fix(ci): pin + cache

.ansible-lint

@@ -1,11 +1,17 @@
 ---
 exclude_paths:
   # default paths
-  - ".cache/"
+  - '.cache/'
-  - ".github/"
+  - '.github/'
-  - "test/fixtures/formatting-before/"
+  - 'test/fixtures/formatting-before/'
-  - "test/fixtures/formatting-prettier/"
+  - 'test/fixtures/formatting-prettier/'
+
+  # The "converge" and "reset" playbooks use import_playbook in
+  # conjunction with the "env" lookup plugin, which lets the
+  # syntax check of ansible-lint fail.
+  - 'molecule/**/converge.yml'
+  - 'molecule/**/prepare.yml'
+  - 'molecule/**/reset.yml'
 
 skip_list:
-  - "fqcn-builtins"
+  - 'fqcn-builtins'
-  - "name[play]"

.github/FUNDING.yml

@@ -0,0 +1,3 @@
+---
+github: timothystewart6
+patreon: technotim

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,77 @@
+
+<!-- It's a good idea to check this post first for general troubleshooting https://github.com/techno-tim/k3s-ansible/discussions/19   -->
+
+<!--- Provide a general summary of the issue in the Title above -->
+
+## Expected Behavior
+
+<!--- Tell us what should happen -->
+
+## Current Behavior
+<!--- Tell us what happens instead of the expected behavior -->
+
+## Steps to Reproduce
+
+<!--- reproduce this bug. Include code to reproduce, if relevant -->
+
+1.
+2.
+3.
+4.
+
+## Context (variables)
+<!--- please include which OS, along with the variables used when running the playbook -->
+
+Operating system:
+
+Hardware:
+
+### Variables Used
+
+`all.yml`
+
+```yml
+k3s_version: ""
+ansible_user: NA
+systemd_dir: ""
+
+flannel_iface: ""
+
+apiserver_endpoint: ""
+
+k3s_token: "NA"
+
+extra_server_args: ""
+extra_agent_args: ""
+
+kube_vip_tag_version: ""
+
+metal_lb_speaker_tag_version: ""
+metal_lb_controller_tag_version: ""
+
+metal_lb_ip_range: ""
+```
+
+### Hosts
+
+`host.ini`
+
+```ini
+[master]
+IP.ADDRESS.ONE
+IP.ADDRESS.TWO
+IP.ADDRESS.THREE
+
+[node]
+IP.ADDRESS.FOUR
+IP.ADDRESS.FIVE
+
+[k3s_cluster:children]
+master
+node
+```
+
+## Possible Solution
+<!--- Not obligatory, but suggest a fix/reason for the bug, -->
+
+- [ ] I've checked the [General Troubleshooting Guide](https://github.com/techno-tim/k3s-ansible/discussions/20)

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,15 @@
+# Proposed Changes
+<!--- Provide a general summary of your changes -->
+
+-
+-
+-
+
+## Checklist
+
+- [ ] Tested locally
+- [ ] Ran `site.yml` playbook
+- [ ] Ran `reset.yml` playbook
+- [ ] Did not add any unnecessary changes
+- [ ] 🚀
+- [ ] Ran pre-commit install at least once before committing

.github/dependabot.yml

@@ -0,0 +1,11 @@
+---
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    rebase-strategy: "auto"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]

.github/download-boxes.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# download-boxes.sh
+# Check all molecule.yml files for required Vagrant boxes and download the ones that are not
+# already present on the system.
+
+set -euo pipefail
+YQ_VERSION=v4.29.2
+YQ_BINARY=yq_linux_amd64
+GIT_ROOT=$(git rev-parse --show-toplevel)
+PROVIDER=virtualbox
+
+# get yq used for filtering
+sudo wget https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/${YQ_BINARY} -O /usr/bin/yq &&\
+    sudo chmod +x /usr/bin/yq
+
+# Read all boxes for all platforms from the "molecule.yml" files
+all_boxes=$(cat "${GIT_ROOT}"/molecule/*/molecule.yml |
+    yq -r '.platforms[].box' |         # Read the "box" property of each node under "platforms"
+    grep --invert-match --regexp=--- | # Filter out file separators
+    sort |
+    uniq)
+
+# Read the boxes that are currently present on the system (for the current provider)
+present_boxes=$(
+    (vagrant box list |
+        grep "${PROVIDER}" | # Filter by boxes available for the current provider
+        awk '{print $1;}' |  # The box name is the first word in each line
+        sort |
+        uniq) ||
+        echo "" # In case any of these commands fails, just use an empty list
+)
+
+# The boxes that we need to download are the ones present in $all_boxes, but not $present_boxes.
+download_boxes=$(comm -2 -3 <(echo "${all_boxes}") <(echo "${present_boxes}"))
+
+# Actually download the necessary boxes
+if [ -n "${download_boxes}" ]; then
+    echo "${download_boxes}" | while IFS= read -r box; do
+        vagrant box add --provider "${PROVIDER}" "${box}"
+    done
+fi

.github/workflows/lint.yml

@@ -0,0 +1,73 @@
+---
+name: Linting
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+    paths-ignore:
+      - '**/README.md'
+jobs:
+  pre-commit-ci:
+    name: Pre-Commit
+    runs-on: self-hosted
+    env:
+      PYTHON_VERSION: "3.10"
+
+    steps:
+      - name: Check out the codebase
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # 3.0.2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Set up Python ${{ env.PYTHON_VERSION }}
+        uses: actions/setup-python@13ae5bb136fac2878aff31522b9efb785519f984 # 4.3.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          cache: 'pip' # caching pip dependencies
+
+      - name: Cache pip
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('./requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: Cache Ansible
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
+        with:
+          path: ~/.ansible/collections
+          key: ${{ runner.os }}-ansible-${{ hashFiles('collections/requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-ansible-
+
+      - name: Install dependencies
+        run: |
+          echo "::group::Upgrade pip"
+          python3 -m pip install --upgrade pip
+          echo "::endgroup::"
+
+          echo "::group::Install Python requirements from requirements.txt"
+          python3 -m pip install -r requirements.txt
+          echo "::endgroup::"
+
+          echo "::group::Install Ansible role requirements from collections/requirements.yml"
+          ansible-galaxy install -r collections/requirements.yml
+          echo "::endgroup::"
+
+      - name: Run pre-commit
+        uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # 3.0.0
+
+  ensure-pinned-actions:
+    name: Ensure SHA Pinned Actions
+    runs-on: self-hosted
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # 3.0.2
+      - name: Ensure SHA pinned actions
+        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@6ca5574367befbc9efdb2fa25978084159c5902d # 1.3.0
+        with:
+          allowlist: |
+            aws-actions/
+            docker/login-action

.github/workflows/test.yml

@@ -0,0 +1,124 @@
+---
+name: Test
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+    paths-ignore:
+      - '**/README.md'
+jobs:
+  molecule:
+    name: Molecule
+    runs-on: self-hosted
+
+    strategy:
+      matrix:
+        scenario:
+          - default
+          - ipv6
+          - single_node
+      fail-fast: false
+    env:
+      PYTHON_VERSION: "3.10"
+      VAGRANT_DEFAULT_PROVIDER: virtualbox
+
+    steps:
+      - name: Check out the codebase
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # 3.0.2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Install Virtual Box from Oracle
+        run: |
+          echo "::group::Virtual Box"
+          wget -O- https://www.virtualbox.org/download/oracle_vbox_2016.asc | sudo gpg --dearmor --yes --output /usr/share/keyrings/oracle-virtualbox-2016.gpg
+          echo "deb [arch=amd64 signed-by=/usr/share/keyrings/oracle-virtualbox-2016.gpg] https://download.virtualbox.org/virtualbox/debian $(lsb_release -cs) contrib" | sudo tee -a /etc/apt/sources.list.d/virtualbox.list
+          sudo apt update && sudo apt install -y linux-headers-generic linux-headers-5.15.0-52-generic build-essential dkms virtualbox-dkms virtualbox-6.1
+          echo "::endgroup::"
+          echo "::group::Virtual Box Test"
+          vboxmanage --version
+          sudo /sbin/vboxconfig
+          sudo modprobe vboxdrv
+          vboxmanage --version
+          echo "::endgroup::"
+
+      - name: Install Vagrant
+        run: |
+          echo "::group::Install Vagrant"
+          wget -O- https://apt.releases.hashicorp.com/gpg | gpg --dearmor | sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg
+          echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
+          sudo apt update && sudo apt install -y vagrant
+          vagrant version
+          vagrant plugin list
+          vagrant plugin install vagrant-vbguest
+          vagrant plugin list
+          echo "::endgroup::"
+
+      - name: Configure VirtualBox
+        run: |-
+          sudo mkdir -p /etc/vbox
+          cat <<EOF | sudo tee -a /etc/vbox/networks.conf > /dev/null
+          * 192.168.30.0/24
+          * fdad:bad:ba55::/64
+          EOF
+
+      - name: Cache pip
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('./requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: Cache Vagrant boxes
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
+        with:
+          path: |
+            ~/.vagrant.d/boxes
+          key: vagrant-boxes-${{ hashFiles('**/molecule.yml') }}
+          restore-keys: |
+            vagrant-boxes
+
+      - name: Download Vagrant boxes for all scenarios
+        # To save some cache space, all scenarios share the same cache key.
+        # On the other hand, this means that the cache contents should be
+        # the same across all scenarios. This step ensures that.
+        run: ./.github/download-boxes.sh
+
+      - name: Set up Python ${{ env.PYTHON_VERSION }}
+        uses: actions/setup-python@13ae5bb136fac2878aff31522b9efb785519f984 # 4.3.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          cache: 'pip' # caching pip dependencies
+
+      - name: Install dependencies
+        run: |
+          echo "::group::Upgrade pip"
+          python3 -m pip install --upgrade pip
+          echo "::endgroup::"
+
+          echo "::group::Install Python requirements from requirements.txt"
+          python3 -m pip install -r requirements.txt
+          echo "::endgroup::"
+
+      - name: Test with molecule
+        run: molecule test --scenario-name ${{ matrix.scenario }}
+        env:
+          ANSIBLE_K3S_LOG_DIR: ${{ runner.temp }}/logs/k3s-ansible/${{ matrix.scenario }}
+          ANSIBLE_SSH_RETRIES: 4
+          ANSIBLE_TIMEOUT: 60
+          PY_COLORS: 1
+          ANSIBLE_FORCE_COLOR: 1
+
+      - name: Upload log files
+        if: always() # do this even if a step before has failed
+        uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # 3.1.1
+        with:
+          name: logs
+          path: |
+            ${{ runner.temp }}/logs
+
+      - name: Delete old box versions
+        if: always() # do this even if a step before has failed
+        run: vagrant box prune --force

.gitignore

@@ -1,2 +1 @@
 .env/
-*.log

.vscode/settings.json

@@ -1,7 +0,0 @@
-{
-  "prettier.bracketSpacing": false,
-  "ansible.python.interpreterPath": "/usr/local/bin/python3",
-  "files.associations": {
-    "*.yaml": "home-assistant"
-  }
-}

Dockerfile

@@ -1,20 +0,0 @@
-FROM ubuntu:20.04 as base
-ENV ANSIBLE_VERSION 2.9.17
-RUN apt-get update; \
-    apt-get install -y gcc python3 sshpass; \
-    apt-get install -y python3-pip; \
-    apt-get clean all
-RUN pip3 install --upgrade pip; \
-    pip3 install "ansible==${ANSIBLE_VERSION}"; \
-    pip3 install ansible;
-
-FROM base as update
-
-WORKDIR /ansible
-
-COPY collections/requirements.yml ./collections/requirements.yml
-COPY ansible.cfg .
-
-RUN ansible-galaxy collection install -r collections/requirements.yml 
-
-COPY . .

README.md

@@ -22,9 +22,9 @@ Build a Kubernetes cluster using Ansible with k3s. The goal is easily install a
 
 on processor architecture:
 
-- [x] x64
+- [X] x64
-- [x] arm64
+- [X] arm64
-- [x] armhf
+- [X] armhf
 
 ## ✅ System requirements
 
@@ -76,7 +76,7 @@ If needed, you can also edit `inventory/my-cluster/group_vars/all.yml` to match
 Start provisioning of the cluster using the following command:
 
 ```bash
-ansible-playbook site.yml -i inventory/my-cluster/hosts.ini --ask-become-pass --ask-vault-pass
+ansible-playbook site.yml -i inventory/my-cluster/hosts.ini
 ```
 
 After deployment control plane will be accessible via virtual ip-address which is defined in inventory/group_vars/all.yml as `apiserver_endpoint`
@@ -105,6 +105,13 @@ See the commands [here](https://docs.technotim.live/posts/k3s-etcd-ansible/#test
 
 Be sure to see [this post](https://github.com/techno-tim/k3s-ansible/discussions/20) on how to troubleshoot common problems
 
+### Testing the playbook using molecule
+
+This playbook includes a [molecule](https://molecule.rtfd.io/)-based test setup.
+It is run automatically in CI, but you can also run the tests locally.
+This might be helpful for quick feedback in a few cases.
+You can find more information about it [here](molecule/README.md).
+
 ## Thanks 🤝
 
 This repo is really standing on the shoulders of giants. Thank you to all those who have contributed and tanks to these repos for code and ideas:
@@ -112,8 +119,3 @@ This repo is really standing on the shoulders of giants. Thank you to all those
 - [k3s-io/k3s-ansible](https://github.com/k3s-io/k3s-ansible)
 - [geerlingguy/turing-pi-cluster](https://github.com/geerlingguy/turing-pi-cluster)
 - [212850a/k3s-ansible](https://github.com/212850a/k3s-ansible)
-
-## TODO
-
-- https://docs.k3s.io/installation/kube-dashboard
-- https://www.phillipsj.net/posts/k3s-enable-nfs-storage/

ansible.cfg

@@ -1,25 +1,12 @@
 [defaults]
 nocows = True
 roles_path = ./roles
-inventory               = ./inventory/my-cluster/hosts.ini
+inventory  = ./hosts.ini
-stdout_callback         = yaml
-interpreter_python      = auto_silent
 
 remote_tmp = $HOME/.ansible/tmp
 local_tmp  = $HOME/.ansible/tmp
-timeout                 = 60
+pipelining = True
+become = True
 host_key_checking = False
 deprecation_warnings = False
 callback_whitelist = profile_tasks
-log_path                = ./ansible.log
-
-[privilege_escalation]
-become                  = True
-
-[ssh_connection]
-scp_if_ssh              = smart
-retries                 = 3
-ssh_args                = -o ControlMaster=auto -o ControlPersist=30m -o Compression=yes -o ServerAliveInterval=15s
-pipelining              = True
-control_path            = %(directory)s/%%h-%%r
-host_key_checking       = False

collections/requirements.yml

@@ -4,4 +4,3 @@ collections:
   - name: community.general
   - name: ansible.posix
   - name: kubernetes.core
-  - name: community.docker

deploy.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+ansible-playbook site.yml -i inventory/my-cluster/hosts.ini

example/deployment.yml

@@ -1,20 +1,13 @@
 ---
-kind: Deployment
 apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: nginx
-  namespace: default
-  labels:
-    app: nginx
 spec:
-  replicas: 3
-  progressDeadlineSeconds: 600
-  revisionHistoryLimit: 2
-  strategy:
-    type: Recreate
   selector:
     matchLabels:
       app: nginx
+  replicas: 3
   template:
     metadata:
       labels:
@@ -22,4 +15,6 @@ spec:
     spec:
       containers:
         - name: nginx
-          image: nginx:latest
+          image: nginx:alpine
+          ports:
+            - containerPort: 80

example/service.yml

@@ -3,11 +3,11 @@ apiVersion: v1
 kind: Service
 metadata:
   name: nginx
-  namespace: default
 spec:
+  ipFamilyPolicy: PreferDualStack
   selector:
     app: nginx
   ports:
-    - name: http
+    - port: 80
       targetPort: 80
-      port: 80
+  type: LoadBalancer

inventory/.gitignore

@@ -0,0 +1,3 @@
+/*
+!.gitignore
+!sample/

inventory/my-cluster/group_vars/all.yml

@@ -1,431 +0,0 @@
----
-k3s_version: v1.24.6+k3s1
-# this is the user that has ssh access to these machines
-ansible_user: lino
-systemd_dir: /etc/systemd/system
-
-# Set your timezone
-system_timezone: "Europe/Lisbon"
-
-# apiserver_endpoint is virtual ip-address which will be configured on each master
-apiserver_endpoint: "10.0.3.1"
-
-# k3s_token is required  masters can talk together securely
-# this token should be alpha numeric only
-k3s_token: "7qXiuKpSY9uLwdVSNSnEF5RkttoERixCpc2EVJW7vh7Ws4NMN3"
-
-# The IP on which the node is reachable in the cluster.
-# Here, a sensible default is provided, you can still override
-# it for each of your hosts, though.
-k3s_node_ip: '{{ ansible_facts[flannel_iface]["ipv4"]["address"] }}'
-
-# Disable the taint manually by setting: k3s_master_taint = false
-k3s_master_taint: false
-
-# these arguments are recommended for servers as well as agents:
-extra_args: >-
-  --flannel-iface={{ flannel_iface }}
-  --node-ip={{ k3s_node_ip }}
-
-# change these to your liking, the only required are: --disable servicelb, --tls-san {{ apiserver_endpoint }}
-extra_server_args: >-
-  {{ extra_args }}
-  {{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
-  --tls-san {{ apiserver_endpoint }}
-  --disable servicelb
-  --disable traefik
-extra_agent_args: >-
-  {{ extra_args }}
-
-# image tag for kube-vip
-kube_vip_tag_version: "v0.5.5"
-
-# image tag for metal lb
-metal_lb_speaker_tag_version: "v0.13.6"
-metal_lb_controller_tag_version: "v0.13.6"
-
-# metallb ip range for load balancer
-metal_lb_ip_range: "10.0.4.1-10.0.4.254"
-
-lxc_password: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  38303735306236303463613632623161643633663631303931396564346565666236643562316264
-  6533643331306364653564653763356537303932313531350a393261643137636232616335376461
-  66383966333765626539363561613361393665616333303964373761356166623766663232303063
-  3138353333373935660a383230393330646538303933336366383736643333623663333934663131
-  3064
-
-proxmox_api_password: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  35376334616332386130656335663736343337396532663266383934643632363664646631653935
-  6533343936353734343761343465646365616130643130360a316234333036303738663566666364
-  61653638373830383733323563373862346662363339656632643661336533363162616435616531
-  6331326462356366320a303331616366356333306638386130666538633833623162653934616338
-  3566
-
-traefik_http_auth_user: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  38323532616336373939646333613338626431363466633631343162636235623563393135653231
-  3961383965356631613164303566393632323938386664360a373037616335643662613564353130
-  30353832376431633834336234386161313062373437613132623733646166303639313364373637
-  3933626639646536320a303163353835633837356530613931346165353939363235373561333836
-  39366266303064393334383835323330353934643862323330343337393761353166393333376131
-  33303439393531303031653361393530313930363039646566613831373366326432653634653165
-  313735383263623836363030386531613033
-
-cloudflare_api_key: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  38363363386466666266613930386237623430646531303734613863306530666530376433633339
-  3166373361393839363439326661396136616637393865630a666637366132643035343832666335
-  33376139643533313730313135653064393239316162376339653965313366643565643664666534
-  6631393564333230370a303634643030346166383235643666356164393232643832333238313664
-  38346161306138653735303861646638653830633938326566663136393862643264353437623963
-  3462616435653132623563316231343739333761653365333437
-
-dns_cloudflare_api_key: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  61306235353261303235646331356666643339393164333762303730646563646633626466306436
-  6565303031366262303161323536323236613861373536330a346564306238633461363765623030
-  33343566363163623532386463616431313865316563616162336633353162316134363266363263
-  6331353838343662380a303565643337653164613637323131363037613861306535326538333030
-  64313165343933343535623731393536396332613336316239363764653565346535666531656433
-  6131646439656638323561643264613834356662363332323835
-
-dns_cloudflare_email: cloudflare@lino.cooking
-
-cloudflare_ddns_api_key: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  32353865663337376239333232376630616436643435343862346164353466356563623930386461
-  3132306361653330356663613534626463373133616132620a313161316137313838666534313737
-  34336161373334356630326432626139666566316663373630656538333331656461373631613931
-  6364313538663464350a343061383835663264616238353965656635343564306635303830343266
-  38396530393133646133643232363061386265373234373832656135393764346462666566656264
-  3635316261393863393736383132386133313666306234343666
-
-homeassistant_pwd: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  34623865646265653733666136316164303765633036616464626133306339393032336465613735
-  3139333561366530383535363834316138303338313030390a306561366265643737623833633837
-  31353332646635353339373937393134376566643539363563613061393731623931643931336566
-  3039626631643930650a393163643534353731316261376638643736623232366431396136313666
-  37613864396630306335626532633832653633346465316332356236393239653063393630323461
-  3862316639643265373166373330333936303233383333653362
-
-gameyfin_pwd: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  64653937643761616366313263363039336262313832623035313635353638393633643330303733
-  3030373063343264633265616638373463383562626132650a643163333961353861626438356339
-  64326161373332396234656664343736356566356561306334306230343335323733306533343563
-  3639656666313434350a303432393831323338313331386262373130633930396365653836633965
-  35623030313533313462666464333339633832643261383839383432366462313262386236346434
-  39646434653137633062346234373965323036636663326437346238373764363261633736356532
-  346437633064623331653362303034653463
-
-igdb_client_id: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  36343238373066633635656365376331626231396666373039636330376132393861373739323061
-  3662366362633461383730633765323530316437626639630a613337333163393539653830366235
-  36636139666332393366366166343064623931326634633161666264333038643537386363663962
-  6430613364653562320a313934393633386262343933363835663639313630653631356563346435
-  61616130336366613066316134303866323838653938393630623763383762316432
-
-igdb_secret: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  65383235643965353066343661616633353163393137326661363862353131333362383336613465
-  3730323833613961326161643730363434643363346138610a313230656534626137373232653633
-  30303163646261666461366161336131326134633832643834623438363137323531393865613761
-  3137316331353531350a306636306233326637623030666634353066396663623663386235393238
-  63303939666561353032396135646666623564616562306637613430663933626530
-
-mastodon_db_user: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  38613037323362636233336166643239636334333333366137306335643836636338343938303135
-  3134373363343964613236313562393966363033623231310a613236383134616566646466633334
-  61323031393663363438336265613062636432343338383936323161313264326662346538366436
-  3863633263643239390a383664663636343934383333623830333931326330613861353333643663
-  66303131633433376562643938313333383335323665643030623461623836643362633034613834
-  61626134386236616538366332313032383732356638356531613534313638316165383665313939
-  633035373238333032303637663366326431
-
-mastodon_db_name: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  64376131373562633437313062366334663738336463613938653564323831316531373233396634
-  3530613830303835666431366438376163383433623561350a653834353761616462316161613037
-  64353430643062316465363764653830313065363261356231356466613533643565613562613437
-  3338303632653865330a326337373830396230343764333231356134616365643138663731613264
-  61323132363839666365326665323236373935666361663063343763363062333130663135366530
-  30366231633932356662663863343330366266366538326232623136363934643334656366343763
-  363833363666643162396434636536323166
-
-mastodon_db_pass: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  66383339653334616233336439376164616532333062393161346238643839393161653932386265
-  3765376366323334613739316162336433623330373131360a653838663436663166373933353064
-  30646663316631653236383437616637396331616339323439353238643866633732323438636138
-  3530306635663631340a306237356664653033663865373964333835613733373565616638363864
-  36333139633033333538306335336165306537303265396631616530366534643465323232336334
-  33636635656130633131623437323764326565656635373265653065646135633066383561643033
-  373333313535343534346331643865616539
-
-mastodon_key_base: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  33346261623634626666383762613065613865306530363831303032656335636332393564653030
-  3866306433323432643930326133303831633437393265620a643234376332336262636364363866
-  33396431653531626538396266626337623735666165636163616262393263373065356330343139
-  3935356133653332370a313039366431343734363430353966386534363234316666613335353562
-  36316435363862646437333431303430613138353338663233646130636436316366323831343531
-  37623063656132336135313964333134323830373761316262386433363337303964366163313265
-  61376438386466636332383932346431313537656332656362376630646565626130303939313432
-  36646233633434383565386465376238373065303831326162386331653631633962353035376266
-  33653332316563333138336439393839336263393438333663383536663834396365666332356334
-  62316264633161363233346263366164643136656464373963303539623465383734326664386130
-  633539303831656364653861336263613432
-
-mastodon_otp_secret: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  65316136326539313931396665656663356536636530613533306531663965303933643939643866
-  3635646438363739303730343834623035613135623130390a316463366362386465353134663264
-  64393337663866333333636635656535373064356263666161633033643635366533653530643336
-  6236396264303463350a306333373231343566653939306564323332633237343463353566343836
-  31323337633238393761656133613230393235663261383961616266373165376263376666333032
-  62313033383339643438376662613235333464323566323763623031616531303238386334623133
-  62653637323034613934313065646565323363313535653931306434393136663961663634313232
-  33653933373537333834363538343432643037646165386633363334613566653538353464303839
-  63373632653235376338336332303064356363653537333363326432306139666238393966306535
-  66633266313465333066613161393734353263366561643865323666633733656439386564326233
-  666338346237313564313937633466373937
-
-mastodon_vapid_private_key: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  38396438623163636339353633356339363435616262303865663834633436326331363365326433
-  6438633038623639346566376233356339333832383939370a353533356630346163633434346533
-  35386565386438383665623661653533646530623337373334356336396636376630356232656632
-  6634376435383163300a613635613633383765646363643563393062653465353663353935333262
-  35313830623635393737316337336436373730303963303962393365643165656164303633656233
-  3766303666323931623230623533316139666265363231356237
-
-mastodon_vapid_public_key: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  61653763663734616263633063323466333064636230643263383935313134306163383135353131
-  6166383263353435306333336131373431313363373334330a383031303163346238343061356537
-  36653764366265323165336161303965353434366262616464646162353038353665363132616630
-  6465353939316534340a626533343835303433383531373666643462326162653535313966373963
-  65636561633532613166356666303833306332656266383237363561663239616139666465383532
-  65613361663534616533343631386634316661616132383035333734353561643934353339373832
-  34626531373530306464336437383636633830616336393265373934613030386534323335303436
-  32373034336162346364643139353961323831636134313538333162373665373330636564306162
-  3337
-
-gmail_smtp_pass: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  31396436653866313237616361636439343765323730383231633739643433646365383137343037
-  3535373866653261303761396163373334383461323661380a376561663864346633646230633531
-  35326435323434386564363037383961383934363163653635346233306139303664323037383435
-  3763313639656566620a623639386437353662316631316638363862323334323838643037336464
-  64373730623035616464303230626462666166636236363033633132363236306132
-
-gitea_db_pwd: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  36393364326238666261663830353336616336653337666434343261666632346666663339616334
-  3631386161346362626236616239646430636532663531310a326462636364323664636134343432
-  31333231383132373131323131643866316331666663333062303865366539613338333662343530
-  3566396439376366640a643966376630656561643865653535363132343138393132343039346630
-  30616533336461396330353364656565633933613031643764343562383734373263633333346662
-  61383736386164366233386235336636613830313231336461636137643361383931363166336238
-  613733336339326564303964353238386264
-
-paperless_pwd: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  39623333316332626237313865646462313963303336323537613932626636333636393965646434
-  3664613735376537306339353537313534376566336433320a383565643833653935373132306461
-  66366333653839313863653632303531363039363265623365636532383732323837653464666465
-  3531346366376337630a393664636332343038303530666531663539616632313332626631363831
-  61356263303563656235623866653065633063313038326432636161316339663030313439646537
-  63333032353133373633353463613861643933353038323231646461386330623038343262343763
-  663836323538623836346337303834313139
-
-nextcloud_mysql_root_pwd: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  31623863613966623834303961333332396238346332646438633665623463353938623336346631
-  3835636631386263336130373130336662666635353461660a643635346430623438616234333964
-  35653638313734373134663865653865393536376162356234326565353665613337376562623231
-  6532333263313362660a306462626330346233393566363632613666616437343361303962353938
-  64343430316661653532366233396262316236633936333162653263646635643466326265613066
-  3062633330616537376462346235653433656635366135346265
-
-nextcloud_mysql_pwd: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  37343730363831393233643034393838323430383339386238626334343462383061656236613530
-  3430363331343139356538333333326337656163333931660a373964653034323466373038663561
-  64363239663665623263326435383132393561616436376564353562666637396631316262653361
-  6134653565623736310a303733396335303139643334363034356138393364373234353537623463
-  62323938343430313132363037626231633435333330653665613637333734613231326434303532
-  3461646466366339653532366639393035396638623035396338
-
-nextcloud_admin_pwd: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  64633233343935636536353533663761353033376331666634633138363233323065323936303934
-  3762643937346435636635306461663461373138636666380a363761616137373430666236306636
-  38663933656231386532333032353731643936653534666530333664333835316561663335633238
-  3531623266386432620a643861666538396437323234623162383437646663653036663836383233
-  62636461303338313436343934656165363361396332343961396434356161363736
-
-minio_root_user: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  63336437653937636433646632333231356331616135613363303138303535386662373131643865
-  6538643332666634356366353439396461356633643561620a376236316162336261633966323934
-  31666166303862643937306636363436333137626531633361323964393632633638333434366165
-  6636313930363936330a616566343031343264333965653531363133353766336635626463386461
-  33326533643032363436663635383631666564623263356663363232336432316433663566343135
-  63653237343338373332616436636664626663626436653064623037353565393964653738356331
-  613838353865326664333064653137343730
-
-minio_root_pwd: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  62386334663539323161393961646133376162306366363430616231376366326339643637613935
-  3931313637653866623834626161616466303538643936630a363361343533636330363136633231
-  31386531633264656434363762353766303038346231666433343934323430373264353232333162
-  6561393463646163380a333333313038316165653939386438396264653738376564613161393264
-  66323635653065313463623532313832613931393161353466666133663361386261323865353531
-  39633030333164666361343139663566656534623539353939653932656631376130613436636234
-  313132666561333238303632643836656361
-
-outline_secret_key: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  65353235386537316131393230383061663333353461343931323935643338333835353965626436
-  3335333334343966356664626331353466376435363131340a653261656339336136323866616637
-  31383238323730353364376666643333616430366134343965313063623166383334643234353763
-  3639616332366439340a303033626164393765303462616332653239656135633937323636656164
-  61393534396334633665313061663030613535633031666230643662653231373132323261633937
-  34353836663436323835633363663761663534656331333931366566656631396462623866366134
-  37333235633038386165303261623432633637333834383737643361366435623061386539366135
-  64646231356631383031
-
-outline_utils_secret: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  63353837326536343330396362343761396236633165353965373138646562346266613138666162
-  3966343638336539663533646565356138303137663135640a313339663265333862343862333561
-  31653235303236643364383566653664373533336534353139623030333535646264623562633264
-  3536643165616462350a373830643963646365303731313636316166623437623066633639616164
-  34306135386265636563323736616332636331636564643934326663623136326230313365376464
-  33393633613365366364356239663965353963393337646532616137633830323238326339336431
-  62636634396263303562393635633161666434346635633138626631313834303633623262643939
-  34613763643561373038
-
-outline_aws_access_key_id: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  39373131326262363733303161383261316337663765346635373866393634343763626361633030
-  6236653436633839333333366562343365643231633232340a636636396265383063363561303135
-  36366361333664663663303761653037663233373639303034346433393536636363626164613730
-  6539333366626533390a313437336466323139326637383331633336653861306366646134383338
-  30666634346639633063383239376434393162353139666464653733346638303632
-
-outline_aws_secret_access_key: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  33663834363831653062366239336461643939633761313037323333333762343762343331326134
-  3033646130323533636538363830633132646435366566350a623965626239643036613666386238
-  38373962656666323034643463653634353031613162623165393333306239633033666663363664
-  6364306530386631340a343862316332356231653333626464613235323666343765373935393334
-  31663436303964616336326636633564616235393130306435316131383234643033373634663564
-  6630613863333062323533666633636263336538353263646332
-
-outline_oidc_client_id: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  62616137383734393734323631383464643762306266356330396238373364663732653366663736
-  6165393964666562363365343239323663373063643162360a393337323932373462323032363166
-  35626138656537343134316231393834356662313336353633373139313932616261326661643530
-  6262383165336434390a626566303563303536653539303562643530336135633330616630653362
-  35663135333963656530323032373836663238396434636334653063366237623863663336373033
-  37626132383266643734653533636261343130656464656536613235373764346536346137383533
-  303465323266633438633261373665316130
-
-outline_oidc_client_secret: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  30643230643335323036323239336334386465393732333865303632663461323761323635333631
-  3037393965303036643661303834323264333334323036330a376538386461326665383435653538
-  36616239636138633838643830393830316335643263303230356639373833336263633564306163
-  3139366165363466610a623239613131646466616161633163366336623937343830363361396331
-  64313137366365356138646465353737393437383666313237633931323363643165653535323632
-  38363636306436663033353636353966353861333665343739383665373932616464313136363536
-  626161313635316364666462646563313636
-
-ghostfolio_redis_pass: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  32396532363432653261333937366434396564643237663432383464653337396439373532346230
-  3531323930356139646537383765336533363939643836370a613162643862663536333630383530
-  30313330393439666538363361373962616231353839326237376363313134643933663465613135
-  3664363834623538330a313334656366653735373263623330333738663264613733353966653664
-  39326133383663323534643534393664393161376264323439623065633064306566656534353537
-  66383534353936323630656332323637656539326430626534623762646334323332396462633066
-  626431336435363264663965636463323832
-
-ghostfolio_postgres_pass: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  66666338343830336235303530663133623435313933666432303938396333363333366261636238
-  3664323432653364333833336465393936386239303537660a343332343566373436346639313034
-  32353439313764376230333138643336663933633139373166323439353365633835323464303832
-  3135303338356534330a663237303561633263333763633634613933326337646135616630393461
-  65326139666138663133636634366436333461313430323639313165366432666539373136663366
-  65323763353639393262643138366565396232623633336539616136656536653963313139386236
-  626435396261393961303036653435366139
-
-ghostfolio_token_salt: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  64346334626434336666643263636566393261393732626431346636326663663939366166323231
-  6661636230616136346363363935666263393964323035320a636337383839383363346431656362
-  30303739326439663132396164333266323264326633363733653430616133656566386664623162
-  6662313236376563330a383137643130353335393137633730623030393030303061343139343166
-  38353363336435353638616330626531333363633632376563316531613939306666656164333066
-  37373634386266323730316333393262653631383035303337366264353265623630303666366331
-  646237333736346138666663626164316239
-
-ghostfolio_jwt: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  33346639313831613566373961356466343336396339366233633333613961353565383661376137
-  6535336132396366623761373330643935356565386138630a363131633430356239353434386363
-  61383666313065663365363932616261303063336236326333643364313361623632636364343330
-  6439373562333535610a363465623465333166336332316134383630646234333766653030346663
-  39653234323065663539333661383230363339306566363836636239363036656231616130313930
-  38393132626531386631633536333633653866626364376134613862623338653664336563653031
-  643433306266643631353535336639343231
-
-heartbeat_user_pwd: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  36383161343965643131303065346532653336643864633266383164623464326538623466383030
-  3565366234666263316233313765633236386637313538350a316536363561313633613630383538
-  64313439323963313231663135353166326666366432393766343266313832373133633836643165
-  3435656236623236640a313633653662616437626236313865343266656261386265343339653637
-  33663438636431313163666234323738316131323263643966613136386537303634303537333036
-  35623363313731343734613036383731306439663661326465363335633433356533333837303038
-  636262643139396462643966383465376263
-
-graylog_root_password: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  33626163626133356532353362323261613661636635653631636334633438303935333239346132
-  6130313764356433383937303862393334376433363538620a623065636637613231343762666435
-  33323933353630626437393936366664656437306532396562353862373862623165616331643064
-  3136396465653563640a316137376233363935666134666161613265383131633766343164613834
-  31393363613538313238326336643331643632363139653339306433373732663030663864613364
-  34333537313535373637613439653032373836646666646561386365616439633035326133313433
-  31303536373338656230616265643038623136643461363437386464633738376661613038623666
-  39376264333362636364
-
-graylog_password_secret: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  63303066396633316531326435656137313261613835356435373037326239306331343065643964
-  6132346632363164666363323565386464316263323336610a656366643761316565343935383262
-  33663561363131323662353364323832616564373264363461616264383563356662366261336138
-  6565613961666561630a313466613931373366636662373137333061333236616539666333363038
-  34663031333031396239386361323539613837383230366165653664396135633563633265376333
-  64346366386136383233613533386437376263653736333437373466353465333339373365376663
-  336434663137336232636133623132653237
-
-technitium_web_admin: !vault |
-  $ANSIBLE_VAULT;1.1;AES256
-  65313430343864303431623031393535376535666130306139626162336439383464333739623463
-  3839323438323532636631643635653566643037643365610a313237633637613131376338356666
-  35323230303636663265656664333632306365623733623232336631333032656638346538636431
-  3931383564353136640a353634363338646437616565623766653330353662663263663138646531
-  35613361306332616464336232323562643463366139313431336436653536393062663761356337
-  66306532353138663762653338646339613038363035303064666433336333633531626666393239
-  653738616662366532653061326632663333

inventory/my-cluster/host_vars/arr

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.25
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 225

inventory/my-cluster/host_vars/changedetection

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.24
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 615

inventory/my-cluster/host_vars/cloudflare-ddns

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.16
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 607

inventory/my-cluster/host_vars/convertx

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.43
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 643

inventory/my-cluster/host_vars/dahua-to-mqtt

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.17
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 608

inventory/my-cluster/host_vars/dawarich

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.48
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 648

inventory/my-cluster/host_vars/droposs

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.46
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 646

inventory/my-cluster/host_vars/epona-pihole

@@ -1,8 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.13
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-mac_addr: EA:11:8B:05:5A:88
-vmid: 203
-node: epona

inventory/my-cluster/host_vars/folding

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.19
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 610

inventory/my-cluster/host_vars/frigate

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.14
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 605

inventory/my-cluster/host_vars/geoguessr

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.39
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 639

inventory/my-cluster/host_vars/ghost

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.47
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 647

inventory/my-cluster/host_vars/ghostfolio

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.40
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 640

inventory/my-cluster/host_vars/gitea

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.28
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 619

inventory/my-cluster/host_vars/graylog

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.41
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 641

inventory/my-cluster/host_vars/heartbeat-1

@@ -1,5 +0,0 @@
----
-
-ansible_user: Prenatal4216
-ansible_host: 10.0.0.203
-ansible_ssh_pass: "{{ heartbeat_user_pwd }}"

inventory/my-cluster/host_vars/hortusfox

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.52
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 652

inventory/my-cluster/host_vars/immich

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.18
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 609

inventory/my-cluster/host_vars/impa

@@ -1,10 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.1
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-ip_addr: 10.0.2.2
-
-# interface which will be used for flannel
-
-flannel_iface: "vmbr0"

inventory/my-cluster/host_vars/jellyfin

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.42
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 642

inventory/my-cluster/host_vars/mastodon

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.20
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 611

inventory/my-cluster/host_vars/mealie

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.26
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 617

inventory/my-cluster/host_vars/minio

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.35
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 635

inventory/my-cluster/host_vars/mipha

@@ -1,7 +0,0 @@
----
-ansible_user: root
-ansible_host: 10.0.2.3
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-ip_addr: 10.0.2.3
-# interface which will be used for flannel
-flannel_iface: "vmbr0"

inventory/my-cluster/host_vars/nextcloud

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.30
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 621

inventory/my-cluster/host_vars/nginx-proxy-manager

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.37
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 637

inventory/my-cluster/host_vars/nocodb

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.44
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 644

inventory/my-cluster/host_vars/openvpn

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.22
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 613

inventory/my-cluster/host_vars/outline

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.36
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 636

inventory/my-cluster/host_vars/paperless

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.29
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 620

inventory/my-cluster/host_vars/purah

@@ -1,10 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.8
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-ip_addr: 10.0.2.2
-
-# interface which will be used for flannel
-
-flannel_iface: "vmbr0"

inventory/my-cluster/host_vars/reactive-resume

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.53
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 653

inventory/my-cluster/host_vars/revali

@@ -1,7 +0,0 @@
----
-ansible_user: root
-ansible_host: 10.0.2.4
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-ip_addr: 10.0.2.4
-# interface which will be used for flannel
-flannel_iface: "vmbr0"

inventory/my-cluster/host_vars/revali-pihole

@@ -1,8 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.12
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-mac_addr: C2:F5:B2:99:92:51
-vmid: 202
-node: revali

inventory/my-cluster/host_vars/sidon

@@ -1,7 +0,0 @@
----
-ansible_user: root
-ansible_host: 10.0.2.2
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-ip_addr: 10.0.2.2
-# interface which will be used for flannel
-flannel_iface: "vmbr0"

inventory/my-cluster/host_vars/super-productivity

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.45
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 645

inventory/my-cluster/host_vars/swag

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.15
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 606

inventory/my-cluster/host_vars/tautulli

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.21
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 612

inventory/my-cluster/host_vars/technitium-dns

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.49
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 649

inventory/my-cluster/host_vars/technitium-dns-2

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.50
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 650

inventory/my-cluster/host_vars/technitium-dns-3

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.51
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 651

inventory/my-cluster/host_vars/tingle

@@ -1,9 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.3.110
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-
-# interface which will be used for flannel
-
-flannel_iface: "eth0"

inventory/my-cluster/host_vars/upsnap

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.38
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 638

inventory/my-cluster/host_vars/urbosa-pihole

@@ -1,7 +0,0 @@
----
-ansible_user: root
-ansible_host: 10.0.2.11
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-mac_addr: 72:2E:3C:F0:2A:B3
-vmid: 201
-node: mipha

inventory/my-cluster/host_vars/vaultwarden

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.27
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 618

inventory/my-cluster/host_vars/youtube-downloader

@@ -1,6 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.2.23
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-vmid: 614

inventory/my-cluster/host_vars/yuga

@@ -1,7 +0,0 @@
----
-ansible_user: root
-ansible_host: 10.0.2.7
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-ip_addr: 10.0.2.7
-# interface which will be used for flannel
-flannel_iface: "vmbr0"

inventory/my-cluster/host_vars/yunobo

@@ -1,10 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.3.3
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-ip_addr: 10.0.3.3
-
-# interface which will be used for flannel
-
-flannel_iface: "vmbr0"

inventory/my-cluster/hosts.ini

@@ -1,54 +0,0 @@
-[lxc]
-frigate
-swag
-cloudflare-ddns
-#dahua-to-mqtt
-#immich
-mastodon
-tautulli
-openvpn
-#youtube-downloader
-changedetection
-arr
-mealie
-vaultwarden
-gitea
-paperless
-#nextcloud
-minio
-outline
-#nginx-proxy-manager
-#upsnap
-#geoguessr
-ghostfolio
-#graylog
-#jellyfin
-convertx
-#nocodb
-super-productivity
-droposs
-ghost
-dawarich
-technitium-dns
-technitium-dns-2
-technitium-dns-3
-hortusfox
-reactive-resume
-
-[baremetal]
-mipha
-purah
-; revali
-yuga
-; impa
-sidon
-yunobo
-
-
-[pihole]
-epona-pihole
-revali-pihole
-urbosa-pihole
-
-[heartbeat_hosts]
-heartbeat-1

inventory/sample/group_vars/all.yml

@@ -0,0 +1,51 @@
+---
+k3s_version: v1.24.6+k3s1
+# this is the user that has ssh access to these machines
+ansible_user: ansibleuser
+systemd_dir: /etc/systemd/system
+
+# Set your timezone
+system_timezone: "Your/Timezone"
+
+# interface which will be used for flannel
+flannel_iface: "eth0"
+
+# apiserver_endpoint is virtual ip-address which will be configured on each master
+apiserver_endpoint: "192.168.30.222"
+
+# k3s_token is required  masters can talk together securely
+# this token should be alpha numeric only
+k3s_token: "some-SUPER-DEDEUPER-secret-password"
+
+# The IP on which the node is reachable in the cluster.
+# Here, a sensible default is provided, you can still override
+# it for each of your hosts, though.
+k3s_node_ip: '{{ ansible_facts[flannel_iface]["ipv4"]["address"] }}'
+
+# Disable the taint manually by setting: k3s_master_taint = false
+k3s_master_taint: "{{ true if groups['node'] | default([]) | length >= 1 else false }}"
+
+# these arguments are recommended for servers as well as agents:
+extra_args: >-
+  --flannel-iface={{ flannel_iface }}
+  --node-ip={{ k3s_node_ip }}
+
+# change these to your liking, the only required are: --disable servicelb, --tls-san {{ apiserver_endpoint }}
+extra_server_args: >-
+  {{ extra_args }}
+  {{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
+  --tls-san {{ apiserver_endpoint }}
+  --disable servicelb
+  --disable traefik
+extra_agent_args: >-
+  {{ extra_args }}
+
+# image tag for kube-vip
+kube_vip_tag_version: "v0.5.5"
+
+# image tag for metal lb
+metal_lb_speaker_tag_version: "v0.13.6"
+metal_lb_controller_tag_version: "v0.13.6"
+
+# metallb ip range for load balancer
+metal_lb_ip_range: "192.168.30.80-192.168.30.90"

inventory/sample/hosts.ini

@@ -0,0 +1,12 @@
+[master]
+192.168.30.38
+192.168.30.39
+192.168.30.40
+
+[node]
+192.168.30.41
+192.168.30.42
+
+[k3s_cluster:children]
+master
+node

molecule/README.md

@@ -0,0 +1,73 @@
+# Test suites for `k3s-ansible`
+
+This folder contains the [molecule](https://molecule.rtfd.io/)-based test setup for this playbook.
+
+## Scenarios
+
+We have these scenarios:
+
+- **default**:
+  A 3 control + 2 worker node cluster based very closely on the [sample inventory](../inventory/sample/).
+- **ipv6**:
+  A cluster that is externally accessible via IPv6 ([more information](ipv6/README.md))
+  To save a bit of test time, this cluster is _not_ highly available, it consists of only one control and one worker node.
+- **single_node**:
+  Very similar to the default scenario, but uses only a single node for all cluster functionality.
+
+## How to execute
+
+To test on your local machine, follow these steps:
+
+### System requirements
+
+Make sure that the following software packages are available on your system:
+
+- [Python 3](https://www.python.org/downloads)
+- [Vagrant](https://www.vagrantup.com/downloads)
+- [VirtualBox](https://www.virtualbox.org/wiki/Downloads)
+
+### Set up VirtualBox networking on Linux and macOS
+
+_You can safely skip this if you are working on Windows._
+
+Furthermore, the test cluster uses the `192.168.30.0/24` subnet which is [not set up by VirtualBox automatically](https://www.virtualbox.org/manual/ch06.html#network_hostonly).
+To set the subnet up for use with VirtualBox, please make sure that `/etc/vbox/networks.conf` exists and that it contains this line:
+
+```
+* 192.168.30.0/24
+* fdad:bad:ba55::/64
+```
+
+### Install Python dependencies
+
+You will get [Molecule, Ansible and a few extra dependencies](../requirements.txt) via [pip](https://pip.pypa.io/).
+Usually, it is advisable to work in a [virtual environment](https://docs.python.org/3/tutorial/venv.html) for this:
+
+```bash
+cd /path/to/k3s-ansible
+
+# Create a virtualenv at ".env". You only need to do this once.
+python3 -m venv .env
+
+# Activate the virtualenv for your current shell session.
+# If you start a new session, you will have to repeat this.
+source .env/bin/activate
+
+# Install the required packages into the virtualenv.
+# These remain installed across shell sessions.
+python3 -m pip install -r requirements.txt
+```
+
+### Run molecule
+
+With the virtual environment from the previous step active in your shell session, you can now use molecule to test the playbook.
+Interesting commands are:
+
+- `molecule create`: Create virtual machines for the test cluster nodes.
+- `molecule destroy`: Delete the virtual machines for the test cluster nodes.
+- `molecule converge`: Run the `site` playbook on the nodes of the test cluster.
+- `molecule side_effect`: Run the `reset` playbook on the nodes of the test cluster.
+- `molecule verify`: Verify that the cluster works correctly.
+- `molecule test`: The "all-in-one" sequence of steps that is executed in CI.
+  This includes the `create`, `converge`, `verify`, `side_effect` and `destroy` steps.
+  See [`molecule.yml`](default/molecule.yml) for more details.

molecule/default/molecule.yml

@@ -0,0 +1,82 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: vagrant
+.platform_presets:
+  - &control
+    memory: 2048
+    cpus: 2
+    groups:
+      - k3s_cluster
+      - master
+  - &node
+    memory: 2048
+    cpus: 2
+    groups:
+      - k3s_cluster
+      - node
+  - &debian
+    box: generic/debian11
+  - &rocky
+    box: generic/rocky9
+  - &ubuntu
+    box: generic/ubuntu2204
+    config_options:
+      # We currently can not use public-key based authentication on Ubuntu 22.04,
+      # see: https://github.com/chef/bento/issues/1405
+      ssh.username: "vagrant"
+      ssh.password: "vagrant"
+platforms:
+  - <<: [*control, *ubuntu]
+    name: control1
+    interfaces:
+      - network_name: private_network
+        ip: 192.168.30.38
+  - <<: [*control, *debian]
+    name: control2
+    interfaces:
+      - network_name: private_network
+        ip: 192.168.30.39
+  - <<: [*control, *rocky]
+    name: control3
+    interfaces:
+      - network_name: private_network
+        ip: 192.168.30.40
+  - <<: [*node, *ubuntu]
+    name: node1
+    interfaces:
+      - network_name: private_network
+        ip: 192.168.30.41
+  - <<: [*node, *rocky]
+    name: node2
+    interfaces:
+      - network_name: private_network
+        ip: 192.168.30.42
+provisioner:
+  name: ansible
+  playbooks:
+    converge: ../resources/converge.yml
+    side_effect: ../resources/reset.yml
+    verify: ../resources/verify.yml
+  inventory:
+    links:
+      group_vars: ../../inventory/sample/group_vars
+scenario:
+  test_sequence:
+    - dependency
+    - lint
+    - cleanup
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    # idempotence is not possible with the playbook in its current form.
+    - verify
+    # We are repurposing side_effect here to test the reset playbook.
+    # This is why we do not run it before verify (which tests the cluster),
+    # but after the verify step.
+    - side_effect
+    - cleanup
+    - destroy

molecule/default/overrides.yml

@@ -0,0 +1,11 @@
+---
+- name: Apply overrides
+  hosts: all
+  tasks:
+    - name: Override host variables
+      ansible.builtin.set_fact:
+        # See: https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant  # noqa yaml[line-length]
+        flannel_iface: eth1
+
+        # The test VMs might be a bit slow, so we give them more time to join the cluster:
+        retry_count: 45

molecule/default/prepare.yml

@@ -0,0 +1,22 @@
+---
+- name: Apply overrides
+  ansible.builtin.import_playbook: >-
+    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
+
+- name: Network setup
+  hosts: all
+  tasks:
+    - name: Disable firewalld
+      when: ansible_distribution == "Rocky"
+      # Rocky Linux comes with firewalld enabled. It blocks some of the network
+      # connections needed for our k3s cluster. For our test setup, we just disable
+      # it since the VM host's firewall is still active for connections to and from
+      # the Internet.
+      # When building your own cluster, please DO NOT blindly copy this. Instead,
+      # please create a custom firewall configuration that fits your network design
+      # and security needs.
+      ansible.builtin.systemd:
+        name: firewalld
+        enabled: no
+        state: stopped
+      become: true

molecule/ipv6/README.md

@@ -0,0 +1,35 @@
+# Sample IPv6 configuration for `k3s-ansible`
+
+This scenario contains a cluster configuration which is _IPv6 first_, but still supports dual-stack networking with IPv4 for most things.
+This means:
+
+- The API server VIP is an IPv6 address.
+- The MetalLB pool consists of both IPv4 and IPv4 addresses.
+- Nodes as well as cluster-internal resources (pods and services) are accessible via IPv4 as well as IPv6.
+
+## Network design
+
+All IPv6 addresses used in this scenario share a single `/48` prefix: `fdad:bad:ba55`.
+The following subnets are used:
+
+- `fdad:bad:ba55:`**`0`**`::/64` is the subnet which contains the cluster components meant for external access.
+  That includes:
+
+  - The VIP for the Kubernetes API server: `fdad:bad:ba55::333`
+  - Services load-balanced by MetalLB: `fdad:bad:ba55::1b:0/112`
+  - Cluster nodes: `fdad:bad:ba55::de:0/112`
+  - The host executing Vagrant: `fdad:bad:ba55::1`
+
+  In a home lab setup, this might be your LAN.
+
+- `fdad:bad:ba55:`**`4200`**`::/56` is used internally by the cluster for pods.
+
+- `fdad:bad:ba55:`**`4300`**`::/108` is used internally by the cluster for services.
+
+IPv4 networking is also available:
+
+- The nodes have addresses inside `192.168.123.0/24`.
+  MetalLB also has a bit of address space in this range: `192.168.123.80-192.168.123.90`
+- For pods and services, the k3s defaults (`10.42.0.0/16` and `10.43.0.0/16)` are used.
+
+Note that the host running Vagrant is not part any of these IPv4 networks.

molecule/ipv6/host_vars/control1.yml

@@ -0,0 +1,3 @@
+---
+node_ipv4: 192.168.123.11
+node_ipv6: fdad:bad:ba55::de:11

molecule/ipv6/host_vars/node1.yml

@@ -0,0 +1,3 @@
+---
+node_ipv4: 192.168.123.21
+node_ipv6: fdad:bad:ba55::de:21

molecule/ipv6/molecule.yml

@@ -0,0 +1,63 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: vagrant
+.platform_presets:
+  - &control
+    memory: 2048
+    cpus: 2
+    groups:
+      - k3s_cluster
+      - master
+  - &node
+    memory: 2048
+    cpus: 2
+    groups:
+      - k3s_cluster
+      - node
+  - &ubuntu
+    box: generic/ubuntu2204
+    config_options:
+      # We currently can not use public-key based authentication on Ubuntu 22.04,
+      # see: https://github.com/chef/bento/issues/1405
+      ssh.username: "vagrant"
+      ssh.password: "vagrant"
+platforms:
+  - <<: [*control, *ubuntu]
+    name: control1
+    interfaces:
+      - network_name: private_network
+        ip: fdad:bad:ba55::de:11
+  - <<: [*node, *ubuntu]
+    name: node1
+    interfaces:
+      - network_name: private_network
+        ip: fdad:bad:ba55::de:21
+provisioner:
+  name: ansible
+  playbooks:
+    converge: ../resources/converge.yml
+    side_effect: ../resources/reset.yml
+    verify: ../resources/verify.yml
+  inventory:
+    links:
+      group_vars: ../../inventory/sample/group_vars
+scenario:
+  test_sequence:
+    - dependency
+    - lint
+    - cleanup
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    # idempotence is not possible with the playbook in its current form.
+    - verify
+    # We are repurposing side_effect here to test the reset playbook.
+    # This is why we do not run it before verify (which tests the cluster),
+    # but after the verify step.
+    - side_effect
+    - cleanup
+    - destroy

molecule/ipv6/overrides.yml

@@ -0,0 +1,45 @@
+---
+- name: Apply overrides
+  hosts: all
+  tasks:
+    - name: Override host variables (1/2)
+      ansible.builtin.set_fact:
+        # See: https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant  # noqa yaml[line-length]
+        flannel_iface: eth1
+
+        # The test VMs might be a bit slow, so we give them more time to join the cluster:
+        retry_count: 45
+
+        # IPv6 configuration
+        # ######################################################################
+
+        # The API server will be reachable on IPv6 only
+        apiserver_endpoint: fdad:bad:ba55::333
+
+        # We give MetalLB address space for both IPv4 and IPv6
+        metal_lb_ip_range:
+          - fdad:bad:ba55::1b:0/112
+          - 192.168.123.80-192.168.123.90
+
+        # k3s_node_ip is by default set to the IPv4 address of flannel_iface.
+        # We want IPv6 addresses here of course, so we just specify them
+        # manually below.
+        k3s_node_ip: "{{ node_ipv4 }},{{ node_ipv6 }}"
+
+    - name: Override host variables (2/2)
+      # Since "extra_args" depends on "k3s_node_ip" and "flannel_iface" we have
+      # to set this AFTER overriding the both of them.
+      ansible.builtin.set_fact:
+        # A few extra server args are necessary:
+        #  - the network policy needs to be disabled.
+        #  - we need to manually specify the subnets for services and pods, as
+        #    the default has IPv4 ranges only.
+        extra_server_args: >-
+          {{ extra_args }}
+          --tls-san {{ apiserver_endpoint }}
+          {{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
+          --disable servicelb
+          --disable traefik
+          --disable-network-policy
+          --cluster-cidr=10.42.0.0/16,fdad:bad:ba55:4200::/56
+          --service-cidr=10.43.0.0/16,fdad:bad:ba55:4300::/108

molecule/ipv6/prepare.yml

@@ -0,0 +1,51 @@
+---
+- name: Apply overrides
+  ansible.builtin.import_playbook: >-
+    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
+
+- name: Configure dual-stack networking
+  hosts: all
+  become: true
+
+  # Unfortunately, as of 2022-09, Vagrant does not support the configuration
+  # of both IPv4 and IPv6 addresses for a single network adapter. So we have
+  # to configure that ourselves.
+  # Moreover, we have to explicitly enable IPv6 for the loopback interface.
+
+  tasks:
+    - name: Enable IPv6 for network interfaces
+      ansible.posix.sysctl:
+        name: net.ipv6.conf.{{ item }}.disable_ipv6
+        value: "0"
+      with_items:
+        - all
+        - default
+        - lo
+
+    - name: Disable duplicate address detection
+      # Duplicate address detection did repeatedly fail within the virtual
+      # network. But since this setup does not use SLAAC anyway, we can safely
+      # disable it.
+      ansible.posix.sysctl:
+        name: net.ipv6.conf.{{ item }}.accept_dad
+        value: "0"
+      with_items:
+        - "{{ flannel_iface }}"
+
+    - name: Write IPv4 configuration
+      ansible.builtin.template:
+        src: 55-flannel-ipv4.yaml.j2
+        dest: /etc/netplan/55-flannel-ipv4.yaml
+        owner: root
+        group: root
+        mode: 0644
+      register: netplan_template
+
+    - name: Apply netplan configuration
+      # Conceptually, this should be a handler rather than a task.
+      # However, we are currently not in a role context - creating
+      # one just for this seemed overkill.
+      when: netplan_template.changed
+      ansible.builtin.command:
+        cmd: netplan apply
+      changed_when: true

molecule/ipv6/templates/55-flannel-ipv4.yaml.j2

@@ -0,0 +1,8 @@
+---
+network:
+  version: 2
+  renderer: networkd
+  ethernets:
+    {{ flannel_iface }}:
+      addresses:
+      - {{ node_ipv4 }}/24

molecule/resources/converge.yml

@@ -0,0 +1,7 @@
+---
+- name: Apply overrides
+  ansible.builtin.import_playbook: >-
+    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
+
+- name: Converge
+  ansible.builtin.import_playbook: ../../site.yml

molecule/resources/reset.yml

@@ -0,0 +1,7 @@
+---
+- name: Apply overrides
+  ansible.builtin.import_playbook: >-
+    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
+
+- name: Reset
+  ansible.builtin.import_playbook: ../../reset.yml

molecule/resources/verify.yml

@@ -0,0 +1,5 @@
+---
+- name: Verify
+  hosts: all
+  roles:
+    - verify/from_outside

molecule/resources/verify/from_outside/defaults/main.yml

@@ -0,0 +1,9 @@
+---
+# A host outside of the cluster from which the checks shall be performed
+outside_host: localhost
+
+# This kubernetes namespace will be used for testing
+testing_namespace: molecule-verify-from-outside
+
+# The directory in which the example manifests reside
+example_manifests_path: ../../../../example

molecule/resources/verify/from_outside/tasks/kubecfg-cleanup.yml

@@ -0,0 +1,5 @@
+---
+- name: Clean up kubecfg
+  ansible.builtin.file:
+    path: "{{ kubecfg.path }}"
+    state: absent

molecule/resources/verify/from_outside/tasks/kubecfg-fetch.yml

@@ -0,0 +1,19 @@
+---
+- name: Create temporary directory for kubecfg
+  ansible.builtin.tempfile:
+    state: directory
+    suffix: kubecfg
+  register: kubecfg
+- name: Gathering facts
+  delegate_to: "{{ groups['master'][0] }}"
+  ansible.builtin.gather_facts:
+- name: Download kubecfg
+  ansible.builtin.fetch:
+    src: "{{ ansible_env.HOME }}/.kube/config"
+    dest: "{{ kubecfg.path }}/"
+    flat: true
+  delegate_to: "{{ groups['master'][0] }}"
+  delegate_facts: true
+- name: Store path to kubecfg
+  ansible.builtin.set_fact:
+    kubecfg_path: "{{ kubecfg.path }}/config"

molecule/resources/verify/from_outside/tasks/main.yml

@@ -0,0 +1,14 @@
+---
+- name: Verify
+  run_once: true
+  delegate_to: "{{ outside_host }}"
+  block:
+    - name: "Test CASE: Get kube config"
+      ansible.builtin.import_tasks: kubecfg-fetch.yml
+    - name: "TEST CASE: Get nodes"
+      ansible.builtin.include_tasks: test/get-nodes.yml
+    - name: "TEST CASE: Deploy example"
+      ansible.builtin.include_tasks: test/deploy-example.yml
+  always:
+    - name: "TEST CASE: Cleanup"
+      ansible.builtin.import_tasks: kubecfg-cleanup.yml

molecule/resources/verify/from_outside/tasks/test/deploy-example.yml

@@ -0,0 +1,58 @@
+---
+- name: Deploy example
+  block:
+    - name: "Create namespace: {{ testing_namespace }}"
+      kubernetes.core.k8s:
+        api_version: v1
+        kind: Namespace
+        name: "{{ testing_namespace }}"
+        state: present
+        wait: true
+        kubeconfig: "{{ kubecfg_path }}"
+
+    - name: Apply example manifests
+      kubernetes.core.k8s:
+        src: "{{ example_manifests_path }}/{{ item }}"
+        namespace: "{{ testing_namespace }}"
+        state: present
+        wait: true
+        kubeconfig: "{{ kubecfg_path }}"
+      with_items:
+        - deployment.yml
+        - service.yml
+
+    - name: Get info about nginx service
+      kubernetes.core.k8s_info:
+        kind: service
+        name: nginx
+        namespace: "{{ testing_namespace }}"
+        kubeconfig: "{{ kubecfg_path }}"
+      vars: &load_balancer_metadata
+        metallb_ip: status.loadBalancer.ingress[0].ip
+        metallb_port: spec.ports[0].port
+      register: nginx_services
+
+    - name: Assert that the nginx welcome page is available
+      ansible.builtin.uri:
+        url: http://{{ ip | ansible.utils.ipwrap }}:{{ port }}/
+        return_content: yes
+      register: result
+      failed_when: "'Welcome to nginx!' not in result.content"
+      vars:
+        ip: >-
+          {{ nginx_services.resources[0].status.loadBalancer.ingress[0].ip }}
+        port: >-
+          {{ nginx_services.resources[0].spec.ports[0].port }}
+      # Deactivated linter rules:
+      #   - jinja[invalid]: As of version 6.6.0, ansible-lint complains that the input to ipwrap
+      #                     would be undefined. This will not be the case during playbook execution.
+      # noqa jinja[invalid]
+
+  always:
+    - name: "Remove namespace: {{ testing_namespace }}"
+      kubernetes.core.k8s:
+        api_version: v1
+        kind: Namespace
+        name: "{{ testing_namespace }}"
+        state: absent
+        kubeconfig: "{{ kubecfg_path }}"

molecule/resources/verify/from_outside/tasks/test/get-nodes.yml

@@ -0,0 +1,28 @@
+---
+- name: Get all nodes in cluster
+  kubernetes.core.k8s_info:
+    kind: node
+    kubeconfig: "{{ kubecfg_path }}"
+  register: cluster_nodes
+
+- name: Assert that the cluster contains exactly the expected nodes
+  ansible.builtin.assert:
+    that: found_nodes == expected_nodes
+    success_msg: "Found nodes as expected: {{ found_nodes }}"
+    fail_msg: "Expected nodes {{ expected_nodes }}, but found nodes {{ found_nodes }}"
+  vars:
+    found_nodes: >-
+      {{ cluster_nodes | json_query('resources[*].metadata.name') | unique | sort }}
+    expected_nodes: |-
+      {{
+        (
+          ( groups['master'] | default([]) ) +
+          ( groups['node'] | default([]) )
+        )
+        | unique
+        | sort
+      }}
+  # Deactivated linter rules:
+  #   - jinja[invalid]: As of version 6.6.0, ansible-lint complains that the input to ipwrap
+  #                     would be undefined. This will not be the case during playbook execution.
+  # noqa jinja[invalid]

molecule/single_node/molecule.yml

@@ -0,0 +1,48 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: vagrant
+platforms:
+  - name: control1
+    box: generic/ubuntu2204
+    memory: 4096
+    cpus: 4
+    config_options:
+      # We currently can not use public-key based authentication on Ubuntu 22.04,
+      # see: https://github.com/chef/bento/issues/1405
+      ssh.username: "vagrant"
+      ssh.password: "vagrant"
+    groups:
+      - k3s_cluster
+      - master
+    interfaces:
+      - network_name: private_network
+        ip: 192.168.30.50
+provisioner:
+  name: ansible
+  playbooks:
+    converge: ../resources/converge.yml
+    side_effect: ../resources/reset.yml
+    verify: ../resources/verify.yml
+  inventory:
+    links:
+      group_vars: ../../inventory/sample/group_vars
+scenario:
+  test_sequence:
+    - dependency
+    - lint
+    - cleanup
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    # idempotence is not possible with the playbook in its current form.
+    - verify
+    # We are repurposing side_effect here to test the reset playbook.
+    # This is why we do not run it before verify (which tests the cluster),
+    # but after the verify step.
+    - side_effect
+    - cleanup
+    - destroy

molecule/single_node/overrides.yml

@@ -0,0 +1,15 @@
+---
+- name: Apply overrides
+  hosts: all
+  tasks:
+    - name: Override host variables
+      ansible.builtin.set_fact:
+        # See: https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant  # noqa yaml[line-length]
+        flannel_iface: eth1
+
+        # The test VMs might be a bit slow, so we give them more time to join the cluster:
+        retry_count: 45
+
+        # Make sure that our IP ranges do not collide with those of the default scenario
+        apiserver_endpoint: "192.168.30.223"
+        metal_lb_ip_range: "192.168.30.91-192.168.30.99"

playbook-41-graylog.yml

@@ -1,27 +0,0 @@
----
-# - hosts: localhost
-#   become: yes
-#   roles:
-#     - role: 41-graylog/provision/delete
-#       vars:
-#         vmid: 641
-#     - role: 41-graylog/provision/create
-#       vars:
-#         vmid: 641
-#     - role: 41-graylog/provision/start
-#       vars:
-#         vmid: 641
-
-- hosts: sidon
-  become: yes
-  roles:
-    - role: 41-graylog/enable-ssh
-      vars:
-        vmid: 641
-
-- hosts: graylog
-  become: yes
-  roles:
-    - role: 41-graylog/update
-    - role: 41-graylog/install-docker
-    - role: 41-graylog/install-app

playbook-42-jellyfin.yml

@@ -1,27 +0,0 @@
----
-- hosts: localhost
-  become: yes
-  roles:
-    - role: 42-jellyfin/provision/delete
-      vars:
-        vmid: 642
-    - role: 42-jellyfin/provision/create
-      vars:
-        vmid: 642
-    - role: 42-jellyfin/provision/start
-      vars:
-        vmid: 642
-
-- hosts: purah
-  become: yes
-  roles:
-    - role: 42-jellyfin/enable-ssh
-      vars:
-        vmid: 642
-
-- hosts: jellyfin
-  become: yes
-  roles:
-    - role: 42-jellyfin/update
-    - role: 42-jellyfin/install-docker
-    - role: 42-jellyfin/install-app

playbook-43-convertx.yml

@@ -1,27 +0,0 @@
----
-- hosts: localhost
-  become: yes
-  roles:
-    - role: 43-convertx/provision/delete
-      vars:
-        vmid: 643
-    - role: 43-convertx/provision/create
-      vars:
-        vmid: 643
-    - role: 43-convertx/provision/start
-      vars:
-        vmid: 643
-
-- hosts: purah
-  become: yes
-  roles:
-    - role: 43-convertx/enable-ssh
-      vars:
-        vmid: 643
-
-- hosts: convertx
-  become: yes
-  roles:
-    - role: 43-convertx/update
-    - role: 43-convertx/install-docker
-    - role: 43-convertx/install-app

playbook-44-nocodb.yml

@@ -1,27 +0,0 @@
----
-- hosts: localhost
-  become: yes
-  roles:
-    - role: 44-nocodb/provision/delete
-      vars:
-        vmid: 644
-    - role: 44-nocodb/provision/create
-      vars:
-        vmid: 644
-    - role: 44-nocodb/provision/start
-      vars:
-        vmid: 644
-
-- hosts: purah
-  become: yes
-  roles:
-    - role: 44-nocodb/enable-ssh
-      vars:
-        vmid: 644
-
-- hosts: nocodb
-  become: yes
-  roles:
-    - role: 44-nocodb/update
-    - role: 44-nocodb/install-docker
-    - role: 44-nocodb/install-app

playbook-45-super-productitivy.yml

@@ -1,27 +0,0 @@
----
-- hosts: localhost
-  become: yes
-  roles:
-    - role: 45-super-productivity/provision/delete
-      vars:
-        vmid: 645
-    - role: 45-super-productivity/provision/create
-      vars:
-        vmid: 645
-    - role: 45-super-productivity/provision/start
-      vars:
-        vmid: 645
-
-- hosts: purah
-  become: yes
-  roles:
-    - role: 45-super-productivity/enable-ssh
-      vars:
-        vmid: 645
-
-- hosts: super-productivity
-  become: yes
-  roles:
-    - role: 45-super-productivity/update
-    - role: 45-super-productivity/install-docker
-    - role: 45-super-productivity/install-app

playbook-46-droposs.yml

@@ -1,27 +0,0 @@
----
-- hosts: localhost
-  become: yes
-  roles:
-    - role: 46-droposs/provision/delete
-      vars:
-        vmid: 646
-    - role: 46-droposs/provision/create
-      vars:
-        vmid: 646
-    - role: 46-droposs/provision/start
-      vars:
-        vmid: 646
-
-- hosts: purah
-  become: yes
-  roles:
-    - role: 46-droposs/enable-ssh
-      vars:
-        vmid: 646
-
-- hosts: droposs
-  become: yes
-  roles:
-    - role: 46-droposs/update
-    - role: 46-droposs/install-docker
-    - role: 46-droposs/install-app

playbook-47-ghost.yml

@@ -1,27 +0,0 @@
----
-- hosts: localhost
-  become: yes
-  roles:
-    - role: 47-ghost/provision/delete
-      vars:
-        vmid: 647
-    - role: 47-ghost/provision/create
-      vars:
-        vmid: 647
-    - role: 47-ghost/provision/start
-      vars:
-        vmid: 647
-
-- hosts: purah
-  become: yes
-  roles:
-    - role: 47-ghost/enable-ssh
-      vars:
-        vmid: 647
-
-- hosts: ghost
-  become: yes
-  roles:
-    - role: 47-ghost/update
-    - role: 47-ghost/install-docker
-    - role: 47-ghost/install-app

playbook-48-dawarich.yml

@@ -1,27 +0,0 @@
----
-# - hosts: localhost
-#   become: yes
-#   roles:
-#     - role: 48-dawarich/provision/delete
-#       vars:
-#         vmid: 648
-#     - role: 48-dawarich/provision/create
-#       vars:
-#         vmid: 648
-#     - role: 48-dawarich/provision/start
-#       vars:
-#         vmid: 648
-
-# - hosts: yunobo
-#   become: yes
-#   roles:
-#     - role: 48-dawarich/enable-ssh
-#       vars:
-#         vmid: 648
-
-- hosts: dawarich
-  become: yes
-  roles:
-    - role: 48-dawarich/update
-    - role: 48-dawarich/install-docker
-    - role: 48-dawarich/install-app