Compare commits
4 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Timothy Stewart
|
cb704edc42 | ||
|
Timothy Stewart
|
21d6e15ff3 | ||
|
Timothy Stewart
|
7c70c5a6a8 | ||
|
Timothy Stewart
|
e9198c60e8 |
+12
-6
@@ -1,11 +1,17 @@
|
|||||||
---
|
---
|
||||||
exclude_paths:
|
exclude_paths:
|
||||||
# default paths
|
# default paths
|
||||||
- ".cache/"
|
- '.cache/'
|
||||||
- ".github/"
|
- '.github/'
|
||||||
- "test/fixtures/formatting-before/"
|
- 'test/fixtures/formatting-before/'
|
||||||
- "test/fixtures/formatting-prettier/"
|
- 'test/fixtures/formatting-prettier/'
|
||||||
|
|
||||||
|
# The "converge" and "reset" playbooks use import_playbook in
|
||||||
|
# conjunction with the "env" lookup plugin, which lets the
|
||||||
|
# syntax check of ansible-lint fail.
|
||||||
|
- 'molecule/**/converge.yml'
|
||||||
|
- 'molecule/**/prepare.yml'
|
||||||
|
- 'molecule/**/reset.yml'
|
||||||
|
|
||||||
skip_list:
|
skip_list:
|
||||||
- "fqcn-builtins"
|
- 'fqcn-builtins'
|
||||||
- "name[play]"
|
|
||||||
|
|||||||
@@ -0,0 +1,3 @@
|
|||||||
|
---
|
||||||
|
github: timothystewart6
|
||||||
|
patreon: technotim
|
||||||
@@ -0,0 +1,77 @@
|
|||||||
|
|
||||||
|
<!-- It's a good idea to check this post first for general troubleshooting https://github.com/techno-tim/k3s-ansible/discussions/19 -->
|
||||||
|
|
||||||
|
<!--- Provide a general summary of the issue in the Title above -->
|
||||||
|
|
||||||
|
## Expected Behavior
|
||||||
|
|
||||||
|
<!--- Tell us what should happen -->
|
||||||
|
|
||||||
|
## Current Behavior
|
||||||
|
<!--- Tell us what happens instead of the expected behavior -->
|
||||||
|
|
||||||
|
## Steps to Reproduce
|
||||||
|
|
||||||
|
<!--- reproduce this bug. Include code to reproduce, if relevant -->
|
||||||
|
|
||||||
|
1.
|
||||||
|
2.
|
||||||
|
3.
|
||||||
|
4.
|
||||||
|
|
||||||
|
## Context (variables)
|
||||||
|
<!--- please include which OS, along with the variables used when running the playbook -->
|
||||||
|
|
||||||
|
Operating system:
|
||||||
|
|
||||||
|
Hardware:
|
||||||
|
|
||||||
|
### Variables Used
|
||||||
|
|
||||||
|
`all.yml`
|
||||||
|
|
||||||
|
```yml
|
||||||
|
k3s_version: ""
|
||||||
|
ansible_user: NA
|
||||||
|
systemd_dir: ""
|
||||||
|
|
||||||
|
flannel_iface: ""
|
||||||
|
|
||||||
|
apiserver_endpoint: ""
|
||||||
|
|
||||||
|
k3s_token: "NA"
|
||||||
|
|
||||||
|
extra_server_args: ""
|
||||||
|
extra_agent_args: ""
|
||||||
|
|
||||||
|
kube_vip_tag_version: ""
|
||||||
|
|
||||||
|
metal_lb_speaker_tag_version: ""
|
||||||
|
metal_lb_controller_tag_version: ""
|
||||||
|
|
||||||
|
metal_lb_ip_range: ""
|
||||||
|
```
|
||||||
|
|
||||||
|
### Hosts
|
||||||
|
|
||||||
|
`host.ini`
|
||||||
|
|
||||||
|
```ini
|
||||||
|
[master]
|
||||||
|
IP.ADDRESS.ONE
|
||||||
|
IP.ADDRESS.TWO
|
||||||
|
IP.ADDRESS.THREE
|
||||||
|
|
||||||
|
[node]
|
||||||
|
IP.ADDRESS.FOUR
|
||||||
|
IP.ADDRESS.FIVE
|
||||||
|
|
||||||
|
[k3s_cluster:children]
|
||||||
|
master
|
||||||
|
node
|
||||||
|
```
|
||||||
|
|
||||||
|
## Possible Solution
|
||||||
|
<!--- Not obligatory, but suggest a fix/reason for the bug, -->
|
||||||
|
|
||||||
|
- [ ] I've checked the [General Troubleshooting Guide](https://github.com/techno-tim/k3s-ansible/discussions/20)
|
||||||
@@ -0,0 +1,14 @@
|
|||||||
|
# Proposed Changes
|
||||||
|
<!--- Provide a general summary of your changes -->
|
||||||
|
|
||||||
|
-
|
||||||
|
-
|
||||||
|
-
|
||||||
|
|
||||||
|
## Checklist
|
||||||
|
|
||||||
|
- [ ] Tested locally
|
||||||
|
- [ ] Ran `site.yml` playbook
|
||||||
|
- [ ] Ran `reset.yml` playbook
|
||||||
|
- [ ] Did not add any unnecessary changes
|
||||||
|
- [ ] 🚀
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
---
|
||||||
|
version: 2
|
||||||
|
updates:
|
||||||
|
- package-ecosystem: "pip"
|
||||||
|
directory: "/"
|
||||||
|
schedule:
|
||||||
|
interval: "daily"
|
||||||
|
rebase-strategy: "auto"
|
||||||
|
ignore:
|
||||||
|
- dependency-name: "*"
|
||||||
|
update-types: ["version-update:semver-major"]
|
||||||
@@ -0,0 +1,30 @@
|
|||||||
|
---
|
||||||
|
name: Linting
|
||||||
|
on:
|
||||||
|
pull_request:
|
||||||
|
push:
|
||||||
|
branches:
|
||||||
|
- master
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
ansible-lint:
|
||||||
|
name: YAML Lint + Ansible Lint
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Check out the codebase
|
||||||
|
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # 3.0.2
|
||||||
|
|
||||||
|
- name: Set up Python 3.x
|
||||||
|
uses: actions/setup-python@b55428b1882923874294fa556849718a1d7f2ca5 #4.0.2
|
||||||
|
with:
|
||||||
|
python-version: '3.x'
|
||||||
|
|
||||||
|
- name: Install test dependencies
|
||||||
|
run: pip3 install yamllint ansible-lint ansible
|
||||||
|
|
||||||
|
- name: Run yamllint
|
||||||
|
run: yamllint .
|
||||||
|
|
||||||
|
- name: Run ansible-lint
|
||||||
|
run: ansible-lint
|
||||||
@@ -0,0 +1,72 @@
|
|||||||
|
---
|
||||||
|
name: Test
|
||||||
|
on:
|
||||||
|
pull_request:
|
||||||
|
push:
|
||||||
|
branches:
|
||||||
|
- master
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
molecule:
|
||||||
|
name: Molecule
|
||||||
|
runs-on: macos-12
|
||||||
|
|
||||||
|
strategy:
|
||||||
|
matrix:
|
||||||
|
scenario:
|
||||||
|
- default
|
||||||
|
- ipv6
|
||||||
|
- single_node
|
||||||
|
fail-fast: false
|
||||||
|
env:
|
||||||
|
PYTHON_VERSION: "3.10"
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Check out the codebase
|
||||||
|
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # 3.0.2
|
||||||
|
|
||||||
|
- name: Configure VirtualBox
|
||||||
|
run: |-
|
||||||
|
sudo mkdir -p /etc/vbox
|
||||||
|
cat <<EOF | sudo tee -a /etc/vbox/networks.conf > /dev/null
|
||||||
|
* 192.168.30.0/24
|
||||||
|
* fdad:bad:ba55::/64
|
||||||
|
EOF
|
||||||
|
|
||||||
|
- name: Cache Vagrant boxes
|
||||||
|
uses: actions/cache@fd5de65bc895cf536527842281bea11763fefd77 # 3.0.8
|
||||||
|
with:
|
||||||
|
path: |
|
||||||
|
~/.vagrant.d/boxes
|
||||||
|
key: vagrant-boxes-${{ hashFiles('**/molecule.yml') }}
|
||||||
|
restore-keys: |
|
||||||
|
vagrant-boxes
|
||||||
|
|
||||||
|
- name: Set up Python ${{ env.PYTHON_VERSION }}
|
||||||
|
uses: actions/setup-python@v2
|
||||||
|
with:
|
||||||
|
python-version: ${{ env.PYTHON_VERSION }}
|
||||||
|
|
||||||
|
- name: Install dependencies
|
||||||
|
run: >-
|
||||||
|
python3 -m pip install --upgrade pip &&
|
||||||
|
python3 -m pip install -r requirements.txt
|
||||||
|
|
||||||
|
- name: Test with molecule
|
||||||
|
run: molecule test --scenario-name ${{ matrix.scenario }}
|
||||||
|
env:
|
||||||
|
ANSIBLE_K3S_LOG_DIR: ${{ runner.temp }}/logs/k3s-ansible/${{ matrix.scenario }}
|
||||||
|
ANSIBLE_SSH_RETRIES: 4
|
||||||
|
ANSIBLE_TIMEOUT: 60
|
||||||
|
|
||||||
|
- name: Upload log files
|
||||||
|
if: always() # do this even if a step before has failed
|
||||||
|
uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # 3.1.0
|
||||||
|
with:
|
||||||
|
name: logs
|
||||||
|
path: |
|
||||||
|
${{ runner.temp }}/logs
|
||||||
|
|
||||||
|
- name: Delete old box versions
|
||||||
|
if: always() # do this even if a step before has failed
|
||||||
|
run: vagrant box prune --force
|
||||||
@@ -1,2 +1 @@
|
|||||||
.env/
|
.env/
|
||||||
*.log
|
|
||||||
|
|||||||
@@ -1,21 +0,0 @@
|
|||||||
---
|
|
||||||
repos:
|
|
||||||
- repo: https://github.com/pre-commit/pre-commit-hooks
|
|
||||||
rev: v4.3.0
|
|
||||||
hooks:
|
|
||||||
- id: requirements-txt-fixer
|
|
||||||
- id: sort-simple-yaml
|
|
||||||
- id: detect-private-key
|
|
||||||
- repo: https://github.com/adrienverge/yamllint.git
|
|
||||||
rev: v1.28.0
|
|
||||||
hooks:
|
|
||||||
- id: yamllint
|
|
||||||
args: [-c=.yamllint]
|
|
||||||
- repo: https://github.com/ansible-community/ansible-lint.git
|
|
||||||
rev: v6.8.2
|
|
||||||
hooks:
|
|
||||||
- id: ansible-lint
|
|
||||||
- repo: https://github.com/shellcheck-py/shellcheck-py
|
|
||||||
rev: v0.8.0.4
|
|
||||||
hooks:
|
|
||||||
- id: shellcheck
|
|
||||||
Vendored
-3
@@ -1,3 +0,0 @@
|
|||||||
{
|
|
||||||
"prettier.bracketSpacing": false
|
|
||||||
}
|
|
||||||
@@ -16,15 +16,15 @@ If you want more context on how this works, see:
|
|||||||
|
|
||||||
Build a Kubernetes cluster using Ansible with k3s. The goal is easily install a HA Kubernetes cluster on machines running:
|
Build a Kubernetes cluster using Ansible with k3s. The goal is easily install a HA Kubernetes cluster on machines running:
|
||||||
|
|
||||||
- [x] Debian (tested on version 11)
|
- [X] Debian
|
||||||
- [x] Ubuntu (tested on version 22.04)
|
- [X] Ubuntu
|
||||||
- [x] Rocky (tested on version 9)
|
- [X] CentOS
|
||||||
|
|
||||||
on processor architecture:
|
on processor architecture:
|
||||||
|
|
||||||
- [x] x64
|
- [X] x64
|
||||||
- [x] arm64
|
- [X] arm64
|
||||||
- [x] armhf
|
- [X] armhf
|
||||||
|
|
||||||
## ✅ System requirements
|
## ✅ System requirements
|
||||||
|
|
||||||
@@ -34,7 +34,7 @@ on processor architecture:
|
|||||||
|
|
||||||
- `server` and `agent` nodes should have passwordless SSH access, if not you can supply arguments to provide credentials `--ask-pass --ask-become-pass` to each command.
|
- `server` and `agent` nodes should have passwordless SSH access, if not you can supply arguments to provide credentials `--ask-pass --ask-become-pass` to each command.
|
||||||
|
|
||||||
- You will also need to install collections that this playbook uses by running `ansible-galaxy collection install -r ./collections/requirements.yml`
|
- You will also need to install collections that this playbook uses by running `ansible-galaxy install -r ./collections/requirements.yml`
|
||||||
|
|
||||||
## 🚀 Getting Started
|
## 🚀 Getting Started
|
||||||
|
|
||||||
@@ -76,7 +76,7 @@ If needed, you can also edit `inventory/my-cluster/group_vars/all.yml` to match
|
|||||||
Start provisioning of the cluster using the following command:
|
Start provisioning of the cluster using the following command:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
ansible-playbook site.yml -i inventory/my-cluster/hosts.ini --ask-become-pass --ask-vault-pass
|
ansible-playbook site.yml -i inventory/my-cluster/hosts.ini
|
||||||
```
|
```
|
||||||
|
|
||||||
After deployment control plane will be accessible via virtual ip-address which is defined in inventory/group_vars/all.yml as `apiserver_endpoint`
|
After deployment control plane will be accessible via virtual ip-address which is defined in inventory/group_vars/all.yml as `apiserver_endpoint`
|
||||||
@@ -105,6 +105,13 @@ See the commands [here](https://docs.technotim.live/posts/k3s-etcd-ansible/#test
|
|||||||
|
|
||||||
Be sure to see [this post](https://github.com/techno-tim/k3s-ansible/discussions/20) on how to troubleshoot common problems
|
Be sure to see [this post](https://github.com/techno-tim/k3s-ansible/discussions/20) on how to troubleshoot common problems
|
||||||
|
|
||||||
|
### Testing the playbook using molecule
|
||||||
|
|
||||||
|
This playbook includes a [molecule](https://molecule.rtfd.io/)-based test setup.
|
||||||
|
It is run automatically in CI, but you can also run the tests locally.
|
||||||
|
This might be helpful for quick feedback in a few cases.
|
||||||
|
You can find more information about it [here](molecule/README.md).
|
||||||
|
|
||||||
## Thanks 🤝
|
## Thanks 🤝
|
||||||
|
|
||||||
This repo is really standing on the shoulders of giants. Thank you to all those who have contributed and tanks to these repos for code and ideas:
|
This repo is really standing on the shoulders of giants. Thank you to all those who have contributed and tanks to these repos for code and ideas:
|
||||||
@@ -112,8 +119,3 @@ This repo is really standing on the shoulders of giants. Thank you to all those
|
|||||||
- [k3s-io/k3s-ansible](https://github.com/k3s-io/k3s-ansible)
|
- [k3s-io/k3s-ansible](https://github.com/k3s-io/k3s-ansible)
|
||||||
- [geerlingguy/turing-pi-cluster](https://github.com/geerlingguy/turing-pi-cluster)
|
- [geerlingguy/turing-pi-cluster](https://github.com/geerlingguy/turing-pi-cluster)
|
||||||
- [212850a/k3s-ansible](https://github.com/212850a/k3s-ansible)
|
- [212850a/k3s-ansible](https://github.com/212850a/k3s-ansible)
|
||||||
|
|
||||||
## TODO
|
|
||||||
|
|
||||||
- https://docs.k3s.io/installation/kube-dashboard
|
|
||||||
- https://www.phillipsj.net/posts/k3s-enable-nfs-storage/
|
|
||||||
|
|||||||
+3
-14
@@ -1,23 +1,12 @@
|
|||||||
[defaults]
|
[defaults]
|
||||||
nocows = True
|
nocows = True
|
||||||
roles_path = ./roles
|
roles_path = ./roles
|
||||||
inventory = ./inventory/my-cluster/hosts.ini
|
inventory = ./hosts.ini
|
||||||
stdout_callback = yaml
|
|
||||||
|
|
||||||
remote_tmp = $HOME/.ansible/tmp
|
remote_tmp = $HOME/.ansible/tmp
|
||||||
local_tmp = $HOME/.ansible/tmp
|
local_tmp = $HOME/.ansible/tmp
|
||||||
timeout = 60
|
pipelining = True
|
||||||
|
become = True
|
||||||
host_key_checking = False
|
host_key_checking = False
|
||||||
deprecation_warnings = False
|
deprecation_warnings = False
|
||||||
callback_whitelist = profile_tasks
|
callback_whitelist = profile_tasks
|
||||||
log_path = ./ansible.log
|
|
||||||
|
|
||||||
[privilege_escalation]
|
|
||||||
become = True
|
|
||||||
|
|
||||||
[ssh_connection]
|
|
||||||
scp_if_ssh = smart
|
|
||||||
retries = 3
|
|
||||||
ssh_args = -o ControlMaster=auto -o ControlPersist=30m -o Compression=yes -o ServerAliveInterval=15s
|
|
||||||
pipelining = True
|
|
||||||
control_path = %(directory)s/%%h-%%r
|
|
||||||
|
|||||||
@@ -4,4 +4,3 @@ collections:
|
|||||||
- name: community.general
|
- name: community.general
|
||||||
- name: ansible.posix
|
- name: ansible.posix
|
||||||
- name: kubernetes.core
|
- name: kubernetes.core
|
||||||
- name: community.docker
|
|
||||||
|
|||||||
@@ -1,20 +1,13 @@
|
|||||||
---
|
---
|
||||||
kind: Deployment
|
|
||||||
apiVersion: apps/v1
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
metadata:
|
metadata:
|
||||||
name: nginx
|
name: nginx
|
||||||
namespace: default
|
|
||||||
labels:
|
|
||||||
app: nginx
|
|
||||||
spec:
|
spec:
|
||||||
replicas: 3
|
|
||||||
progressDeadlineSeconds: 600
|
|
||||||
revisionHistoryLimit: 2
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
selector:
|
selector:
|
||||||
matchLabels:
|
matchLabels:
|
||||||
app: nginx
|
app: nginx
|
||||||
|
replicas: 3
|
||||||
template:
|
template:
|
||||||
metadata:
|
metadata:
|
||||||
labels:
|
labels:
|
||||||
@@ -22,4 +15,6 @@ spec:
|
|||||||
spec:
|
spec:
|
||||||
containers:
|
containers:
|
||||||
- name: nginx
|
- name: nginx
|
||||||
image: nginx:latest
|
image: nginx:alpine
|
||||||
|
ports:
|
||||||
|
- containerPort: 80
|
||||||
@@ -3,11 +3,11 @@ apiVersion: v1
|
|||||||
kind: Service
|
kind: Service
|
||||||
metadata:
|
metadata:
|
||||||
name: nginx
|
name: nginx
|
||||||
namespace: default
|
|
||||||
spec:
|
spec:
|
||||||
|
ipFamilyPolicy: PreferDualStack
|
||||||
selector:
|
selector:
|
||||||
app: nginx
|
app: nginx
|
||||||
ports:
|
ports:
|
||||||
- name: http
|
- port: 80
|
||||||
targetPort: 80
|
targetPort: 80
|
||||||
port: 80
|
type: LoadBalancer
|
||||||
@@ -0,0 +1,3 @@
|
|||||||
|
/*
|
||||||
|
!.gitignore
|
||||||
|
!sample/
|
||||||
@@ -1,225 +0,0 @@
|
|||||||
---
|
|
||||||
k3s_version: v1.24.6+k3s1
|
|
||||||
# this is the user that has ssh access to these machines
|
|
||||||
ansible_user: lino
|
|
||||||
systemd_dir: /etc/systemd/system
|
|
||||||
|
|
||||||
# Set your timezone
|
|
||||||
system_timezone: "Europe/Lisbon"
|
|
||||||
|
|
||||||
# apiserver_endpoint is virtual ip-address which will be configured on each master
|
|
||||||
apiserver_endpoint: "10.0.3.1"
|
|
||||||
|
|
||||||
# k3s_token is required masters can talk together securely
|
|
||||||
# this token should be alpha numeric only
|
|
||||||
k3s_token: "7qXiuKpSY9uLwdVSNSnEF5RkttoERixCpc2EVJW7vh7Ws4NMN3"
|
|
||||||
|
|
||||||
# The IP on which the node is reachable in the cluster.
|
|
||||||
# Here, a sensible default is provided, you can still override
|
|
||||||
# it for each of your hosts, though.
|
|
||||||
k3s_node_ip: '{{ ansible_facts[flannel_iface]["ipv4"]["address"] }}'
|
|
||||||
|
|
||||||
# Disable the taint manually by setting: k3s_master_taint = false
|
|
||||||
k3s_master_taint: false
|
|
||||||
|
|
||||||
# these arguments are recommended for servers as well as agents:
|
|
||||||
extra_args: >-
|
|
||||||
--flannel-iface={{ flannel_iface }}
|
|
||||||
--node-ip={{ k3s_node_ip }}
|
|
||||||
|
|
||||||
# change these to your liking, the only required are: --disable servicelb, --tls-san {{ apiserver_endpoint }}
|
|
||||||
extra_server_args: >-
|
|
||||||
{{ extra_args }}
|
|
||||||
{{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
|
|
||||||
--tls-san {{ apiserver_endpoint }}
|
|
||||||
--disable servicelb
|
|
||||||
--disable traefik
|
|
||||||
extra_agent_args: >-
|
|
||||||
{{ extra_args }}
|
|
||||||
|
|
||||||
# image tag for kube-vip
|
|
||||||
kube_vip_tag_version: "v0.5.5"
|
|
||||||
|
|
||||||
# image tag for metal lb
|
|
||||||
metal_lb_speaker_tag_version: "v0.13.6"
|
|
||||||
metal_lb_controller_tag_version: "v0.13.6"
|
|
||||||
|
|
||||||
# metallb ip range for load balancer
|
|
||||||
metal_lb_ip_range: "10.0.4.1-10.0.4.254"
|
|
||||||
|
|
||||||
lxc_password: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
38303735306236303463613632623161643633663631303931396564346565666236643562316264
|
|
||||||
6533643331306364653564653763356537303932313531350a393261643137636232616335376461
|
|
||||||
66383966333765626539363561613361393665616333303964373761356166623766663232303063
|
|
||||||
3138353333373935660a383230393330646538303933336366383736643333623663333934663131
|
|
||||||
3064
|
|
||||||
|
|
||||||
proxmox_api_password: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
35376334616332386130656335663736343337396532663266383934643632363664646631653935
|
|
||||||
6533343936353734343761343465646365616130643130360a316234333036303738663566666364
|
|
||||||
61653638373830383733323563373862346662363339656632643661336533363162616435616531
|
|
||||||
6331326462356366320a303331616366356333306638386130666538633833623162653934616338
|
|
||||||
3566
|
|
||||||
|
|
||||||
traefik_http_auth_user: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
38323532616336373939646333613338626431363466633631343162636235623563393135653231
|
|
||||||
3961383965356631613164303566393632323938386664360a373037616335643662613564353130
|
|
||||||
30353832376431633834336234386161313062373437613132623733646166303639313364373637
|
|
||||||
3933626639646536320a303163353835633837356530613931346165353939363235373561333836
|
|
||||||
39366266303064393334383835323330353934643862323330343337393761353166393333376131
|
|
||||||
33303439393531303031653361393530313930363039646566613831373366326432653634653165
|
|
||||||
313735383263623836363030386531613033
|
|
||||||
|
|
||||||
cloudflare_api_key: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
38363363386466666266613930386237623430646531303734613863306530666530376433633339
|
|
||||||
3166373361393839363439326661396136616637393865630a666637366132643035343832666335
|
|
||||||
33376139643533313730313135653064393239316162376339653965313366643565643664666534
|
|
||||||
6631393564333230370a303634643030346166383235643666356164393232643832333238313664
|
|
||||||
38346161306138653735303861646638653830633938326566663136393862643264353437623963
|
|
||||||
3462616435653132623563316231343739333761653365333437
|
|
||||||
|
|
||||||
dns_cloudflare_api_key: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
61306235353261303235646331356666643339393164333762303730646563646633626466306436
|
|
||||||
6565303031366262303161323536323236613861373536330a346564306238633461363765623030
|
|
||||||
33343566363163623532386463616431313865316563616162336633353162316134363266363263
|
|
||||||
6331353838343662380a303565643337653164613637323131363037613861306535326538333030
|
|
||||||
64313165343933343535623731393536396332613336316239363764653565346535666531656433
|
|
||||||
6131646439656638323561643264613834356662363332323835
|
|
||||||
|
|
||||||
dns_cloudflare_email: cloudflare@lino.cooking
|
|
||||||
|
|
||||||
cloudflare_ddns_api_key: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
32353865663337376239333232376630616436643435343862346164353466356563623930386461
|
|
||||||
3132306361653330356663613534626463373133616132620a313161316137313838666534313737
|
|
||||||
34336161373334356630326432626139666566316663373630656538333331656461373631613931
|
|
||||||
6364313538663464350a343061383835663264616238353965656635343564306635303830343266
|
|
||||||
38396530393133646133643232363061386265373234373832656135393764346462666566656264
|
|
||||||
3635316261393863393736383132386133313666306234343666
|
|
||||||
|
|
||||||
homeassistant_pwd: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
34623865646265653733666136316164303765633036616464626133306339393032336465613735
|
|
||||||
3139333561366530383535363834316138303338313030390a306561366265643737623833633837
|
|
||||||
31353332646635353339373937393134376566643539363563613061393731623931643931336566
|
|
||||||
3039626631643930650a393163643534353731316261376638643736623232366431396136313666
|
|
||||||
37613864396630306335626532633832653633346465316332356236393239653063393630323461
|
|
||||||
3862316639643265373166373330333936303233383333653362
|
|
||||||
|
|
||||||
gameyfin_pwd: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
64653937643761616366313263363039336262313832623035313635353638393633643330303733
|
|
||||||
3030373063343264633265616638373463383562626132650a643163333961353861626438356339
|
|
||||||
64326161373332396234656664343736356566356561306334306230343335323733306533343563
|
|
||||||
3639656666313434350a303432393831323338313331386262373130633930396365653836633965
|
|
||||||
35623030313533313462666464333339633832643261383839383432366462313262386236346434
|
|
||||||
39646434653137633062346234373965323036636663326437346238373764363261633736356532
|
|
||||||
346437633064623331653362303034653463
|
|
||||||
|
|
||||||
igdb_client_id: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
36343238373066633635656365376331626231396666373039636330376132393861373739323061
|
|
||||||
3662366362633461383730633765323530316437626639630a613337333163393539653830366235
|
|
||||||
36636139666332393366366166343064623931326634633161666264333038643537386363663962
|
|
||||||
6430613364653562320a313934393633386262343933363835663639313630653631356563346435
|
|
||||||
61616130336366613066316134303866323838653938393630623763383762316432
|
|
||||||
|
|
||||||
igdb_secret: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
65383235643965353066343661616633353163393137326661363862353131333362383336613465
|
|
||||||
3730323833613961326161643730363434643363346138610a313230656534626137373232653633
|
|
||||||
30303163646261666461366161336131326134633832643834623438363137323531393865613761
|
|
||||||
3137316331353531350a306636306233326637623030666634353066396663623663386235393238
|
|
||||||
63303939666561353032396135646666623564616562306637613430663933626530
|
|
||||||
|
|
||||||
mastodon_db_user: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
38613037323362636233336166643239636334333333366137306335643836636338343938303135
|
|
||||||
3134373363343964613236313562393966363033623231310a613236383134616566646466633334
|
|
||||||
61323031393663363438336265613062636432343338383936323161313264326662346538366436
|
|
||||||
3863633263643239390a383664663636343934383333623830333931326330613861353333643663
|
|
||||||
66303131633433376562643938313333383335323665643030623461623836643362633034613834
|
|
||||||
61626134386236616538366332313032383732356638356531613534313638316165383665313939
|
|
||||||
633035373238333032303637663366326431
|
|
||||||
|
|
||||||
mastodon_db_name: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
64376131373562633437313062366334663738336463613938653564323831316531373233396634
|
|
||||||
3530613830303835666431366438376163383433623561350a653834353761616462316161613037
|
|
||||||
64353430643062316465363764653830313065363261356231356466613533643565613562613437
|
|
||||||
3338303632653865330a326337373830396230343764333231356134616365643138663731613264
|
|
||||||
61323132363839666365326665323236373935666361663063343763363062333130663135366530
|
|
||||||
30366231633932356662663863343330366266366538326232623136363934643334656366343763
|
|
||||||
363833363666643162396434636536323166
|
|
||||||
|
|
||||||
mastodon_db_pass: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
66383339653334616233336439376164616532333062393161346238643839393161653932386265
|
|
||||||
3765376366323334613739316162336433623330373131360a653838663436663166373933353064
|
|
||||||
30646663316631653236383437616637396331616339323439353238643866633732323438636138
|
|
||||||
3530306635663631340a306237356664653033663865373964333835613733373565616638363864
|
|
||||||
36333139633033333538306335336165306537303265396631616530366534643465323232336334
|
|
||||||
33636635656130633131623437323764326565656635373265653065646135633066383561643033
|
|
||||||
373333313535343534346331643865616539
|
|
||||||
|
|
||||||
mastodon_key_base: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
33346261623634626666383762613065613865306530363831303032656335636332393564653030
|
|
||||||
3866306433323432643930326133303831633437393265620a643234376332336262636364363866
|
|
||||||
33396431653531626538396266626337623735666165636163616262393263373065356330343139
|
|
||||||
3935356133653332370a313039366431343734363430353966386534363234316666613335353562
|
|
||||||
36316435363862646437333431303430613138353338663233646130636436316366323831343531
|
|
||||||
37623063656132336135313964333134323830373761316262386433363337303964366163313265
|
|
||||||
61376438386466636332383932346431313537656332656362376630646565626130303939313432
|
|
||||||
36646233633434383565386465376238373065303831326162386331653631633962353035376266
|
|
||||||
33653332316563333138336439393839336263393438333663383536663834396365666332356334
|
|
||||||
62316264633161363233346263366164643136656464373963303539623465383734326664386130
|
|
||||||
633539303831656364653861336263613432
|
|
||||||
|
|
||||||
mastodon_otp_secret: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
65316136326539313931396665656663356536636530613533306531663965303933643939643866
|
|
||||||
3635646438363739303730343834623035613135623130390a316463366362386465353134663264
|
|
||||||
64393337663866333333636635656535373064356263666161633033643635366533653530643336
|
|
||||||
6236396264303463350a306333373231343566653939306564323332633237343463353566343836
|
|
||||||
31323337633238393761656133613230393235663261383961616266373165376263376666333032
|
|
||||||
62313033383339643438376662613235333464323566323763623031616531303238386334623133
|
|
||||||
62653637323034613934313065646565323363313535653931306434393136663961663634313232
|
|
||||||
33653933373537333834363538343432643037646165386633363334613566653538353464303839
|
|
||||||
63373632653235376338336332303064356363653537333363326432306139666238393966306535
|
|
||||||
66633266313465333066613161393734353263366561643865323666633733656439386564326233
|
|
||||||
666338346237313564313937633466373937
|
|
||||||
|
|
||||||
mastodon_vapid_private_key: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
38396438623163636339353633356339363435616262303865663834633436326331363365326433
|
|
||||||
6438633038623639346566376233356339333832383939370a353533356630346163633434346533
|
|
||||||
35386565386438383665623661653533646530623337373334356336396636376630356232656632
|
|
||||||
6634376435383163300a613635613633383765646363643563393062653465353663353935333262
|
|
||||||
35313830623635393737316337336436373730303963303962393365643165656164303633656233
|
|
||||||
3766303666323931623230623533316139666265363231356237
|
|
||||||
|
|
||||||
mastodon_vapid_public_key: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
61653763663734616263633063323466333064636230643263383935313134306163383135353131
|
|
||||||
6166383263353435306333336131373431313363373334330a383031303163346238343061356537
|
|
||||||
36653764366265323165336161303965353434366262616464646162353038353665363132616630
|
|
||||||
6465353939316534340a626533343835303433383531373666643462326162653535313966373963
|
|
||||||
65636561633532613166356666303833306332656266383237363561663239616139666465383532
|
|
||||||
65613361663534616533343631386634316661616132383035333734353561643934353339373832
|
|
||||||
34626531373530306464336437383636633830616336393265373934613030386534323335303436
|
|
||||||
32373034336162346364643139353961323831636134313538333162373665373330636564306162
|
|
||||||
3337
|
|
||||||
|
|
||||||
gmail_smtp_pass: !vault |
|
|
||||||
$ANSIBLE_VAULT;1.1;AES256
|
|
||||||
31396436653866313237616361636439343765323730383231633739643433646365383137343037
|
|
||||||
3535373866653261303761396163373334383461323661380a376561663864346633646230633531
|
|
||||||
35326435323434386564363037383961383934363163653635346233306139303664323037383435
|
|
||||||
3763313639656566620a623639386437353662316631316638363862323334323838643037336464
|
|
||||||
64373730623035616464303230626462666166636236363033633132363236306132
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.16
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
vmid: 607
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.17
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
vmid: 608
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.2
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
ip_addr: 10.0.2.2
|
|
||||||
|
|
||||||
# interface which will be used for flannel
|
|
||||||
|
|
||||||
flannel_iface: "vmbr0"
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.13
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
mac_addr: EA:11:8B:05:5A:88
|
|
||||||
vmid: 203
|
|
||||||
node: epona
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.19
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
vmid: 610
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.14
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
vmid: 605
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.18
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
vmid: 609
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.1
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
ip_addr: 10.0.2.2
|
|
||||||
|
|
||||||
# interface which will be used for flannel
|
|
||||||
|
|
||||||
flannel_iface: "vmbr0"
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.20
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
vmid: 611
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
---
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.3
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
ip_addr: 10.0.2.3
|
|
||||||
# interface which will be used for flannel
|
|
||||||
flannel_iface: "vmbr0"
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.22
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
vmid: 613
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
---
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.4
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
ip_addr: 10.0.2.4
|
|
||||||
# interface which will be used for flannel
|
|
||||||
flannel_iface: "vmbr0"
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.12
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
mac_addr: C2:F5:B2:99:92:51
|
|
||||||
vmid: 202
|
|
||||||
node: revali
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.15
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
vmid: 606
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.21
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
vmid: 612
|
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.3.110
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
|
|
||||||
# interface which will be used for flannel
|
|
||||||
|
|
||||||
flannel_iface: "eth0"
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
---
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.11
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
mac_addr: 72:2E:3C:F0:2A:B3
|
|
||||||
vmid: 201
|
|
||||||
node: mipha
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.23
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
vmid: 614
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
---
|
|
||||||
ansible_user: root
|
|
||||||
ansible_host: 10.0.2.7
|
|
||||||
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
|
||||||
ip_addr: 10.0.2.7
|
|
||||||
# interface which will be used for flannel
|
|
||||||
flannel_iface: "vmbr0"
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
[lxc]
|
|
||||||
frigate
|
|
||||||
swag
|
|
||||||
cloudflare-ddns
|
|
||||||
dahua-to-mqtt
|
|
||||||
immich
|
|
||||||
folding
|
|
||||||
mastodon
|
|
||||||
tautulli
|
|
||||||
openvpn
|
|
||||||
youtube-downloader
|
|
||||||
|
|
||||||
[baremetal]
|
|
||||||
mipha
|
|
||||||
epona
|
|
||||||
revali
|
|
||||||
yuga
|
|
||||||
impa
|
|
||||||
|
|
||||||
[pihole]
|
|
||||||
epona-pihole
|
|
||||||
revali-pihole
|
|
||||||
urbosa-pihole
|
|
||||||
@@ -0,0 +1,46 @@
|
|||||||
|
---
|
||||||
|
k3s_version: v1.24.4+k3s1
|
||||||
|
# this is the user that has ssh access to these machines
|
||||||
|
ansible_user: ansibleuser
|
||||||
|
systemd_dir: /etc/systemd/system
|
||||||
|
|
||||||
|
# Set your timezone
|
||||||
|
system_timezone: "Your/Timezone"
|
||||||
|
|
||||||
|
# interface which will be used for flannel
|
||||||
|
flannel_iface: "eth0"
|
||||||
|
|
||||||
|
# apiserver_endpoint is virtual ip-address which will be configured on each master
|
||||||
|
apiserver_endpoint: "192.168.30.222"
|
||||||
|
|
||||||
|
# k3s_token is required masters can talk together securely
|
||||||
|
# this token should be alpha numeric only
|
||||||
|
k3s_token: "some-SUPER-DEDEUPER-secret-password"
|
||||||
|
|
||||||
|
# The IP on which the node is reachable in the cluster.
|
||||||
|
# Here, a sensible default is provided, you can still override
|
||||||
|
# it for each of your hosts, though.
|
||||||
|
k3s_node_ip: '{{ ansible_facts[flannel_iface]["ipv4"]["address"] }}'
|
||||||
|
|
||||||
|
# these arguments are recommended for servers as well as agents:
|
||||||
|
extra_args: >-
|
||||||
|
--flannel-iface={{ flannel_iface }}
|
||||||
|
--node-ip={{ k3s_node_ip }}
|
||||||
|
|
||||||
|
# change these to your liking, the only required one is --disable servicelb
|
||||||
|
extra_server_args: >-
|
||||||
|
{{ extra_args }}
|
||||||
|
--disable servicelb
|
||||||
|
--disable traefik
|
||||||
|
extra_agent_args: >-
|
||||||
|
{{ extra_args }}
|
||||||
|
|
||||||
|
# image tag for kube-vip
|
||||||
|
kube_vip_tag_version: "v0.5.0"
|
||||||
|
|
||||||
|
# image tag for metal lb
|
||||||
|
metal_lb_speaker_tag_version: "v0.13.5"
|
||||||
|
metal_lb_controller_tag_version: "v0.13.5"
|
||||||
|
|
||||||
|
# metallb ip range for load balancer
|
||||||
|
metal_lb_ip_range: "192.168.30.80-192.168.30.90"
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
[master]
|
||||||
|
192.168.30.38
|
||||||
|
192.168.30.39
|
||||||
|
192.168.30.40
|
||||||
|
|
||||||
|
[node]
|
||||||
|
192.168.30.41
|
||||||
|
192.168.30.42
|
||||||
|
|
||||||
|
[k3s_cluster:children]
|
||||||
|
master
|
||||||
|
node
|
||||||
@@ -0,0 +1,73 @@
|
|||||||
|
# Test suites for `k3s-ansible`
|
||||||
|
|
||||||
|
This folder contains the [molecule](https://molecule.rtfd.io/)-based test setup for this playbook.
|
||||||
|
|
||||||
|
## Scenarios
|
||||||
|
|
||||||
|
We have these scenarios:
|
||||||
|
|
||||||
|
- **default**:
|
||||||
|
A 3 control + 2 worker node cluster based very closely on the [sample inventory](../inventory/sample/).
|
||||||
|
- **ipv6**:
|
||||||
|
A cluster that is externally accessible via IPv6 ([more information](ipv6/README.md))
|
||||||
|
To save a bit of test time, this cluster is _not_ highly available, it consists of only one control and one worker node.
|
||||||
|
- **single_node**:
|
||||||
|
Very similar to the default scenario, but uses only a single node for all cluster functionality.
|
||||||
|
|
||||||
|
## How to execute
|
||||||
|
|
||||||
|
To test on your local machine, follow these steps:
|
||||||
|
|
||||||
|
### System requirements
|
||||||
|
|
||||||
|
Make sure that the following software packages are available on your system:
|
||||||
|
|
||||||
|
- [Python 3](https://www.python.org/downloads)
|
||||||
|
- [Vagrant](https://www.vagrantup.com/downloads)
|
||||||
|
- [VirtualBox](https://www.virtualbox.org/wiki/Downloads)
|
||||||
|
|
||||||
|
### Set up VirtualBox networking on Linux and macOS
|
||||||
|
|
||||||
|
_You can safely skip this if you are working on Windows._
|
||||||
|
|
||||||
|
Furthermore, the test cluster uses the `192.168.30.0/24` subnet which is [not set up by VirtualBox automatically](https://www.virtualbox.org/manual/ch06.html#network_hostonly).
|
||||||
|
To set the subnet up for use with VirtualBox, please make sure that `/etc/vbox/networks.conf` exists and that it contains this line:
|
||||||
|
|
||||||
|
```
|
||||||
|
* 192.168.30.0/24
|
||||||
|
* fdad:bad:ba55::/64
|
||||||
|
```
|
||||||
|
|
||||||
|
### Install Python dependencies
|
||||||
|
|
||||||
|
You will get [Molecule, Ansible and a few extra dependencies](../requirements.txt) via [pip](https://pip.pypa.io/).
|
||||||
|
Usually, it is advisable to work in a [virtual environment](https://docs.python.org/3/tutorial/venv.html) for this:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd /path/to/k3s-ansible
|
||||||
|
|
||||||
|
# Create a virtualenv at ".env". You only need to do this once.
|
||||||
|
python3 -m venv .env
|
||||||
|
|
||||||
|
# Activate the virtualenv for your current shell session.
|
||||||
|
# If you start a new session, you will have to repeat this.
|
||||||
|
source .env/bin/activate
|
||||||
|
|
||||||
|
# Install the required packages into the virtualenv.
|
||||||
|
# These remain installed across shell sessions.
|
||||||
|
python3 -m pip install -r requirements.txt
|
||||||
|
```
|
||||||
|
|
||||||
|
### Run molecule
|
||||||
|
|
||||||
|
With the virtual environment from the previous step active in your shell session, you can now use molecule to test the playbook.
|
||||||
|
Interesting commands are:
|
||||||
|
|
||||||
|
- `molecule create`: Create virtual machines for the test cluster nodes.
|
||||||
|
- `molecule destroy`: Delete the virtual machines for the test cluster nodes.
|
||||||
|
- `molecule converge`: Run the `site` playbook on the nodes of the test cluster.
|
||||||
|
- `molecule side_effect`: Run the `reset` playbook on the nodes of the test cluster.
|
||||||
|
- `molecule verify`: Verify that the cluster works correctly.
|
||||||
|
- `molecule test`: The "all-in-one" sequence of steps that is executed in CI.
|
||||||
|
This includes the `create`, `converge`, `verify`, `side_effect` and `destroy` steps.
|
||||||
|
See [`molecule.yml`](default/molecule.yml) for more details.
|
||||||
@@ -0,0 +1,73 @@
|
|||||||
|
---
|
||||||
|
dependency:
|
||||||
|
name: galaxy
|
||||||
|
driver:
|
||||||
|
name: vagrant
|
||||||
|
platforms:
|
||||||
|
- &control
|
||||||
|
name: control1
|
||||||
|
box: generic/ubuntu2204
|
||||||
|
memory: 2048
|
||||||
|
cpus: 2
|
||||||
|
config_options:
|
||||||
|
# We currently can not use public-key based authentication on Ubuntu 22.04,
|
||||||
|
# see: https://github.com/chef/bento/issues/1405
|
||||||
|
ssh.username: "vagrant"
|
||||||
|
ssh.password: "vagrant"
|
||||||
|
groups:
|
||||||
|
- k3s_cluster
|
||||||
|
- master
|
||||||
|
interfaces:
|
||||||
|
- network_name: private_network
|
||||||
|
ip: 192.168.30.38
|
||||||
|
- <<: *control
|
||||||
|
name: control2
|
||||||
|
interfaces:
|
||||||
|
- network_name: private_network
|
||||||
|
ip: 192.168.30.39
|
||||||
|
- <<: *control
|
||||||
|
name: control3
|
||||||
|
interfaces:
|
||||||
|
- network_name: private_network
|
||||||
|
ip: 192.168.30.40
|
||||||
|
- &node
|
||||||
|
<<: *control
|
||||||
|
name: node1
|
||||||
|
groups:
|
||||||
|
- k3s_cluster
|
||||||
|
- node
|
||||||
|
interfaces:
|
||||||
|
- network_name: private_network
|
||||||
|
ip: 192.168.30.41
|
||||||
|
- <<: *node
|
||||||
|
name: node2
|
||||||
|
interfaces:
|
||||||
|
- network_name: private_network
|
||||||
|
ip: 192.168.30.42
|
||||||
|
provisioner:
|
||||||
|
name: ansible
|
||||||
|
playbooks:
|
||||||
|
converge: ../resources/converge.yml
|
||||||
|
side_effect: ../resources/reset.yml
|
||||||
|
verify: ../resources/verify.yml
|
||||||
|
inventory:
|
||||||
|
links:
|
||||||
|
group_vars: ../../inventory/sample/group_vars
|
||||||
|
scenario:
|
||||||
|
test_sequence:
|
||||||
|
- dependency
|
||||||
|
- lint
|
||||||
|
- cleanup
|
||||||
|
- destroy
|
||||||
|
- syntax
|
||||||
|
- create
|
||||||
|
- prepare
|
||||||
|
- converge
|
||||||
|
# idempotence is not possible with the playbook in its current form.
|
||||||
|
- verify
|
||||||
|
# We are repurposing side_effect here to test the reset playbook.
|
||||||
|
# This is why we do not run it before verify (which tests the cluster),
|
||||||
|
# but after the verify step.
|
||||||
|
- side_effect
|
||||||
|
- cleanup
|
||||||
|
- destroy
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
---
|
||||||
|
- name: Apply overrides
|
||||||
|
hosts: all
|
||||||
|
tasks:
|
||||||
|
- name: Override host variables
|
||||||
|
ansible.builtin.set_fact:
|
||||||
|
# See: https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant # noqa yaml[line-length]
|
||||||
|
flannel_iface: eth1
|
||||||
|
|
||||||
|
# The test VMs might be a bit slow, so we give them more time to join the cluster:
|
||||||
|
retry_count: 45
|
||||||
@@ -0,0 +1,35 @@
|
|||||||
|
# Sample IPv6 configuration for `k3s-ansible`
|
||||||
|
|
||||||
|
This scenario contains a cluster configuration which is _IPv6 first_, but still supports dual-stack networking with IPv4 for most things.
|
||||||
|
This means:
|
||||||
|
|
||||||
|
- The API server VIP is an IPv6 address.
|
||||||
|
- The MetalLB pool consists of both IPv4 and IPv4 addresses.
|
||||||
|
- Nodes as well as cluster-internal resources (pods and services) are accessible via IPv4 as well as IPv6.
|
||||||
|
|
||||||
|
## Network design
|
||||||
|
|
||||||
|
All IPv6 addresses used in this scenario share a single `/48` prefix: `fdad:bad:ba55`.
|
||||||
|
The following subnets are used:
|
||||||
|
|
||||||
|
- `fdad:bad:ba55:`**`0`**`::/64` is the subnet which contains the cluster components meant for external access.
|
||||||
|
That includes:
|
||||||
|
|
||||||
|
- The VIP for the Kubernetes API server: `fdad:bad:ba55::333`
|
||||||
|
- Services load-balanced by MetalLB: `fdad:bad:ba55::1b:0/112`
|
||||||
|
- Cluster nodes: `fdad:bad:ba55::de:0/112`
|
||||||
|
- The host executing Vagrant: `fdad:bad:ba55::1`
|
||||||
|
|
||||||
|
In a home lab setup, this might be your LAN.
|
||||||
|
|
||||||
|
- `fdad:bad:ba55:`**`4200`**`::/56` is used internally by the cluster for pods.
|
||||||
|
|
||||||
|
- `fdad:bad:ba55:`**`4300`**`::/108` is used internally by the cluster for services.
|
||||||
|
|
||||||
|
IPv4 networking is also available:
|
||||||
|
|
||||||
|
- The nodes have addresses inside `192.168.123.0/24`.
|
||||||
|
MetalLB also has a bit of address space in this range: `192.168.123.80-192.168.123.90`
|
||||||
|
- For pods and services, the k3s defaults (`10.42.0.0/16` and `10.43.0.0/16)` are used.
|
||||||
|
|
||||||
|
Note that the host running Vagrant is not part any of these IPv4 networks.
|
||||||
@@ -0,0 +1,3 @@
|
|||||||
|
---
|
||||||
|
node_ipv4: 192.168.123.11
|
||||||
|
node_ipv6: fdad:bad:ba55::de:11
|
||||||
@@ -0,0 +1,3 @@
|
|||||||
|
---
|
||||||
|
node_ipv4: 192.168.123.21
|
||||||
|
node_ipv6: fdad:bad:ba55::de:21
|
||||||
@@ -0,0 +1,57 @@
|
|||||||
|
---
|
||||||
|
dependency:
|
||||||
|
name: galaxy
|
||||||
|
driver:
|
||||||
|
name: vagrant
|
||||||
|
platforms:
|
||||||
|
- &control
|
||||||
|
name: control1
|
||||||
|
box: generic/ubuntu2204
|
||||||
|
memory: 2048
|
||||||
|
cpus: 2
|
||||||
|
config_options:
|
||||||
|
# We currently can not use public-key based authentication on Ubuntu 22.04,
|
||||||
|
# see: https://github.com/chef/bento/issues/1405
|
||||||
|
ssh.username: "vagrant"
|
||||||
|
ssh.password: "vagrant"
|
||||||
|
groups:
|
||||||
|
- k3s_cluster
|
||||||
|
- master
|
||||||
|
interfaces:
|
||||||
|
- network_name: private_network
|
||||||
|
ip: fdad:bad:ba55::de:11
|
||||||
|
- <<: *control
|
||||||
|
name: node1
|
||||||
|
groups:
|
||||||
|
- k3s_cluster
|
||||||
|
- node
|
||||||
|
interfaces:
|
||||||
|
- network_name: private_network
|
||||||
|
ip: fdad:bad:ba55::de:21
|
||||||
|
provisioner:
|
||||||
|
name: ansible
|
||||||
|
playbooks:
|
||||||
|
converge: ../resources/converge.yml
|
||||||
|
side_effect: ../resources/reset.yml
|
||||||
|
verify: ../resources/verify.yml
|
||||||
|
inventory:
|
||||||
|
links:
|
||||||
|
group_vars: ../../inventory/sample/group_vars
|
||||||
|
scenario:
|
||||||
|
test_sequence:
|
||||||
|
- dependency
|
||||||
|
- lint
|
||||||
|
- cleanup
|
||||||
|
- destroy
|
||||||
|
- syntax
|
||||||
|
- create
|
||||||
|
- prepare
|
||||||
|
- converge
|
||||||
|
# idempotence is not possible with the playbook in its current form.
|
||||||
|
- verify
|
||||||
|
# We are repurposing side_effect here to test the reset playbook.
|
||||||
|
# This is why we do not run it before verify (which tests the cluster),
|
||||||
|
# but after the verify step.
|
||||||
|
- side_effect
|
||||||
|
- cleanup
|
||||||
|
- destroy
|
||||||
@@ -0,0 +1,43 @@
|
|||||||
|
---
|
||||||
|
- name: Apply overrides
|
||||||
|
hosts: all
|
||||||
|
tasks:
|
||||||
|
- name: Override host variables (1/2)
|
||||||
|
ansible.builtin.set_fact:
|
||||||
|
# See: https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant # noqa yaml[line-length]
|
||||||
|
flannel_iface: eth1
|
||||||
|
|
||||||
|
# The test VMs might be a bit slow, so we give them more time to join the cluster:
|
||||||
|
retry_count: 45
|
||||||
|
|
||||||
|
# IPv6 configuration
|
||||||
|
# ######################################################################
|
||||||
|
|
||||||
|
# The API server will be reachable on IPv6 only
|
||||||
|
apiserver_endpoint: fdad:bad:ba55::333
|
||||||
|
|
||||||
|
# We give MetalLB address space for both IPv4 and IPv6
|
||||||
|
metal_lb_ip_range:
|
||||||
|
- fdad:bad:ba55::1b:0/112
|
||||||
|
- 192.168.123.80-192.168.123.90
|
||||||
|
|
||||||
|
# k3s_node_ip is by default set to the IPv4 address of flannel_iface.
|
||||||
|
# We want IPv6 addresses here of course, so we just specify them
|
||||||
|
# manually below.
|
||||||
|
k3s_node_ip: "{{ node_ipv4 }},{{ node_ipv6 }}"
|
||||||
|
|
||||||
|
- name: Override host variables (2/2)
|
||||||
|
# Since "extra_args" depends on "k3s_node_ip" and "flannel_iface" we have
|
||||||
|
# to set this AFTER overriding the both of them.
|
||||||
|
ansible.builtin.set_fact:
|
||||||
|
# A few extra server args are necessary:
|
||||||
|
# - the network policy needs to be disabled.
|
||||||
|
# - we need to manually specify the subnets for services and pods, as
|
||||||
|
# the default has IPv4 ranges only.
|
||||||
|
extra_server_args: >-
|
||||||
|
{{ extra_args }}
|
||||||
|
--disable servicelb
|
||||||
|
--disable traefik
|
||||||
|
--disable-network-policy
|
||||||
|
--cluster-cidr=10.42.0.0/16,fdad:bad:ba55:4200::/56
|
||||||
|
--service-cidr=10.43.0.0/16,fdad:bad:ba55:4300::/108
|
||||||
@@ -0,0 +1,51 @@
|
|||||||
|
---
|
||||||
|
- name: Apply overrides
|
||||||
|
ansible.builtin.import_playbook: >-
|
||||||
|
{{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
|
||||||
|
|
||||||
|
- name: Configure dual-stack networking
|
||||||
|
hosts: all
|
||||||
|
become: true
|
||||||
|
|
||||||
|
# Unfortunately, as of 2022-09, Vagrant does not support the configuration
|
||||||
|
# of both IPv4 and IPv6 addresses for a single network adapter. So we have
|
||||||
|
# to configure that ourselves.
|
||||||
|
# Moreover, we have to explicitly enable IPv6 for the loopback interface.
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
- name: Enable IPv6 for network interfaces
|
||||||
|
ansible.posix.sysctl:
|
||||||
|
name: net.ipv6.conf.{{ item }}.disable_ipv6
|
||||||
|
value: "0"
|
||||||
|
with_items:
|
||||||
|
- all
|
||||||
|
- default
|
||||||
|
- lo
|
||||||
|
|
||||||
|
- name: Disable duplicate address detection
|
||||||
|
# Duplicate address detection did repeatedly fail within the virtual
|
||||||
|
# network. But since this setup does not use SLAAC anyway, we can safely
|
||||||
|
# disable it.
|
||||||
|
ansible.posix.sysctl:
|
||||||
|
name: net.ipv6.conf.{{ item }}.accept_dad
|
||||||
|
value: "0"
|
||||||
|
with_items:
|
||||||
|
- "{{ flannel_iface }}"
|
||||||
|
|
||||||
|
- name: Write IPv4 configuration
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: 55-flannel-ipv4.yaml.j2
|
||||||
|
dest: /etc/netplan/55-flannel-ipv4.yaml
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: 0644
|
||||||
|
register: netplan_template
|
||||||
|
|
||||||
|
- name: Apply netplan configuration
|
||||||
|
# Conceptually, this should be a handler rather than a task.
|
||||||
|
# However, we are currently not in a role context - creating
|
||||||
|
# one just for this seemed overkill.
|
||||||
|
when: netplan_template.changed
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: netplan apply
|
||||||
|
changed_when: true
|
||||||
@@ -0,0 +1,8 @@
|
|||||||
|
---
|
||||||
|
network:
|
||||||
|
version: 2
|
||||||
|
renderer: networkd
|
||||||
|
ethernets:
|
||||||
|
{{ flannel_iface }}:
|
||||||
|
addresses:
|
||||||
|
- {{ node_ipv4 }}/24
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
- name: Apply overrides
|
||||||
|
ansible.builtin.import_playbook: >-
|
||||||
|
{{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
|
||||||
|
|
||||||
|
- name: Converge
|
||||||
|
ansible.builtin.import_playbook: ../../site.yml
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
- name: Apply overrides
|
||||||
|
ansible.builtin.import_playbook: >-
|
||||||
|
{{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
|
||||||
|
|
||||||
|
- name: Reset
|
||||||
|
ansible.builtin.import_playbook: ../../reset.yml
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
---
|
||||||
|
- name: Verify
|
||||||
|
hosts: all
|
||||||
|
roles:
|
||||||
|
- verify/from_outside
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
---
|
||||||
|
# A host outside of the cluster from which the checks shall be performed
|
||||||
|
outside_host: localhost
|
||||||
|
|
||||||
|
# This kubernetes namespace will be used for testing
|
||||||
|
testing_namespace: molecule-verify-from-outside
|
||||||
|
|
||||||
|
# The directory in which the example manifests reside
|
||||||
|
example_manifests_path: ../../../../example
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
---
|
||||||
|
- name: Clean up kubecfg
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ kubecfg.path }}"
|
||||||
|
state: absent
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
---
|
||||||
|
- name: Create temporary directory for kubecfg
|
||||||
|
ansible.builtin.tempfile:
|
||||||
|
state: directory
|
||||||
|
suffix: kubecfg
|
||||||
|
register: kubecfg
|
||||||
|
- name: Gathering facts
|
||||||
|
delegate_to: "{{ groups['master'][0] }}"
|
||||||
|
ansible.builtin.gather_facts:
|
||||||
|
- name: Download kubecfg
|
||||||
|
ansible.builtin.fetch:
|
||||||
|
src: "{{ ansible_env.HOME }}/.kube/config"
|
||||||
|
dest: "{{ kubecfg.path }}/"
|
||||||
|
flat: true
|
||||||
|
delegate_to: "{{ groups['master'][0] }}"
|
||||||
|
delegate_facts: true
|
||||||
|
- name: Store path to kubecfg
|
||||||
|
ansible.builtin.set_fact:
|
||||||
|
kubecfg_path: "{{ kubecfg.path }}/config"
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
---
|
||||||
|
- name: Verify
|
||||||
|
run_once: true
|
||||||
|
delegate_to: "{{ outside_host }}"
|
||||||
|
block:
|
||||||
|
- ansible.builtin.import_tasks: kubecfg-fetch.yml
|
||||||
|
- name: "TEST CASE: Get nodes"
|
||||||
|
ansible.builtin.include_tasks: test/get-nodes.yml
|
||||||
|
- name: "TEST CASE: Deploy example"
|
||||||
|
ansible.builtin.include_tasks: test/deploy-example.yml
|
||||||
|
always:
|
||||||
|
- ansible.builtin.import_tasks: kubecfg-cleanup.yml
|
||||||
@@ -0,0 +1,54 @@
|
|||||||
|
---
|
||||||
|
- name: Deploy example
|
||||||
|
block:
|
||||||
|
- name: "Create namespace: {{ testing_namespace }}"
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
api_version: v1
|
||||||
|
kind: Namespace
|
||||||
|
name: "{{ testing_namespace }}"
|
||||||
|
state: present
|
||||||
|
wait: true
|
||||||
|
kubeconfig: "{{ kubecfg_path }}"
|
||||||
|
|
||||||
|
- name: Apply example manifests
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
src: "{{ example_manifests_path }}/{{ item }}"
|
||||||
|
namespace: "{{ testing_namespace }}"
|
||||||
|
state: present
|
||||||
|
wait: true
|
||||||
|
kubeconfig: "{{ kubecfg_path }}"
|
||||||
|
with_items:
|
||||||
|
- deployment.yml
|
||||||
|
- service.yml
|
||||||
|
|
||||||
|
- name: Get info about nginx service
|
||||||
|
kubernetes.core.k8s_info:
|
||||||
|
kind: service
|
||||||
|
name: nginx
|
||||||
|
namespace: "{{ testing_namespace }}"
|
||||||
|
kubeconfig: "{{ kubecfg_path }}"
|
||||||
|
vars: &load_balancer_metadata
|
||||||
|
metallb_ip: status.loadBalancer.ingress[0].ip
|
||||||
|
metallb_port: spec.ports[0].port
|
||||||
|
register: nginx_services
|
||||||
|
|
||||||
|
- name: Assert that the nginx welcome page is available
|
||||||
|
ansible.builtin.uri:
|
||||||
|
url: http://{{ ip | ansible.utils.ipwrap }}:{{ port }}/
|
||||||
|
return_content: yes
|
||||||
|
register: result
|
||||||
|
failed_when: "'Welcome to nginx!' not in result.content"
|
||||||
|
vars:
|
||||||
|
ip: >-
|
||||||
|
{{ nginx_services.resources[0].status.loadBalancer.ingress[0].ip }}
|
||||||
|
port: >-
|
||||||
|
{{ nginx_services.resources[0].spec.ports[0].port }}
|
||||||
|
|
||||||
|
always:
|
||||||
|
- name: "Remove namespace: {{ testing_namespace }}"
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
api_version: v1
|
||||||
|
kind: Namespace
|
||||||
|
name: "{{ testing_namespace }}"
|
||||||
|
state: absent
|
||||||
|
kubeconfig: "{{ kubecfg_path }}"
|
||||||
@@ -0,0 +1,24 @@
|
|||||||
|
---
|
||||||
|
- name: Get all nodes in cluster
|
||||||
|
kubernetes.core.k8s_info:
|
||||||
|
kind: node
|
||||||
|
kubeconfig: "{{ kubecfg_path }}"
|
||||||
|
register: cluster_nodes
|
||||||
|
|
||||||
|
- name: Assert that the cluster contains exactly the expected nodes
|
||||||
|
ansible.builtin.assert:
|
||||||
|
that: found_nodes == expected_nodes
|
||||||
|
success_msg: "Found nodes as expected: {{ found_nodes }}"
|
||||||
|
fail_msg: "Expected nodes {{ expected_nodes }}, but found nodes {{ found_nodes }}"
|
||||||
|
vars:
|
||||||
|
found_nodes: >-
|
||||||
|
{{ cluster_nodes | json_query('resources[*].metadata.name') | unique | sort }}
|
||||||
|
expected_nodes: |-
|
||||||
|
{{
|
||||||
|
(
|
||||||
|
( groups['master'] | default([]) ) +
|
||||||
|
( groups['node'] | default([]) )
|
||||||
|
)
|
||||||
|
| unique
|
||||||
|
| sort
|
||||||
|
}}
|
||||||
@@ -0,0 +1,48 @@
|
|||||||
|
---
|
||||||
|
dependency:
|
||||||
|
name: galaxy
|
||||||
|
driver:
|
||||||
|
name: vagrant
|
||||||
|
platforms:
|
||||||
|
- name: control1
|
||||||
|
box: generic/ubuntu2204
|
||||||
|
memory: 4096
|
||||||
|
cpus: 4
|
||||||
|
config_options:
|
||||||
|
# We currently can not use public-key based authentication on Ubuntu 22.04,
|
||||||
|
# see: https://github.com/chef/bento/issues/1405
|
||||||
|
ssh.username: "vagrant"
|
||||||
|
ssh.password: "vagrant"
|
||||||
|
groups:
|
||||||
|
- k3s_cluster
|
||||||
|
- master
|
||||||
|
interfaces:
|
||||||
|
- network_name: private_network
|
||||||
|
ip: 192.168.30.50
|
||||||
|
provisioner:
|
||||||
|
name: ansible
|
||||||
|
playbooks:
|
||||||
|
converge: ../resources/converge.yml
|
||||||
|
side_effect: ../resources/reset.yml
|
||||||
|
verify: ../resources/verify.yml
|
||||||
|
inventory:
|
||||||
|
links:
|
||||||
|
group_vars: ../../inventory/sample/group_vars
|
||||||
|
scenario:
|
||||||
|
test_sequence:
|
||||||
|
- dependency
|
||||||
|
- lint
|
||||||
|
- cleanup
|
||||||
|
- destroy
|
||||||
|
- syntax
|
||||||
|
- create
|
||||||
|
- prepare
|
||||||
|
- converge
|
||||||
|
# idempotence is not possible with the playbook in its current form.
|
||||||
|
- verify
|
||||||
|
# We are repurposing side_effect here to test the reset playbook.
|
||||||
|
# This is why we do not run it before verify (which tests the cluster),
|
||||||
|
# but after the verify step.
|
||||||
|
- side_effect
|
||||||
|
- cleanup
|
||||||
|
- destroy
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
---
|
||||||
|
- name: Apply overrides
|
||||||
|
hosts: all
|
||||||
|
tasks:
|
||||||
|
- name: Override host variables
|
||||||
|
ansible.builtin.set_fact:
|
||||||
|
# See: https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant # noqa yaml[line-length]
|
||||||
|
flannel_iface: eth1
|
||||||
|
|
||||||
|
# The test VMs might be a bit slow, so we give them more time to join the cluster:
|
||||||
|
retry_count: 45
|
||||||
|
|
||||||
|
# Make sure that our IP ranges do not collide with those of the default scenario
|
||||||
|
apiserver_endpoint: "192.168.30.223"
|
||||||
|
metal_lb_ip_range: "192.168.30.91-192.168.30.99"
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
---
|
|
||||||
- hosts: localhost
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
# - role: cloudflare-ddns/provision/delete
|
|
||||||
- role: cloudflare-ddns/provision/create
|
|
||||||
- role: cloudflare-ddns/provision/start
|
|
||||||
|
|
||||||
- hosts: revali
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: lxc/enable-ssh
|
|
||||||
|
|
||||||
- hosts: cloudflare-ddns
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: cloudflare-ddns/update
|
|
||||||
- role: cloudflare-ddns/install-docker
|
|
||||||
- role: cloudflare-ddns/install-app
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
---
|
|
||||||
- hosts: localhost
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
# - role: dahua-to-mqtt/provision/delete
|
|
||||||
# - role: dahua-to-mqtt/provision/create
|
|
||||||
- role: dahua-to-mqtt/provision/start
|
|
||||||
vars:
|
|
||||||
vmid: 608
|
|
||||||
|
|
||||||
- hosts: revali
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: dahua-to-mqtt/enable-ssh
|
|
||||||
vars:
|
|
||||||
vmid: 608
|
|
||||||
|
|
||||||
- hosts: dahua-to-mqtt
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: dahua-to-mqtt/update
|
|
||||||
- role: dahua-to-mqtt/install-docker
|
|
||||||
- role: dahua-to-mqtt/install-app
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
---
|
|
||||||
# - hosts: localhost
|
|
||||||
# become: yes
|
|
||||||
# roles:
|
|
||||||
# - role: folding/provision/delete
|
|
||||||
# - role: folding/provision/create
|
|
||||||
# - role: folding/provision/start
|
|
||||||
# vars:
|
|
||||||
# vmid: 610
|
|
||||||
|
|
||||||
- hosts: hyrule
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: folding/enable-ssh
|
|
||||||
vars:
|
|
||||||
vmid: 610
|
|
||||||
|
|
||||||
- hosts: folding
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: folding/update
|
|
||||||
- role: folding/install-app
|
|
||||||
@@ -1,28 +0,0 @@
|
|||||||
---
|
|
||||||
- hosts: localhost
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: frigate/provision/delete
|
|
||||||
- role: frigate/provision/create
|
|
||||||
|
|
||||||
- hosts: epona
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: frigate/provision/cgroup
|
|
||||||
|
|
||||||
- hosts: localhost
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: frigate/provision/start
|
|
||||||
|
|
||||||
- hosts: epona
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: lxc/enable-ssh
|
|
||||||
|
|
||||||
- hosts: frigate
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: frigate/update
|
|
||||||
- role: frigate/install-docker
|
|
||||||
- role: frigate/install-app
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
---
|
|
||||||
- hosts: localhost
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: immich/provision/delete
|
|
||||||
- role: immich/provision/create
|
|
||||||
- role: immich/provision/start
|
|
||||||
vars:
|
|
||||||
vmid: 609
|
|
||||||
|
|
||||||
- hosts: hyrule
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: immich/enable-ssh
|
|
||||||
vars:
|
|
||||||
vmid: 609
|
|
||||||
|
|
||||||
- hosts: immich
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: immich/update
|
|
||||||
- role: immich/install-docker
|
|
||||||
- role: immich/install-app
|
|
||||||
@@ -1,38 +0,0 @@
|
|||||||
---
|
|
||||||
# - hosts: k3s_cluster
|
|
||||||
# gather_facts: yes
|
|
||||||
# become: yes
|
|
||||||
# roles:
|
|
||||||
# - role: prereq
|
|
||||||
# - role: download
|
|
||||||
|
|
||||||
# - hosts: master
|
|
||||||
# become: yes
|
|
||||||
# roles:
|
|
||||||
# - role: k3s/master
|
|
||||||
|
|
||||||
# - hosts: node
|
|
||||||
# become: yes
|
|
||||||
# roles:
|
|
||||||
# - role: k3s/node
|
|
||||||
|
|
||||||
# - hosts: master
|
|
||||||
# become: yes
|
|
||||||
# roles:
|
|
||||||
# - role: k3s/post
|
|
||||||
|
|
||||||
# - hosts: master
|
|
||||||
# become: yes
|
|
||||||
# roles:
|
|
||||||
# - role: k3s/copy-config
|
|
||||||
|
|
||||||
- hosts: localhost
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
# - role: traefik
|
|
||||||
# - role: cert-manager
|
|
||||||
# - role: authentik
|
|
||||||
- role: argocd
|
|
||||||
# - role: nginx
|
|
||||||
# - role: arr
|
|
||||||
# - role: redis
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
---
|
|
||||||
- hosts: localhost
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: mastodon/provision/delete
|
|
||||||
- role: mastodon/provision/create
|
|
||||||
- role: mastodon/provision/start
|
|
||||||
vars:
|
|
||||||
vmid: 611
|
|
||||||
|
|
||||||
- hosts: epona
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: mastodon/enable-ssh
|
|
||||||
vars:
|
|
||||||
vmid: 611
|
|
||||||
|
|
||||||
- hosts: mastodon
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: mastodon/update
|
|
||||||
- role: mastodon/install-docker
|
|
||||||
- role: mastodon/install-app
|
|
||||||
@@ -1,42 +0,0 @@
|
|||||||
---
|
|
||||||
- hosts: localhost
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: openvpn/provision/stop
|
|
||||||
- role: openvpn/provision/delete
|
|
||||||
- role: openvpn/provision/create
|
|
||||||
- role: openvpn/provision/start
|
|
||||||
vars:
|
|
||||||
vmid: 613
|
|
||||||
|
|
||||||
- hosts: mipha
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: openvpn/enable-ssh
|
|
||||||
vars:
|
|
||||||
vmid: 613
|
|
||||||
|
|
||||||
- hosts: localhost
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: openvpn/provision/stop
|
|
||||||
vars:
|
|
||||||
vmid: 613
|
|
||||||
|
|
||||||
- hosts: mipha
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: openvpn/cgroup-rules
|
|
||||||
|
|
||||||
- hosts: localhost
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: openvpn/provision/start
|
|
||||||
vars:
|
|
||||||
vmid: 613
|
|
||||||
|
|
||||||
- hosts: openvpn
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: openvpn/update
|
|
||||||
- role: openvpn/install-app
|
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
---
|
|
||||||
# - hosts: localhost
|
|
||||||
# become: yes
|
|
||||||
# roles:
|
|
||||||
# - role: swag/provision/delete
|
|
||||||
# - role: swag/provision/create
|
|
||||||
# - role: swag/provision/start
|
|
||||||
|
|
||||||
# - hosts: mipha
|
|
||||||
# become: yes
|
|
||||||
# roles:
|
|
||||||
# - role: lxc/enable-ssh
|
|
||||||
|
|
||||||
- hosts: swag
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
# - role: swag/update
|
|
||||||
# - role: swag/install-docker
|
|
||||||
- role: swag/install-app
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
---
|
|
||||||
- hosts: localhost
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: tautulli/provision/delete
|
|
||||||
- role: tautulli/provision/create
|
|
||||||
- role: tautulli/provision/start
|
|
||||||
vars:
|
|
||||||
vmid: 612
|
|
||||||
|
|
||||||
- hosts: epona
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: tautulli/enable-ssh
|
|
||||||
vars:
|
|
||||||
vmid: 612
|
|
||||||
|
|
||||||
- hosts: tautulli
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: tautulli/update
|
|
||||||
- role: tautulli/install-docker
|
|
||||||
- role: tautulli/install-app
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
---
|
|
||||||
- hosts: frigate
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: frigate/update
|
|
||||||
|
|
||||||
- hosts: cloudflare-ddns
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: cloudflare-ddns/update
|
|
||||||
|
|
||||||
- hosts: swag
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: swag/update
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
---
|
|
||||||
- hosts: localhost
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: youtube-downloader/provision/delete
|
|
||||||
- role: youtube-downloader/provision/create
|
|
||||||
- role: youtube-downloader/provision/start
|
|
||||||
vars:
|
|
||||||
vmid: 614
|
|
||||||
|
|
||||||
- hosts: impa
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: youtube-downloader/enable-ssh
|
|
||||||
vars:
|
|
||||||
vmid: 614
|
|
||||||
|
|
||||||
- hosts: youtube-downloader
|
|
||||||
become: yes
|
|
||||||
roles:
|
|
||||||
- role: youtube-downloader/update
|
|
||||||
- role: youtube-downloader/install-docker
|
|
||||||
- role: youtube-downloader/install-app
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
ansible-playbook reboot.yml -i inventory/my-cluster/hosts.ini
|
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Reboot k3s_cluster
|
|
||||||
hosts: k3s_cluster
|
|
||||||
gather_facts: yes
|
|
||||||
become: yes
|
|
||||||
tasks:
|
|
||||||
- name: Reboot the nodes (and Wait upto 5 mins max)
|
|
||||||
reboot:
|
|
||||||
reboot_timeout: 300
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
ansible-core>=2.13.2
|
|
||||||
ansible-lint>=6.6.0
|
|
||||||
kubernetes>=12.0.0
|
|
||||||
netaddr>=0.8.0
|
|
||||||
pyyaml>=3.11
|
|
||||||
yamllint>=1.28.0
|
|
||||||
jmespath>=1.0.1
|
|
||||||
jsonpatch>=1.32
|
|
||||||
pre-commit>=2.20.0
|
|
||||||
netaddr>=0.8.0
|
|
||||||
+8
-218
@@ -1,218 +1,8 @@
|
|||||||
#
|
ansible-core>=2.13.2
|
||||||
# This file is autogenerated by pip-compile with python 3.8
|
jmespath
|
||||||
# To update, run:
|
jsonpatch
|
||||||
#
|
kubernetes>=12.0.0
|
||||||
# pip-compile requirements.in
|
molecule-vagrant>=1.0.0
|
||||||
#
|
molecule>=4.0.1
|
||||||
ansible-compat==2.2.4
|
netaddr>=0.8.0
|
||||||
# via
|
pyyaml>=3.11
|
||||||
# ansible-lint
|
|
||||||
ansible-core==2.13.5
|
|
||||||
# via
|
|
||||||
# -r requirements.in
|
|
||||||
# ansible-lint
|
|
||||||
ansible-lint==6.8.6
|
|
||||||
# via -r requirements.in
|
|
||||||
arrow==1.2.3
|
|
||||||
# via jinja2-time
|
|
||||||
attrs==22.1.0
|
|
||||||
# via jsonschema
|
|
||||||
binaryornot==0.4.4
|
|
||||||
# via cookiecutter
|
|
||||||
black==22.10.0
|
|
||||||
# via ansible-lint
|
|
||||||
bracex==2.3.post1
|
|
||||||
# via wcmatch
|
|
||||||
cachetools==5.2.0
|
|
||||||
# via google-auth
|
|
||||||
certifi==2022.9.24
|
|
||||||
# via
|
|
||||||
# kubernetes
|
|
||||||
# requests
|
|
||||||
cffi==1.15.1
|
|
||||||
# via cryptography
|
|
||||||
cfgv==3.3.1
|
|
||||||
# via pre-commit
|
|
||||||
chardet==5.0.0
|
|
||||||
# via binaryornot
|
|
||||||
charset-normalizer==2.1.1
|
|
||||||
# via requests
|
|
||||||
click==8.1.3
|
|
||||||
# via
|
|
||||||
# black
|
|
||||||
# click-help-colors
|
|
||||||
# cookiecutter
|
|
||||||
click-help-colors==0.9.1
|
|
||||||
commonmark==0.9.1
|
|
||||||
# via rich
|
|
||||||
cookiecutter==2.1.1
|
|
||||||
cryptography==38.0.3
|
|
||||||
# via ansible-core
|
|
||||||
distlib==0.3.6
|
|
||||||
# via virtualenv
|
|
||||||
distro==1.8.0
|
|
||||||
# via selinux
|
|
||||||
enrich==1.2.7
|
|
||||||
# via molecule
|
|
||||||
filelock==3.8.0
|
|
||||||
# via
|
|
||||||
# ansible-lint
|
|
||||||
# virtualenv
|
|
||||||
google-auth==2.14.0
|
|
||||||
# via kubernetes
|
|
||||||
identify==2.5.8
|
|
||||||
# via pre-commit
|
|
||||||
idna==3.4
|
|
||||||
# via requests
|
|
||||||
importlib-resources==5.10.0
|
|
||||||
# via jsonschema
|
|
||||||
jinja2==3.1.2
|
|
||||||
# via
|
|
||||||
# ansible-core
|
|
||||||
# cookiecutter
|
|
||||||
# jinja2-time
|
|
||||||
# molecule
|
|
||||||
# molecule-vagrant
|
|
||||||
jinja2-time==0.2.0
|
|
||||||
# via cookiecutter
|
|
||||||
jmespath==1.0.1
|
|
||||||
# via -r requirements.in
|
|
||||||
jsonpatch==1.32
|
|
||||||
# via -r requirements.in
|
|
||||||
jsonpointer==2.3
|
|
||||||
# via jsonpatch
|
|
||||||
jsonschema==4.17.0
|
|
||||||
# via
|
|
||||||
# ansible-compat
|
|
||||||
# ansible-lint
|
|
||||||
# molecule
|
|
||||||
kubernetes==25.3.0
|
|
||||||
# via -r requirements.in
|
|
||||||
markupsafe==2.1.1
|
|
||||||
# via jinja2
|
|
||||||
molecule==4.0.3
|
|
||||||
# via
|
|
||||||
# -r requirements.in
|
|
||||||
# molecule-vagrant
|
|
||||||
molecule-vagrant==1.0.0
|
|
||||||
# via -r requirements.in
|
|
||||||
mypy-extensions==0.4.3
|
|
||||||
# via black
|
|
||||||
netaddr==0.8.0
|
|
||||||
# via -r requirements.in
|
|
||||||
nodeenv==1.7.0
|
|
||||||
# via pre-commit
|
|
||||||
oauthlib==3.2.2
|
|
||||||
# via requests-oauthlib
|
|
||||||
packaging==21.3
|
|
||||||
# via
|
|
||||||
# ansible-compat
|
|
||||||
# ansible-core
|
|
||||||
# ansible-lint
|
|
||||||
# molecule
|
|
||||||
pathspec==0.10.1
|
|
||||||
# via
|
|
||||||
# black
|
|
||||||
# yamllint
|
|
||||||
pkgutil-resolve-name==1.3.10
|
|
||||||
# via jsonschema
|
|
||||||
platformdirs==2.5.2
|
|
||||||
# via
|
|
||||||
# black
|
|
||||||
# virtualenv
|
|
||||||
pluggy==1.0.0
|
|
||||||
# via molecule
|
|
||||||
pre-commit==2.20.0
|
|
||||||
# via -r requirements.in
|
|
||||||
pyasn1==0.4.8
|
|
||||||
# via
|
|
||||||
# pyasn1-modules
|
|
||||||
# rsa
|
|
||||||
pyasn1-modules==0.2.8
|
|
||||||
# via google-auth
|
|
||||||
pycparser==2.21
|
|
||||||
# via cffi
|
|
||||||
pygments==2.13.0
|
|
||||||
# via rich
|
|
||||||
pyparsing==3.0.9
|
|
||||||
# via packaging
|
|
||||||
pyrsistent==0.19.2
|
|
||||||
# via jsonschema
|
|
||||||
python-dateutil==2.8.2
|
|
||||||
# via
|
|
||||||
# arrow
|
|
||||||
# kubernetes
|
|
||||||
python-slugify==6.1.2
|
|
||||||
# via cookiecutter
|
|
||||||
python-vagrant==1.0.0
|
|
||||||
# via molecule-vagrant
|
|
||||||
pyyaml==6.0
|
|
||||||
# via
|
|
||||||
# -r requirements.in
|
|
||||||
# ansible-compat
|
|
||||||
# ansible-core
|
|
||||||
# ansible-lint
|
|
||||||
# cookiecutter
|
|
||||||
# kubernetes
|
|
||||||
# molecule
|
|
||||||
# molecule-vagrant
|
|
||||||
# pre-commit
|
|
||||||
# yamllint
|
|
||||||
requests==2.28.1
|
|
||||||
# via
|
|
||||||
# cookiecutter
|
|
||||||
# kubernetes
|
|
||||||
# requests-oauthlib
|
|
||||||
requests-oauthlib==1.3.1
|
|
||||||
# via kubernetes
|
|
||||||
resolvelib==0.8.1
|
|
||||||
# via ansible-core
|
|
||||||
rich==12.6.0
|
|
||||||
# via
|
|
||||||
# ansible-lint
|
|
||||||
# enrich
|
|
||||||
# molecule
|
|
||||||
rsa==4.9
|
|
||||||
# via google-auth
|
|
||||||
ruamel-yaml==0.17.21
|
|
||||||
# via ansible-lint
|
|
||||||
ruamel-yaml-clib==0.2.7
|
|
||||||
# via ruamel-yaml
|
|
||||||
selinux==0.2.1
|
|
||||||
# via molecule-vagrant
|
|
||||||
six==1.16.0
|
|
||||||
# via
|
|
||||||
# google-auth
|
|
||||||
# kubernetes
|
|
||||||
# python-dateutil
|
|
||||||
subprocess-tee==0.3.5
|
|
||||||
# via ansible-compat
|
|
||||||
text-unidecode==1.3
|
|
||||||
# via python-slugify
|
|
||||||
toml==0.10.2
|
|
||||||
# via pre-commit
|
|
||||||
tomli==2.0.1
|
|
||||||
# via black
|
|
||||||
typing-extensions==4.4.0
|
|
||||||
# via
|
|
||||||
# black
|
|
||||||
# rich
|
|
||||||
urllib3==1.26.12
|
|
||||||
# via
|
|
||||||
# kubernetes
|
|
||||||
# requests
|
|
||||||
virtualenv==20.16.6
|
|
||||||
# via pre-commit
|
|
||||||
wcmatch==8.4.1
|
|
||||||
# via ansible-lint
|
|
||||||
websocket-client==1.4.2
|
|
||||||
# via kubernetes
|
|
||||||
yamllint==1.28.0
|
|
||||||
# via
|
|
||||||
# -r requirements.in
|
|
||||||
# ansible-lint
|
|
||||||
zipp==3.10.0
|
|
||||||
# via importlib-resources
|
|
||||||
|
|
||||||
# The following packages are considered to be unsafe in a requirements file:
|
|
||||||
# setuptools
|
|
||||||
|
|||||||
@@ -1,3 +1,3 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini --ask-become-pass --ask-vault-pass
|
ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini
|
||||||
|
|||||||
@@ -1,10 +1,7 @@
|
|||||||
---
|
---
|
||||||
|
|
||||||
- hosts: k3s_cluster
|
- hosts: k3s_cluster
|
||||||
gather_facts: yes
|
gather_facts: yes
|
||||||
become: yes
|
become: yes
|
||||||
roles:
|
roles:
|
||||||
- role: reset
|
- role: reset
|
||||||
post_tasks:
|
|
||||||
- name: Reboot and wait for node to come back up
|
|
||||||
reboot:
|
|
||||||
reboot_timeout: 3600
|
|
||||||
|
|||||||
@@ -1,27 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Create argocd namespace
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
name: argocd
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
api_version: v1
|
|
||||||
kind: Namespace
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Install argocd
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
state: present
|
|
||||||
namespace: argocd
|
|
||||||
definition: "{{ lookup('template', 'install.yml') | from_yaml }}"
|
|
||||||
|
|
||||||
- name: Deploy forwardauth middleware
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
state: present
|
|
||||||
definition: "{{ lookup('template', 'middleware-forwardauth.yml') | from_yaml }}"
|
|
||||||
|
|
||||||
- name: Deploy argocd - ingress
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
state: present
|
|
||||||
definition: "{{ lookup('template', 'ingress.yml') | from_yaml }}"
|
|
||||||
@@ -1,37 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: traefik.containo.us/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: argocd
|
|
||||||
namespace: argocd
|
|
||||||
annotations:
|
|
||||||
kubernetes.io/ingress.class: traefik-external
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- websecure
|
|
||||||
routes:
|
|
||||||
- match: Host(`argocd.lino.cooking`)
|
|
||||||
kind: Rule
|
|
||||||
services:
|
|
||||||
- name: argocd-server
|
|
||||||
port: 80
|
|
||||||
middlewares:
|
|
||||||
- name: argocd-forwardauth
|
|
||||||
namespace: argocd
|
|
||||||
- match: Host(`argocd.lino.cooking`) && Headers(`Content-Type`, `application/grpc`)
|
|
||||||
kind: Rule
|
|
||||||
services:
|
|
||||||
- name: argocd-server
|
|
||||||
port: 80
|
|
||||||
scheme: h2c
|
|
||||||
- match: "Host(`argocd.lino.cooking`) && PathPrefix(`/outpost.goauthentik.io/`)"
|
|
||||||
kind: Rule
|
|
||||||
priority: 15
|
|
||||||
services:
|
|
||||||
- kind: Service
|
|
||||||
# Or, to use an external Outpost, create an ExternalName service and reference that here.
|
|
||||||
# See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
|
|
||||||
name: authentik
|
|
||||||
port: 9000
|
|
||||||
tls:
|
|
||||||
secretName: lino-cooking-tls
|
|
||||||
File diff suppressed because it is too large
Load Diff
@@ -1,21 +0,0 @@
|
|||||||
apiVersion: traefik.containo.us/v1alpha1
|
|
||||||
kind: Middleware
|
|
||||||
metadata:
|
|
||||||
name: argocd-forwardauth
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
forwardAuth:
|
|
||||||
address: https://argocd.lino.cooking/outpost.goauthentik.io/auth/traefik
|
|
||||||
trustForwardHeader: true
|
|
||||||
authResponseHeaders:
|
|
||||||
- X-authentik-username
|
|
||||||
- X-authentik-groups
|
|
||||||
- X-authentik-email
|
|
||||||
- X-authentik-name
|
|
||||||
- X-authentik-uid
|
|
||||||
- X-authentik-jwt
|
|
||||||
- X-authentik-meta-jwks
|
|
||||||
- X-authentik-meta-outpost
|
|
||||||
- X-authentik-meta-provider
|
|
||||||
- X-authentik-meta-app
|
|
||||||
- X-authentik-meta-version
|
|
||||||
@@ -1,64 +0,0 @@
|
|||||||
---
|
|
||||||
# - name: Create a arr-apps namespace
|
|
||||||
# kubernetes.core.k8s:
|
|
||||||
# name: arr-apps
|
|
||||||
# kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
# api_version: v1
|
|
||||||
# kind: Namespace
|
|
||||||
# state: present
|
|
||||||
|
|
||||||
- name: Deploy arr - deployment
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
state: present
|
|
||||||
definition: "{{ lookup('template', 'deployment.yml') | from_yaml }}"
|
|
||||||
loop:
|
|
||||||
- { name: 'radarr', port: 7878 }
|
|
||||||
- { name: 'prowlarr', port: 9696 }
|
|
||||||
- { name: 'sonarr', port: 8989 }
|
|
||||||
- { name: 'overseerr', port: 5055 }
|
|
||||||
- { name: 'transmission', port: 9091 }
|
|
||||||
- { name: 'bazarr', port: 6767 }
|
|
||||||
- { name: 'lidarr', port: 8686 }
|
|
||||||
|
|
||||||
- name: Deploy arr services
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
state: present
|
|
||||||
definition: "{{ lookup('template', 'service.yml') | from_yaml }}"
|
|
||||||
loop:
|
|
||||||
- { name: 'radarr', port: 7878 }
|
|
||||||
- { name: 'prowlarr', port: 9696 }
|
|
||||||
- { name: 'sonarr', port: 8989 }
|
|
||||||
- { name: 'overseerr', port: 5055 }
|
|
||||||
- { name: 'transmission', port: 9091 }
|
|
||||||
- { name: 'bazarr', port: 6767 }
|
|
||||||
- { name: 'lidarr', port: 8686 }
|
|
||||||
|
|
||||||
- name: Deploy forwardauth middleware
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
state: present
|
|
||||||
definition: "{{ lookup('template', 'middleware-forwardauth.yml') | from_yaml }}"
|
|
||||||
loop:
|
|
||||||
- radarr
|
|
||||||
- prowlarr
|
|
||||||
- sonarr
|
|
||||||
- overseerr
|
|
||||||
- transmission
|
|
||||||
- bazarr
|
|
||||||
- lidarr
|
|
||||||
|
|
||||||
- name: Deploy arr - ingress
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
state: present
|
|
||||||
definition: "{{ lookup('template', 'ingress.yml') | from_yaml }}"
|
|
||||||
loop:
|
|
||||||
- { name: 'radarr', port: 7878 }
|
|
||||||
- { name: 'prowlarr', port: 9696 }
|
|
||||||
- { name: 'sonarr', port: 8989 }
|
|
||||||
- { name: 'overseerr', port: 5055 }
|
|
||||||
- { name: 'transmission', port: 9091 }
|
|
||||||
- { name: 'bazarr', port: 6767 }
|
|
||||||
- { name: 'lidarr', port: 8686 }
|
|
||||||
@@ -1,30 +0,0 @@
|
|||||||
---
|
|
||||||
- kind: Deployment
|
|
||||||
apiVersion: apps/v1
|
|
||||||
metadata:
|
|
||||||
name: {{ item.name }}
|
|
||||||
namespace: default
|
|
||||||
labels:
|
|
||||||
app: {{ item.name }}
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
progressDeadlineSeconds: 600
|
|
||||||
revisionHistoryLimit: 2
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: {{ item.name }}
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: {{ item.name }}
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- name: {{ item.name }}
|
|
||||||
image: linuxserver/{{ item.name }}
|
|
||||||
ports:
|
|
||||||
- name: app-port
|
|
||||||
containerPort: {{ item.port }}
|
|
||||||
hostPort: {{ item.port }}
|
|
||||||
protocol: TCP
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: traefik.containo.us/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: {{ item.name }}
|
|
||||||
namespace: default
|
|
||||||
annotations:
|
|
||||||
kubernetes.io/ingress.class: traefik-external
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- websecure
|
|
||||||
routes:
|
|
||||||
- match: Host(`{{ item.name }}.lino.cooking`)
|
|
||||||
kind: Rule
|
|
||||||
services:
|
|
||||||
- name: {{ item.name }}
|
|
||||||
port: {{ item.port }}
|
|
||||||
middlewares:
|
|
||||||
- name: default-headers
|
|
||||||
- name: {{ item.name }}-forwardauth
|
|
||||||
namespace: traefik
|
|
||||||
- match: "Host(`{{ item.name }}.lino.cooking`) && PathPrefix(`/outpost.goauthentik.io/`)"
|
|
||||||
kind: Rule
|
|
||||||
priority: 15
|
|
||||||
services:
|
|
||||||
- kind: Service
|
|
||||||
# Or, to use an external Outpost, create an ExternalName service and reference that here.
|
|
||||||
# See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
|
|
||||||
name: authentik
|
|
||||||
port: 9000
|
|
||||||
tls:
|
|
||||||
secretName: lino-cooking-tls
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
apiVersion: traefik.containo.us/v1alpha1
|
|
||||||
kind: Middleware
|
|
||||||
metadata:
|
|
||||||
name: {{ item }}-forwardauth
|
|
||||||
namespace: traefik
|
|
||||||
spec:
|
|
||||||
forwardAuth:
|
|
||||||
address: https://{{ item }}.lino.cooking/outpost.goauthentik.io/auth/traefik
|
|
||||||
trustForwardHeader: true
|
|
||||||
authResponseHeaders:
|
|
||||||
- X-authentik-username
|
|
||||||
- X-authentik-groups
|
|
||||||
- X-authentik-email
|
|
||||||
- X-authentik-name
|
|
||||||
- X-authentik-uid
|
|
||||||
- X-authentik-jwt
|
|
||||||
- X-authentik-meta-jwks
|
|
||||||
- X-authentik-meta-outpost
|
|
||||||
- X-authentik-meta-provider
|
|
||||||
- X-authentik-meta-app
|
|
||||||
- X-authentik-meta-version
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: {{ item.name }}
|
|
||||||
namespace: default
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
app: {{ item.name }}
|
|
||||||
ports:
|
|
||||||
- name: http
|
|
||||||
targetPort: {{ item.port }}
|
|
||||||
port: {{ item.port }}
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Add authentik helm repo
|
|
||||||
kubernetes.core.helm_repository:
|
|
||||||
name: authentik
|
|
||||||
repo_url: "https://charts.goauthentik.io"
|
|
||||||
|
|
||||||
- name: Update the repository cache
|
|
||||||
kubernetes.core.helm:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
name: dummy
|
|
||||||
namespace: kube-system
|
|
||||||
state: absent
|
|
||||||
update_repo_cache: true
|
|
||||||
|
|
||||||
- name: Deploy latest version of Authentik chart inside
|
|
||||||
kubernetes.core.helm:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
name: authentik
|
|
||||||
namespace: traefik
|
|
||||||
chart_ref: authentik/authentik
|
|
||||||
values: "{{ lookup('template', 'values.yml') | from_yaml }}"
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
authentik:
|
|
||||||
secret_key: "fKkVEXDoUdGYwoNb$97xQuG9uw7zu$rFDe6y7!UZ&6$5*cyx6h"
|
|
||||||
# This sends anonymous usage-data, stack traces on errors and
|
|
||||||
# performance data to sentry.io, and is fully opt-in
|
|
||||||
error_reporting:
|
|
||||||
enabled: true
|
|
||||||
postgresql:
|
|
||||||
password: "uNP9W3zMpp4853QF9f@mpJDEXprca@tX@cEj3#BLFR&WFZVBU^"
|
|
||||||
|
|
||||||
ingress:
|
|
||||||
enabled: true
|
|
||||||
hosts:
|
|
||||||
- host: auth.lino.cooking
|
|
||||||
paths:
|
|
||||||
- path: "/"
|
|
||||||
pathType: Prefix
|
|
||||||
|
|
||||||
postgresql:
|
|
||||||
enabled: true
|
|
||||||
postgresqlPassword: "uNP9W3zMpp4853QF9f@mpJDEXprca@tX@cEj3#BLFR&WFZVBU^"
|
|
||||||
redis:
|
|
||||||
enabled: true
|
|
||||||
@@ -1,65 +0,0 @@
|
|||||||
---
|
|
||||||
# From repository
|
|
||||||
- name: Add traefik helm repo
|
|
||||||
kubernetes.core.helm_repository:
|
|
||||||
name: jetstack
|
|
||||||
repo_url: "https://charts.jetstack.io"
|
|
||||||
|
|
||||||
- name: Update the repository cache
|
|
||||||
kubernetes.core.helm:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
name: dummy
|
|
||||||
namespace: kube-system
|
|
||||||
state: absent
|
|
||||||
update_repo_cache: true
|
|
||||||
|
|
||||||
- name: Download cert-manager.crds manifest to the cluster.
|
|
||||||
ansible.builtin.get_url:
|
|
||||||
url: https://github.com/cert-manager/cert-manager/releases/download/v1.10.0/cert-manager.crds.yaml
|
|
||||||
dest: /tmp/cert-manager.crds.yaml
|
|
||||||
mode: "0664"
|
|
||||||
|
|
||||||
- name: Apply cert-manager.crds manifest to the cluster.
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
state: present
|
|
||||||
src: /tmp/cert-manager.crds.yaml
|
|
||||||
|
|
||||||
- name: Deploy latest version of cert-manager chart inside cert-manager namespace (and create it)
|
|
||||||
kubernetes.core.helm:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
name: cert-manager
|
|
||||||
chart_ref: jetstack/cert-manager
|
|
||||||
release_namespace: cert-manager
|
|
||||||
create_namespace: true
|
|
||||||
values: "{{ lookup('template', 'values.yml') | from_yaml }}"
|
|
||||||
|
|
||||||
- name: Deploy cert-manager secret - Cloudflare
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
state: present
|
|
||||||
definition: "{{ lookup('template', 'secret-cf-token.yml') | from_yaml }}"
|
|
||||||
|
|
||||||
- name: Deploy lets encrypt staging
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
state: present
|
|
||||||
definition: "{{ lookup('template', 'letsencrypt-staging.yml') | from_yaml }}"
|
|
||||||
|
|
||||||
- name: Deploy cert-manager staging
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
state: present
|
|
||||||
definition: "{{ lookup('template', 'lino-cooking.staging.yml') | from_yaml }}"
|
|
||||||
|
|
||||||
- name: Deploy lets encrypt production
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
state: present
|
|
||||||
definition: "{{ lookup('template', 'letsencrypt-production.yml') | from_yaml }}"
|
|
||||||
|
|
||||||
- name: Deploy cert-manager production
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
state: present
|
|
||||||
definition: "{{ lookup('template', 'lino-cooking.prod.yml') | from_yaml }}"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: ClusterIssuer
|
|
||||||
metadata:
|
|
||||||
name: letsencrypt-production
|
|
||||||
spec:
|
|
||||||
acme:
|
|
||||||
server: https://acme-v02.api.letsencrypt.org/directory
|
|
||||||
email: letsencrypt@lino.cooking
|
|
||||||
privateKeySecretRef:
|
|
||||||
name: letsencrypt-production
|
|
||||||
solvers:
|
|
||||||
- dns01:
|
|
||||||
cloudflare:
|
|
||||||
email: D5&YbHe&oKx82uuTQ^AfW#$*D8GsDE#K3x^446S^wvH#8T@W2C
|
|
||||||
apiTokenSecretRef:
|
|
||||||
name: cloudflare-api-token-secret
|
|
||||||
key: cloudflare-token
|
|
||||||
selector:
|
|
||||||
dnsZones:
|
|
||||||
- "lino.cooking"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: ClusterIssuer
|
|
||||||
metadata:
|
|
||||||
name: letsencrypt-staging
|
|
||||||
spec:
|
|
||||||
acme:
|
|
||||||
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
|
||||||
email: letsencrypt@lino.cooking
|
|
||||||
privateKeySecretRef:
|
|
||||||
name: letsencrypt-staging
|
|
||||||
solvers:
|
|
||||||
- dns01:
|
|
||||||
cloudflare:
|
|
||||||
email: okulto+cloudflare@gmail.com
|
|
||||||
apiTokenSecretRef:
|
|
||||||
name: cloudflare-api-token-secret
|
|
||||||
key: api-token
|
|
||||||
selector:
|
|
||||||
dnsZones:
|
|
||||||
- "lino.cooking"
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: lino-cooking
|
|
||||||
namespace: default
|
|
||||||
spec:
|
|
||||||
secretName: lino-cooking-tls
|
|
||||||
issuerRef:
|
|
||||||
name: letsencrypt-production
|
|
||||||
kind: ClusterIssuer
|
|
||||||
commonName: "*.lino.cooking"
|
|
||||||
dnsNames:
|
|
||||||
- "lino.cooking"
|
|
||||||
- "*.lino.cooking"
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: lino-cooking
|
|
||||||
namespace: default
|
|
||||||
spec:
|
|
||||||
secretName: lino-cooking-staging-tls
|
|
||||||
issuerRef:
|
|
||||||
name: letsencrypt-staging
|
|
||||||
kind: ClusterIssuer
|
|
||||||
commonName: "*.lino.cooking"
|
|
||||||
dnsNames:
|
|
||||||
- "lino.cooking"
|
|
||||||
- "*.lino.cooking"
|
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: cloudflare-api-token-secret
|
|
||||||
namespace: cert-manager
|
|
||||||
type: Opaque
|
|
||||||
stringData:
|
|
||||||
cloudflare-token: "{{ cloudflare_api_key }}"
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
installCRDs: false
|
|
||||||
replicaCount: 3
|
|
||||||
extraArgs:
|
|
||||||
- --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
|
|
||||||
- --dns01-recursive-nameservers-only
|
|
||||||
podDnsPolicy: None
|
|
||||||
podDnsConfig:
|
|
||||||
nameservers:
|
|
||||||
- "1.1.1.1"
|
|
||||||
- "9.9.9.9"
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Store kube configuration
|
|
||||||
ansible.builtin.fetch:
|
|
||||||
src: ~/.kube/config
|
|
||||||
dest: ~/.kube/config
|
|
||||||
flat: true
|
|
||||||
when: ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname']
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Deploy admin user
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
state: present
|
|
||||||
definition: "{{ lookup('template', 'dashboard.admin-user.yml') | from_yaml }}"
|
|
||||||
|
|
||||||
- name: Deploy admin user role
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
kubeconfig: /Users/lino.silva/.kube/config
|
|
||||||
state: present
|
|
||||||
definition: "{{ lookup('template', 'dashboard.admin-user-role.yml') | from_yaml }}"
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
name: admin-user
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: ClusterRole
|
|
||||||
name: cluster-admin
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: admin-user
|
|
||||||
namespace: kubernetes-dashboard
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
name: admin-user
|
|
||||||
namespace: kubernetes-dashboard
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user