Compare commits
33 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Lino Silva
|
71a4005bbf | ||
|
Lino Silva
|
d75ad58f5a | ||
|
Lino Silva
|
09ddf680a7 | ||
|
Lino Silva
|
1a23832aa9 | ||
|
Lino Silva
|
4fbe12c336 | ||
|
Lino Silva
|
e37782b856 | ||
|
Lino Silva
|
d48f3e739b | ||
|
Lino Silva
|
a12b6e6c7f | ||
|
Lino Silva
|
0ad4fd3945 | ||
|
Lino Silva
|
a43c1593d9 | ||
|
Lino Silva
|
fe17c6eb69 | ||
|
Lino Silva
|
cfecd0afd8 | ||
|
Lino Silva
|
fbd6e53083 | ||
|
Lino Silva
|
5fab069837 | ||
|
Lino Silva
|
acd49ed5d8 | ||
|
Lino Silva
|
51400d260b | ||
 lino
|
8c2abd090c | ||
|
Lino Silva
|
5d2bd81a14 | ||
|
Lino Silva
|
c9c9861a82 | ||
|
Lino Silva
|
e596ff0e83 | ||
 lino
|
1913d6417c | ||
|
lino
|
508e433bab | ||
|
Lino Silva
|
5075a3e697 | ||
|
Lino Silva
|
b27354241d | ||
|
Lino Silva
|
645dacdca4 | ||
|
lino
|
f783d35513 | ||
|
Lino Silva
|
9a7c540c7e | ||
|
Lino Silva
|
6753d614ee | ||
 automationxpert
|
f892029fcf | ||
 snoopy82481
|
6b37ba5e60 | ||
 Techno Tim
|
b1fee44403 | ||
|
Techno Tim
|
a1c7175bd1 | ||
 dependabot[bot]
|
69d3bdcd88 |
+6
-12
@@ -1,17 +1,11 @@
|
|||||||
---
|
---
|
||||||
exclude_paths:
|
exclude_paths:
|
||||||
# default paths
|
# default paths
|
||||||
- '.cache/'
|
- ".cache/"
|
||||||
- '.github/'
|
- ".github/"
|
||||||
- 'test/fixtures/formatting-before/'
|
- "test/fixtures/formatting-before/"
|
||||||
- 'test/fixtures/formatting-prettier/'
|
- "test/fixtures/formatting-prettier/"
|
||||||
|
|
||||||
# The "converge" and "reset" playbooks use import_playbook in
|
|
||||||
# conjunction with the "env" lookup plugin, which lets the
|
|
||||||
# syntax check of ansible-lint fail.
|
|
||||||
- 'molecule/**/converge.yml'
|
|
||||||
- 'molecule/**/prepare.yml'
|
|
||||||
- 'molecule/**/reset.yml'
|
|
||||||
|
|
||||||
skip_list:
|
skip_list:
|
||||||
- 'fqcn-builtins'
|
- "fqcn-builtins"
|
||||||
|
- "name[play]"
|
||||||
|
|||||||
@@ -1,3 +0,0 @@
|
|||||||
---
|
|
||||||
github: timothystewart6
|
|
||||||
patreon: technotim
|
|
||||||
@@ -1,77 +0,0 @@
|
|||||||
|
|
||||||
<!-- It's a good idea to check this post first for general troubleshooting https://github.com/techno-tim/k3s-ansible/discussions/19 -->
|
|
||||||
|
|
||||||
<!--- Provide a general summary of the issue in the Title above -->
|
|
||||||
|
|
||||||
## Expected Behavior
|
|
||||||
|
|
||||||
<!--- Tell us what should happen -->
|
|
||||||
|
|
||||||
## Current Behavior
|
|
||||||
<!--- Tell us what happens instead of the expected behavior -->
|
|
||||||
|
|
||||||
## Steps to Reproduce
|
|
||||||
|
|
||||||
<!--- reproduce this bug. Include code to reproduce, if relevant -->
|
|
||||||
|
|
||||||
1.
|
|
||||||
2.
|
|
||||||
3.
|
|
||||||
4.
|
|
||||||
|
|
||||||
## Context (variables)
|
|
||||||
<!--- please include which OS, along with the variables used when running the playbook -->
|
|
||||||
|
|
||||||
Operating system:
|
|
||||||
|
|
||||||
Hardware:
|
|
||||||
|
|
||||||
### Variables Used
|
|
||||||
|
|
||||||
`all.yml`
|
|
||||||
|
|
||||||
```yml
|
|
||||||
k3s_version: ""
|
|
||||||
ansible_user: NA
|
|
||||||
systemd_dir: ""
|
|
||||||
|
|
||||||
flannel_iface: ""
|
|
||||||
|
|
||||||
apiserver_endpoint: ""
|
|
||||||
|
|
||||||
k3s_token: "NA"
|
|
||||||
|
|
||||||
extra_server_args: ""
|
|
||||||
extra_agent_args: ""
|
|
||||||
|
|
||||||
kube_vip_tag_version: ""
|
|
||||||
|
|
||||||
metal_lb_speaker_tag_version: ""
|
|
||||||
metal_lb_controller_tag_version: ""
|
|
||||||
|
|
||||||
metal_lb_ip_range: ""
|
|
||||||
```
|
|
||||||
|
|
||||||
### Hosts
|
|
||||||
|
|
||||||
`host.ini`
|
|
||||||
|
|
||||||
```ini
|
|
||||||
[master]
|
|
||||||
IP.ADDRESS.ONE
|
|
||||||
IP.ADDRESS.TWO
|
|
||||||
IP.ADDRESS.THREE
|
|
||||||
|
|
||||||
[node]
|
|
||||||
IP.ADDRESS.FOUR
|
|
||||||
IP.ADDRESS.FIVE
|
|
||||||
|
|
||||||
[k3s_cluster:children]
|
|
||||||
master
|
|
||||||
node
|
|
||||||
```
|
|
||||||
|
|
||||||
## Possible Solution
|
|
||||||
<!--- Not obligatory, but suggest a fix/reason for the bug, -->
|
|
||||||
|
|
||||||
- [ ] I've checked the [General Troubleshooting Guide](https://github.com/techno-tim/k3s-ansible/discussions/20)
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
# Proposed Changes
|
|
||||||
<!--- Provide a general summary of your changes -->
|
|
||||||
|
|
||||||
-
|
|
||||||
-
|
|
||||||
-
|
|
||||||
|
|
||||||
## Checklist
|
|
||||||
|
|
||||||
- [ ] Tested locally
|
|
||||||
- [ ] Ran `site.yml` playbook
|
|
||||||
- [ ] Ran `reset.yml` playbook
|
|
||||||
- [ ] Did not add any unnecessary changes
|
|
||||||
- [ ] 🚀
|
|
||||||
- [ ] Ran pre-commit install at least once before committing
|
|
||||||
@@ -1,11 +0,0 @@
|
|||||||
---
|
|
||||||
version: 2
|
|
||||||
updates:
|
|
||||||
- package-ecosystem: "pip"
|
|
||||||
directory: "/"
|
|
||||||
schedule:
|
|
||||||
interval: "daily"
|
|
||||||
rebase-strategy: "auto"
|
|
||||||
ignore:
|
|
||||||
- dependency-name: "*"
|
|
||||||
update-types: ["version-update:semver-major"]
|
|
||||||
@@ -1,37 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
# download-boxes.sh
|
|
||||||
# Check all molecule.yml files for required Vagrant boxes and download the ones that are not
|
|
||||||
# already present on the system.
|
|
||||||
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
GIT_ROOT=$(git rev-parse --show-toplevel)
|
|
||||||
PROVIDER=virtualbox
|
|
||||||
|
|
||||||
# Read all boxes for all platforms from the "molecule.yml" files
|
|
||||||
all_boxes=$(cat "${GIT_ROOT}"/molecule/*/molecule.yml |
|
|
||||||
yq -r '.platforms[].box' | # Read the "box" property of each node under "platforms"
|
|
||||||
grep --invert-match --regexp=--- | # Filter out file separators
|
|
||||||
sort |
|
|
||||||
uniq)
|
|
||||||
|
|
||||||
# Read the boxes that are currently present on the system (for the current provider)
|
|
||||||
present_boxes=$(
|
|
||||||
(vagrant box list |
|
|
||||||
grep "${PROVIDER}" | # Filter by boxes available for the current provider
|
|
||||||
awk '{print $1;}' | # The box name is the first word in each line
|
|
||||||
sort |
|
|
||||||
uniq) ||
|
|
||||||
echo "" # In case any of these commands fails, just use an empty list
|
|
||||||
)
|
|
||||||
|
|
||||||
# The boxes that we need to download are the ones present in $all_boxes, but not $present_boxes.
|
|
||||||
download_boxes=$(comm -2 -3 <(echo "${all_boxes}") <(echo "${present_boxes}"))
|
|
||||||
|
|
||||||
# Actually download the necessary boxes
|
|
||||||
if [ -n "${download_boxes}" ]; then
|
|
||||||
echo "${download_boxes}" | while IFS= read -r box; do
|
|
||||||
vagrant box add --provider "${PROVIDER}" "${box}"
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
@@ -1,38 +0,0 @@
|
|||||||
---
|
|
||||||
name: Linting
|
|
||||||
on:
|
|
||||||
pull_request:
|
|
||||||
push:
|
|
||||||
branches:
|
|
||||||
- master
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
pre-commit-ci:
|
|
||||||
name: Pre-Commit
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: Check out the codebase
|
|
||||||
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # 3.0.2
|
|
||||||
|
|
||||||
- name: Set up Python 3.x
|
|
||||||
uses: actions/setup-python@b55428b1882923874294fa556849718a1d7f2ca5 #4.0.2
|
|
||||||
with:
|
|
||||||
python-version: "3.x"
|
|
||||||
|
|
||||||
- name: Install dependencies
|
|
||||||
run: |
|
|
||||||
echo "::group::Upgrade pip"
|
|
||||||
python3 -m pip install --upgrade pip
|
|
||||||
echo "::endgroup::"
|
|
||||||
|
|
||||||
echo "::group::Install Python requirements from requirements.txt"
|
|
||||||
python3 -m pip install -r requirements.txt
|
|
||||||
echo "::endgroup::"
|
|
||||||
|
|
||||||
echo "::group::Install Ansible role requirements from collections/requirements.yml"
|
|
||||||
ansible-galaxy install -r collections/requirements.yml
|
|
||||||
echo "::endgroup::"
|
|
||||||
|
|
||||||
- name: Run pre-commit
|
|
||||||
uses: pre-commit/action@v3.0.0
|
|
||||||
@@ -1,81 +0,0 @@
|
|||||||
---
|
|
||||||
name: Test
|
|
||||||
on:
|
|
||||||
pull_request:
|
|
||||||
push:
|
|
||||||
branches:
|
|
||||||
- master
|
|
||||||
paths-ignore:
|
|
||||||
- '**/README.md'
|
|
||||||
jobs:
|
|
||||||
molecule:
|
|
||||||
name: Molecule
|
|
||||||
runs-on: macos-12
|
|
||||||
|
|
||||||
strategy:
|
|
||||||
matrix:
|
|
||||||
scenario:
|
|
||||||
- default
|
|
||||||
- ipv6
|
|
||||||
- single_node
|
|
||||||
fail-fast: false
|
|
||||||
env:
|
|
||||||
PYTHON_VERSION: "3.10"
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: Check out the codebase
|
|
||||||
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # 3.0.2
|
|
||||||
|
|
||||||
- name: Configure VirtualBox
|
|
||||||
run: |-
|
|
||||||
sudo mkdir -p /etc/vbox
|
|
||||||
cat <<EOF | sudo tee -a /etc/vbox/networks.conf > /dev/null
|
|
||||||
* 192.168.30.0/24
|
|
||||||
* fdad:bad:ba55::/64
|
|
||||||
EOF
|
|
||||||
|
|
||||||
- name: Cache Vagrant boxes
|
|
||||||
uses: actions/cache@fd5de65bc895cf536527842281bea11763fefd77 # 3.0.8
|
|
||||||
with:
|
|
||||||
path: |
|
|
||||||
~/.vagrant.d/boxes
|
|
||||||
key: vagrant-boxes-${{ hashFiles('**/molecule.yml') }}
|
|
||||||
restore-keys: |
|
|
||||||
vagrant-boxes
|
|
||||||
|
|
||||||
- name: Download Vagrant boxes for all scenarios
|
|
||||||
# To save some cache space, all scenarios share the same cache key.
|
|
||||||
# On the other hand, this means that the cache contents should be
|
|
||||||
# the same across all scenarios. This step ensures that.
|
|
||||||
run: ./.github/download-boxes.sh
|
|
||||||
|
|
||||||
- name: Set up Python ${{ env.PYTHON_VERSION }}
|
|
||||||
uses: actions/setup-python@v2
|
|
||||||
with:
|
|
||||||
python-version: ${{ env.PYTHON_VERSION }}
|
|
||||||
|
|
||||||
- name: Install dependencies
|
|
||||||
run: >-
|
|
||||||
python3 -m pip install --upgrade pip &&
|
|
||||||
python3 -m pip install -r requirements.txt
|
|
||||||
|
|
||||||
- name: Test with molecule
|
|
||||||
run: molecule test --scenario-name ${{ matrix.scenario }}
|
|
||||||
env:
|
|
||||||
ANSIBLE_K3S_LOG_DIR: ${{ runner.temp }}/logs/k3s-ansible/${{ matrix.scenario }}
|
|
||||||
ANSIBLE_SSH_RETRIES: 4
|
|
||||||
ANSIBLE_TIMEOUT: 60
|
|
||||||
PY_COLORS: 1
|
|
||||||
ANSIBLE_FORCE_COLOR: 1
|
|
||||||
|
|
||||||
- name: Upload log files
|
|
||||||
if: always() # do this even if a step before has failed
|
|
||||||
uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # 3.1.0
|
|
||||||
with:
|
|
||||||
name: logs
|
|
||||||
path: |
|
|
||||||
${{ runner.temp }}/logs
|
|
||||||
|
|
||||||
- name: Delete old box versions
|
|
||||||
if: always() # do this even if a step before has failed
|
|
||||||
run: vagrant box prune --force
|
|
||||||
@@ -1 +1,2 @@
|
|||||||
.env/
|
.env/
|
||||||
|
*.log
|
||||||
|
|||||||
Vendored
+3
@@ -0,0 +1,3 @@
|
|||||||
|
{
|
||||||
|
"prettier.bracketSpacing": false
|
||||||
|
}
|
||||||
@@ -22,13 +22,13 @@ Build a Kubernetes cluster using Ansible with k3s. The goal is easily install a
|
|||||||
|
|
||||||
on processor architecture:
|
on processor architecture:
|
||||||
|
|
||||||
- [X] x64
|
- [x] x64
|
||||||
- [X] arm64
|
- [x] arm64
|
||||||
- [X] armhf
|
- [x] armhf
|
||||||
|
|
||||||
## ✅ System requirements
|
## ✅ System requirements
|
||||||
|
|
||||||
- Deployment environment must have Ansible 2.4.0+. If you need a quick primer on Ansible [you can check out my docs and setting up Ansible](https://docs.technotim.live/posts/ansible-automation/).
|
- Deployment environment must have Ansible 2.4.0+. If you need a quick primer on Ansible [you can check out my docs and setting up Ansible](https://docs.technotim.live/posts/ansible-automation/).
|
||||||
|
|
||||||
- [`netaddr` package](https://pypi.org/project/netaddr/) must be available to Ansible. If you have installed Ansible via apt, this is already taken care of. If you have installed Ansible via `pip`, make sure to install `netaddr` into the respective virtual environment.
|
- [`netaddr` package](https://pypi.org/project/netaddr/) must be available to Ansible. If you have installed Ansible via apt, this is already taken care of. If you have installed Ansible via `pip`, make sure to install `netaddr` into the respective virtual environment.
|
||||||
|
|
||||||
@@ -76,7 +76,7 @@ If needed, you can also edit `inventory/my-cluster/group_vars/all.yml` to match
|
|||||||
Start provisioning of the cluster using the following command:
|
Start provisioning of the cluster using the following command:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
ansible-playbook site.yml -i inventory/my-cluster/hosts.ini
|
ansible-playbook site.yml -i inventory/my-cluster/hosts.ini --ask-become-pass --ask-vault-pass
|
||||||
```
|
```
|
||||||
|
|
||||||
After deployment control plane will be accessible via virtual ip-address which is defined in inventory/group_vars/all.yml as `apiserver_endpoint`
|
After deployment control plane will be accessible via virtual ip-address which is defined in inventory/group_vars/all.yml as `apiserver_endpoint`
|
||||||
@@ -87,7 +87,7 @@ After deployment control plane will be accessible via virtual ip-address which i
|
|||||||
ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini
|
ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini
|
||||||
```
|
```
|
||||||
|
|
||||||
>You should also reboot these nodes due to the VIP not being destroyed
|
> You should also reboot these nodes due to the VIP not being destroyed
|
||||||
|
|
||||||
## ⚙️ Kube Config
|
## ⚙️ Kube Config
|
||||||
|
|
||||||
@@ -105,13 +105,6 @@ See the commands [here](https://docs.technotim.live/posts/k3s-etcd-ansible/#test
|
|||||||
|
|
||||||
Be sure to see [this post](https://github.com/techno-tim/k3s-ansible/discussions/20) on how to troubleshoot common problems
|
Be sure to see [this post](https://github.com/techno-tim/k3s-ansible/discussions/20) on how to troubleshoot common problems
|
||||||
|
|
||||||
### Testing the playbook using molecule
|
|
||||||
|
|
||||||
This playbook includes a [molecule](https://molecule.rtfd.io/)-based test setup.
|
|
||||||
It is run automatically in CI, but you can also run the tests locally.
|
|
||||||
This might be helpful for quick feedback in a few cases.
|
|
||||||
You can find more information about it [here](molecule/README.md).
|
|
||||||
|
|
||||||
## Thanks 🤝
|
## Thanks 🤝
|
||||||
|
|
||||||
This repo is really standing on the shoulders of giants. Thank you to all those who have contributed and tanks to these repos for code and ideas:
|
This repo is really standing on the shoulders of giants. Thank you to all those who have contributed and tanks to these repos for code and ideas:
|
||||||
@@ -119,3 +112,8 @@ This repo is really standing on the shoulders of giants. Thank you to all those
|
|||||||
- [k3s-io/k3s-ansible](https://github.com/k3s-io/k3s-ansible)
|
- [k3s-io/k3s-ansible](https://github.com/k3s-io/k3s-ansible)
|
||||||
- [geerlingguy/turing-pi-cluster](https://github.com/geerlingguy/turing-pi-cluster)
|
- [geerlingguy/turing-pi-cluster](https://github.com/geerlingguy/turing-pi-cluster)
|
||||||
- [212850a/k3s-ansible](https://github.com/212850a/k3s-ansible)
|
- [212850a/k3s-ansible](https://github.com/212850a/k3s-ansible)
|
||||||
|
|
||||||
|
## TODO
|
||||||
|
|
||||||
|
- https://docs.k3s.io/installation/kube-dashboard
|
||||||
|
- https://www.phillipsj.net/posts/k3s-enable-nfs-storage/
|
||||||
|
|||||||
+21
-10
@@ -1,12 +1,23 @@
|
|||||||
[defaults]
|
[defaults]
|
||||||
nocows = True
|
nocows = True
|
||||||
roles_path = ./roles
|
roles_path = ./roles
|
||||||
inventory = ./hosts.ini
|
inventory = ./inventory/my-cluster/hosts.ini
|
||||||
|
stdout_callback = yaml
|
||||||
|
|
||||||
remote_tmp = $HOME/.ansible/tmp
|
remote_tmp = $HOME/.ansible/tmp
|
||||||
local_tmp = $HOME/.ansible/tmp
|
local_tmp = $HOME/.ansible/tmp
|
||||||
pipelining = True
|
timeout = 60
|
||||||
become = True
|
host_key_checking = False
|
||||||
host_key_checking = False
|
deprecation_warnings = False
|
||||||
deprecation_warnings = False
|
callback_whitelist = profile_tasks
|
||||||
callback_whitelist = profile_tasks
|
log_path = ./ansible.log
|
||||||
|
|
||||||
|
[privilege_escalation]
|
||||||
|
become = True
|
||||||
|
|
||||||
|
[ssh_connection]
|
||||||
|
scp_if_ssh = smart
|
||||||
|
retries = 3
|
||||||
|
ssh_args = -o ControlMaster=auto -o ControlPersist=30m -o Compression=yes -o ServerAliveInterval=15s
|
||||||
|
pipelining = True
|
||||||
|
control_path = %(directory)s/%%h-%%r
|
||||||
|
|||||||
@@ -4,3 +4,4 @@ collections:
|
|||||||
- name: community.general
|
- name: community.general
|
||||||
- name: ansible.posix
|
- name: ansible.posix
|
||||||
- name: kubernetes.core
|
- name: kubernetes.core
|
||||||
|
- name: community.docker
|
||||||
|
|||||||
@@ -1,3 +0,0 @@
|
|||||||
/*
|
|
||||||
!.gitignore
|
|
||||||
!sample/
|
|
||||||
@@ -0,0 +1,225 @@
|
|||||||
|
---
|
||||||
|
k3s_version: v1.24.6+k3s1
|
||||||
|
# this is the user that has ssh access to these machines
|
||||||
|
ansible_user: lino
|
||||||
|
systemd_dir: /etc/systemd/system
|
||||||
|
|
||||||
|
# Set your timezone
|
||||||
|
system_timezone: "Europe/Lisbon"
|
||||||
|
|
||||||
|
# apiserver_endpoint is virtual ip-address which will be configured on each master
|
||||||
|
apiserver_endpoint: "10.0.3.1"
|
||||||
|
|
||||||
|
# k3s_token is required masters can talk together securely
|
||||||
|
# this token should be alpha numeric only
|
||||||
|
k3s_token: "7qXiuKpSY9uLwdVSNSnEF5RkttoERixCpc2EVJW7vh7Ws4NMN3"
|
||||||
|
|
||||||
|
# The IP on which the node is reachable in the cluster.
|
||||||
|
# Here, a sensible default is provided, you can still override
|
||||||
|
# it for each of your hosts, though.
|
||||||
|
k3s_node_ip: '{{ ansible_facts[flannel_iface]["ipv4"]["address"] }}'
|
||||||
|
|
||||||
|
# Disable the taint manually by setting: k3s_master_taint = false
|
||||||
|
k3s_master_taint: false
|
||||||
|
|
||||||
|
# these arguments are recommended for servers as well as agents:
|
||||||
|
extra_args: >-
|
||||||
|
--flannel-iface={{ flannel_iface }}
|
||||||
|
--node-ip={{ k3s_node_ip }}
|
||||||
|
|
||||||
|
# change these to your liking, the only required are: --disable servicelb, --tls-san {{ apiserver_endpoint }}
|
||||||
|
extra_server_args: >-
|
||||||
|
{{ extra_args }}
|
||||||
|
{{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
|
||||||
|
--tls-san {{ apiserver_endpoint }}
|
||||||
|
--disable servicelb
|
||||||
|
--disable traefik
|
||||||
|
extra_agent_args: >-
|
||||||
|
{{ extra_args }}
|
||||||
|
|
||||||
|
# image tag for kube-vip
|
||||||
|
kube_vip_tag_version: "v0.5.5"
|
||||||
|
|
||||||
|
# image tag for metal lb
|
||||||
|
metal_lb_speaker_tag_version: "v0.13.6"
|
||||||
|
metal_lb_controller_tag_version: "v0.13.6"
|
||||||
|
|
||||||
|
# metallb ip range for load balancer
|
||||||
|
metal_lb_ip_range: "10.0.4.1-10.0.4.254"
|
||||||
|
|
||||||
|
lxc_password: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
38303735306236303463613632623161643633663631303931396564346565666236643562316264
|
||||||
|
6533643331306364653564653763356537303932313531350a393261643137636232616335376461
|
||||||
|
66383966333765626539363561613361393665616333303964373761356166623766663232303063
|
||||||
|
3138353333373935660a383230393330646538303933336366383736643333623663333934663131
|
||||||
|
3064
|
||||||
|
|
||||||
|
proxmox_api_password: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
35376334616332386130656335663736343337396532663266383934643632363664646631653935
|
||||||
|
6533343936353734343761343465646365616130643130360a316234333036303738663566666364
|
||||||
|
61653638373830383733323563373862346662363339656632643661336533363162616435616531
|
||||||
|
6331326462356366320a303331616366356333306638386130666538633833623162653934616338
|
||||||
|
3566
|
||||||
|
|
||||||
|
traefik_http_auth_user: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
38323532616336373939646333613338626431363466633631343162636235623563393135653231
|
||||||
|
3961383965356631613164303566393632323938386664360a373037616335643662613564353130
|
||||||
|
30353832376431633834336234386161313062373437613132623733646166303639313364373637
|
||||||
|
3933626639646536320a303163353835633837356530613931346165353939363235373561333836
|
||||||
|
39366266303064393334383835323330353934643862323330343337393761353166393333376131
|
||||||
|
33303439393531303031653361393530313930363039646566613831373366326432653634653165
|
||||||
|
313735383263623836363030386531613033
|
||||||
|
|
||||||
|
cloudflare_api_key: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
38363363386466666266613930386237623430646531303734613863306530666530376433633339
|
||||||
|
3166373361393839363439326661396136616637393865630a666637366132643035343832666335
|
||||||
|
33376139643533313730313135653064393239316162376339653965313366643565643664666534
|
||||||
|
6631393564333230370a303634643030346166383235643666356164393232643832333238313664
|
||||||
|
38346161306138653735303861646638653830633938326566663136393862643264353437623963
|
||||||
|
3462616435653132623563316231343739333761653365333437
|
||||||
|
|
||||||
|
dns_cloudflare_api_key: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
61306235353261303235646331356666643339393164333762303730646563646633626466306436
|
||||||
|
6565303031366262303161323536323236613861373536330a346564306238633461363765623030
|
||||||
|
33343566363163623532386463616431313865316563616162336633353162316134363266363263
|
||||||
|
6331353838343662380a303565643337653164613637323131363037613861306535326538333030
|
||||||
|
64313165343933343535623731393536396332613336316239363764653565346535666531656433
|
||||||
|
6131646439656638323561643264613834356662363332323835
|
||||||
|
|
||||||
|
dns_cloudflare_email: cloudflare@lino.cooking
|
||||||
|
|
||||||
|
cloudflare_ddns_api_key: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
32353865663337376239333232376630616436643435343862346164353466356563623930386461
|
||||||
|
3132306361653330356663613534626463373133616132620a313161316137313838666534313737
|
||||||
|
34336161373334356630326432626139666566316663373630656538333331656461373631613931
|
||||||
|
6364313538663464350a343061383835663264616238353965656635343564306635303830343266
|
||||||
|
38396530393133646133643232363061386265373234373832656135393764346462666566656264
|
||||||
|
3635316261393863393736383132386133313666306234343666
|
||||||
|
|
||||||
|
homeassistant_pwd: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
34623865646265653733666136316164303765633036616464626133306339393032336465613735
|
||||||
|
3139333561366530383535363834316138303338313030390a306561366265643737623833633837
|
||||||
|
31353332646635353339373937393134376566643539363563613061393731623931643931336566
|
||||||
|
3039626631643930650a393163643534353731316261376638643736623232366431396136313666
|
||||||
|
37613864396630306335626532633832653633346465316332356236393239653063393630323461
|
||||||
|
3862316639643265373166373330333936303233383333653362
|
||||||
|
|
||||||
|
gameyfin_pwd: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
64653937643761616366313263363039336262313832623035313635353638393633643330303733
|
||||||
|
3030373063343264633265616638373463383562626132650a643163333961353861626438356339
|
||||||
|
64326161373332396234656664343736356566356561306334306230343335323733306533343563
|
||||||
|
3639656666313434350a303432393831323338313331386262373130633930396365653836633965
|
||||||
|
35623030313533313462666464333339633832643261383839383432366462313262386236346434
|
||||||
|
39646434653137633062346234373965323036636663326437346238373764363261633736356532
|
||||||
|
346437633064623331653362303034653463
|
||||||
|
|
||||||
|
igdb_client_id: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
36343238373066633635656365376331626231396666373039636330376132393861373739323061
|
||||||
|
3662366362633461383730633765323530316437626639630a613337333163393539653830366235
|
||||||
|
36636139666332393366366166343064623931326634633161666264333038643537386363663962
|
||||||
|
6430613364653562320a313934393633386262343933363835663639313630653631356563346435
|
||||||
|
61616130336366613066316134303866323838653938393630623763383762316432
|
||||||
|
|
||||||
|
igdb_secret: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
65383235643965353066343661616633353163393137326661363862353131333362383336613465
|
||||||
|
3730323833613961326161643730363434643363346138610a313230656534626137373232653633
|
||||||
|
30303163646261666461366161336131326134633832643834623438363137323531393865613761
|
||||||
|
3137316331353531350a306636306233326637623030666634353066396663623663386235393238
|
||||||
|
63303939666561353032396135646666623564616562306637613430663933626530
|
||||||
|
|
||||||
|
mastodon_db_user: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
38613037323362636233336166643239636334333333366137306335643836636338343938303135
|
||||||
|
3134373363343964613236313562393966363033623231310a613236383134616566646466633334
|
||||||
|
61323031393663363438336265613062636432343338383936323161313264326662346538366436
|
||||||
|
3863633263643239390a383664663636343934383333623830333931326330613861353333643663
|
||||||
|
66303131633433376562643938313333383335323665643030623461623836643362633034613834
|
||||||
|
61626134386236616538366332313032383732356638356531613534313638316165383665313939
|
||||||
|
633035373238333032303637663366326431
|
||||||
|
|
||||||
|
mastodon_db_name: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
64376131373562633437313062366334663738336463613938653564323831316531373233396634
|
||||||
|
3530613830303835666431366438376163383433623561350a653834353761616462316161613037
|
||||||
|
64353430643062316465363764653830313065363261356231356466613533643565613562613437
|
||||||
|
3338303632653865330a326337373830396230343764333231356134616365643138663731613264
|
||||||
|
61323132363839666365326665323236373935666361663063343763363062333130663135366530
|
||||||
|
30366231633932356662663863343330366266366538326232623136363934643334656366343763
|
||||||
|
363833363666643162396434636536323166
|
||||||
|
|
||||||
|
mastodon_db_pass: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
66383339653334616233336439376164616532333062393161346238643839393161653932386265
|
||||||
|
3765376366323334613739316162336433623330373131360a653838663436663166373933353064
|
||||||
|
30646663316631653236383437616637396331616339323439353238643866633732323438636138
|
||||||
|
3530306635663631340a306237356664653033663865373964333835613733373565616638363864
|
||||||
|
36333139633033333538306335336165306537303265396631616530366534643465323232336334
|
||||||
|
33636635656130633131623437323764326565656635373265653065646135633066383561643033
|
||||||
|
373333313535343534346331643865616539
|
||||||
|
|
||||||
|
mastodon_key_base: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
33346261623634626666383762613065613865306530363831303032656335636332393564653030
|
||||||
|
3866306433323432643930326133303831633437393265620a643234376332336262636364363866
|
||||||
|
33396431653531626538396266626337623735666165636163616262393263373065356330343139
|
||||||
|
3935356133653332370a313039366431343734363430353966386534363234316666613335353562
|
||||||
|
36316435363862646437333431303430613138353338663233646130636436316366323831343531
|
||||||
|
37623063656132336135313964333134323830373761316262386433363337303964366163313265
|
||||||
|
61376438386466636332383932346431313537656332656362376630646565626130303939313432
|
||||||
|
36646233633434383565386465376238373065303831326162386331653631633962353035376266
|
||||||
|
33653332316563333138336439393839336263393438333663383536663834396365666332356334
|
||||||
|
62316264633161363233346263366164643136656464373963303539623465383734326664386130
|
||||||
|
633539303831656364653861336263613432
|
||||||
|
|
||||||
|
mastodon_otp_secret: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
65316136326539313931396665656663356536636530613533306531663965303933643939643866
|
||||||
|
3635646438363739303730343834623035613135623130390a316463366362386465353134663264
|
||||||
|
64393337663866333333636635656535373064356263666161633033643635366533653530643336
|
||||||
|
6236396264303463350a306333373231343566653939306564323332633237343463353566343836
|
||||||
|
31323337633238393761656133613230393235663261383961616266373165376263376666333032
|
||||||
|
62313033383339643438376662613235333464323566323763623031616531303238386334623133
|
||||||
|
62653637323034613934313065646565323363313535653931306434393136663961663634313232
|
||||||
|
33653933373537333834363538343432643037646165386633363334613566653538353464303839
|
||||||
|
63373632653235376338336332303064356363653537333363326432306139666238393966306535
|
||||||
|
66633266313465333066613161393734353263366561643865323666633733656439386564326233
|
||||||
|
666338346237313564313937633466373937
|
||||||
|
|
||||||
|
mastodon_vapid_private_key: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
38396438623163636339353633356339363435616262303865663834633436326331363365326433
|
||||||
|
6438633038623639346566376233356339333832383939370a353533356630346163633434346533
|
||||||
|
35386565386438383665623661653533646530623337373334356336396636376630356232656632
|
||||||
|
6634376435383163300a613635613633383765646363643563393062653465353663353935333262
|
||||||
|
35313830623635393737316337336436373730303963303962393365643165656164303633656233
|
||||||
|
3766303666323931623230623533316139666265363231356237
|
||||||
|
|
||||||
|
mastodon_vapid_public_key: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
61653763663734616263633063323466333064636230643263383935313134306163383135353131
|
||||||
|
6166383263353435306333336131373431313363373334330a383031303163346238343061356537
|
||||||
|
36653764366265323165336161303965353434366262616464646162353038353665363132616630
|
||||||
|
6465353939316534340a626533343835303433383531373666643462326162653535313966373963
|
||||||
|
65636561633532613166356666303833306332656266383237363561663239616139666465383532
|
||||||
|
65613361663534616533343631386634316661616132383035333734353561643934353339373832
|
||||||
|
34626531373530306464336437383636633830616336393265373934613030386534323335303436
|
||||||
|
32373034336162346364643139353961323831636134313538333162373665373330636564306162
|
||||||
|
3337
|
||||||
|
|
||||||
|
gmail_smtp_pass: !vault |
|
||||||
|
$ANSIBLE_VAULT;1.1;AES256
|
||||||
|
31396436653866313237616361636439343765323730383231633739643433646365383137343037
|
||||||
|
3535373866653261303761396163373334383461323661380a376561663864346633646230633531
|
||||||
|
35326435323434386564363037383961383934363163653635346233306139303664323037383435
|
||||||
|
3763313639656566620a623639386437353662316631316638363862323334323838643037336464
|
||||||
|
64373730623035616464303230626462666166636236363033633132363236306132
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.16
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
vmid: 607
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.17
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
vmid: 608
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.2
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
ip_addr: 10.0.2.2
|
||||||
|
|
||||||
|
# interface which will be used for flannel
|
||||||
|
|
||||||
|
flannel_iface: "vmbr0"
|
||||||
@@ -0,0 +1,8 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.13
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
mac_addr: EA:11:8B:05:5A:88
|
||||||
|
vmid: 203
|
||||||
|
node: epona
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.19
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
vmid: 610
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.14
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
vmid: 605
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.18
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
vmid: 609
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.1
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
ip_addr: 10.0.2.2
|
||||||
|
|
||||||
|
# interface which will be used for flannel
|
||||||
|
|
||||||
|
flannel_iface: "vmbr0"
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.20
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
vmid: 611
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.3
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
ip_addr: 10.0.2.3
|
||||||
|
# interface which will be used for flannel
|
||||||
|
flannel_iface: "vmbr0"
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.22
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
vmid: 613
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.4
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
ip_addr: 10.0.2.4
|
||||||
|
# interface which will be used for flannel
|
||||||
|
flannel_iface: "vmbr0"
|
||||||
@@ -0,0 +1,8 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.12
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
mac_addr: C2:F5:B2:99:92:51
|
||||||
|
vmid: 202
|
||||||
|
node: revali
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.15
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
vmid: 606
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.21
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
vmid: 612
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.3.110
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
|
||||||
|
# interface which will be used for flannel
|
||||||
|
|
||||||
|
flannel_iface: "eth0"
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.11
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
mac_addr: 72:2E:3C:F0:2A:B3
|
||||||
|
vmid: 201
|
||||||
|
node: mipha
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.23
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
vmid: 614
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
ansible_user: root
|
||||||
|
ansible_host: 10.0.2.7
|
||||||
|
ansible_ssh_pass: "{{ proxmox_api_password }}"
|
||||||
|
ip_addr: 10.0.2.7
|
||||||
|
# interface which will be used for flannel
|
||||||
|
flannel_iface: "vmbr0"
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
[lxc]
|
||||||
|
frigate
|
||||||
|
swag
|
||||||
|
cloudflare-ddns
|
||||||
|
dahua-to-mqtt
|
||||||
|
immich
|
||||||
|
folding
|
||||||
|
mastodon
|
||||||
|
tautulli
|
||||||
|
openvpn
|
||||||
|
youtube-downloader
|
||||||
|
|
||||||
|
[baremetal]
|
||||||
|
mipha
|
||||||
|
epona
|
||||||
|
revali
|
||||||
|
yuga
|
||||||
|
impa
|
||||||
|
|
||||||
|
[pihole]
|
||||||
|
epona-pihole
|
||||||
|
revali-pihole
|
||||||
|
urbosa-pihole
|
||||||
@@ -1,51 +0,0 @@
|
|||||||
---
|
|
||||||
k3s_version: v1.24.6+k3s1
|
|
||||||
# this is the user that has ssh access to these machines
|
|
||||||
ansible_user: ansibleuser
|
|
||||||
systemd_dir: /etc/systemd/system
|
|
||||||
|
|
||||||
# Set your timezone
|
|
||||||
system_timezone: "Your/Timezone"
|
|
||||||
|
|
||||||
# interface which will be used for flannel
|
|
||||||
flannel_iface: "eth0"
|
|
||||||
|
|
||||||
# apiserver_endpoint is virtual ip-address which will be configured on each master
|
|
||||||
apiserver_endpoint: "192.168.30.222"
|
|
||||||
|
|
||||||
# k3s_token is required masters can talk together securely
|
|
||||||
# this token should be alpha numeric only
|
|
||||||
k3s_token: "some-SUPER-DEDEUPER-secret-password"
|
|
||||||
|
|
||||||
# The IP on which the node is reachable in the cluster.
|
|
||||||
# Here, a sensible default is provided, you can still override
|
|
||||||
# it for each of your hosts, though.
|
|
||||||
k3s_node_ip: '{{ ansible_facts[flannel_iface]["ipv4"]["address"] }}'
|
|
||||||
|
|
||||||
# Disable the taint manually by setting: k3s_master_taint = false
|
|
||||||
k3s_master_taint: "{{ true if groups['node'] | default([]) | length >= 1 else false }}"
|
|
||||||
|
|
||||||
# these arguments are recommended for servers as well as agents:
|
|
||||||
extra_args: >-
|
|
||||||
--flannel-iface={{ flannel_iface }}
|
|
||||||
--node-ip={{ k3s_node_ip }}
|
|
||||||
|
|
||||||
# change these to your liking, the only required are: --disable servicelb, --tls-san {{ apiserver_endpoint }}
|
|
||||||
extra_server_args: >-
|
|
||||||
{{ extra_args }}
|
|
||||||
{{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
|
|
||||||
--tls-san {{ apiserver_endpoint }}
|
|
||||||
--disable servicelb
|
|
||||||
--disable traefik
|
|
||||||
extra_agent_args: >-
|
|
||||||
{{ extra_args }}
|
|
||||||
|
|
||||||
# image tag for kube-vip
|
|
||||||
kube_vip_tag_version: "v0.5.5"
|
|
||||||
|
|
||||||
# image tag for metal lb
|
|
||||||
metal_lb_speaker_tag_version: "v0.13.6"
|
|
||||||
metal_lb_controller_tag_version: "v0.13.6"
|
|
||||||
|
|
||||||
# metallb ip range for load balancer
|
|
||||||
metal_lb_ip_range: "192.168.30.80-192.168.30.90"
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
[master]
|
|
||||||
192.168.30.38
|
|
||||||
192.168.30.39
|
|
||||||
192.168.30.40
|
|
||||||
|
|
||||||
[node]
|
|
||||||
192.168.30.41
|
|
||||||
192.168.30.42
|
|
||||||
|
|
||||||
[k3s_cluster:children]
|
|
||||||
master
|
|
||||||
node
|
|
||||||
@@ -1,73 +0,0 @@
|
|||||||
# Test suites for `k3s-ansible`
|
|
||||||
|
|
||||||
This folder contains the [molecule](https://molecule.rtfd.io/)-based test setup for this playbook.
|
|
||||||
|
|
||||||
## Scenarios
|
|
||||||
|
|
||||||
We have these scenarios:
|
|
||||||
|
|
||||||
- **default**:
|
|
||||||
A 3 control + 2 worker node cluster based very closely on the [sample inventory](../inventory/sample/).
|
|
||||||
- **ipv6**:
|
|
||||||
A cluster that is externally accessible via IPv6 ([more information](ipv6/README.md))
|
|
||||||
To save a bit of test time, this cluster is _not_ highly available, it consists of only one control and one worker node.
|
|
||||||
- **single_node**:
|
|
||||||
Very similar to the default scenario, but uses only a single node for all cluster functionality.
|
|
||||||
|
|
||||||
## How to execute
|
|
||||||
|
|
||||||
To test on your local machine, follow these steps:
|
|
||||||
|
|
||||||
### System requirements
|
|
||||||
|
|
||||||
Make sure that the following software packages are available on your system:
|
|
||||||
|
|
||||||
- [Python 3](https://www.python.org/downloads)
|
|
||||||
- [Vagrant](https://www.vagrantup.com/downloads)
|
|
||||||
- [VirtualBox](https://www.virtualbox.org/wiki/Downloads)
|
|
||||||
|
|
||||||
### Set up VirtualBox networking on Linux and macOS
|
|
||||||
|
|
||||||
_You can safely skip this if you are working on Windows._
|
|
||||||
|
|
||||||
Furthermore, the test cluster uses the `192.168.30.0/24` subnet which is [not set up by VirtualBox automatically](https://www.virtualbox.org/manual/ch06.html#network_hostonly).
|
|
||||||
To set the subnet up for use with VirtualBox, please make sure that `/etc/vbox/networks.conf` exists and that it contains this line:
|
|
||||||
|
|
||||||
```
|
|
||||||
* 192.168.30.0/24
|
|
||||||
* fdad:bad:ba55::/64
|
|
||||||
```
|
|
||||||
|
|
||||||
### Install Python dependencies
|
|
||||||
|
|
||||||
You will get [Molecule, Ansible and a few extra dependencies](../requirements.txt) via [pip](https://pip.pypa.io/).
|
|
||||||
Usually, it is advisable to work in a [virtual environment](https://docs.python.org/3/tutorial/venv.html) for this:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
cd /path/to/k3s-ansible
|
|
||||||
|
|
||||||
# Create a virtualenv at ".env". You only need to do this once.
|
|
||||||
python3 -m venv .env
|
|
||||||
|
|
||||||
# Activate the virtualenv for your current shell session.
|
|
||||||
# If you start a new session, you will have to repeat this.
|
|
||||||
source .env/bin/activate
|
|
||||||
|
|
||||||
# Install the required packages into the virtualenv.
|
|
||||||
# These remain installed across shell sessions.
|
|
||||||
python3 -m pip install -r requirements.txt
|
|
||||||
```
|
|
||||||
|
|
||||||
### Run molecule
|
|
||||||
|
|
||||||
With the virtual environment from the previous step active in your shell session, you can now use molecule to test the playbook.
|
|
||||||
Interesting commands are:
|
|
||||||
|
|
||||||
- `molecule create`: Create virtual machines for the test cluster nodes.
|
|
||||||
- `molecule destroy`: Delete the virtual machines for the test cluster nodes.
|
|
||||||
- `molecule converge`: Run the `site` playbook on the nodes of the test cluster.
|
|
||||||
- `molecule side_effect`: Run the `reset` playbook on the nodes of the test cluster.
|
|
||||||
- `molecule verify`: Verify that the cluster works correctly.
|
|
||||||
- `molecule test`: The "all-in-one" sequence of steps that is executed in CI.
|
|
||||||
This includes the `create`, `converge`, `verify`, `side_effect` and `destroy` steps.
|
|
||||||
See [`molecule.yml`](default/molecule.yml) for more details.
|
|
||||||
@@ -1,82 +0,0 @@
|
|||||||
---
|
|
||||||
dependency:
|
|
||||||
name: galaxy
|
|
||||||
driver:
|
|
||||||
name: vagrant
|
|
||||||
.platform_presets:
|
|
||||||
- &control
|
|
||||||
memory: 2048
|
|
||||||
cpus: 2
|
|
||||||
groups:
|
|
||||||
- k3s_cluster
|
|
||||||
- master
|
|
||||||
- &node
|
|
||||||
memory: 2048
|
|
||||||
cpus: 2
|
|
||||||
groups:
|
|
||||||
- k3s_cluster
|
|
||||||
- node
|
|
||||||
- &debian
|
|
||||||
box: generic/debian11
|
|
||||||
- &rocky
|
|
||||||
box: generic/rocky9
|
|
||||||
- &ubuntu
|
|
||||||
box: generic/ubuntu2204
|
|
||||||
config_options:
|
|
||||||
# We currently can not use public-key based authentication on Ubuntu 22.04,
|
|
||||||
# see: https://github.com/chef/bento/issues/1405
|
|
||||||
ssh.username: "vagrant"
|
|
||||||
ssh.password: "vagrant"
|
|
||||||
platforms:
|
|
||||||
- <<: [*control, *ubuntu]
|
|
||||||
name: control1
|
|
||||||
interfaces:
|
|
||||||
- network_name: private_network
|
|
||||||
ip: 192.168.30.38
|
|
||||||
- <<: [*control, *debian]
|
|
||||||
name: control2
|
|
||||||
interfaces:
|
|
||||||
- network_name: private_network
|
|
||||||
ip: 192.168.30.39
|
|
||||||
- <<: [*control, *rocky]
|
|
||||||
name: control3
|
|
||||||
interfaces:
|
|
||||||
- network_name: private_network
|
|
||||||
ip: 192.168.30.40
|
|
||||||
- <<: [*node, *ubuntu]
|
|
||||||
name: node1
|
|
||||||
interfaces:
|
|
||||||
- network_name: private_network
|
|
||||||
ip: 192.168.30.41
|
|
||||||
- <<: [*node, *rocky]
|
|
||||||
name: node2
|
|
||||||
interfaces:
|
|
||||||
- network_name: private_network
|
|
||||||
ip: 192.168.30.42
|
|
||||||
provisioner:
|
|
||||||
name: ansible
|
|
||||||
playbooks:
|
|
||||||
converge: ../resources/converge.yml
|
|
||||||
side_effect: ../resources/reset.yml
|
|
||||||
verify: ../resources/verify.yml
|
|
||||||
inventory:
|
|
||||||
links:
|
|
||||||
group_vars: ../../inventory/sample/group_vars
|
|
||||||
scenario:
|
|
||||||
test_sequence:
|
|
||||||
- dependency
|
|
||||||
- lint
|
|
||||||
- cleanup
|
|
||||||
- destroy
|
|
||||||
- syntax
|
|
||||||
- create
|
|
||||||
- prepare
|
|
||||||
- converge
|
|
||||||
# idempotence is not possible with the playbook in its current form.
|
|
||||||
- verify
|
|
||||||
# We are repurposing side_effect here to test the reset playbook.
|
|
||||||
# This is why we do not run it before verify (which tests the cluster),
|
|
||||||
# but after the verify step.
|
|
||||||
- side_effect
|
|
||||||
- cleanup
|
|
||||||
- destroy
|
|
||||||
@@ -1,11 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Apply overrides
|
|
||||||
hosts: all
|
|
||||||
tasks:
|
|
||||||
- name: Override host variables
|
|
||||||
ansible.builtin.set_fact:
|
|
||||||
# See: https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant # noqa yaml[line-length]
|
|
||||||
flannel_iface: eth1
|
|
||||||
|
|
||||||
# The test VMs might be a bit slow, so we give them more time to join the cluster:
|
|
||||||
retry_count: 45
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Apply overrides
|
|
||||||
ansible.builtin.import_playbook: >-
|
|
||||||
{{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
|
|
||||||
|
|
||||||
- name: Network setup
|
|
||||||
hosts: all
|
|
||||||
tasks:
|
|
||||||
- name: Disable firewalld
|
|
||||||
when: ansible_distribution == "Rocky"
|
|
||||||
# Rocky Linux comes with firewalld enabled. It blocks some of the network
|
|
||||||
# connections needed for our k3s cluster. For our test setup, we just disable
|
|
||||||
# it since the VM host's firewall is still active for connections to and from
|
|
||||||
# the Internet.
|
|
||||||
# When building your own cluster, please DO NOT blindly copy this. Instead,
|
|
||||||
# please create a custom firewall configuration that fits your network design
|
|
||||||
# and security needs.
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: firewalld
|
|
||||||
enabled: no
|
|
||||||
state: stopped
|
|
||||||
become: true
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
# Sample IPv6 configuration for `k3s-ansible`
|
|
||||||
|
|
||||||
This scenario contains a cluster configuration which is _IPv6 first_, but still supports dual-stack networking with IPv4 for most things.
|
|
||||||
This means:
|
|
||||||
|
|
||||||
- The API server VIP is an IPv6 address.
|
|
||||||
- The MetalLB pool consists of both IPv4 and IPv4 addresses.
|
|
||||||
- Nodes as well as cluster-internal resources (pods and services) are accessible via IPv4 as well as IPv6.
|
|
||||||
|
|
||||||
## Network design
|
|
||||||
|
|
||||||
All IPv6 addresses used in this scenario share a single `/48` prefix: `fdad:bad:ba55`.
|
|
||||||
The following subnets are used:
|
|
||||||
|
|
||||||
- `fdad:bad:ba55:`**`0`**`::/64` is the subnet which contains the cluster components meant for external access.
|
|
||||||
That includes:
|
|
||||||
|
|
||||||
- The VIP for the Kubernetes API server: `fdad:bad:ba55::333`
|
|
||||||
- Services load-balanced by MetalLB: `fdad:bad:ba55::1b:0/112`
|
|
||||||
- Cluster nodes: `fdad:bad:ba55::de:0/112`
|
|
||||||
- The host executing Vagrant: `fdad:bad:ba55::1`
|
|
||||||
|
|
||||||
In a home lab setup, this might be your LAN.
|
|
||||||
|
|
||||||
- `fdad:bad:ba55:`**`4200`**`::/56` is used internally by the cluster for pods.
|
|
||||||
|
|
||||||
- `fdad:bad:ba55:`**`4300`**`::/108` is used internally by the cluster for services.
|
|
||||||
|
|
||||||
IPv4 networking is also available:
|
|
||||||
|
|
||||||
- The nodes have addresses inside `192.168.123.0/24`.
|
|
||||||
MetalLB also has a bit of address space in this range: `192.168.123.80-192.168.123.90`
|
|
||||||
- For pods and services, the k3s defaults (`10.42.0.0/16` and `10.43.0.0/16)` are used.
|
|
||||||
|
|
||||||
Note that the host running Vagrant is not part any of these IPv4 networks.
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
---
|
|
||||||
node_ipv4: 192.168.123.11
|
|
||||||
node_ipv6: fdad:bad:ba55::de:11
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
---
|
|
||||||
node_ipv4: 192.168.123.21
|
|
||||||
node_ipv6: fdad:bad:ba55::de:21
|
|
||||||
@@ -1,63 +0,0 @@
|
|||||||
---
|
|
||||||
dependency:
|
|
||||||
name: galaxy
|
|
||||||
driver:
|
|
||||||
name: vagrant
|
|
||||||
.platform_presets:
|
|
||||||
- &control
|
|
||||||
memory: 2048
|
|
||||||
cpus: 2
|
|
||||||
groups:
|
|
||||||
- k3s_cluster
|
|
||||||
- master
|
|
||||||
- &node
|
|
||||||
memory: 2048
|
|
||||||
cpus: 2
|
|
||||||
groups:
|
|
||||||
- k3s_cluster
|
|
||||||
- node
|
|
||||||
- &ubuntu
|
|
||||||
box: generic/ubuntu2204
|
|
||||||
config_options:
|
|
||||||
# We currently can not use public-key based authentication on Ubuntu 22.04,
|
|
||||||
# see: https://github.com/chef/bento/issues/1405
|
|
||||||
ssh.username: "vagrant"
|
|
||||||
ssh.password: "vagrant"
|
|
||||||
platforms:
|
|
||||||
- <<: [*control, *ubuntu]
|
|
||||||
name: control1
|
|
||||||
interfaces:
|
|
||||||
- network_name: private_network
|
|
||||||
ip: fdad:bad:ba55::de:11
|
|
||||||
- <<: [*node, *ubuntu]
|
|
||||||
name: node1
|
|
||||||
interfaces:
|
|
||||||
- network_name: private_network
|
|
||||||
ip: fdad:bad:ba55::de:21
|
|
||||||
provisioner:
|
|
||||||
name: ansible
|
|
||||||
playbooks:
|
|
||||||
converge: ../resources/converge.yml
|
|
||||||
side_effect: ../resources/reset.yml
|
|
||||||
verify: ../resources/verify.yml
|
|
||||||
inventory:
|
|
||||||
links:
|
|
||||||
group_vars: ../../inventory/sample/group_vars
|
|
||||||
scenario:
|
|
||||||
test_sequence:
|
|
||||||
- dependency
|
|
||||||
- lint
|
|
||||||
- cleanup
|
|
||||||
- destroy
|
|
||||||
- syntax
|
|
||||||
- create
|
|
||||||
- prepare
|
|
||||||
- converge
|
|
||||||
# idempotence is not possible with the playbook in its current form.
|
|
||||||
- verify
|
|
||||||
# We are repurposing side_effect here to test the reset playbook.
|
|
||||||
# This is why we do not run it before verify (which tests the cluster),
|
|
||||||
# but after the verify step.
|
|
||||||
- side_effect
|
|
||||||
- cleanup
|
|
||||||
- destroy
|
|
||||||
@@ -1,45 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Apply overrides
|
|
||||||
hosts: all
|
|
||||||
tasks:
|
|
||||||
- name: Override host variables (1/2)
|
|
||||||
ansible.builtin.set_fact:
|
|
||||||
# See: https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant # noqa yaml[line-length]
|
|
||||||
flannel_iface: eth1
|
|
||||||
|
|
||||||
# The test VMs might be a bit slow, so we give them more time to join the cluster:
|
|
||||||
retry_count: 45
|
|
||||||
|
|
||||||
# IPv6 configuration
|
|
||||||
# ######################################################################
|
|
||||||
|
|
||||||
# The API server will be reachable on IPv6 only
|
|
||||||
apiserver_endpoint: fdad:bad:ba55::333
|
|
||||||
|
|
||||||
# We give MetalLB address space for both IPv4 and IPv6
|
|
||||||
metal_lb_ip_range:
|
|
||||||
- fdad:bad:ba55::1b:0/112
|
|
||||||
- 192.168.123.80-192.168.123.90
|
|
||||||
|
|
||||||
# k3s_node_ip is by default set to the IPv4 address of flannel_iface.
|
|
||||||
# We want IPv6 addresses here of course, so we just specify them
|
|
||||||
# manually below.
|
|
||||||
k3s_node_ip: "{{ node_ipv4 }},{{ node_ipv6 }}"
|
|
||||||
|
|
||||||
- name: Override host variables (2/2)
|
|
||||||
# Since "extra_args" depends on "k3s_node_ip" and "flannel_iface" we have
|
|
||||||
# to set this AFTER overriding the both of them.
|
|
||||||
ansible.builtin.set_fact:
|
|
||||||
# A few extra server args are necessary:
|
|
||||||
# - the network policy needs to be disabled.
|
|
||||||
# - we need to manually specify the subnets for services and pods, as
|
|
||||||
# the default has IPv4 ranges only.
|
|
||||||
extra_server_args: >-
|
|
||||||
{{ extra_args }}
|
|
||||||
--tls-san {{ apiserver_endpoint }}
|
|
||||||
{{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
|
|
||||||
--disable servicelb
|
|
||||||
--disable traefik
|
|
||||||
--disable-network-policy
|
|
||||||
--cluster-cidr=10.42.0.0/16,fdad:bad:ba55:4200::/56
|
|
||||||
--service-cidr=10.43.0.0/16,fdad:bad:ba55:4300::/108
|
|
||||||
@@ -1,51 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Apply overrides
|
|
||||||
ansible.builtin.import_playbook: >-
|
|
||||||
{{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
|
|
||||||
|
|
||||||
- name: Configure dual-stack networking
|
|
||||||
hosts: all
|
|
||||||
become: true
|
|
||||||
|
|
||||||
# Unfortunately, as of 2022-09, Vagrant does not support the configuration
|
|
||||||
# of both IPv4 and IPv6 addresses for a single network adapter. So we have
|
|
||||||
# to configure that ourselves.
|
|
||||||
# Moreover, we have to explicitly enable IPv6 for the loopback interface.
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- name: Enable IPv6 for network interfaces
|
|
||||||
ansible.posix.sysctl:
|
|
||||||
name: net.ipv6.conf.{{ item }}.disable_ipv6
|
|
||||||
value: "0"
|
|
||||||
with_items:
|
|
||||||
- all
|
|
||||||
- default
|
|
||||||
- lo
|
|
||||||
|
|
||||||
- name: Disable duplicate address detection
|
|
||||||
# Duplicate address detection did repeatedly fail within the virtual
|
|
||||||
# network. But since this setup does not use SLAAC anyway, we can safely
|
|
||||||
# disable it.
|
|
||||||
ansible.posix.sysctl:
|
|
||||||
name: net.ipv6.conf.{{ item }}.accept_dad
|
|
||||||
value: "0"
|
|
||||||
with_items:
|
|
||||||
- "{{ flannel_iface }}"
|
|
||||||
|
|
||||||
- name: Write IPv4 configuration
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: 55-flannel-ipv4.yaml.j2
|
|
||||||
dest: /etc/netplan/55-flannel-ipv4.yaml
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: 0644
|
|
||||||
register: netplan_template
|
|
||||||
|
|
||||||
- name: Apply netplan configuration
|
|
||||||
# Conceptually, this should be a handler rather than a task.
|
|
||||||
# However, we are currently not in a role context - creating
|
|
||||||
# one just for this seemed overkill.
|
|
||||||
when: netplan_template.changed
|
|
||||||
ansible.builtin.command:
|
|
||||||
cmd: netplan apply
|
|
||||||
changed_when: true
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
---
|
|
||||||
network:
|
|
||||||
version: 2
|
|
||||||
renderer: networkd
|
|
||||||
ethernets:
|
|
||||||
{{ flannel_iface }}:
|
|
||||||
addresses:
|
|
||||||
- {{ node_ipv4 }}/24
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Apply overrides
|
|
||||||
ansible.builtin.import_playbook: >-
|
|
||||||
{{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
|
|
||||||
|
|
||||||
- name: Converge
|
|
||||||
ansible.builtin.import_playbook: ../../site.yml
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Apply overrides
|
|
||||||
ansible.builtin.import_playbook: >-
|
|
||||||
{{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
|
|
||||||
|
|
||||||
- name: Reset
|
|
||||||
ansible.builtin.import_playbook: ../../reset.yml
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Verify
|
|
||||||
hosts: all
|
|
||||||
roles:
|
|
||||||
- verify/from_outside
|
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
---
|
|
||||||
# A host outside of the cluster from which the checks shall be performed
|
|
||||||
outside_host: localhost
|
|
||||||
|
|
||||||
# This kubernetes namespace will be used for testing
|
|
||||||
testing_namespace: molecule-verify-from-outside
|
|
||||||
|
|
||||||
# The directory in which the example manifests reside
|
|
||||||
example_manifests_path: ../../../../example
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Clean up kubecfg
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ kubecfg.path }}"
|
|
||||||
state: absent
|
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Create temporary directory for kubecfg
|
|
||||||
ansible.builtin.tempfile:
|
|
||||||
state: directory
|
|
||||||
suffix: kubecfg
|
|
||||||
register: kubecfg
|
|
||||||
- name: Gathering facts
|
|
||||||
delegate_to: "{{ groups['master'][0] }}"
|
|
||||||
ansible.builtin.gather_facts:
|
|
||||||
- name: Download kubecfg
|
|
||||||
ansible.builtin.fetch:
|
|
||||||
src: "{{ ansible_env.HOME }}/.kube/config"
|
|
||||||
dest: "{{ kubecfg.path }}/"
|
|
||||||
flat: true
|
|
||||||
delegate_to: "{{ groups['master'][0] }}"
|
|
||||||
delegate_facts: true
|
|
||||||
- name: Store path to kubecfg
|
|
||||||
ansible.builtin.set_fact:
|
|
||||||
kubecfg_path: "{{ kubecfg.path }}/config"
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Verify
|
|
||||||
run_once: true
|
|
||||||
delegate_to: "{{ outside_host }}"
|
|
||||||
block:
|
|
||||||
- name: "Test CASE: Get kube config"
|
|
||||||
ansible.builtin.import_tasks: kubecfg-fetch.yml
|
|
||||||
- name: "TEST CASE: Get nodes"
|
|
||||||
ansible.builtin.include_tasks: test/get-nodes.yml
|
|
||||||
- name: "TEST CASE: Deploy example"
|
|
||||||
ansible.builtin.include_tasks: test/deploy-example.yml
|
|
||||||
always:
|
|
||||||
- name: "TEST CASE: Cleanup"
|
|
||||||
ansible.builtin.import_tasks: kubecfg-cleanup.yml
|
|
||||||
@@ -1,58 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Deploy example
|
|
||||||
block:
|
|
||||||
- name: "Create namespace: {{ testing_namespace }}"
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
api_version: v1
|
|
||||||
kind: Namespace
|
|
||||||
name: "{{ testing_namespace }}"
|
|
||||||
state: present
|
|
||||||
wait: true
|
|
||||||
kubeconfig: "{{ kubecfg_path }}"
|
|
||||||
|
|
||||||
- name: Apply example manifests
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
src: "{{ example_manifests_path }}/{{ item }}"
|
|
||||||
namespace: "{{ testing_namespace }}"
|
|
||||||
state: present
|
|
||||||
wait: true
|
|
||||||
kubeconfig: "{{ kubecfg_path }}"
|
|
||||||
with_items:
|
|
||||||
- deployment.yml
|
|
||||||
- service.yml
|
|
||||||
|
|
||||||
- name: Get info about nginx service
|
|
||||||
kubernetes.core.k8s_info:
|
|
||||||
kind: service
|
|
||||||
name: nginx
|
|
||||||
namespace: "{{ testing_namespace }}"
|
|
||||||
kubeconfig: "{{ kubecfg_path }}"
|
|
||||||
vars: &load_balancer_metadata
|
|
||||||
metallb_ip: status.loadBalancer.ingress[0].ip
|
|
||||||
metallb_port: spec.ports[0].port
|
|
||||||
register: nginx_services
|
|
||||||
|
|
||||||
- name: Assert that the nginx welcome page is available
|
|
||||||
ansible.builtin.uri:
|
|
||||||
url: http://{{ ip | ansible.utils.ipwrap }}:{{ port }}/
|
|
||||||
return_content: yes
|
|
||||||
register: result
|
|
||||||
failed_when: "'Welcome to nginx!' not in result.content"
|
|
||||||
vars:
|
|
||||||
ip: >-
|
|
||||||
{{ nginx_services.resources[0].status.loadBalancer.ingress[0].ip }}
|
|
||||||
port: >-
|
|
||||||
{{ nginx_services.resources[0].spec.ports[0].port }}
|
|
||||||
# Deactivated linter rules:
|
|
||||||
# - jinja[invalid]: As of version 6.6.0, ansible-lint complains that the input to ipwrap
|
|
||||||
# would be undefined. This will not be the case during playbook execution.
|
|
||||||
# noqa jinja[invalid]
|
|
||||||
|
|
||||||
always:
|
|
||||||
- name: "Remove namespace: {{ testing_namespace }}"
|
|
||||||
kubernetes.core.k8s:
|
|
||||||
api_version: v1
|
|
||||||
kind: Namespace
|
|
||||||
name: "{{ testing_namespace }}"
|
|
||||||
state: absent
|
|
||||||
kubeconfig: "{{ kubecfg_path }}"
|
|
||||||
@@ -1,28 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Get all nodes in cluster
|
|
||||||
kubernetes.core.k8s_info:
|
|
||||||
kind: node
|
|
||||||
kubeconfig: "{{ kubecfg_path }}"
|
|
||||||
register: cluster_nodes
|
|
||||||
|
|
||||||
- name: Assert that the cluster contains exactly the expected nodes
|
|
||||||
ansible.builtin.assert:
|
|
||||||
that: found_nodes == expected_nodes
|
|
||||||
success_msg: "Found nodes as expected: {{ found_nodes }}"
|
|
||||||
fail_msg: "Expected nodes {{ expected_nodes }}, but found nodes {{ found_nodes }}"
|
|
||||||
vars:
|
|
||||||
found_nodes: >-
|
|
||||||
{{ cluster_nodes | json_query('resources[*].metadata.name') | unique | sort }}
|
|
||||||
expected_nodes: |-
|
|
||||||
{{
|
|
||||||
(
|
|
||||||
( groups['master'] | default([]) ) +
|
|
||||||
( groups['node'] | default([]) )
|
|
||||||
)
|
|
||||||
| unique
|
|
||||||
| sort
|
|
||||||
}}
|
|
||||||
# Deactivated linter rules:
|
|
||||||
# - jinja[invalid]: As of version 6.6.0, ansible-lint complains that the input to ipwrap
|
|
||||||
# would be undefined. This will not be the case during playbook execution.
|
|
||||||
# noqa jinja[invalid]
|
|
||||||
@@ -1,48 +0,0 @@
|
|||||||
---
|
|
||||||
dependency:
|
|
||||||
name: galaxy
|
|
||||||
driver:
|
|
||||||
name: vagrant
|
|
||||||
platforms:
|
|
||||||
- name: control1
|
|
||||||
box: generic/ubuntu2204
|
|
||||||
memory: 4096
|
|
||||||
cpus: 4
|
|
||||||
config_options:
|
|
||||||
# We currently can not use public-key based authentication on Ubuntu 22.04,
|
|
||||||
# see: https://github.com/chef/bento/issues/1405
|
|
||||||
ssh.username: "vagrant"
|
|
||||||
ssh.password: "vagrant"
|
|
||||||
groups:
|
|
||||||
- k3s_cluster
|
|
||||||
- master
|
|
||||||
interfaces:
|
|
||||||
- network_name: private_network
|
|
||||||
ip: 192.168.30.50
|
|
||||||
provisioner:
|
|
||||||
name: ansible
|
|
||||||
playbooks:
|
|
||||||
converge: ../resources/converge.yml
|
|
||||||
side_effect: ../resources/reset.yml
|
|
||||||
verify: ../resources/verify.yml
|
|
||||||
inventory:
|
|
||||||
links:
|
|
||||||
group_vars: ../../inventory/sample/group_vars
|
|
||||||
scenario:
|
|
||||||
test_sequence:
|
|
||||||
- dependency
|
|
||||||
- lint
|
|
||||||
- cleanup
|
|
||||||
- destroy
|
|
||||||
- syntax
|
|
||||||
- create
|
|
||||||
- prepare
|
|
||||||
- converge
|
|
||||||
# idempotence is not possible with the playbook in its current form.
|
|
||||||
- verify
|
|
||||||
# We are repurposing side_effect here to test the reset playbook.
|
|
||||||
# This is why we do not run it before verify (which tests the cluster),
|
|
||||||
# but after the verify step.
|
|
||||||
- side_effect
|
|
||||||
- cleanup
|
|
||||||
- destroy
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Apply overrides
|
|
||||||
hosts: all
|
|
||||||
tasks:
|
|
||||||
- name: Override host variables
|
|
||||||
ansible.builtin.set_fact:
|
|
||||||
# See: https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant # noqa yaml[line-length]
|
|
||||||
flannel_iface: eth1
|
|
||||||
|
|
||||||
# The test VMs might be a bit slow, so we give them more time to join the cluster:
|
|
||||||
retry_count: 45
|
|
||||||
|
|
||||||
# Make sure that our IP ranges do not collide with those of the default scenario
|
|
||||||
apiserver_endpoint: "192.168.30.223"
|
|
||||||
metal_lb_ip_range: "192.168.30.91-192.168.30.99"
|
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
---
|
||||||
|
- hosts: localhost
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
# - role: cloudflare-ddns/provision/delete
|
||||||
|
- role: cloudflare-ddns/provision/create
|
||||||
|
- role: cloudflare-ddns/provision/start
|
||||||
|
|
||||||
|
- hosts: revali
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: lxc/enable-ssh
|
||||||
|
|
||||||
|
- hosts: cloudflare-ddns
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: cloudflare-ddns/update
|
||||||
|
- role: cloudflare-ddns/install-docker
|
||||||
|
- role: cloudflare-ddns/install-app
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
---
|
||||||
|
- hosts: localhost
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
# - role: dahua-to-mqtt/provision/delete
|
||||||
|
# - role: dahua-to-mqtt/provision/create
|
||||||
|
- role: dahua-to-mqtt/provision/start
|
||||||
|
vars:
|
||||||
|
vmid: 608
|
||||||
|
|
||||||
|
- hosts: revali
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: dahua-to-mqtt/enable-ssh
|
||||||
|
vars:
|
||||||
|
vmid: 608
|
||||||
|
|
||||||
|
- hosts: dahua-to-mqtt
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: dahua-to-mqtt/update
|
||||||
|
- role: dahua-to-mqtt/install-docker
|
||||||
|
- role: dahua-to-mqtt/install-app
|
||||||
@@ -0,0 +1,22 @@
|
|||||||
|
---
|
||||||
|
# - hosts: localhost
|
||||||
|
# become: yes
|
||||||
|
# roles:
|
||||||
|
# - role: folding/provision/delete
|
||||||
|
# - role: folding/provision/create
|
||||||
|
# - role: folding/provision/start
|
||||||
|
# vars:
|
||||||
|
# vmid: 610
|
||||||
|
|
||||||
|
- hosts: hyrule
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: folding/enable-ssh
|
||||||
|
vars:
|
||||||
|
vmid: 610
|
||||||
|
|
||||||
|
- hosts: folding
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: folding/update
|
||||||
|
- role: folding/install-app
|
||||||
@@ -0,0 +1,28 @@
|
|||||||
|
---
|
||||||
|
- hosts: localhost
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: frigate/provision/delete
|
||||||
|
- role: frigate/provision/create
|
||||||
|
|
||||||
|
- hosts: epona
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: frigate/provision/cgroup
|
||||||
|
|
||||||
|
- hosts: localhost
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: frigate/provision/start
|
||||||
|
|
||||||
|
- hosts: epona
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: lxc/enable-ssh
|
||||||
|
|
||||||
|
- hosts: frigate
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: frigate/update
|
||||||
|
- role: frigate/install-docker
|
||||||
|
- role: frigate/install-app
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
---
|
||||||
|
- hosts: localhost
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: immich/provision/delete
|
||||||
|
- role: immich/provision/create
|
||||||
|
- role: immich/provision/start
|
||||||
|
vars:
|
||||||
|
vmid: 609
|
||||||
|
|
||||||
|
- hosts: hyrule
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: immich/enable-ssh
|
||||||
|
vars:
|
||||||
|
vmid: 609
|
||||||
|
|
||||||
|
- hosts: immich
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: immich/update
|
||||||
|
- role: immich/install-docker
|
||||||
|
- role: immich/install-app
|
||||||
@@ -0,0 +1,38 @@
|
|||||||
|
---
|
||||||
|
# - hosts: k3s_cluster
|
||||||
|
# gather_facts: yes
|
||||||
|
# become: yes
|
||||||
|
# roles:
|
||||||
|
# - role: prereq
|
||||||
|
# - role: download
|
||||||
|
|
||||||
|
# - hosts: master
|
||||||
|
# become: yes
|
||||||
|
# roles:
|
||||||
|
# - role: k3s/master
|
||||||
|
|
||||||
|
# - hosts: node
|
||||||
|
# become: yes
|
||||||
|
# roles:
|
||||||
|
# - role: k3s/node
|
||||||
|
|
||||||
|
# - hosts: master
|
||||||
|
# become: yes
|
||||||
|
# roles:
|
||||||
|
# - role: k3s/post
|
||||||
|
|
||||||
|
# - hosts: master
|
||||||
|
# become: yes
|
||||||
|
# roles:
|
||||||
|
# - role: k3s/copy-config
|
||||||
|
|
||||||
|
- hosts: localhost
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
# - role: traefik
|
||||||
|
# - role: cert-manager
|
||||||
|
# - role: authentik
|
||||||
|
- role: argocd
|
||||||
|
# - role: nginx
|
||||||
|
# - role: arr
|
||||||
|
# - role: redis
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
---
|
||||||
|
- hosts: localhost
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: mastodon/provision/delete
|
||||||
|
- role: mastodon/provision/create
|
||||||
|
- role: mastodon/provision/start
|
||||||
|
vars:
|
||||||
|
vmid: 611
|
||||||
|
|
||||||
|
- hosts: epona
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: mastodon/enable-ssh
|
||||||
|
vars:
|
||||||
|
vmid: 611
|
||||||
|
|
||||||
|
- hosts: mastodon
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: mastodon/update
|
||||||
|
- role: mastodon/install-docker
|
||||||
|
- role: mastodon/install-app
|
||||||
@@ -0,0 +1,42 @@
|
|||||||
|
---
|
||||||
|
- hosts: localhost
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: openvpn/provision/stop
|
||||||
|
- role: openvpn/provision/delete
|
||||||
|
- role: openvpn/provision/create
|
||||||
|
- role: openvpn/provision/start
|
||||||
|
vars:
|
||||||
|
vmid: 613
|
||||||
|
|
||||||
|
- hosts: mipha
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: openvpn/enable-ssh
|
||||||
|
vars:
|
||||||
|
vmid: 613
|
||||||
|
|
||||||
|
- hosts: localhost
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: openvpn/provision/stop
|
||||||
|
vars:
|
||||||
|
vmid: 613
|
||||||
|
|
||||||
|
- hosts: mipha
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: openvpn/cgroup-rules
|
||||||
|
|
||||||
|
- hosts: localhost
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: openvpn/provision/start
|
||||||
|
vars:
|
||||||
|
vmid: 613
|
||||||
|
|
||||||
|
- hosts: openvpn
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: openvpn/update
|
||||||
|
- role: openvpn/install-app
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
---
|
||||||
|
# - hosts: localhost
|
||||||
|
# become: yes
|
||||||
|
# roles:
|
||||||
|
# - role: swag/provision/delete
|
||||||
|
# - role: swag/provision/create
|
||||||
|
# - role: swag/provision/start
|
||||||
|
|
||||||
|
# - hosts: mipha
|
||||||
|
# become: yes
|
||||||
|
# roles:
|
||||||
|
# - role: lxc/enable-ssh
|
||||||
|
|
||||||
|
- hosts: swag
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
# - role: swag/update
|
||||||
|
# - role: swag/install-docker
|
||||||
|
- role: swag/install-app
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
---
|
||||||
|
- hosts: localhost
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: tautulli/provision/delete
|
||||||
|
- role: tautulli/provision/create
|
||||||
|
- role: tautulli/provision/start
|
||||||
|
vars:
|
||||||
|
vmid: 612
|
||||||
|
|
||||||
|
- hosts: epona
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: tautulli/enable-ssh
|
||||||
|
vars:
|
||||||
|
vmid: 612
|
||||||
|
|
||||||
|
- hosts: tautulli
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: tautulli/update
|
||||||
|
- role: tautulli/install-docker
|
||||||
|
- role: tautulli/install-app
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
---
|
||||||
|
- hosts: frigate
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: frigate/update
|
||||||
|
|
||||||
|
- hosts: cloudflare-ddns
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: cloudflare-ddns/update
|
||||||
|
|
||||||
|
- hosts: swag
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: swag/update
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
---
|
||||||
|
- hosts: localhost
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: youtube-downloader/provision/delete
|
||||||
|
- role: youtube-downloader/provision/create
|
||||||
|
- role: youtube-downloader/provision/start
|
||||||
|
vars:
|
||||||
|
vmid: 614
|
||||||
|
|
||||||
|
- hosts: impa
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: youtube-downloader/enable-ssh
|
||||||
|
vars:
|
||||||
|
vmid: 614
|
||||||
|
|
||||||
|
- hosts: youtube-downloader
|
||||||
|
become: yes
|
||||||
|
roles:
|
||||||
|
- role: youtube-downloader/update
|
||||||
|
- role: youtube-downloader/install-docker
|
||||||
|
- role: youtube-downloader/install-app
|
||||||
@@ -0,0 +1,3 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
ansible-playbook reboot.yml -i inventory/my-cluster/hosts.ini
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
---
|
||||||
|
- name: Reboot k3s_cluster
|
||||||
|
hosts: k3s_cluster
|
||||||
|
gather_facts: yes
|
||||||
|
become: yes
|
||||||
|
tasks:
|
||||||
|
- name: Reboot the nodes (and Wait upto 5 mins max)
|
||||||
|
reboot:
|
||||||
|
reboot_timeout: 300
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
ansible-core>=2.13.2
|
||||||
|
ansible-lint>=6.6.0
|
||||||
|
kubernetes>=12.0.0
|
||||||
|
netaddr>=0.8.0
|
||||||
|
pyyaml>=3.11
|
||||||
|
yamllint>=1.28.0
|
||||||
|
jmespath>=1.0.1
|
||||||
|
jsonpatch>=1.32
|
||||||
|
pre-commit>=2.20.0
|
||||||
|
netaddr>=0.8.0
|
||||||
+162
-16
@@ -1,72 +1,218 @@
|
|||||||
ansible-compat==2.2.1
|
#
|
||||||
|
# This file is autogenerated by pip-compile with python 3.8
|
||||||
|
# To update, run:
|
||||||
|
#
|
||||||
|
# pip-compile requirements.in
|
||||||
|
#
|
||||||
|
ansible-compat==2.2.4
|
||||||
|
# via
|
||||||
|
# ansible-lint
|
||||||
ansible-core==2.13.5
|
ansible-core==2.13.5
|
||||||
ansible-lint==6.8.4
|
# via
|
||||||
|
# -r requirements.in
|
||||||
|
# ansible-lint
|
||||||
|
ansible-lint==6.8.6
|
||||||
|
# via -r requirements.in
|
||||||
arrow==1.2.3
|
arrow==1.2.3
|
||||||
|
# via jinja2-time
|
||||||
attrs==22.1.0
|
attrs==22.1.0
|
||||||
|
# via jsonschema
|
||||||
binaryornot==0.4.4
|
binaryornot==0.4.4
|
||||||
|
# via cookiecutter
|
||||||
black==22.10.0
|
black==22.10.0
|
||||||
|
# via ansible-lint
|
||||||
bracex==2.3.post1
|
bracex==2.3.post1
|
||||||
|
# via wcmatch
|
||||||
cachetools==5.2.0
|
cachetools==5.2.0
|
||||||
Cerberus==1.3.2
|
# via google-auth
|
||||||
certifi==2022.9.24
|
certifi==2022.9.24
|
||||||
|
# via
|
||||||
|
# kubernetes
|
||||||
|
# requests
|
||||||
cffi==1.15.1
|
cffi==1.15.1
|
||||||
|
# via cryptography
|
||||||
|
cfgv==3.3.1
|
||||||
|
# via pre-commit
|
||||||
chardet==5.0.0
|
chardet==5.0.0
|
||||||
|
# via binaryornot
|
||||||
charset-normalizer==2.1.1
|
charset-normalizer==2.1.1
|
||||||
|
# via requests
|
||||||
click==8.1.3
|
click==8.1.3
|
||||||
|
# via
|
||||||
|
# black
|
||||||
|
# click-help-colors
|
||||||
|
# cookiecutter
|
||||||
click-help-colors==0.9.1
|
click-help-colors==0.9.1
|
||||||
commonmark==0.9.1
|
commonmark==0.9.1
|
||||||
|
# via rich
|
||||||
cookiecutter==2.1.1
|
cookiecutter==2.1.1
|
||||||
cryptography==38.0.1
|
cryptography==38.0.3
|
||||||
|
# via ansible-core
|
||||||
|
distlib==0.3.6
|
||||||
|
# via virtualenv
|
||||||
distro==1.8.0
|
distro==1.8.0
|
||||||
|
# via selinux
|
||||||
enrich==1.2.7
|
enrich==1.2.7
|
||||||
|
# via molecule
|
||||||
filelock==3.8.0
|
filelock==3.8.0
|
||||||
google-auth==2.13.0
|
# via
|
||||||
|
# ansible-lint
|
||||||
|
# virtualenv
|
||||||
|
google-auth==2.14.0
|
||||||
|
# via kubernetes
|
||||||
|
identify==2.5.8
|
||||||
|
# via pre-commit
|
||||||
idna==3.4
|
idna==3.4
|
||||||
|
# via requests
|
||||||
importlib-resources==5.10.0
|
importlib-resources==5.10.0
|
||||||
Jinja2==3.1.2
|
# via jsonschema
|
||||||
|
jinja2==3.1.2
|
||||||
|
# via
|
||||||
|
# ansible-core
|
||||||
|
# cookiecutter
|
||||||
|
# jinja2-time
|
||||||
|
# molecule
|
||||||
|
# molecule-vagrant
|
||||||
jinja2-time==0.2.0
|
jinja2-time==0.2.0
|
||||||
|
# via cookiecutter
|
||||||
jmespath==1.0.1
|
jmespath==1.0.1
|
||||||
|
# via -r requirements.in
|
||||||
jsonpatch==1.32
|
jsonpatch==1.32
|
||||||
|
# via -r requirements.in
|
||||||
jsonpointer==2.3
|
jsonpointer==2.3
|
||||||
jsonschema==4.16.0
|
# via jsonpatch
|
||||||
kubernetes==24.2.0
|
jsonschema==4.17.0
|
||||||
MarkupSafe==2.1.1
|
# via
|
||||||
molecule==4.0.1
|
# ansible-compat
|
||||||
|
# ansible-lint
|
||||||
|
# molecule
|
||||||
|
kubernetes==25.3.0
|
||||||
|
# via -r requirements.in
|
||||||
|
markupsafe==2.1.1
|
||||||
|
# via jinja2
|
||||||
|
molecule==4.0.3
|
||||||
|
# via
|
||||||
|
# -r requirements.in
|
||||||
|
# molecule-vagrant
|
||||||
molecule-vagrant==1.0.0
|
molecule-vagrant==1.0.0
|
||||||
|
# via -r requirements.in
|
||||||
mypy-extensions==0.4.3
|
mypy-extensions==0.4.3
|
||||||
|
# via black
|
||||||
netaddr==0.8.0
|
netaddr==0.8.0
|
||||||
|
# via -r requirements.in
|
||||||
|
nodeenv==1.7.0
|
||||||
|
# via pre-commit
|
||||||
oauthlib==3.2.2
|
oauthlib==3.2.2
|
||||||
|
# via requests-oauthlib
|
||||||
packaging==21.3
|
packaging==21.3
|
||||||
|
# via
|
||||||
|
# ansible-compat
|
||||||
|
# ansible-core
|
||||||
|
# ansible-lint
|
||||||
|
# molecule
|
||||||
pathspec==0.10.1
|
pathspec==0.10.1
|
||||||
|
# via
|
||||||
|
# black
|
||||||
|
# yamllint
|
||||||
pkgutil-resolve-name==1.3.10
|
pkgutil-resolve-name==1.3.10
|
||||||
|
# via jsonschema
|
||||||
platformdirs==2.5.2
|
platformdirs==2.5.2
|
||||||
|
# via
|
||||||
|
# black
|
||||||
|
# virtualenv
|
||||||
pluggy==1.0.0
|
pluggy==1.0.0
|
||||||
|
# via molecule
|
||||||
pre-commit==2.20.0
|
pre-commit==2.20.0
|
||||||
|
# via -r requirements.in
|
||||||
pyasn1==0.4.8
|
pyasn1==0.4.8
|
||||||
|
# via
|
||||||
|
# pyasn1-modules
|
||||||
|
# rsa
|
||||||
pyasn1-modules==0.2.8
|
pyasn1-modules==0.2.8
|
||||||
|
# via google-auth
|
||||||
pycparser==2.21
|
pycparser==2.21
|
||||||
Pygments==2.13.0
|
# via cffi
|
||||||
|
pygments==2.13.0
|
||||||
|
# via rich
|
||||||
pyparsing==3.0.9
|
pyparsing==3.0.9
|
||||||
pyrsistent==0.18.1
|
# via packaging
|
||||||
|
pyrsistent==0.19.2
|
||||||
|
# via jsonschema
|
||||||
python-dateutil==2.8.2
|
python-dateutil==2.8.2
|
||||||
|
# via
|
||||||
|
# arrow
|
||||||
|
# kubernetes
|
||||||
python-slugify==6.1.2
|
python-slugify==6.1.2
|
||||||
|
# via cookiecutter
|
||||||
python-vagrant==1.0.0
|
python-vagrant==1.0.0
|
||||||
PyYAML==6.0
|
# via molecule-vagrant
|
||||||
|
pyyaml==6.0
|
||||||
|
# via
|
||||||
|
# -r requirements.in
|
||||||
|
# ansible-compat
|
||||||
|
# ansible-core
|
||||||
|
# ansible-lint
|
||||||
|
# cookiecutter
|
||||||
|
# kubernetes
|
||||||
|
# molecule
|
||||||
|
# molecule-vagrant
|
||||||
|
# pre-commit
|
||||||
|
# yamllint
|
||||||
requests==2.28.1
|
requests==2.28.1
|
||||||
|
# via
|
||||||
|
# cookiecutter
|
||||||
|
# kubernetes
|
||||||
|
# requests-oauthlib
|
||||||
requests-oauthlib==1.3.1
|
requests-oauthlib==1.3.1
|
||||||
|
# via kubernetes
|
||||||
resolvelib==0.8.1
|
resolvelib==0.8.1
|
||||||
|
# via ansible-core
|
||||||
rich==12.6.0
|
rich==12.6.0
|
||||||
|
# via
|
||||||
|
# ansible-lint
|
||||||
|
# enrich
|
||||||
|
# molecule
|
||||||
rsa==4.9
|
rsa==4.9
|
||||||
ruamel.yaml==0.17.21
|
# via google-auth
|
||||||
ruamel.yaml.clib==0.2.7
|
ruamel-yaml==0.17.21
|
||||||
|
# via ansible-lint
|
||||||
|
ruamel-yaml-clib==0.2.7
|
||||||
|
# via ruamel-yaml
|
||||||
selinux==0.2.1
|
selinux==0.2.1
|
||||||
|
# via molecule-vagrant
|
||||||
six==1.16.0
|
six==1.16.0
|
||||||
|
# via
|
||||||
|
# google-auth
|
||||||
|
# kubernetes
|
||||||
|
# python-dateutil
|
||||||
subprocess-tee==0.3.5
|
subprocess-tee==0.3.5
|
||||||
|
# via ansible-compat
|
||||||
text-unidecode==1.3
|
text-unidecode==1.3
|
||||||
|
# via python-slugify
|
||||||
|
toml==0.10.2
|
||||||
|
# via pre-commit
|
||||||
tomli==2.0.1
|
tomli==2.0.1
|
||||||
|
# via black
|
||||||
typing-extensions==4.4.0
|
typing-extensions==4.4.0
|
||||||
|
# via
|
||||||
|
# black
|
||||||
|
# rich
|
||||||
urllib3==1.26.12
|
urllib3==1.26.12
|
||||||
|
# via
|
||||||
|
# kubernetes
|
||||||
|
# requests
|
||||||
|
virtualenv==20.16.6
|
||||||
|
# via pre-commit
|
||||||
wcmatch==8.4.1
|
wcmatch==8.4.1
|
||||||
websocket-client==1.4.1
|
# via ansible-lint
|
||||||
|
websocket-client==1.4.2
|
||||||
|
# via kubernetes
|
||||||
yamllint==1.28.0
|
yamllint==1.28.0
|
||||||
|
# via
|
||||||
|
# -r requirements.in
|
||||||
|
# ansible-lint
|
||||||
zipp==3.10.0
|
zipp==3.10.0
|
||||||
|
# via importlib-resources
|
||||||
|
|
||||||
|
# The following packages are considered to be unsafe in a requirements file:
|
||||||
|
# setuptools
|
||||||
|
|||||||
@@ -1,3 +1,3 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini
|
ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini --ask-become-pass --ask-vault-pass
|
||||||
|
|||||||
@@ -1,12 +1,9 @@
|
|||||||
---
|
---
|
||||||
|
|
||||||
- hosts: k3s_cluster
|
- hosts: k3s_cluster
|
||||||
gather_facts: yes
|
gather_facts: yes
|
||||||
become: yes
|
become: yes
|
||||||
roles:
|
roles:
|
||||||
- role: reset
|
- role: reset
|
||||||
- role: raspberrypi
|
|
||||||
vars: {state: absent}
|
|
||||||
post_tasks:
|
post_tasks:
|
||||||
- name: Reboot and wait for node to come back up
|
- name: Reboot and wait for node to come back up
|
||||||
reboot:
|
reboot:
|
||||||
|
|||||||
@@ -0,0 +1,27 @@
|
|||||||
|
---
|
||||||
|
- name: Create argocd namespace
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
name: argocd
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
api_version: v1
|
||||||
|
kind: Namespace
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Install argocd
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
state: present
|
||||||
|
namespace: argocd
|
||||||
|
definition: "{{ lookup('template', 'install.yml') | from_yaml }}"
|
||||||
|
|
||||||
|
- name: Deploy forwardauth middleware
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
state: present
|
||||||
|
definition: "{{ lookup('template', 'middleware-forwardauth.yml') | from_yaml }}"
|
||||||
|
|
||||||
|
- name: Deploy argocd - ingress
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
state: present
|
||||||
|
definition: "{{ lookup('template', 'ingress.yml') | from_yaml }}"
|
||||||
@@ -0,0 +1,37 @@
|
|||||||
|
---
|
||||||
|
apiVersion: traefik.containo.us/v1alpha1
|
||||||
|
kind: IngressRoute
|
||||||
|
metadata:
|
||||||
|
name: argocd
|
||||||
|
namespace: argocd
|
||||||
|
annotations:
|
||||||
|
kubernetes.io/ingress.class: traefik-external
|
||||||
|
spec:
|
||||||
|
entryPoints:
|
||||||
|
- websecure
|
||||||
|
routes:
|
||||||
|
- match: Host(`argocd.lino.cooking`)
|
||||||
|
kind: Rule
|
||||||
|
services:
|
||||||
|
- name: argocd-server
|
||||||
|
port: 80
|
||||||
|
middlewares:
|
||||||
|
- name: argocd-forwardauth
|
||||||
|
namespace: argocd
|
||||||
|
- match: Host(`argocd.lino.cooking`) && Headers(`Content-Type`, `application/grpc`)
|
||||||
|
kind: Rule
|
||||||
|
services:
|
||||||
|
- name: argocd-server
|
||||||
|
port: 80
|
||||||
|
scheme: h2c
|
||||||
|
- match: "Host(`argocd.lino.cooking`) && PathPrefix(`/outpost.goauthentik.io/`)"
|
||||||
|
kind: Rule
|
||||||
|
priority: 15
|
||||||
|
services:
|
||||||
|
- kind: Service
|
||||||
|
# Or, to use an external Outpost, create an ExternalName service and reference that here.
|
||||||
|
# See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
|
||||||
|
name: authentik
|
||||||
|
port: 9000
|
||||||
|
tls:
|
||||||
|
secretName: lino-cooking-tls
|
||||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,21 @@
|
|||||||
|
apiVersion: traefik.containo.us/v1alpha1
|
||||||
|
kind: Middleware
|
||||||
|
metadata:
|
||||||
|
name: argocd-forwardauth
|
||||||
|
namespace: argocd
|
||||||
|
spec:
|
||||||
|
forwardAuth:
|
||||||
|
address: https://argocd.lino.cooking/outpost.goauthentik.io/auth/traefik
|
||||||
|
trustForwardHeader: true
|
||||||
|
authResponseHeaders:
|
||||||
|
- X-authentik-username
|
||||||
|
- X-authentik-groups
|
||||||
|
- X-authentik-email
|
||||||
|
- X-authentik-name
|
||||||
|
- X-authentik-uid
|
||||||
|
- X-authentik-jwt
|
||||||
|
- X-authentik-meta-jwks
|
||||||
|
- X-authentik-meta-outpost
|
||||||
|
- X-authentik-meta-provider
|
||||||
|
- X-authentik-meta-app
|
||||||
|
- X-authentik-meta-version
|
||||||
@@ -0,0 +1,64 @@
|
|||||||
|
---
|
||||||
|
# - name: Create a arr-apps namespace
|
||||||
|
# kubernetes.core.k8s:
|
||||||
|
# name: arr-apps
|
||||||
|
# kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
# api_version: v1
|
||||||
|
# kind: Namespace
|
||||||
|
# state: present
|
||||||
|
|
||||||
|
- name: Deploy arr - deployment
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
state: present
|
||||||
|
definition: "{{ lookup('template', 'deployment.yml') | from_yaml }}"
|
||||||
|
loop:
|
||||||
|
- { name: 'radarr', port: 7878 }
|
||||||
|
- { name: 'prowlarr', port: 9696 }
|
||||||
|
- { name: 'sonarr', port: 8989 }
|
||||||
|
- { name: 'overseerr', port: 5055 }
|
||||||
|
- { name: 'transmission', port: 9091 }
|
||||||
|
- { name: 'bazarr', port: 6767 }
|
||||||
|
- { name: 'lidarr', port: 8686 }
|
||||||
|
|
||||||
|
- name: Deploy arr services
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
state: present
|
||||||
|
definition: "{{ lookup('template', 'service.yml') | from_yaml }}"
|
||||||
|
loop:
|
||||||
|
- { name: 'radarr', port: 7878 }
|
||||||
|
- { name: 'prowlarr', port: 9696 }
|
||||||
|
- { name: 'sonarr', port: 8989 }
|
||||||
|
- { name: 'overseerr', port: 5055 }
|
||||||
|
- { name: 'transmission', port: 9091 }
|
||||||
|
- { name: 'bazarr', port: 6767 }
|
||||||
|
- { name: 'lidarr', port: 8686 }
|
||||||
|
|
||||||
|
- name: Deploy forwardauth middleware
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
state: present
|
||||||
|
definition: "{{ lookup('template', 'middleware-forwardauth.yml') | from_yaml }}"
|
||||||
|
loop:
|
||||||
|
- radarr
|
||||||
|
- prowlarr
|
||||||
|
- sonarr
|
||||||
|
- overseerr
|
||||||
|
- transmission
|
||||||
|
- bazarr
|
||||||
|
- lidarr
|
||||||
|
|
||||||
|
- name: Deploy arr - ingress
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
state: present
|
||||||
|
definition: "{{ lookup('template', 'ingress.yml') | from_yaml }}"
|
||||||
|
loop:
|
||||||
|
- { name: 'radarr', port: 7878 }
|
||||||
|
- { name: 'prowlarr', port: 9696 }
|
||||||
|
- { name: 'sonarr', port: 8989 }
|
||||||
|
- { name: 'overseerr', port: 5055 }
|
||||||
|
- { name: 'transmission', port: 9091 }
|
||||||
|
- { name: 'bazarr', port: 6767 }
|
||||||
|
- { name: 'lidarr', port: 8686 }
|
||||||
@@ -0,0 +1,30 @@
|
|||||||
|
---
|
||||||
|
- kind: Deployment
|
||||||
|
apiVersion: apps/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ item.name }}
|
||||||
|
namespace: default
|
||||||
|
labels:
|
||||||
|
app: {{ item.name }}
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
progressDeadlineSeconds: 600
|
||||||
|
revisionHistoryLimit: 2
|
||||||
|
strategy:
|
||||||
|
type: Recreate
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: {{ item.name }}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: {{ item.name }}
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: {{ item.name }}
|
||||||
|
image: linuxserver/{{ item.name }}
|
||||||
|
ports:
|
||||||
|
- name: app-port
|
||||||
|
containerPort: {{ item.port }}
|
||||||
|
hostPort: {{ item.port }}
|
||||||
|
protocol: TCP
|
||||||
@@ -0,0 +1,32 @@
|
|||||||
|
---
|
||||||
|
apiVersion: traefik.containo.us/v1alpha1
|
||||||
|
kind: IngressRoute
|
||||||
|
metadata:
|
||||||
|
name: {{ item.name }}
|
||||||
|
namespace: default
|
||||||
|
annotations:
|
||||||
|
kubernetes.io/ingress.class: traefik-external
|
||||||
|
spec:
|
||||||
|
entryPoints:
|
||||||
|
- websecure
|
||||||
|
routes:
|
||||||
|
- match: Host(`{{ item.name }}.lino.cooking`)
|
||||||
|
kind: Rule
|
||||||
|
services:
|
||||||
|
- name: {{ item.name }}
|
||||||
|
port: {{ item.port }}
|
||||||
|
middlewares:
|
||||||
|
- name: default-headers
|
||||||
|
- name: {{ item.name }}-forwardauth
|
||||||
|
namespace: traefik
|
||||||
|
- match: "Host(`{{ item.name }}.lino.cooking`) && PathPrefix(`/outpost.goauthentik.io/`)"
|
||||||
|
kind: Rule
|
||||||
|
priority: 15
|
||||||
|
services:
|
||||||
|
- kind: Service
|
||||||
|
# Or, to use an external Outpost, create an ExternalName service and reference that here.
|
||||||
|
# See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
|
||||||
|
name: authentik
|
||||||
|
port: 9000
|
||||||
|
tls:
|
||||||
|
secretName: lino-cooking-tls
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
apiVersion: traefik.containo.us/v1alpha1
|
||||||
|
kind: Middleware
|
||||||
|
metadata:
|
||||||
|
name: {{ item }}-forwardauth
|
||||||
|
namespace: traefik
|
||||||
|
spec:
|
||||||
|
forwardAuth:
|
||||||
|
address: https://{{ item }}.lino.cooking/outpost.goauthentik.io/auth/traefik
|
||||||
|
trustForwardHeader: true
|
||||||
|
authResponseHeaders:
|
||||||
|
- X-authentik-username
|
||||||
|
- X-authentik-groups
|
||||||
|
- X-authentik-email
|
||||||
|
- X-authentik-name
|
||||||
|
- X-authentik-uid
|
||||||
|
- X-authentik-jwt
|
||||||
|
- X-authentik-meta-jwks
|
||||||
|
- X-authentik-meta-outpost
|
||||||
|
- X-authentik-meta-provider
|
||||||
|
- X-authentik-meta-app
|
||||||
|
- X-authentik-meta-version
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ item.name }}
|
||||||
|
namespace: default
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
app: {{ item.name }}
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
targetPort: {{ item.port }}
|
||||||
|
port: {{ item.port }}
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
---
|
||||||
|
- name: Add authentik helm repo
|
||||||
|
kubernetes.core.helm_repository:
|
||||||
|
name: authentik
|
||||||
|
repo_url: "https://charts.goauthentik.io"
|
||||||
|
|
||||||
|
- name: Update the repository cache
|
||||||
|
kubernetes.core.helm:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
name: dummy
|
||||||
|
namespace: kube-system
|
||||||
|
state: absent
|
||||||
|
update_repo_cache: true
|
||||||
|
|
||||||
|
- name: Deploy latest version of Authentik chart inside
|
||||||
|
kubernetes.core.helm:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
name: authentik
|
||||||
|
namespace: traefik
|
||||||
|
chart_ref: authentik/authentik
|
||||||
|
values: "{{ lookup('template', 'values.yml') | from_yaml }}"
|
||||||
@@ -0,0 +1,22 @@
|
|||||||
|
authentik:
|
||||||
|
secret_key: "fKkVEXDoUdGYwoNb$97xQuG9uw7zu$rFDe6y7!UZ&6$5*cyx6h"
|
||||||
|
# This sends anonymous usage-data, stack traces on errors and
|
||||||
|
# performance data to sentry.io, and is fully opt-in
|
||||||
|
error_reporting:
|
||||||
|
enabled: true
|
||||||
|
postgresql:
|
||||||
|
password: "uNP9W3zMpp4853QF9f@mpJDEXprca@tX@cEj3#BLFR&WFZVBU^"
|
||||||
|
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
hosts:
|
||||||
|
- host: auth.lino.cooking
|
||||||
|
paths:
|
||||||
|
- path: "/"
|
||||||
|
pathType: Prefix
|
||||||
|
|
||||||
|
postgresql:
|
||||||
|
enabled: true
|
||||||
|
postgresqlPassword: "uNP9W3zMpp4853QF9f@mpJDEXprca@tX@cEj3#BLFR&WFZVBU^"
|
||||||
|
redis:
|
||||||
|
enabled: true
|
||||||
@@ -0,0 +1,65 @@
|
|||||||
|
---
|
||||||
|
# From repository
|
||||||
|
- name: Add traefik helm repo
|
||||||
|
kubernetes.core.helm_repository:
|
||||||
|
name: jetstack
|
||||||
|
repo_url: "https://charts.jetstack.io"
|
||||||
|
|
||||||
|
- name: Update the repository cache
|
||||||
|
kubernetes.core.helm:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
name: dummy
|
||||||
|
namespace: kube-system
|
||||||
|
state: absent
|
||||||
|
update_repo_cache: true
|
||||||
|
|
||||||
|
- name: Download cert-manager.crds manifest to the cluster.
|
||||||
|
ansible.builtin.get_url:
|
||||||
|
url: https://github.com/cert-manager/cert-manager/releases/download/v1.10.0/cert-manager.crds.yaml
|
||||||
|
dest: /tmp/cert-manager.crds.yaml
|
||||||
|
mode: "0664"
|
||||||
|
|
||||||
|
- name: Apply cert-manager.crds manifest to the cluster.
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
state: present
|
||||||
|
src: /tmp/cert-manager.crds.yaml
|
||||||
|
|
||||||
|
- name: Deploy latest version of cert-manager chart inside cert-manager namespace (and create it)
|
||||||
|
kubernetes.core.helm:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
name: cert-manager
|
||||||
|
chart_ref: jetstack/cert-manager
|
||||||
|
release_namespace: cert-manager
|
||||||
|
create_namespace: true
|
||||||
|
values: "{{ lookup('template', 'values.yml') | from_yaml }}"
|
||||||
|
|
||||||
|
- name: Deploy cert-manager secret - Cloudflare
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
state: present
|
||||||
|
definition: "{{ lookup('template', 'secret-cf-token.yml') | from_yaml }}"
|
||||||
|
|
||||||
|
- name: Deploy lets encrypt staging
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
state: present
|
||||||
|
definition: "{{ lookup('template', 'letsencrypt-staging.yml') | from_yaml }}"
|
||||||
|
|
||||||
|
- name: Deploy cert-manager staging
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
state: present
|
||||||
|
definition: "{{ lookup('template', 'lino-cooking.staging.yml') | from_yaml }}"
|
||||||
|
|
||||||
|
- name: Deploy lets encrypt production
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
state: present
|
||||||
|
definition: "{{ lookup('template', 'letsencrypt-production.yml') | from_yaml }}"
|
||||||
|
|
||||||
|
- name: Deploy cert-manager production
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
state: present
|
||||||
|
definition: "{{ lookup('template', 'lino-cooking.prod.yml') | from_yaml }}"
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
---
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: ClusterIssuer
|
||||||
|
metadata:
|
||||||
|
name: letsencrypt-production
|
||||||
|
spec:
|
||||||
|
acme:
|
||||||
|
server: https://acme-v02.api.letsencrypt.org/directory
|
||||||
|
email: letsencrypt@lino.cooking
|
||||||
|
privateKeySecretRef:
|
||||||
|
name: letsencrypt-production
|
||||||
|
solvers:
|
||||||
|
- dns01:
|
||||||
|
cloudflare:
|
||||||
|
email: D5&YbHe&oKx82uuTQ^AfW#$*D8GsDE#K3x^446S^wvH#8T@W2C
|
||||||
|
apiTokenSecretRef:
|
||||||
|
name: cloudflare-api-token-secret
|
||||||
|
key: cloudflare-token
|
||||||
|
selector:
|
||||||
|
dnsZones:
|
||||||
|
- "lino.cooking"
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
---
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: ClusterIssuer
|
||||||
|
metadata:
|
||||||
|
name: letsencrypt-staging
|
||||||
|
spec:
|
||||||
|
acme:
|
||||||
|
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||||
|
email: letsencrypt@lino.cooking
|
||||||
|
privateKeySecretRef:
|
||||||
|
name: letsencrypt-staging
|
||||||
|
solvers:
|
||||||
|
- dns01:
|
||||||
|
cloudflare:
|
||||||
|
email: okulto+cloudflare@gmail.com
|
||||||
|
apiTokenSecretRef:
|
||||||
|
name: cloudflare-api-token-secret
|
||||||
|
key: api-token
|
||||||
|
selector:
|
||||||
|
dnsZones:
|
||||||
|
- "lino.cooking"
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
---
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Certificate
|
||||||
|
metadata:
|
||||||
|
name: lino-cooking
|
||||||
|
namespace: default
|
||||||
|
spec:
|
||||||
|
secretName: lino-cooking-tls
|
||||||
|
issuerRef:
|
||||||
|
name: letsencrypt-production
|
||||||
|
kind: ClusterIssuer
|
||||||
|
commonName: "*.lino.cooking"
|
||||||
|
dnsNames:
|
||||||
|
- "lino.cooking"
|
||||||
|
- "*.lino.cooking"
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
---
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Certificate
|
||||||
|
metadata:
|
||||||
|
name: lino-cooking
|
||||||
|
namespace: default
|
||||||
|
spec:
|
||||||
|
secretName: lino-cooking-staging-tls
|
||||||
|
issuerRef:
|
||||||
|
name: letsencrypt-staging
|
||||||
|
kind: ClusterIssuer
|
||||||
|
commonName: "*.lino.cooking"
|
||||||
|
dnsNames:
|
||||||
|
- "lino.cooking"
|
||||||
|
- "*.lino.cooking"
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: cloudflare-api-token-secret
|
||||||
|
namespace: cert-manager
|
||||||
|
type: Opaque
|
||||||
|
stringData:
|
||||||
|
cloudflare-token: "{{ cloudflare_api_key }}"
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
installCRDs: false
|
||||||
|
replicaCount: 3
|
||||||
|
extraArgs:
|
||||||
|
- --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
|
||||||
|
- --dns01-recursive-nameservers-only
|
||||||
|
podDnsPolicy: None
|
||||||
|
podDnsConfig:
|
||||||
|
nameservers:
|
||||||
|
- "1.1.1.1"
|
||||||
|
- "9.9.9.9"
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
- name: Store kube configuration
|
||||||
|
ansible.builtin.fetch:
|
||||||
|
src: ~/.kube/config
|
||||||
|
dest: ~/.kube/config
|
||||||
|
flat: true
|
||||||
|
when: ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname']
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
---
|
||||||
|
- name: Deploy admin user
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
state: present
|
||||||
|
definition: "{{ lookup('template', 'dashboard.admin-user.yml') | from_yaml }}"
|
||||||
|
|
||||||
|
- name: Deploy admin user role
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kubeconfig: /Users/lino.silva/.kube/config
|
||||||
|
state: present
|
||||||
|
definition: "{{ lookup('template', 'dashboard.admin-user-role.yml') | from_yaml }}"
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: admin-user
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: cluster-admin
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: admin-user
|
||||||
|
namespace: kubernetes-dashboard
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: admin-user
|
||||||
|
namespace: kubernetes-dashboard
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user