fix(ci): pin + cache

.ansible-lint

@@ -1,11 +1,17 @@
 ---
 exclude_paths:
   # default paths
-  - ".cache/"
+  - '.cache/'
-  - ".github/"
+  - '.github/'
-  - "test/fixtures/formatting-before/"
+  - 'test/fixtures/formatting-before/'
-  - "test/fixtures/formatting-prettier/"
+  - 'test/fixtures/formatting-prettier/'
+
+  # The "converge" and "reset" playbooks use import_playbook in
+  # conjunction with the "env" lookup plugin, which lets the
+  # syntax check of ansible-lint fail.
+  - 'molecule/**/converge.yml'
+  - 'molecule/**/prepare.yml'
+  - 'molecule/**/reset.yml'
 
 skip_list:
-  - "fqcn-builtins"
+  - 'fqcn-builtins'
-  - "name[play]"

.github/FUNDING.yml

@@ -0,0 +1,3 @@
+---
+github: timothystewart6
+patreon: technotim

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,77 @@
+
+<!-- It's a good idea to check this post first for general troubleshooting https://github.com/techno-tim/k3s-ansible/discussions/19   -->
+
+<!--- Provide a general summary of the issue in the Title above -->
+
+## Expected Behavior
+
+<!--- Tell us what should happen -->
+
+## Current Behavior
+<!--- Tell us what happens instead of the expected behavior -->
+
+## Steps to Reproduce
+
+<!--- reproduce this bug. Include code to reproduce, if relevant -->
+
+1.
+2.
+3.
+4.
+
+## Context (variables)
+<!--- please include which OS, along with the variables used when running the playbook -->
+
+Operating system:
+
+Hardware:
+
+### Variables Used
+
+`all.yml`
+
+```yml
+k3s_version: ""
+ansible_user: NA
+systemd_dir: ""
+
+flannel_iface: ""
+
+apiserver_endpoint: ""
+
+k3s_token: "NA"
+
+extra_server_args: ""
+extra_agent_args: ""
+
+kube_vip_tag_version: ""
+
+metal_lb_speaker_tag_version: ""
+metal_lb_controller_tag_version: ""
+
+metal_lb_ip_range: ""
+```
+
+### Hosts
+
+`host.ini`
+
+```ini
+[master]
+IP.ADDRESS.ONE
+IP.ADDRESS.TWO
+IP.ADDRESS.THREE
+
+[node]
+IP.ADDRESS.FOUR
+IP.ADDRESS.FIVE
+
+[k3s_cluster:children]
+master
+node
+```
+
+## Possible Solution
+<!--- Not obligatory, but suggest a fix/reason for the bug, -->
+
+- [ ] I've checked the [General Troubleshooting Guide](https://github.com/techno-tim/k3s-ansible/discussions/20)

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,15 @@
+# Proposed Changes
+<!--- Provide a general summary of your changes -->
+
+-
+-
+-
+
+## Checklist
+
+- [ ] Tested locally
+- [ ] Ran `site.yml` playbook
+- [ ] Ran `reset.yml` playbook
+- [ ] Did not add any unnecessary changes
+- [ ] 🚀
+- [ ] Ran pre-commit install at least once before committing

.github/dependabot.yml

@@ -0,0 +1,11 @@
+---
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    rebase-strategy: "auto"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]

.github/download-boxes.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# download-boxes.sh
+# Check all molecule.yml files for required Vagrant boxes and download the ones that are not
+# already present on the system.
+
+set -euo pipefail
+YQ_VERSION=v4.29.2
+YQ_BINARY=yq_linux_amd64
+GIT_ROOT=$(git rev-parse --show-toplevel)
+PROVIDER=virtualbox
+
+# get yq used for filtering
+sudo wget https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/${YQ_BINARY} -O /usr/bin/yq &&\
+    sudo chmod +x /usr/bin/yq
+
+# Read all boxes for all platforms from the "molecule.yml" files
+all_boxes=$(cat "${GIT_ROOT}"/molecule/*/molecule.yml |
+    yq -r '.platforms[].box' |         # Read the "box" property of each node under "platforms"
+    grep --invert-match --regexp=--- | # Filter out file separators
+    sort |
+    uniq)
+
+# Read the boxes that are currently present on the system (for the current provider)
+present_boxes=$(
+    (vagrant box list |
+        grep "${PROVIDER}" | # Filter by boxes available for the current provider
+        awk '{print $1;}' |  # The box name is the first word in each line
+        sort |
+        uniq) ||
+        echo "" # In case any of these commands fails, just use an empty list
+)
+
+# The boxes that we need to download are the ones present in $all_boxes, but not $present_boxes.
+download_boxes=$(comm -2 -3 <(echo "${all_boxes}") <(echo "${present_boxes}"))
+
+# Actually download the necessary boxes
+if [ -n "${download_boxes}" ]; then
+    echo "${download_boxes}" | while IFS= read -r box; do
+        vagrant box add --provider "${PROVIDER}" "${box}"
+    done
+fi

.github/workflows/lint.yml

@@ -0,0 +1,73 @@
+---
+name: Linting
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+    paths-ignore:
+      - '**/README.md'
+jobs:
+  pre-commit-ci:
+    name: Pre-Commit
+    runs-on: self-hosted
+    env:
+      PYTHON_VERSION: "3.10"
+
+    steps:
+      - name: Check out the codebase
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # 3.0.2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Set up Python ${{ env.PYTHON_VERSION }}
+        uses: actions/setup-python@13ae5bb136fac2878aff31522b9efb785519f984 # 4.3.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          cache: 'pip' # caching pip dependencies
+
+      - name: Cache pip
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('./requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: Cache Ansible
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
+        with:
+          path: ~/.ansible/collections
+          key: ${{ runner.os }}-ansible-${{ hashFiles('collections/requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-ansible-
+
+      - name: Install dependencies
+        run: |
+          echo "::group::Upgrade pip"
+          python3 -m pip install --upgrade pip
+          echo "::endgroup::"
+
+          echo "::group::Install Python requirements from requirements.txt"
+          python3 -m pip install -r requirements.txt
+          echo "::endgroup::"
+
+          echo "::group::Install Ansible role requirements from collections/requirements.yml"
+          ansible-galaxy install -r collections/requirements.yml
+          echo "::endgroup::"
+
+      - name: Run pre-commit
+        uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # 3.0.0
+
+  ensure-pinned-actions:
+    name: Ensure SHA Pinned Actions
+    runs-on: self-hosted
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # 3.0.2
+      - name: Ensure SHA pinned actions
+        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@6ca5574367befbc9efdb2fa25978084159c5902d # 1.3.0
+        with:
+          allowlist: |
+            aws-actions/
+            docker/login-action

.github/workflows/test.yml

@@ -0,0 +1,124 @@
+---
+name: Test
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+    paths-ignore:
+      - '**/README.md'
+jobs:
+  molecule:
+    name: Molecule
+    runs-on: self-hosted
+
+    strategy:
+      matrix:
+        scenario:
+          - default
+          - ipv6
+          - single_node
+      fail-fast: false
+    env:
+      PYTHON_VERSION: "3.10"
+      VAGRANT_DEFAULT_PROVIDER: virtualbox
+
+    steps:
+      - name: Check out the codebase
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # 3.0.2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Install Virtual Box from Oracle
+        run: |
+          echo "::group::Virtual Box"
+          wget -O- https://www.virtualbox.org/download/oracle_vbox_2016.asc | sudo gpg --dearmor --yes --output /usr/share/keyrings/oracle-virtualbox-2016.gpg
+          echo "deb [arch=amd64 signed-by=/usr/share/keyrings/oracle-virtualbox-2016.gpg] https://download.virtualbox.org/virtualbox/debian $(lsb_release -cs) contrib" | sudo tee -a /etc/apt/sources.list.d/virtualbox.list
+          sudo apt update && sudo apt install -y linux-headers-generic linux-headers-5.15.0-52-generic build-essential dkms virtualbox-dkms virtualbox-6.1
+          echo "::endgroup::"
+          echo "::group::Virtual Box Test"
+          vboxmanage --version
+          sudo /sbin/vboxconfig
+          sudo modprobe vboxdrv
+          vboxmanage --version
+          echo "::endgroup::"
+
+      - name: Install Vagrant
+        run: |
+          echo "::group::Install Vagrant"
+          wget -O- https://apt.releases.hashicorp.com/gpg | gpg --dearmor | sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg
+          echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
+          sudo apt update && sudo apt install -y vagrant
+          vagrant version
+          vagrant plugin list
+          vagrant plugin install vagrant-vbguest
+          vagrant plugin list
+          echo "::endgroup::"
+
+      - name: Configure VirtualBox
+        run: |-
+          sudo mkdir -p /etc/vbox
+          cat <<EOF | sudo tee -a /etc/vbox/networks.conf > /dev/null
+          * 192.168.30.0/24
+          * fdad:bad:ba55::/64
+          EOF
+
+      - name: Cache pip
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('./requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: Cache Vagrant boxes
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
+        with:
+          path: |
+            ~/.vagrant.d/boxes
+          key: vagrant-boxes-${{ hashFiles('**/molecule.yml') }}
+          restore-keys: |
+            vagrant-boxes
+
+      - name: Download Vagrant boxes for all scenarios
+        # To save some cache space, all scenarios share the same cache key.
+        # On the other hand, this means that the cache contents should be
+        # the same across all scenarios. This step ensures that.
+        run: ./.github/download-boxes.sh
+
+      - name: Set up Python ${{ env.PYTHON_VERSION }}
+        uses: actions/setup-python@13ae5bb136fac2878aff31522b9efb785519f984 # 4.3.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          cache: 'pip' # caching pip dependencies
+
+      - name: Install dependencies
+        run: |
+          echo "::group::Upgrade pip"
+          python3 -m pip install --upgrade pip
+          echo "::endgroup::"
+
+          echo "::group::Install Python requirements from requirements.txt"
+          python3 -m pip install -r requirements.txt
+          echo "::endgroup::"
+
+      - name: Test with molecule
+        run: molecule test --scenario-name ${{ matrix.scenario }}
+        env:
+          ANSIBLE_K3S_LOG_DIR: ${{ runner.temp }}/logs/k3s-ansible/${{ matrix.scenario }}
+          ANSIBLE_SSH_RETRIES: 4
+          ANSIBLE_TIMEOUT: 60
+          PY_COLORS: 1
+          ANSIBLE_FORCE_COLOR: 1
+
+      - name: Upload log files
+        if: always() # do this even if a step before has failed
+        uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # 3.1.1
+        with:
+          name: logs
+          path: |
+            ${{ runner.temp }}/logs
+
+      - name: Delete old box versions
+        if: always() # do this even if a step before has failed
+        run: vagrant box prune --force

.gitignore

@@ -1,2 +1 @@
 .env/
-*.log

README.md

@@ -22,13 +22,13 @@ Build a Kubernetes cluster using Ansible with k3s. The goal is easily install a
 
 on processor architecture:
 
-- [x] x64
+- [X] x64
-- [x] arm64
+- [X] arm64
-- [x] armhf
+- [X] armhf
 
 ## ✅ System requirements
 
-- Deployment environment must have Ansible 2.4.0+. If you need a quick primer on Ansible [you can check out my docs and setting up Ansible](https://docs.technotim.live/posts/ansible-automation/).
+- Deployment environment must have Ansible 2.4.0+.  If you need a quick primer on Ansible [you can check out my docs and setting up Ansible](https://docs.technotim.live/posts/ansible-automation/).
 
 - [`netaddr` package](https://pypi.org/project/netaddr/) must be available to Ansible. If you have installed Ansible via apt, this is already taken care of. If you have installed Ansible via `pip`, make sure to install `netaddr` into the respective virtual environment.
 
@@ -76,7 +76,7 @@ If needed, you can also edit `inventory/my-cluster/group_vars/all.yml` to match
 Start provisioning of the cluster using the following command:
 
 ```bash
-ansible-playbook site.yml -i inventory/my-cluster/hosts.ini --ask-become-pass --ask-vault-pass
+ansible-playbook site.yml -i inventory/my-cluster/hosts.ini
 ```
 
 After deployment control plane will be accessible via virtual ip-address which is defined in inventory/group_vars/all.yml as `apiserver_endpoint`
@@ -87,7 +87,7 @@ After deployment control plane will be accessible via virtual ip-address which i
 ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini
 ```
 
-> You should also reboot these nodes due to the VIP not being destroyed
+>You should also reboot these nodes due to the VIP not being destroyed
 
 ## ⚙️ Kube Config
 
@@ -105,6 +105,13 @@ See the commands [here](https://docs.technotim.live/posts/k3s-etcd-ansible/#test
 
 Be sure to see [this post](https://github.com/techno-tim/k3s-ansible/discussions/20) on how to troubleshoot common problems
 
+### Testing the playbook using molecule
+
+This playbook includes a [molecule](https://molecule.rtfd.io/)-based test setup.
+It is run automatically in CI, but you can also run the tests locally.
+This might be helpful for quick feedback in a few cases.
+You can find more information about it [here](molecule/README.md).
+
 ## Thanks 🤝
 
 This repo is really standing on the shoulders of giants. Thank you to all those who have contributed and tanks to these repos for code and ideas:
@@ -112,9 +119,3 @@ This repo is really standing on the shoulders of giants. Thank you to all those
 - [k3s-io/k3s-ansible](https://github.com/k3s-io/k3s-ansible)
 - [geerlingguy/turing-pi-cluster](https://github.com/geerlingguy/turing-pi-cluster)
 - [212850a/k3s-ansible](https://github.com/212850a/k3s-ansible)
-
-## TODO
-
-- https://docs.k3s.io/installation/kube-dashboard
-- https://www.phillipsj.net/posts/k3s-enable-nfs-storage/
-- https://www.authelia.com/integration/kubernetes/chart/

ansible.cfg

@@ -1,23 +1,12 @@
 [defaults]
-nocows                  = True
+nocows = True
-roles_path              = ./roles
+roles_path = ./roles
-inventory               = ./inventory/my-cluster/hosts.ini
+inventory  = ./hosts.ini
-stdout_callback         = yaml
 
-remote_tmp              = $HOME/.ansible/tmp
+remote_tmp = $HOME/.ansible/tmp
-local_tmp               = $HOME/.ansible/tmp
+local_tmp  = $HOME/.ansible/tmp
-timeout                 = 60
+pipelining = True
-host_key_checking       = False
+become = True
-deprecation_warnings    = False
+host_key_checking = False
-callback_whitelist      = profile_tasks
+deprecation_warnings = False
-log_path                = ./ansible.log
+callback_whitelist = profile_tasks
-
-[privilege_escalation]
-become                  = True
-
-[ssh_connection]
-scp_if_ssh              = smart
-retries                 = 3
-ssh_args                = -o ControlMaster=auto -o ControlPersist=30m -o Compression=yes -o ServerAliveInterval=15s
-pipelining              = True
-control_path            = %(directory)s/%%h-%%r

collections/requirements.yml

@@ -4,4 +4,3 @@ collections:
   - name: community.general
   - name: ansible.posix
   - name: kubernetes.core
-  - name: community.docker

example/deployment.yml

@@ -1,20 +1,13 @@
 ---
-kind: Deployment
 apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: nginx
-  namespace: default
-  labels:
-    app: nginx
 spec:
-  replicas: 3
-  progressDeadlineSeconds: 600
-  revisionHistoryLimit: 2
-  strategy:
-    type: Recreate
   selector:
     matchLabels:
       app: nginx
+  replicas: 3
   template:
     metadata:
       labels:
@@ -22,4 +15,6 @@ spec:
     spec:
       containers:
         - name: nginx
-          image: nginx:latest
+          image: nginx:alpine
+          ports:
+            - containerPort: 80

example/service.yml

@@ -3,11 +3,11 @@ apiVersion: v1
 kind: Service
 metadata:
   name: nginx
-  namespace: default
 spec:
+  ipFamilyPolicy: PreferDualStack
   selector:
     app: nginx
   ports:
-    - name: http
+    - port: 80
       targetPort: 80
-      port: 80
+  type: LoadBalancer

inventory/.gitignore

@@ -0,0 +1,3 @@
+/*
+!.gitignore
+!sample/

inventory/my-cluster/group_vars/all.yml

@@ -1,86 +0,0 @@
----
-k3s_version: v1.24.6+k3s1
-# this is the user that has ssh access to these machines
-ansible_user: lino
-systemd_dir: /etc/systemd/system
-
-# Set your timezone
-system_timezone: "Europe/Lisbon"
-
-# interface which will be used for flannel
-flannel_iface: "eth0"
-
-# apiserver_endpoint is virtual ip-address which will be configured on each master
-apiserver_endpoint: "10.0.3.1"
-
-# k3s_token is required  masters can talk together securely
-# this token should be alpha numeric only
-k3s_token: "7qXiuKpSY9uLwdVSNSnEF5RkttoERixCpc2EVJW7vh7Ws4NMN3"
-
-# The IP on which the node is reachable in the cluster.
-# Here, a sensible default is provided, you can still override
-# it for each of your hosts, though.
-k3s_node_ip: '{{ ansible_facts[flannel_iface]["ipv4"]["address"] }}'
-
-# Disable the taint manually by setting: k3s_master_taint = false
-k3s_master_taint: false
-
-# these arguments are recommended for servers as well as agents:
-extra_args: >-
-  --flannel-iface={{ flannel_iface }}
-  --node-ip={{ k3s_node_ip }}
-
-# change these to your liking, the only required are: --disable servicelb, --tls-san {{ apiserver_endpoint }}
-extra_server_args: >-
-  {{ extra_args }}
-  {{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
-  --tls-san {{ apiserver_endpoint }}
-  --disable servicelb
-  --disable traefik
-extra_agent_args: >-
-  {{ extra_args }}
-
-# image tag for kube-vip
-kube_vip_tag_version: "v0.5.5"
-
-# image tag for metal lb
-metal_lb_speaker_tag_version: "v0.13.6"
-metal_lb_controller_tag_version: "v0.13.6"
-
-# metallb ip range for load balancer
-metal_lb_ip_range: "10.0.4.1-10.0.4.254"
-
-lxc_password: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  38303735306236303463613632623161643633663631303931396564346565666236643562316264
-  6533643331306364653564653763356537303932313531350a393261643137636232616335376461
-  66383966333765626539363561613361393665616333303964373761356166623766663232303063
-  3138353333373935660a383230393330646538303933336366383736643333623663333934663131
-  3064
-
-proxmox_api_password: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  35376334616332386130656335663736343337396532663266383934643632363664646631653935
-  6533343936353734343761343465646365616130643130360a316234333036303738663566666364
-  61653638373830383733323563373862346662363339656632643661336533363162616435616531
-  6331326462356366320a303331616366356333306638386130666538633833623162653934616338
-  3566
-
-traefik_http_auth_user: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  38323532616336373939646333613338626431363466633631343162636235623563393135653231
-  3961383965356631613164303566393632323938386664360a373037616335643662613564353130
-  30353832376431633834336234386161313062373437613132623733646166303639313364373637
-  3933626639646536320a303163353835633837356530613931346165353939363235373561333836
-  39366266303064393334383835323330353934643862323330343337393761353166393333376131
-  33303439393531303031653361393530313930363039646566613831373366326432653634653165
-  313735383263623836363030386531613033
-
-cloudflare_api_key: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  38363363386466666266613930386237623430646531303734613863306530666530376433633339
-  3166373361393839363439326661396136616637393865630a666637366132643035343832666335
-  33376139643533313730313135653064393239316162376339653965313366643565643664666534
-  6631393564333230370a303634643030346166383235643666356164393232643832333238313664
-  38346161306138653735303861646638653830633938326566663136393862643264353437623963
-  3462616435653132623563316231343739333761653365333437

inventory/my-cluster/host_vars/daruk

@@ -1,14 +0,0 @@
----
-ansible_user: root
-ansible_host: 10.0.2.6
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-ip_addr: 10.0.2.6
-k3s_mac_addr: DE:05:FF:02:47:D8
-k3s_hostname: k3s-agent-daruk
-k3s_lxc_host: 10.0.3.6
-k3s_vm_host: 10.0.3.106
-k3s_cores: 8
-k3s_memory: 4096
-k3s_disk: 150
-k3s_vmid: 606
-k3s_template_id: 900

inventory/my-cluster/host_vars/epona

@@ -1,14 +0,0 @@
----
-ansible_user: root
-ansible_host: 10.0.2.2
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-ip_addr: 10.0.2.2
-k3s_mac_addr: de:05:ff:02:47:d7
-k3s_hostname: k3s-master-epona
-k3s_lxc_host: 10.0.3.2
-k3s_vm_host: 10.0.3.102
-k3s_cores: 4
-k3s_memory: 8192
-k3s_disk: 75
-k3s_vmid: 601
-k3s_template_id: 901

inventory/my-cluster/host_vars/epona-pihole

@@ -1,8 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.13
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-mac_addr: EA:11:8B:05:5A:88
-vmid: 203
-node: epona

inventory/my-cluster/host_vars/frigate

@@ -1,5 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.14
-ansible_ssh_pass: "{{ proxmox_api_password }}"

inventory/my-cluster/host_vars/k3s-agent-daruk

@@ -1,5 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.3.106
-ansible_ssh_pass: "{{ proxmox_api_password }}"

inventory/my-cluster/host_vars/k3s-agent-revali

@@ -1,5 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.3.104
-ansible_ssh_pass: "{{ proxmox_api_password }}"

inventory/my-cluster/host_vars/k3s-agent-urbosa

@@ -1,5 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.3.105
-ansible_ssh_pass: "{{ proxmox_api_password }}"

inventory/my-cluster/host_vars/k3s-master-epona

@@ -1,5 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.3.102
-ansible_ssh_pass: "{{ proxmox_api_password }}"

inventory/my-cluster/host_vars/k3s-master-mipha

@@ -1,5 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.3.103
-ansible_ssh_pass: "{{ proxmox_api_password }}"

inventory/my-cluster/host_vars/mipha

@@ -1,14 +0,0 @@
----
-ansible_user: root
-ansible_host: 10.0.2.3
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-ip_addr: 10.0.2.3
-k3s_mac_addr: 0e:a0:ff:8c:70:df
-k3s_hostname: k3s-master-mipha
-k3s_lxc_host: 10.0.3.3
-k3s_vm_host: 10.0.3.103
-k3s_cores: 4
-k3s_memory: 6144
-k3s_disk: 75
-k3s_vmid: 602
-k3s_template_id: 902

inventory/my-cluster/host_vars/revali

@@ -1,14 +0,0 @@
----
-ansible_user: root
-ansible_host: 10.0.2.4
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-ip_addr: 10.0.2.4
-k3s_mac_addr: 32:47:89:3f:1a:e2
-k3s_hostname: k3s-agent-revali
-k3s_lxc_host: 10.0.3.4
-k3s_vm_host: 10.0.3.104
-k3s_cores: 2
-k3s_memory: 4096
-k3s_disk: 200
-k3s_vmid: 603
-k3s_template_id: 903

inventory/my-cluster/host_vars/revali-pihole

@@ -1,8 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.12
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-mac_addr: C2:F5:B2:99:92:51
-vmid: 202
-node: revali

inventory/my-cluster/host_vars/urbosa

@@ -1,14 +0,0 @@
----
-ansible_user: root
-ansible_host: 10.0.2.5
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-ip_addr: 10.0.2.5
-# k3s_mac_addr: ee:36:d5:79:f8:ff
-# k3s_hostname: k3s-agent-urbosa
-# k3s_lxc_host: 10.0.3.5
-# k3s_vm_host: 10.0.3.105
-# k3s_cores: 3
-# k3s_memory: 2048
-# k3s_disk: 80
-# k3s_vmid: 604
-# k3s_template_id: 904

inventory/my-cluster/host_vars/urbosa-pihole

@@ -1,8 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.11
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-mac_addr: 72:2E:3C:F0:2A:B3
-vmid: 201
-node: urbosa

inventory/my-cluster/hosts.ini

@@ -1,35 +0,0 @@
-[master]
-k3s-master-mipha
-k3s-master-epona
-
-[node]
-k3s-agent-revali
-k3s-agent-daruk
-
-[k3s_cluster:children]
-master
-node
-
-[lxc]
-frigate
-
-[lxc:children]
-k3s_cluster
-
-[k3s_hosts]
-mipha
-epona
-revali
-daruk
-
-[baremetal]
-mipha
-epona
-urbosa
-revali
-daruk
-
-[pihole]
-epona-pihole
-revali-pihole
-urbosa-pihole

inventory/sample/group_vars/all.yml

@@ -0,0 +1,51 @@
+---
+k3s_version: v1.24.6+k3s1
+# this is the user that has ssh access to these machines
+ansible_user: ansibleuser
+systemd_dir: /etc/systemd/system
+
+# Set your timezone
+system_timezone: "Your/Timezone"
+
+# interface which will be used for flannel
+flannel_iface: "eth0"
+
+# apiserver_endpoint is virtual ip-address which will be configured on each master
+apiserver_endpoint: "192.168.30.222"
+
+# k3s_token is required  masters can talk together securely
+# this token should be alpha numeric only
+k3s_token: "some-SUPER-DEDEUPER-secret-password"
+
+# The IP on which the node is reachable in the cluster.
+# Here, a sensible default is provided, you can still override
+# it for each of your hosts, though.
+k3s_node_ip: '{{ ansible_facts[flannel_iface]["ipv4"]["address"] }}'
+
+# Disable the taint manually by setting: k3s_master_taint = false
+k3s_master_taint: "{{ true if groups['node'] | default([]) | length >= 1 else false }}"
+
+# these arguments are recommended for servers as well as agents:
+extra_args: >-
+  --flannel-iface={{ flannel_iface }}
+  --node-ip={{ k3s_node_ip }}
+
+# change these to your liking, the only required are: --disable servicelb, --tls-san {{ apiserver_endpoint }}
+extra_server_args: >-
+  {{ extra_args }}
+  {{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
+  --tls-san {{ apiserver_endpoint }}
+  --disable servicelb
+  --disable traefik
+extra_agent_args: >-
+  {{ extra_args }}
+
+# image tag for kube-vip
+kube_vip_tag_version: "v0.5.5"
+
+# image tag for metal lb
+metal_lb_speaker_tag_version: "v0.13.6"
+metal_lb_controller_tag_version: "v0.13.6"
+
+# metallb ip range for load balancer
+metal_lb_ip_range: "192.168.30.80-192.168.30.90"

inventory/sample/hosts.ini

@@ -0,0 +1,12 @@
+[master]
+192.168.30.38
+192.168.30.39
+192.168.30.40
+
+[node]
+192.168.30.41
+192.168.30.42
+
+[k3s_cluster:children]
+master
+node

molecule/README.md

@@ -0,0 +1,73 @@
+# Test suites for `k3s-ansible`
+
+This folder contains the [molecule](https://molecule.rtfd.io/)-based test setup for this playbook.
+
+## Scenarios
+
+We have these scenarios:
+
+- **default**:
+  A 3 control + 2 worker node cluster based very closely on the [sample inventory](../inventory/sample/).
+- **ipv6**:
+  A cluster that is externally accessible via IPv6 ([more information](ipv6/README.md))
+  To save a bit of test time, this cluster is _not_ highly available, it consists of only one control and one worker node.
+- **single_node**:
+  Very similar to the default scenario, but uses only a single node for all cluster functionality.
+
+## How to execute
+
+To test on your local machine, follow these steps:
+
+### System requirements
+
+Make sure that the following software packages are available on your system:
+
+- [Python 3](https://www.python.org/downloads)
+- [Vagrant](https://www.vagrantup.com/downloads)
+- [VirtualBox](https://www.virtualbox.org/wiki/Downloads)
+
+### Set up VirtualBox networking on Linux and macOS
+
+_You can safely skip this if you are working on Windows._
+
+Furthermore, the test cluster uses the `192.168.30.0/24` subnet which is [not set up by VirtualBox automatically](https://www.virtualbox.org/manual/ch06.html#network_hostonly).
+To set the subnet up for use with VirtualBox, please make sure that `/etc/vbox/networks.conf` exists and that it contains this line:
+
+```
+* 192.168.30.0/24
+* fdad:bad:ba55::/64
+```
+
+### Install Python dependencies
+
+You will get [Molecule, Ansible and a few extra dependencies](../requirements.txt) via [pip](https://pip.pypa.io/).
+Usually, it is advisable to work in a [virtual environment](https://docs.python.org/3/tutorial/venv.html) for this:
+
+```bash
+cd /path/to/k3s-ansible
+
+# Create a virtualenv at ".env". You only need to do this once.
+python3 -m venv .env
+
+# Activate the virtualenv for your current shell session.
+# If you start a new session, you will have to repeat this.
+source .env/bin/activate
+
+# Install the required packages into the virtualenv.
+# These remain installed across shell sessions.
+python3 -m pip install -r requirements.txt
+```
+
+### Run molecule
+
+With the virtual environment from the previous step active in your shell session, you can now use molecule to test the playbook.
+Interesting commands are:
+
+- `molecule create`: Create virtual machines for the test cluster nodes.
+- `molecule destroy`: Delete the virtual machines for the test cluster nodes.
+- `molecule converge`: Run the `site` playbook on the nodes of the test cluster.
+- `molecule side_effect`: Run the `reset` playbook on the nodes of the test cluster.
+- `molecule verify`: Verify that the cluster works correctly.
+- `molecule test`: The "all-in-one" sequence of steps that is executed in CI.
+  This includes the `create`, `converge`, `verify`, `side_effect` and `destroy` steps.
+  See [`molecule.yml`](default/molecule.yml) for more details.

molecule/default/molecule.yml

@@ -0,0 +1,82 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: vagrant
+.platform_presets:
+  - &control
+    memory: 2048
+    cpus: 2
+    groups:
+      - k3s_cluster
+      - master
+  - &node
+    memory: 2048
+    cpus: 2
+    groups:
+      - k3s_cluster
+      - node
+  - &debian
+    box: generic/debian11
+  - &rocky
+    box: generic/rocky9
+  - &ubuntu
+    box: generic/ubuntu2204
+    config_options:
+      # We currently can not use public-key based authentication on Ubuntu 22.04,
+      # see: https://github.com/chef/bento/issues/1405
+      ssh.username: "vagrant"
+      ssh.password: "vagrant"
+platforms:
+  - <<: [*control, *ubuntu]
+    name: control1
+    interfaces:
+      - network_name: private_network
+        ip: 192.168.30.38
+  - <<: [*control, *debian]
+    name: control2
+    interfaces:
+      - network_name: private_network
+        ip: 192.168.30.39
+  - <<: [*control, *rocky]
+    name: control3
+    interfaces:
+      - network_name: private_network
+        ip: 192.168.30.40
+  - <<: [*node, *ubuntu]
+    name: node1
+    interfaces:
+      - network_name: private_network
+        ip: 192.168.30.41
+  - <<: [*node, *rocky]
+    name: node2
+    interfaces:
+      - network_name: private_network
+        ip: 192.168.30.42
+provisioner:
+  name: ansible
+  playbooks:
+    converge: ../resources/converge.yml
+    side_effect: ../resources/reset.yml
+    verify: ../resources/verify.yml
+  inventory:
+    links:
+      group_vars: ../../inventory/sample/group_vars
+scenario:
+  test_sequence:
+    - dependency
+    - lint
+    - cleanup
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    # idempotence is not possible with the playbook in its current form.
+    - verify
+    # We are repurposing side_effect here to test the reset playbook.
+    # This is why we do not run it before verify (which tests the cluster),
+    # but after the verify step.
+    - side_effect
+    - cleanup
+    - destroy

molecule/default/overrides.yml

@@ -0,0 +1,11 @@
+---
+- name: Apply overrides
+  hosts: all
+  tasks:
+    - name: Override host variables
+      ansible.builtin.set_fact:
+        # See: https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant  # noqa yaml[line-length]
+        flannel_iface: eth1
+
+        # The test VMs might be a bit slow, so we give them more time to join the cluster:
+        retry_count: 45

molecule/default/prepare.yml

@@ -0,0 +1,22 @@
+---
+- name: Apply overrides
+  ansible.builtin.import_playbook: >-
+    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
+
+- name: Network setup
+  hosts: all
+  tasks:
+    - name: Disable firewalld
+      when: ansible_distribution == "Rocky"
+      # Rocky Linux comes with firewalld enabled. It blocks some of the network
+      # connections needed for our k3s cluster. For our test setup, we just disable
+      # it since the VM host's firewall is still active for connections to and from
+      # the Internet.
+      # When building your own cluster, please DO NOT blindly copy this. Instead,
+      # please create a custom firewall configuration that fits your network design
+      # and security needs.
+      ansible.builtin.systemd:
+        name: firewalld
+        enabled: no
+        state: stopped
+      become: true

molecule/ipv6/README.md

@@ -0,0 +1,35 @@
+# Sample IPv6 configuration for `k3s-ansible`
+
+This scenario contains a cluster configuration which is _IPv6 first_, but still supports dual-stack networking with IPv4 for most things.
+This means:
+
+- The API server VIP is an IPv6 address.
+- The MetalLB pool consists of both IPv4 and IPv4 addresses.
+- Nodes as well as cluster-internal resources (pods and services) are accessible via IPv4 as well as IPv6.
+
+## Network design
+
+All IPv6 addresses used in this scenario share a single `/48` prefix: `fdad:bad:ba55`.
+The following subnets are used:
+
+- `fdad:bad:ba55:`**`0`**`::/64` is the subnet which contains the cluster components meant for external access.
+  That includes:
+
+  - The VIP for the Kubernetes API server: `fdad:bad:ba55::333`
+  - Services load-balanced by MetalLB: `fdad:bad:ba55::1b:0/112`
+  - Cluster nodes: `fdad:bad:ba55::de:0/112`
+  - The host executing Vagrant: `fdad:bad:ba55::1`
+
+  In a home lab setup, this might be your LAN.
+
+- `fdad:bad:ba55:`**`4200`**`::/56` is used internally by the cluster for pods.
+
+- `fdad:bad:ba55:`**`4300`**`::/108` is used internally by the cluster for services.
+
+IPv4 networking is also available:
+
+- The nodes have addresses inside `192.168.123.0/24`.
+  MetalLB also has a bit of address space in this range: `192.168.123.80-192.168.123.90`
+- For pods and services, the k3s defaults (`10.42.0.0/16` and `10.43.0.0/16)` are used.
+
+Note that the host running Vagrant is not part any of these IPv4 networks.

molecule/ipv6/host_vars/control1.yml

@@ -0,0 +1,3 @@
+---
+node_ipv4: 192.168.123.11
+node_ipv6: fdad:bad:ba55::de:11

molecule/ipv6/host_vars/node1.yml

@@ -0,0 +1,3 @@
+---
+node_ipv4: 192.168.123.21
+node_ipv6: fdad:bad:ba55::de:21

molecule/ipv6/molecule.yml

@@ -0,0 +1,63 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: vagrant
+.platform_presets:
+  - &control
+    memory: 2048
+    cpus: 2
+    groups:
+      - k3s_cluster
+      - master
+  - &node
+    memory: 2048
+    cpus: 2
+    groups:
+      - k3s_cluster
+      - node
+  - &ubuntu
+    box: generic/ubuntu2204
+    config_options:
+      # We currently can not use public-key based authentication on Ubuntu 22.04,
+      # see: https://github.com/chef/bento/issues/1405
+      ssh.username: "vagrant"
+      ssh.password: "vagrant"
+platforms:
+  - <<: [*control, *ubuntu]
+    name: control1
+    interfaces:
+      - network_name: private_network
+        ip: fdad:bad:ba55::de:11
+  - <<: [*node, *ubuntu]
+    name: node1
+    interfaces:
+      - network_name: private_network
+        ip: fdad:bad:ba55::de:21
+provisioner:
+  name: ansible
+  playbooks:
+    converge: ../resources/converge.yml
+    side_effect: ../resources/reset.yml
+    verify: ../resources/verify.yml
+  inventory:
+    links:
+      group_vars: ../../inventory/sample/group_vars
+scenario:
+  test_sequence:
+    - dependency
+    - lint
+    - cleanup
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    # idempotence is not possible with the playbook in its current form.
+    - verify
+    # We are repurposing side_effect here to test the reset playbook.
+    # This is why we do not run it before verify (which tests the cluster),
+    # but after the verify step.
+    - side_effect
+    - cleanup
+    - destroy

molecule/ipv6/overrides.yml

@@ -0,0 +1,45 @@
+---
+- name: Apply overrides
+  hosts: all
+  tasks:
+    - name: Override host variables (1/2)
+      ansible.builtin.set_fact:
+        # See: https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant  # noqa yaml[line-length]
+        flannel_iface: eth1
+
+        # The test VMs might be a bit slow, so we give them more time to join the cluster:
+        retry_count: 45
+
+        # IPv6 configuration
+        # ######################################################################
+
+        # The API server will be reachable on IPv6 only
+        apiserver_endpoint: fdad:bad:ba55::333
+
+        # We give MetalLB address space for both IPv4 and IPv6
+        metal_lb_ip_range:
+          - fdad:bad:ba55::1b:0/112
+          - 192.168.123.80-192.168.123.90
+
+        # k3s_node_ip is by default set to the IPv4 address of flannel_iface.
+        # We want IPv6 addresses here of course, so we just specify them
+        # manually below.
+        k3s_node_ip: "{{ node_ipv4 }},{{ node_ipv6 }}"
+
+    - name: Override host variables (2/2)
+      # Since "extra_args" depends on "k3s_node_ip" and "flannel_iface" we have
+      # to set this AFTER overriding the both of them.
+      ansible.builtin.set_fact:
+        # A few extra server args are necessary:
+        #  - the network policy needs to be disabled.
+        #  - we need to manually specify the subnets for services and pods, as
+        #    the default has IPv4 ranges only.
+        extra_server_args: >-
+          {{ extra_args }}
+          --tls-san {{ apiserver_endpoint }}
+          {{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
+          --disable servicelb
+          --disable traefik
+          --disable-network-policy
+          --cluster-cidr=10.42.0.0/16,fdad:bad:ba55:4200::/56
+          --service-cidr=10.43.0.0/16,fdad:bad:ba55:4300::/108

molecule/ipv6/prepare.yml

@@ -0,0 +1,51 @@
+---
+- name: Apply overrides
+  ansible.builtin.import_playbook: >-
+    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
+
+- name: Configure dual-stack networking
+  hosts: all
+  become: true
+
+  # Unfortunately, as of 2022-09, Vagrant does not support the configuration
+  # of both IPv4 and IPv6 addresses for a single network adapter. So we have
+  # to configure that ourselves.
+  # Moreover, we have to explicitly enable IPv6 for the loopback interface.
+
+  tasks:
+    - name: Enable IPv6 for network interfaces
+      ansible.posix.sysctl:
+        name: net.ipv6.conf.{{ item }}.disable_ipv6
+        value: "0"
+      with_items:
+        - all
+        - default
+        - lo
+
+    - name: Disable duplicate address detection
+      # Duplicate address detection did repeatedly fail within the virtual
+      # network. But since this setup does not use SLAAC anyway, we can safely
+      # disable it.
+      ansible.posix.sysctl:
+        name: net.ipv6.conf.{{ item }}.accept_dad
+        value: "0"
+      with_items:
+        - "{{ flannel_iface }}"
+
+    - name: Write IPv4 configuration
+      ansible.builtin.template:
+        src: 55-flannel-ipv4.yaml.j2
+        dest: /etc/netplan/55-flannel-ipv4.yaml
+        owner: root
+        group: root
+        mode: 0644
+      register: netplan_template
+
+    - name: Apply netplan configuration
+      # Conceptually, this should be a handler rather than a task.
+      # However, we are currently not in a role context - creating
+      # one just for this seemed overkill.
+      when: netplan_template.changed
+      ansible.builtin.command:
+        cmd: netplan apply
+      changed_when: true

molecule/ipv6/templates/55-flannel-ipv4.yaml.j2

@@ -0,0 +1,8 @@
+---
+network:
+  version: 2
+  renderer: networkd
+  ethernets:
+    {{ flannel_iface }}:
+      addresses:
+      - {{ node_ipv4 }}/24

molecule/resources/converge.yml

@@ -0,0 +1,7 @@
+---
+- name: Apply overrides
+  ansible.builtin.import_playbook: >-
+    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
+
+- name: Converge
+  ansible.builtin.import_playbook: ../../site.yml

molecule/resources/reset.yml

@@ -0,0 +1,7 @@
+---
+- name: Apply overrides
+  ansible.builtin.import_playbook: >-
+    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
+
+- name: Reset
+  ansible.builtin.import_playbook: ../../reset.yml

molecule/resources/verify.yml

@@ -0,0 +1,5 @@
+---
+- name: Verify
+  hosts: all
+  roles:
+    - verify/from_outside

molecule/resources/verify/from_outside/defaults/main.yml

@@ -0,0 +1,9 @@
+---
+# A host outside of the cluster from which the checks shall be performed
+outside_host: localhost
+
+# This kubernetes namespace will be used for testing
+testing_namespace: molecule-verify-from-outside
+
+# The directory in which the example manifests reside
+example_manifests_path: ../../../../example

molecule/resources/verify/from_outside/tasks/kubecfg-cleanup.yml

@@ -0,0 +1,5 @@
+---
+- name: Clean up kubecfg
+  ansible.builtin.file:
+    path: "{{ kubecfg.path }}"
+    state: absent

molecule/resources/verify/from_outside/tasks/kubecfg-fetch.yml

@@ -0,0 +1,19 @@
+---
+- name: Create temporary directory for kubecfg
+  ansible.builtin.tempfile:
+    state: directory
+    suffix: kubecfg
+  register: kubecfg
+- name: Gathering facts
+  delegate_to: "{{ groups['master'][0] }}"
+  ansible.builtin.gather_facts:
+- name: Download kubecfg
+  ansible.builtin.fetch:
+    src: "{{ ansible_env.HOME }}/.kube/config"
+    dest: "{{ kubecfg.path }}/"
+    flat: true
+  delegate_to: "{{ groups['master'][0] }}"
+  delegate_facts: true
+- name: Store path to kubecfg
+  ansible.builtin.set_fact:
+    kubecfg_path: "{{ kubecfg.path }}/config"

molecule/resources/verify/from_outside/tasks/main.yml

@@ -0,0 +1,14 @@
+---
+- name: Verify
+  run_once: true
+  delegate_to: "{{ outside_host }}"
+  block:
+    - name: "Test CASE: Get kube config"
+      ansible.builtin.import_tasks: kubecfg-fetch.yml
+    - name: "TEST CASE: Get nodes"
+      ansible.builtin.include_tasks: test/get-nodes.yml
+    - name: "TEST CASE: Deploy example"
+      ansible.builtin.include_tasks: test/deploy-example.yml
+  always:
+    - name: "TEST CASE: Cleanup"
+      ansible.builtin.import_tasks: kubecfg-cleanup.yml

molecule/resources/verify/from_outside/tasks/test/deploy-example.yml

@@ -0,0 +1,58 @@
+---
+- name: Deploy example
+  block:
+    - name: "Create namespace: {{ testing_namespace }}"
+      kubernetes.core.k8s:
+        api_version: v1
+        kind: Namespace
+        name: "{{ testing_namespace }}"
+        state: present
+        wait: true
+        kubeconfig: "{{ kubecfg_path }}"
+
+    - name: Apply example manifests
+      kubernetes.core.k8s:
+        src: "{{ example_manifests_path }}/{{ item }}"
+        namespace: "{{ testing_namespace }}"
+        state: present
+        wait: true
+        kubeconfig: "{{ kubecfg_path }}"
+      with_items:
+        - deployment.yml
+        - service.yml
+
+    - name: Get info about nginx service
+      kubernetes.core.k8s_info:
+        kind: service
+        name: nginx
+        namespace: "{{ testing_namespace }}"
+        kubeconfig: "{{ kubecfg_path }}"
+      vars: &load_balancer_metadata
+        metallb_ip: status.loadBalancer.ingress[0].ip
+        metallb_port: spec.ports[0].port
+      register: nginx_services
+
+    - name: Assert that the nginx welcome page is available
+      ansible.builtin.uri:
+        url: http://{{ ip | ansible.utils.ipwrap }}:{{ port }}/
+        return_content: yes
+      register: result
+      failed_when: "'Welcome to nginx!' not in result.content"
+      vars:
+        ip: >-
+          {{ nginx_services.resources[0].status.loadBalancer.ingress[0].ip }}
+        port: >-
+          {{ nginx_services.resources[0].spec.ports[0].port }}
+      # Deactivated linter rules:
+      #   - jinja[invalid]: As of version 6.6.0, ansible-lint complains that the input to ipwrap
+      #                     would be undefined. This will not be the case during playbook execution.
+      # noqa jinja[invalid]
+
+  always:
+    - name: "Remove namespace: {{ testing_namespace }}"
+      kubernetes.core.k8s:
+        api_version: v1
+        kind: Namespace
+        name: "{{ testing_namespace }}"
+        state: absent
+        kubeconfig: "{{ kubecfg_path }}"

molecule/resources/verify/from_outside/tasks/test/get-nodes.yml

@@ -0,0 +1,28 @@
+---
+- name: Get all nodes in cluster
+  kubernetes.core.k8s_info:
+    kind: node
+    kubeconfig: "{{ kubecfg_path }}"
+  register: cluster_nodes
+
+- name: Assert that the cluster contains exactly the expected nodes
+  ansible.builtin.assert:
+    that: found_nodes == expected_nodes
+    success_msg: "Found nodes as expected: {{ found_nodes }}"
+    fail_msg: "Expected nodes {{ expected_nodes }}, but found nodes {{ found_nodes }}"
+  vars:
+    found_nodes: >-
+      {{ cluster_nodes | json_query('resources[*].metadata.name') | unique | sort }}
+    expected_nodes: |-
+      {{
+        (
+          ( groups['master'] | default([]) ) +
+          ( groups['node'] | default([]) )
+        )
+        | unique
+        | sort
+      }}
+  # Deactivated linter rules:
+  #   - jinja[invalid]: As of version 6.6.0, ansible-lint complains that the input to ipwrap
+  #                     would be undefined. This will not be the case during playbook execution.
+  # noqa jinja[invalid]

molecule/single_node/molecule.yml

@@ -0,0 +1,48 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: vagrant
+platforms:
+  - name: control1
+    box: generic/ubuntu2204
+    memory: 4096
+    cpus: 4
+    config_options:
+      # We currently can not use public-key based authentication on Ubuntu 22.04,
+      # see: https://github.com/chef/bento/issues/1405
+      ssh.username: "vagrant"
+      ssh.password: "vagrant"
+    groups:
+      - k3s_cluster
+      - master
+    interfaces:
+      - network_name: private_network
+        ip: 192.168.30.50
+provisioner:
+  name: ansible
+  playbooks:
+    converge: ../resources/converge.yml
+    side_effect: ../resources/reset.yml
+    verify: ../resources/verify.yml
+  inventory:
+    links:
+      group_vars: ../../inventory/sample/group_vars
+scenario:
+  test_sequence:
+    - dependency
+    - lint
+    - cleanup
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    # idempotence is not possible with the playbook in its current form.
+    - verify
+    # We are repurposing side_effect here to test the reset playbook.
+    # This is why we do not run it before verify (which tests the cluster),
+    # but after the verify step.
+    - side_effect
+    - cleanup
+    - destroy

molecule/single_node/overrides.yml

@@ -0,0 +1,15 @@
+---
+- name: Apply overrides
+  hosts: all
+  tasks:
+    - name: Override host variables
+      ansible.builtin.set_fact:
+        # See: https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant  # noqa yaml[line-length]
+        flannel_iface: eth1
+
+        # The test VMs might be a bit slow, so we give them more time to join the cluster:
+        retry_count: 45
+
+        # Make sure that our IP ranges do not collide with those of the default scenario
+        apiserver_endpoint: "192.168.30.223"
+        metal_lb_ip_range: "192.168.30.91-192.168.30.99"

playbook-frigate.yml

@@ -1,28 +0,0 @@
----
-- hosts: localhost
-  become: yes
-  roles:
-    - role: frigate/provision/delete
-    - role: frigate/provision/create
-
-- hosts: epona
-  become: yes
-  roles:
-    - role: frigate/provision/cgroup
-
-- hosts: localhost
-  become: yes
-  roles:
-    - role: frigate/provision/start
-
-- hosts: epona
-  become: yes
-  roles:
-    - role: frigate/provision/enable-ssh
-
-- hosts: frigate
-  become: yes
-  roles:
-    - role: frigate/update
-    - role: frigate/install-docker
-    - role: frigate/install-app

playbook-k3s.yml

@@ -1,56 +0,0 @@
----
-# - hosts: localhost
-#   gather_facts: no
-#   become: yes
-#   roles:
-#     - role: k3s/provision/delete
-- hosts: localhost
-  gather_facts: no
-  become: yes
-  roles:
-    - role: k3s/provision/create
-- hosts: k3s_hosts
-  gather_facts: yes
-  become: yes
-  roles:
-    - role: k3s/provision/pre
-    - role: k3s/provision/cloud-init
-- hosts: localhost
-  gather_facts: no
-  become: yes
-  roles:
-    - role: k3s/provision/start
-- hosts: k3s_cluster
-  gather_facts: yes
-  become: yes
-  roles:
-    - role: prereq
-    - role: download
-- hosts: master
-  become: yes
-  roles:
-    - role: k3s/master
-
-- hosts: node
-  become: yes
-  roles:
-    - role: k3s/node
-
-- hosts: master
-  become: yes
-  roles:
-    - role: k3s/post
-
-- hosts: master
-  become: yes
-  roles:
-    - role: k3s/copy-config
-- hosts: localhost
-  become: yes
-  roles:
-    - role: longhorn
-    - role: traefik
-    - role: nginx
-    - role: cert-manager
-    - role: authelia
-    - role: redis

reboot.sh

@@ -1,3 +0,0 @@
-#!/bin/bash
-
-ansible-playbook reboot.yml -i inventory/my-cluster/hosts.ini

reboot.yml

@@ -1,9 +0,0 @@
----
-- name: Reboot k3s_cluster
-  hosts: k3s_cluster
-  gather_facts: yes
-  become: yes
-  tasks:
-    - name: Reboot the nodes (and Wait upto 5 mins max)
-      reboot:
-        reboot_timeout: 300

requirements.in

@@ -1,10 +0,0 @@
-ansible-core>=2.13.2
-ansible-lint>=6.6.0
-kubernetes>=12.0.0
-netaddr>=0.8.0
-pyyaml>=3.11
-yamllint>=1.28.0
-jmespath>=1.0.1
-jsonpatch>=1.32
-pre-commit>=2.20.0
-netaddr>=0.8.0

requirements.txt

@@ -1,218 +1,72 @@
-#
+ansible-compat==2.2.1
-# This file is autogenerated by pip-compile with python 3.8
-# To update, run:
-#
-#    pip-compile requirements.in
-#
-ansible-compat==2.2.4
-    # via
-    #   ansible-lint
 ansible-core==2.13.5
-    # via
+ansible-lint==6.8.4
-    #   -r requirements.in
-    #   ansible-lint
-ansible-lint==6.8.6
-    # via -r requirements.in
 arrow==1.2.3
-    # via jinja2-time
 attrs==22.1.0
-    # via jsonschema
 binaryornot==0.4.4
-    # via cookiecutter
 black==22.10.0
-    # via ansible-lint
 bracex==2.3.post1
-    # via wcmatch
 cachetools==5.2.0
-    # via google-auth
+Cerberus==1.3.2
 certifi==2022.9.24
-    # via
-    #   kubernetes
-    #   requests
 cffi==1.15.1
-    # via cryptography
-cfgv==3.3.1
-    # via pre-commit
 chardet==5.0.0
-    # via binaryornot
 charset-normalizer==2.1.1
-    # via requests
 click==8.1.3
-    # via
-    #   black
-    #   click-help-colors
-    #   cookiecutter
 click-help-colors==0.9.1
 commonmark==0.9.1
-    # via rich
 cookiecutter==2.1.1
-cryptography==38.0.3
+cryptography==38.0.1
-    # via ansible-core
-distlib==0.3.6
-    # via virtualenv
 distro==1.8.0
-    # via selinux
 enrich==1.2.7
-    # via molecule
 filelock==3.8.0
-    # via
+google-auth==2.13.0
-    #   ansible-lint
-    #   virtualenv
-google-auth==2.14.0
-    # via kubernetes
-identify==2.5.8
-    # via pre-commit
 idna==3.4
-    # via requests
 importlib-resources==5.10.0
-    # via jsonschema
+Jinja2==3.1.2
-jinja2==3.1.2
-    # via
-    #   ansible-core
-    #   cookiecutter
-    #   jinja2-time
-    #   molecule
-    #   molecule-vagrant
 jinja2-time==0.2.0
-    # via cookiecutter
 jmespath==1.0.1
-    # via -r requirements.in
 jsonpatch==1.32
-    # via -r requirements.in
 jsonpointer==2.3
-    # via jsonpatch
+jsonschema==4.16.0
-jsonschema==4.17.0
+kubernetes==24.2.0
-    # via
+MarkupSafe==2.1.1
-    #   ansible-compat
+molecule==4.0.1
-    #   ansible-lint
-    #   molecule
-kubernetes==25.3.0
-    # via -r requirements.in
-markupsafe==2.1.1
-    # via jinja2
-molecule==4.0.3
-    # via
-    #   -r requirements.in
-    #   molecule-vagrant
 molecule-vagrant==1.0.0
-    # via -r requirements.in
 mypy-extensions==0.4.3
-    # via black
 netaddr==0.8.0
-    # via -r requirements.in
-nodeenv==1.7.0
-    # via pre-commit
 oauthlib==3.2.2
-    # via requests-oauthlib
 packaging==21.3
-    # via
-    #   ansible-compat
-    #   ansible-core
-    #   ansible-lint
-    #   molecule
 pathspec==0.10.1
-    # via
-    #   black
-    #   yamllint
 pkgutil-resolve-name==1.3.10
-    # via jsonschema
 platformdirs==2.5.2
-    # via
-    #   black
-    #   virtualenv
 pluggy==1.0.0
-    # via molecule
 pre-commit==2.20.0
-    # via -r requirements.in
 pyasn1==0.4.8
-    # via
-    #   pyasn1-modules
-    #   rsa
 pyasn1-modules==0.2.8
-    # via google-auth
 pycparser==2.21
-    # via cffi
+Pygments==2.13.0
-pygments==2.13.0
-    # via rich
 pyparsing==3.0.9
-    # via packaging
+pyrsistent==0.18.1
-pyrsistent==0.19.2
-    # via jsonschema
 python-dateutil==2.8.2
-    # via
-    #   arrow
-    #   kubernetes
 python-slugify==6.1.2
-    # via cookiecutter
 python-vagrant==1.0.0
-    # via molecule-vagrant
+PyYAML==6.0
-pyyaml==6.0
-    # via
-    #   -r requirements.in
-    #   ansible-compat
-    #   ansible-core
-    #   ansible-lint
-    #   cookiecutter
-    #   kubernetes
-    #   molecule
-    #   molecule-vagrant
-    #   pre-commit
-    #   yamllint
 requests==2.28.1
-    # via
-    #   cookiecutter
-    #   kubernetes
-    #   requests-oauthlib
 requests-oauthlib==1.3.1
-    # via kubernetes
 resolvelib==0.8.1
-    # via ansible-core
 rich==12.6.0
-    # via
-    #   ansible-lint
-    #   enrich
-    #   molecule
 rsa==4.9
-    # via google-auth
+ruamel.yaml==0.17.21
-ruamel-yaml==0.17.21
+ruamel.yaml.clib==0.2.7
-    # via ansible-lint
-ruamel-yaml-clib==0.2.7
-    # via ruamel-yaml
 selinux==0.2.1
-    # via molecule-vagrant
 six==1.16.0
-    # via
-    #   google-auth
-    #   kubernetes
-    #   python-dateutil
 subprocess-tee==0.3.5
-    # via ansible-compat
 text-unidecode==1.3
-    # via python-slugify
-toml==0.10.2
-    # via pre-commit
 tomli==2.0.1
-    # via black
 typing-extensions==4.4.0
-    # via
-    #   black
-    #   rich
 urllib3==1.26.12
-    # via
-    #   kubernetes
-    #   requests
-virtualenv==20.16.6
-    # via pre-commit
 wcmatch==8.4.1
-    # via ansible-lint
+websocket-client==1.4.1
-websocket-client==1.4.2
-    # via kubernetes
 yamllint==1.28.0
-    # via
-    #   -r requirements.in
-    #   ansible-lint
 zipp==3.10.0
-    # via importlib-resources
-
-# The following packages are considered to be unsafe in a requirements file:
-# setuptools

reset.yml

@@ -1,9 +1,12 @@
 ---
+
 - hosts: k3s_cluster
   gather_facts: yes
   become: yes
   roles:
     - role: reset
+    - role: raspberrypi
+      vars: {state: absent}
   post_tasks:
     - name: Reboot and wait for node to come back up
       reboot:

roles/authelia/tasks/main.yml

@@ -1,20 +0,0 @@
----
-- name: Add traefik helm repo
-  kubernetes.core.helm_repository:
-    name: authelia
-    repo_url: "https://charts.authelia.com"
-
-- name: Update the repository cache
-  kubernetes.core.helm:
-    kubeconfig: /Users/lino.silva/.kube/config
-    name: dummy
-    namespace: kube-system
-    state: absent
-    update_repo_cache: true
-
-- name: Deploy latest version of Authelia chart inside
-  kubernetes.core.helm:
-    kubeconfig: /Users/lino.silva/.kube/config
-    name: authelia
-    chart_ref: authelia/authelia
-    values: "{{ lookup('template', 'values.yml') | from_yaml }}"

roles/cert-manager/tasks/main.yml

@@ -1,65 +0,0 @@
----
-# From repository
-- name: Add traefik helm repo
-  kubernetes.core.helm_repository:
-    name: jetstack
-    repo_url: "https://charts.jetstack.io"
-
-- name: Update the repository cache
-  kubernetes.core.helm:
-    kubeconfig: /Users/lino.silva/.kube/config
-    name: dummy
-    namespace: kube-system
-    state: absent
-    update_repo_cache: true
-
-- name: Download cert-manager.crds manifest to the cluster.
-  ansible.builtin.get_url:
-    url: https://github.com/cert-manager/cert-manager/releases/download/v1.10.0/cert-manager.crds.yaml
-    dest: /tmp/cert-manager.crds.yaml
-    mode: "0664"
-
-- name: Apply cert-manager.crds manifest to the cluster.
-  kubernetes.core.k8s:
-    kubeconfig: /Users/lino.silva/.kube/config
-    state: present
-    src: /tmp/cert-manager.crds.yaml
-
-- name: Deploy latest version of cert-manager chart inside cert-manager namespace (and create it)
-  kubernetes.core.helm:
-    kubeconfig: /Users/lino.silva/.kube/config
-    name: cert-manager
-    chart_ref: jetstack/cert-manager
-    release_namespace: cert-manager
-    create_namespace: true
-    values: "{{ lookup('template', 'values.yml') | from_yaml }}"
-
-- name: Deploy cert-manager secret - Cloudflare
-  kubernetes.core.k8s:
-    kubeconfig: /Users/lino.silva/.kube/config
-    state: present
-    definition: "{{ lookup('template', 'secret-cf-token.yml') | from_yaml }}"
-
-- name: Deploy lets encrypt staging
-  kubernetes.core.k8s:
-    kubeconfig: /Users/lino.silva/.kube/config
-    state: present
-    definition: "{{ lookup('template', 'letsencrypt-staging.yml') | from_yaml }}"
-
-- name: Deploy cert-manager staging
-  kubernetes.core.k8s:
-    kubeconfig: /Users/lino.silva/.kube/config
-    state: present
-    definition: "{{ lookup('template', 'lino-cooking.staging.yml') | from_yaml }}"
-
-- name: Deploy lets encrypt production
-  kubernetes.core.k8s:
-    kubeconfig: /Users/lino.silva/.kube/config
-    state: present
-    definition: "{{ lookup('template', 'letsencrypt-production.yml') | from_yaml }}"
-
-- name: Deploy cert-manager production
-  kubernetes.core.k8s:
-    kubeconfig: /Users/lino.silva/.kube/config
-    state: present
-    definition: "{{ lookup('template', 'lino-cooking.prod.yml') | from_yaml }}"

roles/cert-manager/templates/letsencrypt-production.yml

@@ -1,21 +0,0 @@
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-production
-spec:
-  acme:
-    server: https://acme-v02.api.letsencrypt.org/directory
-    email: letsencrypt@lino.cooking
-    privateKeySecretRef:
-      name: letsencrypt-production
-    solvers:
-      - dns01:
-          cloudflare:
-            email: D5&YbHe&oKx82uuTQ^AfW#$*D8GsDE#K3x^446S^wvH#8T@W2C
-            apiTokenSecretRef:
-              name: cloudflare-api-token-secret
-              key: cloudflare-token
-        selector:
-          dnsZones:
-            - "lino.cooking"

roles/cert-manager/templates/letsencrypt-staging.yml

@@ -1,21 +0,0 @@
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-staging
-spec:
-  acme:
-    server: https://acme-staging-v02.api.letsencrypt.org/directory
-    email: letsencrypt@lino.cooking
-    privateKeySecretRef:
-      name: letsencrypt-staging
-    solvers:
-      - dns01:
-          cloudflare:
-            email: okulto+cloudflare@gmail.com
-            apiTokenSecretRef:
-              name: cloudflare-api-token-secret
-              key: api-token
-        selector:
-          dnsZones:
-            - "lino.cooking"

roles/cert-manager/templates/lino-cooking.prod.yml

@@ -1,15 +0,0 @@
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: lino-cooking
-  namespace: default
-spec:
-  secretName: lino-cooking-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "*.lino.cooking"
-  dnsNames:
-    - "lino.cooking"
-    - "*.lino.cooking"

roles/cert-manager/templates/lino-cooking.staging.yml

@@ -1,15 +0,0 @@
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: lino-cooking
-  namespace: default
-spec:
-  secretName: lino-cooking-staging-tls
-  issuerRef:
-    name: letsencrypt-staging
-    kind: ClusterIssuer
-  commonName: "*.lino.cooking"
-  dnsNames:
-    - "lino.cooking"
-    - "*.lino.cooking"

roles/cert-manager/templates/secret-cf-token.yml

@@ -1,9 +0,0 @@
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cloudflare-api-token-secret
-  namespace: cert-manager
-type: Opaque
-stringData:
-  cloudflare-token: "{{ cloudflare_api_key }}"

roles/cert-manager/templates/values.yml

@@ -1,10 +0,0 @@
-installCRDs: false
-replicaCount: 3
-extraArgs:
-  - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
-  - --dns01-recursive-nameservers-only
-podDnsPolicy: None
-podDnsConfig:
-  nameservers:
-    - "1.1.1.1"
-    - "9.9.9.9"

roles/frigate/install-app/tasks/main.yml

@@ -1,20 +0,0 @@
----
-- name: Create directory for docker-compose
-  ansible.builtin.file:
-    path: /root/docker/frigate/
-    state: directory
-    mode: "0755"
-
-- name: Copy docker-compose file
-  template:
-    src: "docker-compose.yml"
-    dest: /root/docker/frigate/docker-compose.yml
-    owner: root
-    group: root
-    mode: 0755
-
-- name: Run docker-compose
-  ansible.builtin.shell:
-  args:
-    cmd: docker compose up -d
-    chdir: /root/docker/frigate/

roles/frigate/install-app/templates/docker-compose.yml

@@ -1,20 +0,0 @@
-version: "3.9"
-services:
-  frigate:
-    container_name: frigate
-    privileged: true
-    restart: unless-stopped
-    image: blakeblackshear/frigate:stable
-    shm_size: "256mb"
-    devices:
-      - /dev/bus/usb:/dev/bus/usb
-    volumes:
-      - /etc/localtime:/etc/localtime:ro
-      - /config/config.yml:/config/config.yml:ro
-      - /db:/db
-      - type: tmpfs
-        target: /tmp/cache
-        tmpfs:
-          size: 1000000000
-    ports:
-      - "5000:5000"

roles/frigate/install-docker/tasks/main.yml

@@ -1,27 +0,0 @@
----
-- name: Get convenience script
-  uri:
-    url: "https://get.docker.com"
-    method: GET
-    dest: /tmp/get-docker.sh
-    mode: a+x
-    creates: /tmp/get-docker.sh
-
-- name: Execute script
-  ansible.builtin.shell: /tmp/get-docker.sh
-
-- name: Ensure group "docker" exists
-  ansible.builtin.group:
-    name: docker
-    state: present
-
-- name: Add root user to docker group
-  ansible.builtin.user:
-    name: root
-    groups: docker
-    append: yes
-
-- name: Enable docker on startup
-  ansible.builtin.shell: |
-    systemctl enable docker.service
-    systemctl enable containerd.service

roles/frigate/provision/cgroup/tasks/main.yml

@@ -1,15 +0,0 @@
----
-- name: Add cgroup rule
-  ansible.builtin.blockinfile:
-    path: /etc/pve/nodes/epona/lxc/605.conf
-    state: present
-    block: |
-      lxc.cgroup2.devices.allow: c 226:0 rwm
-      lxc.cgroup2.devices.allow: c 226:128 rwm
-      lxc.cgroup2.devices.allow: c 29:0 rwm
-      lxc.cgroup2.devices.allow: c 189:* rwm
-      lxc.cgroup2.devices.allow: a
-      lxc.mount.entry: /dev/dri/renderD128 dev/dri/renderD128 none bind,optional,create=file 0, 0
-      lxc.mount.entry: /dev/bus/usb/002 dev/bus/usb/002 none bind,optional,create=dir 0, 0
-      lxc.cap.drop:
-      lxc.mount.auto: cgroup:rw

roles/frigate/provision/create/tasks/main.yml

@@ -1,28 +0,0 @@
----
-- name: Create container
-  community.general.proxmox:
-    vmid: 605
-    node: epona
-    api_user: root@pam
-    api_password: "{{ proxmox_api_password }}"
-    api_host: 10.0.2.2
-    password: "{{ lxc_password }}"
-    hostname: frigate
-    ostemplate: "hyrule-8tb-nfs:vztmpl/debian-11-standard_11.3-1_amd64.tar.zst"
-    netif: "{'net0':'name=eth0,\
-      gw=10.0.0.1,\
-      ip=10.0.2.14/21,\
-      hwaddr=44:ae:9f:cd:b9:2a,\
-      bridge=vmbr0'}"
-    cores: 1
-    memory: 6144
-    unprivileged: no
-    swap: 0
-    searchdomain: "home"
-    onboot: 1
-    mounts: '{"mp0":"/mnt/pve/hyrule-8tb-nfs/frigate/config,mp=/config","mp1":"/mnt/pve/hyrule-8tb-nfs/frigate/media,mp=/media/frigate","mp2":"local-lvm:50,mp=/db"}'
-    features:
-      - nesting=1
-      - keyctl=1
-    disk: local-lvm:50
-    force: yes

roles/frigate/provision/delete/tasks/main.yml

@@ -1,26 +0,0 @@
----
-- name: Stop container
-  community.general.proxmox:
-    vmid: 605
-    api_user: root@pam
-    api_password: "{{ proxmox_api_password }}"
-    api_host: 10.0.2.2
-    state: stopped
-  ignore_errors: true
-  timeout: 90
-
-- name: Remove containers
-  community.general.proxmox:
-    vmid: 605
-    api_user: root@pam
-    api_password: "{{ proxmox_api_password }}"
-    api_host: 10.0.2.2
-    state: absent
-  ignore_errors: true
-  timeout: 90
-
-- name: Remove .ssh/known_hosts lines
-  ansible.builtin.lineinfile:
-    path: /Users/lino.silva/.ssh/known_hosts
-    state: absent
-    regexp: "^10.0.2.14"

roles/frigate/provision/enable-ssh/tasks/main.yml

@@ -1,8 +0,0 @@
----
-# Unable to use ansible.builtin.lineinfile, because we need to run this through the proxmox host (because SSH is not enabled duh)
-
-- name: Allow SSH into LXC
-  ansible.builtin.command: lxc-attach -n 605 -- sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" /etc/ssh/sshd_config
-
-- name: Restart SSH Service
-  ansible.builtin.command: lxc-attach -n 605 service ssh restart

roles/frigate/provision/start/tasks/main.yml

@@ -1,8 +0,0 @@
----
-- name: Start deployments
-  community.general.proxmox:
-    vmid: 605
-    api_user: root@pam
-    api_password: "{{ proxmox_api_password }}"
-    api_host: 10.0.2.2
-    state: started

roles/frigate/update/tasks/main.yml

@@ -1,6 +0,0 @@
----
-- name: Update all packages to their latest version
-  become: true
-  ansible.builtin.apt:    
-    update_cache: yes
-    upgrade: full

roles/k3s/copy-config/tasks/main.yml

@@ -1,7 +0,0 @@
----
-- name: Store kube configuration
-  ansible.builtin.fetch:
-    src: ~/.kube/config
-    dest: ~/.kube/config
-    flat: true
-  when: ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname']

roles/k3s/dashboard/templates/dashboard.admin-user-role.yml

@@ -1,12 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: admin-user
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
-subjects:
-  - kind: ServiceAccount
-    name: admin-user
-    namespace: kubernetes-dashboard

roles/k3s/dashboard/templates/dashboard.admin-user.yml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: admin-user
-  namespace: kubernetes-dashboard

roles/k3s/master/tasks/main.yml

@@ -1,4 +1,5 @@
 ---
+
 - name: Clean previous runs of k3s-init
   systemd:
     name: k3s-init
@@ -10,7 +11,7 @@
   failed_when: false
   changed_when: false
   args:
-    warn: false # The ansible systemd module does not support reset-failed
+    warn: false  # The ansible systemd module does not support reset-failed
 
 - name: Create manifests directory on first master
   file:
@@ -61,12 +62,12 @@
 - name: Init cluster inside the transient k3s-init service
   command:
     cmd: "systemd-run -p RestartSec=2 \
-      -p Restart=on-failure \
+                      -p Restart=on-failure \
-      --unit=k3s-init \
+                      --unit=k3s-init \
-      k3s server {{ server_init_args }}"
+                      k3s server {{ server_init_args }}"
     creates: "{{ systemd_dir }}/k3s.service"
   args:
-    warn: false # The ansible systemd module does not support transient units
+    warn: false  # The ansible systemd module does not support transient units
 
 - name: Verification
   block:
@@ -75,8 +76,8 @@
         cmd: k3s kubectl get nodes -l "node-role.kubernetes.io/master=true" -o=jsonpath="{.items[*].metadata.name}"
       register: nodes
       until: nodes.rc == 0 and (nodes.stdout.split() | length) == (groups['master'] | length)
-      retries: "{{ retry_count | default(40) }}"
+      retries: "{{ retry_count | default(20) }}"
-      delay: 20
+      delay: 10
       changed_when: false
   always:
     - name: Save logs of k3s-init.service
@@ -84,7 +85,7 @@
       when: log_destination
       vars:
         log_destination: >-
-          {{ lookup('ansible.builtin.env', 'ANSIBLE_K3S_LOG_DIR', default=True) }}
+          {{ lookup('ansible.builtin.env', 'ANSIBLE_K3S_LOG_DIR', default=False) }}
     - name: Kill the temporary service used for initialization
       systemd:
         name: k3s-init

roles/k3s/provision/cgroup/tasks/main.yml

@@ -1,24 +0,0 @@
----
-- name: Add cgroup rule
-  ansible.builtin.lineinfile:
-    path: /etc/pve/nodes/{{ ansible_hostname }}/lxc/{{ hostvars[ansible_hostname]['k3s_vmid'] }}.conf
-    state: present
-    line: lxc.apparmor.profile{{":"}} unconfined
-
-- name: Add cgroup rule
-  ansible.builtin.lineinfile:
-    path: /etc/pve/nodes/{{ ansible_hostname }}/lxc/{{ hostvars[ansible_hostname]['k3s_vmid'] }}.conf
-    state: present
-    line: lxc.cap.drop{{":"}}
-
-- name: Add cgroup rule
-  ansible.builtin.lineinfile:
-    path: /etc/pve/nodes/{{ ansible_hostname }}/lxc/{{ hostvars[ansible_hostname]['k3s_vmid'] }}.conf
-    state: present
-    line: lxc.mount.auto"{{":"}}" "proc{{":"}}rw sys{{":"}}rw"
-
-- name: Add cgroup rule
-  ansible.builtin.lineinfile:
-    path: /etc/pve/nodes/{{ ansible_hostname }}/lxc/{{ hostvars[ansible_hostname]['k3s_vmid'] }}.conf
-    state: present
-    line: lxc.cgroup2.devices.allow{{":"}} c 10{{":"}}200 rwm

roles/k3s/provision/cloud-init/tasks/main.yml

@@ -1,21 +0,0 @@
----
-- name: Configure cloud-init - IP
-  ansible.builtin.command: qm set "{{ k3s_vmid }}" --ipconfig0 ip="{{ k3s_vm_host }}"/21,gw=10.0.0.1
-
-- name: Configure cloud-init - User
-  ansible.builtin.command: qm set "{{ k3s_vmid }}" --ciuser "root"
-
-- name: Configure cloud-init - Password
-  ansible.builtin.command: qm set "{{ k3s_vmid }}" --cipassword "{{ ansible_ssh_pass }}"
-
-- name: Copy SSH Pub key
-  ansible.builtin.copy:
-    src: ~/.ssh/id_rsa.pub
-    dest: /tmp/ansible_controller-key.pub
-    mode: 0600
-
-- name: Configure cloud-init - SSH Key
-  ansible.builtin.command: qm set "{{ k3s_vmid }}" --sshkey /tmp/ansible_controller-key.pub
-
-- name: Configure networking
-  ansible.builtin.command: qm set "{{ k3s_vmid }}" --net0 virtio={{ k3s_mac_addr }},bridge=vmbr0

roles/k3s/provision/create/tasks/main.yml

@@ -1,51 +0,0 @@
----
-- name: Create containers
-  # community.general.proxmox:
-  #   vmid: "{{ hostvars[item]['k3s_vmid'] }}"
-  #   node: "{{ item }}"
-  #   api_user: root@pam
-  #   api_password: "{{ proxmox_api_password }}"
-  #   api_host: 10.0.2.2
-  #   password: "{{ lxc_password }}"
-  #   hostname: "{{ hostvars[item]['k3s_hostname'] }}"
-  #   ostemplate: "hyrule-8tb-nfs:vztmpl/debian-11-standard_11.3-1_amd64.tar.zst"
-  #   netif: "{'net0':'name=eth0,\
-  #     gw=10.0.0.1,\
-  #     ip={{ hostvars[item]['k3s_lxc_host'] }}/21,\
-  #     hwaddr={{ hostvars[item]['k3s_mac_addr'] }},\
-  #     bridge=vmbr0'}"
-  #   cores: "{{ hostvars[item]['k3s_cores'] }}"
-  #   memory: "{{ hostvars[item]['k3s_memory'] }}"
-  #   unprivileged: no
-  #   swap: 0
-  #   searchdomain: "home"
-  #   onboot: 1
-  #   features:
-  #     - nesting=1
-  #   disk: local-lvm:{{ hostvars[item]['k3s_disk'] }}
-  #   force: yes
-  # loop: "{{ groups['k3s_hosts'] }}"
-  proxmox_kvm:
-    api_user: root@pam
-    api_password: "{{ proxmox_api_password }}"
-    api_host: 10.0.2.2
-    name: "{{ hostvars[item]['k3s_hostname'] }}"
-    node: "{{ item }}"
-    newid: "{{ hostvars[item]['k3s_vmid'] }}"
-    clone: debian-10-openstack-amd64
-    vmid: "{{ hostvars[item]['k3s_template_id'] }}"
-    timeout: 900
-  loop: "{{ groups['k3s_hosts'] }}"
-
-- name: Update VMs
-  proxmox_kvm:
-    api_user: root@pam
-    api_password: "{{ proxmox_api_password }}"
-    api_host: 10.0.2.2
-    memory: "{{ hostvars[item]['k3s_memory'] }}"
-    cores: "{{ hostvars[item]['k3s_cores'] }}"
-    vmid: "{{ hostvars[item]['k3s_vmid'] }}"
-    node: "{{ item }}"
-    update: yes
-    agent: yes
-  loop: "{{ groups['k3s_hosts'] }}"

roles/k3s/provision/delete/tasks/main.yml

@@ -1,44 +0,0 @@
----
-- name: Stop containers
-  # community.general.proxmox:
-  #   vmid: "{{ hostvars[item]['k3s_vmid'] }}"
-  #   api_user: root@pam
-  #   api_password: "{{ proxmox_api_password }}"
-  #   api_host: 10.0.2.2
-  #   state: stopped
-  proxmox_kvm:
-    api_user: root@pam
-    api_password: "{{ proxmox_api_password }}"
-    api_host: 10.0.2.2
-    name: "{{ hostvars[item]['k3s_hostname'] }}"
-    node: "{{ item }}"
-    state: stopped
-    timeout: 240
-  loop: "{{ groups['k3s_hosts'] }}"
-  ignore_errors: true
-
-- name: Remove containers
-  # community.general.proxmox:
-  # vmid: "{{ hostvars[item]['k3s_vmid'] }}"
-  # api_user: root@pam
-  # api_password: "{{ proxmox_api_password }}"
-  # api_host: "{{ hostvars[item]['ip_addr'] }}"
-  # state: absent
-  proxmox_kvm:
-    api_user: root@pam
-    api_password: "{{ proxmox_api_password }}"
-    api_host: 10.0.2.2
-    name: "{{ hostvars[item]['k3s_hostname'] }}"
-    node: "{{ item }}"
-    state: absent
-    timeout: 90
-  loop: "{{ groups['k3s_hosts'] }}"
-  ignore_errors: true
-
-- name: Remove .ssh/known_hosts lines
-  ansible.builtin.lineinfile:
-    path: /Users/lino.silva/.ssh/known_hosts
-    state: absent
-    # regexp: '^{{ hostvars[item]["k3s_lxc_host"] }}'
-    regexp: '^{{ hostvars[item]["k3s_vm_host"] }}'
-  loop: "{{ groups['k3s_hosts'] }}"

roles/k3s/provision/enable-ssh/tasks/main.yml

@@ -1,8 +0,0 @@
----
-# Unable to use ansible.builtin.lineinfile, because we need to run this through the proxmox host (because SSH is not enabled duh)
-
-- name: Allow SSH into LXC
-  ansible.builtin.command: lxc-attach -n "{{ k3s_vmid }}" -- sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" /etc/ssh/sshd_config
-
-- name: Restart SSH Service
-  ansible.builtin.command: lxc-attach -n "{{ k3s_vmid }}" service ssh restart

roles/k3s/provision/pre/tasks/main.yml

@@ -1,19 +0,0 @@
----
-# - name: Move storage to local_lvm
-#   ansible.builtin.command: qm disk move "{{ k3s_vmid }}" scsi0 local-lvm
-#   ignore_errors: true
-
-# - name: Resize storage
-#   ansible.builtin.command: qm disk resize "{{ k3s_vmid }}" scsi0 +"{{ k3s_disk }}G"
-
-- name: Allow ipv4 forwarding
-  ansible.builtin.shell: "sysctl net.ipv4.ip_forward=1"
-
-- name: Allow ipv6 forwarding
-  ansible.builtin.shell: "sysctl net.ipv6.conf.all.forwarding=1"
-
-- name: Uncomment ipv4 forward line on /etc/sysctl.conf
-  ansible.builtin.shell: "sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/g' /etc/sysctl.conf"
-
-- name: Uncomment ipv6 forward line on /etc/sysctl.conf
-  ansible.builtin.shell: "sed -i 's/#net.ipv6.conf.all.forwarding=1/net.ipv6.conf.all.forwarding=1/g' /etc/sysctl.conf"

roles/k3s/provision/start/tasks/main.yml

@@ -1,16 +0,0 @@
----
-- name: Start deployments
-  # community.general.proxmox:
-  #   vmid: "{{ hostvars[item]['k3s_vmid'] }}"
-  #   api_user: root@pam
-  #   api_password: "{{ proxmox_api_password }}"
-  #   api_host: 10.0.2.2
-  #   state: started
-  community.general.cloud.misc.proxmox_kvm:
-    api_user: root@pam
-    api_password: "{{ proxmox_api_password }}"
-    api_host: 10.0.2.2
-    name: "{{ hostvars[item]['k3s_hostname'] }}"
-    node: "{{ item }}"
-    state: started
-  loop: "{{ groups['k3s_hosts'] }}"

roles/longhorn/tasks/main.yml

@@ -1,22 +0,0 @@
----
-- name: Add longhorn helm repo
-  kubernetes.core.helm_repository:
-    name: longhorn
-    repo_url: "https://charts.longhorn.io"
-
-- name: Update the repository cache
-  kubernetes.core.helm:
-    kubeconfig: /Users/lino.silva/.kube/config
-    name: dummy
-    namespace: kube-system
-    state: absent
-    update_repo_cache: true
-
-- name: Deploy latest version of Longhorn chart inside longhorn-system namespace (and create it)
-  kubernetes.core.helm:
-    kubeconfig: /Users/lino.silva/.kube/config
-    name: longhorn
-    chart_ref: longhorn/longhorn
-    release_namespace: longhorn-system
-    create_namespace: true
-    chart_version: 1.2.4

roles/nginx/tasks/main.yml

@@ -1,18 +0,0 @@
----
-- name: Deploy nginx - deployment
-  kubernetes.core.k8s:
-    kubeconfig: /Users/lino.silva/.kube/config
-    state: present
-    definition: "{{ lookup('template', 'deployment.yml') | from_yaml }}"
-
-- name: Deploy nginx - service
-  kubernetes.core.k8s:
-    kubeconfig: /Users/lino.silva/.kube/config
-    state: present
-    definition: "{{ lookup('template', 'service.yml') | from_yaml }}"
-
-- name: Deploy nginx - ingress
-  kubernetes.core.k8s:
-    kubeconfig: /Users/lino.silva/.kube/config
-    state: present
-    definition: "{{ lookup('template', 'ingress.yml') | from_yaml }}"

roles/nginx/templates/ingress.yml

@@ -1,26 +0,0 @@
----
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: nginx
-  namespace: default
-  annotations:
-    kubernetes.io/ingress.class: traefik-external
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`www.nginx.lino.cooking`)
-      kind: Rule
-      services:
-        - name: nginx
-          port: 80
-    - match: Host(`nginx.lino.cooking`)
-      kind: Rule
-      services:
-        - name: nginx
-          port: 80
-      middlewares:
-        - name: default-headers
-  tls:
-    secretName: lino-cooking-tls

roles/pihole/provision/create/tasks/main.yml

@@ -1,25 +0,0 @@
----
-- name: Create Piholes
-  community.general.proxmox:
-    vmid: "{{ hostvars[item]['vmid'] }}"
-    node: "{{ hostvars[item]['node'] }}"
-    api_user: root@pam
-    api_password: "{{ proxmox_api_password }}"
-    api_host: 10.0.2.2
-    password: "{{ lxc_password }}"
-    hostname: "{{ item }}"
-    ostemplate: "hyrule-8tb-nfs:vztmpl/debian-11-standard_11.3-1_amd64.tar.zst"
-    netif: "{'net0':'name=eth0,\
-      gw=10.0.0.1,\
-      ip={{ hostvars[item]['ansible_host'] }}/21,\
-      hwaddr={{ hostvars[item]['mac_addr'] }},\
-      bridge=vmbr0'}"
-    cores: 1
-    memory: 2048
-    unprivileged: no
-    swap: 512
-    searchdomain: "home"
-    onboot: 1
-    disk: local-lvm:8
-    force: yes
-  loop: "{{ groups['pihole'] }}"

roles/pihole/provision/delete/tasks/main.yml

@@ -1,26 +0,0 @@
----
-- name: Stop containers
-  community.general.proxmox:
-    vmid: "{{ vmid }}"
-    api_user: root@pam
-    api_password: "{{ proxmox_api_password }}"
-    api_host: 10.0.2.2
-    state: stopped
-  ignore_errors: true
-  timeout: 90
-
-- name: Remove containers
-  community.general.proxmox:
-    vmid: "{{ vmid }}"
-    api_user: root@pam
-    api_password: "{{ proxmox_api_password }}"
-    api_host: 10.0.2.2
-    state: absent
-  ignore_errors: true
-  timeout: 90
-
-- name: Remove .ssh/known_hosts lines
-  ansible.builtin.lineinfile:
-    path: /Users/lino.silva/.ssh/known_hosts
-    state: absent
-    regexp: "^{{ ansible_host }}"

roles/pihole/provision/enable-ssh/tasks/main.yml

@@ -1,8 +0,0 @@
----
-# Unable to use ansible.builtin.lineinfile, because we need to run this through the proxmox host (because SSH is not enabled duh)
-
-- name: Allow SSH into LXC
-  ansible.builtin.command: lxc-attach -n "{{ vmid }}" -- sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" /etc/ssh/sshd_config
-
-- name: Restart SSH Service
-  ansible.builtin.command: lxc-attach -n "{{ vmid }}" service ssh restart

roles/pihole/provision/pre/tasks/main.yml

@@ -1,12 +0,0 @@
----
-- name: Allow ipv4 forwarding
-  ansible.builtin.shell: "sysctl net.ipv4.ip_forward=1"
-
-- name: Allow ipv6 forwarding
-  ansible.builtin.shell: "sysctl net.ipv6.conf.all.forwarding=1"
-
-- name: Uncomment ipv4 forward line on /etc/sysctl.conf
-  ansible.builtin.shell: "sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/g' /etc/sysctl.conf"
-
-- name: Uncomment ipv6 forward line on /etc/sysctl.conf
-  ansible.builtin.shell: "sed -i 's/#net.ipv6.conf.all.forwarding=1/net.ipv6.conf.all.forwarding=1/g' /etc/sysctl.conf"

roles/pihole/provision/start/tasks/main.yml

@@ -1,9 +0,0 @@
----
-- name: Start deployments
-  community.general.proxmox:
-    vmid: "{{ hostvars[item]['k3s_vmid'] }}"
-    api_user: root@pam
-    api_password: "{{ proxmox_api_password }}"
-    api_host: 10.0.2.2
-    state: started
-  loop: "{{ groups['baremetal'] }}"