{ k3s_vmid }}" service ssh restart
|
||||
@@ -0,0 +1,19 @@
|
||||
---
|
||||
# - name: Move storage to local_lvm
|
||||
# ansible.builtin.command: qm disk move "{{ k3s_vmid }}" scsi0 local-lvm
|
||||
# ignore_errors: true
|
||||
|
||||
# - name: Resize storage
|
||||
# ansible.builtin.command: qm disk resize "{{ k3s_vmid }}" scsi0 +"{{ k3s_disk }}G"
|
||||
|
||||
- name: Allow ipv4 forwarding
|
||||
ansible.builtin.shell: "sysctl net.ipv4.ip_forward=1"
|
||||
|
||||
- name: Allow ipv6 forwarding
|
||||
ansible.builtin.shell: "sysctl net.ipv6.conf.all.forwarding=1"
|
||||
|
||||
- name: Uncomment ipv4 forward line on /etc/sysctl.conf
|
||||
ansible.builtin.shell: "sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/g' /etc/sysctl.conf"
|
||||
|
||||
- name: Uncomment ipv6 forward line on /etc/sysctl.conf
|
||||
ansible.builtin.shell: "sed -i 's/#net.ipv6.conf.all.forwarding=1/net.ipv6.conf.all.forwarding=1/g' /etc/sysctl.conf"
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
- name: Start deployments
|
||||
# community.general.proxmox:
|
||||
# vmid: "{{ hostvars[item]['k3s_vmid'] }}"
|
||||
# api_user: root@pam
|
||||
# api_password: "{{ proxmox_api_password }}"
|
||||
# api_host: 10.0.2.2
|
||||
# state: started
|
||||
community.general.cloud.misc.proxmox_kvm:
|
||||
api_user: root@pam
|
||||
api_password: "{{ proxmox_api_password }}"
|
||||
api_host: 10.0.2.2
|
||||
name: "{{ hostvars[item]['k3s_hostname'] }}"
|
||||
node: "{{ item }}"
|
||||
state: started
|
||||
loop: "{{ groups['k3s_hosts'] }}"
|
||||
@@ -0,0 +1,24 @@
|
||||
---
|
||||
- name: Deploy nginx - deployment
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'deployment.yml') | from_yaml }}"
|
||||
|
||||
- name: Deploy nginx - service
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'service.yml') | from_yaml }}"
|
||||
|
||||
- name: Deploy forwardauth middleware
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'middleware-forwardauth.yml') | from_yaml }}"
|
||||
|
||||
- name: Deploy nginx - ingress
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'ingress.yml') | from_yaml }}"
|
||||
@@ -0,0 +1,25 @@
|
||||
---
|
||||
kind: Deployment
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
name: nginx
|
||||
namespace: default
|
||||
labels:
|
||||
app: nginx
|
||||
spec:
|
||||
replicas: 3
|
||||
progressDeadlineSeconds: 600
|
||||
revisionHistoryLimit: 2
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: nginx
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: nginx
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx:latest
|
||||
@@ -0,0 +1,32 @@
|
||||
---
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: nginx
|
||||
namespace: default
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: traefik-external
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`nginx.lino.cooking`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: nginx
|
||||
port: 80
|
||||
middlewares:
|
||||
- name: default-headers
|
||||
- name: nginx-middleware-forwardauth
|
||||
namespace: traefik
|
||||
- match: "Host(`nginx.lino.cooking`) && PathPrefix(`/outpost.goauthentik.io/`)"
|
||||
kind: Rule
|
||||
priority: 15
|
||||
services:
|
||||
- kind: Service
|
||||
# Or, to use an external Outpost, create an ExternalName service and reference that here.
|
||||
# See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
|
||||
name: authentik
|
||||
port: 9000
|
||||
tls:
|
||||
secretName: lino-cooking-tls
|
||||
@@ -0,0 +1,21 @@
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: nginx-middleware-forwardauth
|
||||
namespace: traefik
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: https://nginx.lino.cooking/outpost.goauthentik.io/auth/traefik
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- X-authentik-username
|
||||
- X-authentik-groups
|
||||
- X-authentik-email
|
||||
- X-authentik-name
|
||||
- X-authentik-uid
|
||||
- X-authentik-jwt
|
||||
- X-authentik-meta-jwks
|
||||
- X-authentik-meta-outpost
|
||||
- X-authentik-meta-provider
|
||||
- X-authentik-meta-app
|
||||
- X-authentik-meta-version
|
||||
@@ -0,0 +1,13 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: nginx
|
||||
namespace: default
|
||||
spec:
|
||||
selector:
|
||||
app: nginx
|
||||
ports:
|
||||
- name: http
|
||||
targetPort: 80
|
||||
port: 80
|
||||
@@ -0,0 +1,90 @@
|
||||
---
|
||||
- name: Run the equivalent of "apt-get update" as a separate step
|
||||
ansible.builtin.apt:
|
||||
update_cache: yes
|
||||
|
||||
- name: Upgrade the OS (apt-get dist-upgrade)
|
||||
ansible.builtin.apt:
|
||||
upgrade: full
|
||||
|
||||
- name: Set same timezone on every Server
|
||||
community.general.system.timezone:
|
||||
name: "{{ system_timezone }}"
|
||||
when: (system_timezone is defined) and (system_timezone != "Your/Timezone")
|
||||
|
||||
- name: Set SELinux to disabled state
|
||||
ansible.posix.selinux:
|
||||
state: disabled
|
||||
when: ansible_os_family == "RedHat"
|
||||
|
||||
- name: Enable IPv4 forwarding
|
||||
ansible.posix.sysctl:
|
||||
name: net.ipv4.ip_forward
|
||||
value: "1"
|
||||
state: present
|
||||
reload: yes
|
||||
|
||||
- name: Enable IPv6 forwarding
|
||||
ansible.posix.sysctl:
|
||||
name: net.ipv6.conf.all.forwarding
|
||||
value: "1"
|
||||
state: present
|
||||
reload: yes
|
||||
|
||||
- name: Enable IPv6 router advertisements
|
||||
ansible.posix.sysctl:
|
||||
name: net.ipv6.conf.all.accept_ra
|
||||
value: "2"
|
||||
state: present
|
||||
reload: yes
|
||||
|
||||
- name: Add br_netfilter to /etc/modules-load.d/
|
||||
copy:
|
||||
content: "br_netfilter"
|
||||
dest: /etc/modules-load.d/br_netfilter.conf
|
||||
mode: "u=rw,g=,o="
|
||||
|
||||
- name: Load br_netfilter
|
||||
community.general.system.modprobe:
|
||||
name: br_netfilter
|
||||
state: present
|
||||
|
||||
- name: Add overlay to /etc/modules-load.d/
|
||||
copy:
|
||||
content: "overlay"
|
||||
dest: /etc/modules-load.d/overlay.conf
|
||||
mode: "u=rw,g=,o="
|
||||
|
||||
- name: Load overlay
|
||||
community.general.system.modprobe:
|
||||
name: overlay
|
||||
state: present
|
||||
|
||||
- name: Set bridge-nf-call-iptables (just to be sure)
|
||||
ansible.posix.sysctl:
|
||||
name: "{{ item }}"
|
||||
value: "1"
|
||||
state: present
|
||||
reload: yes
|
||||
when: ansible_os_family == "RedHat"
|
||||
loop:
|
||||
- net.bridge.bridge-nf-call-iptables
|
||||
- net.bridge.bridge-nf-call-ip6tables
|
||||
|
||||
- name: Add /usr/local/bin to sudo secure_path
|
||||
lineinfile:
|
||||
line: "Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin"
|
||||
regexp: "Defaults(\\s)*secure_path(\\s)*="
|
||||
state: present
|
||||
insertafter: EOF
|
||||
path: /etc/sudoers
|
||||
validate: "visudo -cf %s"
|
||||
when: ansible_os_family == "RedHat"
|
||||
|
||||
- name: Copy /etc/rc.local file
|
||||
template:
|
||||
src: "rclocal.j2"
|
||||
dest: "/etc/rc.local"
|
||||
owner: root
|
||||
group: root
|
||||
mode: a+x
|
||||
@@ -0,0 +1,3 @@
|
||||
#!/bin/sh -e
|
||||
ln -s /dev/console /dev/kmsg
|
||||
mount --make-rshared /
|
||||
@@ -0,0 +1,26 @@
|
||||
---
|
||||
- name: Create redis-server namespace
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
name: redis-server
|
||||
api_version: v1
|
||||
kind: Namespace
|
||||
state: present
|
||||
|
||||
- name: Create PersistentVolumeClaim
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'pvc.yml') | from_yaml }}"
|
||||
|
||||
- name: Deploy redis
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'deployment.yml') | from_yaml }}"
|
||||
|
||||
- name: Crete redis-server Service
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /Users/lino.silva/.kube/config
|
||||
state: present
|
||||
definition: "{{ lookup('template', 'service.yml') | from_yaml }}"
|
||||
@@ -0,0 +1,35 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: redis-server
|
||||
namespace: redis-server
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: redis-server
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: redis-server
|
||||
name: redis-server
|
||||
spec:
|
||||
nodeSelector:
|
||||
node-type: worker
|
||||
containers:
|
||||
- name: redis-server
|
||||
image: redis
|
||||
args: ["--appendonly", "yes"]
|
||||
ports:
|
||||
- name: redis-server
|
||||
containerPort: 6379
|
||||
volumeMounts:
|
||||
- name: lv-storage
|
||||
mountPath: /data
|
||||
env:
|
||||
- name: ALLOW_EMPTY_PASSWORD
|
||||
value: "yes"
|
||||
volumes:
|
||||
- name: lv-storage
|
||||
persistentVolumeClaim:
|
||||
claimName: redis-pvc
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: redis-pvc
|
||||
namespace: redis-server
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: longhorn
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: redis-server
|
||||
namespace: redis-server
|
||||
spec:
|
||||
selector:
|
||||
app: redis-server
|
||||
type: LoadBalancer
|
||||
ports:
|
||||
- name: redis-port
|
||||
protocol: TCP
|
||||
port: 6379
|
||||
targetPort: 6379
|
||||
loadBalancerIP: 10.0.4.2
|
||||
@@ -0,0 +1,56 @@
|
||||
---
|
||||
- name: Disable services
|
||||
systemd:
|
||||
name: "{{ item }}"
|
||||
state: stopped
|
||||
enabled: no
|
||||
failed_when: false
|
||||
with_items:
|
||||
- k3s
|
||||
- k3s-node
|
||||
- k3s-init
|
||||
|
||||
- name: RUN pkill -9 -f "k3s/data/[^/]+/bin/containerd-shim-runc"
|
||||
register: pkill_containerd_shim_runc
|
||||
command: pkill -9 -f "k3s/data/[^/]+/bin/containerd-shim-runc"
|
||||
changed_when: "pkill_containerd_shim_runc.rc == 0"
|
||||
failed_when: false
|
||||
|
||||
- name: Umount k3s filesystems
|
||||
include_tasks: umount_with_children.yml
|
||||
with_items:
|
||||
- /run/k3s
|
||||
- /var/lib/kubelet
|
||||
- /run/netns
|
||||
- /var/lib/rancher/k3s
|
||||
- /var/lib/kubelet/pods
|
||||
- /var/lib/kubelet/plugins
|
||||
- /run/netns/cni-
|
||||
loop_control:
|
||||
loop_var: mounted_fs
|
||||
|
||||
- name: Remove service files, binaries and data
|
||||
file:
|
||||
name: "{{ item }}"
|
||||
state: absent
|
||||
with_items:
|
||||
- /usr/local/bin/k3s
|
||||
- "{{ systemd_dir }}/k3s.service"
|
||||
- "{{ systemd_dir }}/k3s-node.service"
|
||||
- /etc/rancher/k3s
|
||||
- /run/k3s
|
||||
- /run/flannel
|
||||
- /etc/rancher/
|
||||
- /var/lib/kubelet
|
||||
- /var/lib/rancher/k3s
|
||||
- /var/lib/rancher/
|
||||
- /var/lib/cni/
|
||||
|
||||
- name: Reload daemon_reload
|
||||
systemd:
|
||||
daemon_reload: yes
|
||||
|
||||
- name: Remove tmp directory used for manifests
|
||||
file:
|
||||
path: /tmp/k3s
|
||||
state: absent
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
- name: Get the list of mounted filesystems
|
||||
shell: set -o pipefail && cat /proc/mounts | awk '{ print $2}' | grep -E "^{{ mounted_fs }}"
|
||||
register: get_mounted_filesystems
|
||||
args:
|
||||
executable: /bin/bash
|
||||
failed_when: false
|
||||
changed_when: get_mounted_filesystems.stdout | length > 0
|
||||
check_mode: false
|
||||
|
||||
- name: Umount filesystem
|
||||
mount:
|
||||
path: "{{ item }}"
|
||||
state: unmounted
|
||||
with_items:
|
||||
"{{ get_mounted_filesystems.stdout_lines | reverse | list }}"
|
||||
Reference in New Issue
Block a user