feat: restructure repository as ansible collection
BREAKING CHANGE: Repository restructure from Ansible Role to Ansible Collection !37
This commit is contained in:
27
roles/nfc_kubernetes/tasks/helm/main.yaml
Normal file
27
roles/nfc_kubernetes/tasks/helm/main.yaml
Normal file
@ -0,0 +1,27 @@
|
||||
---
|
||||
|
||||
- name: Fetch Helm APT Key
|
||||
ansible.builtin.get_url:
|
||||
url: https://baltocdn.com/helm/signing.asc
|
||||
dest: /usr/share/keyrings/helm.asc
|
||||
mode: 740
|
||||
|
||||
|
||||
- name: Add Helm Repository
|
||||
ansible.builtin.apt_repository:
|
||||
repo: >-
|
||||
deb [arch={%- if ansible_architecture == 'aarch64' -%}
|
||||
arm64
|
||||
{%- else -%}
|
||||
amd64
|
||||
{%- endif %} signed-by=/usr/share/keyrings/helm.asc] http://baltocdn.com/helm/stable/{{
|
||||
ansible_os_family | lower }}/ all main
|
||||
state: present
|
||||
filename: helm
|
||||
|
||||
|
||||
- name: Install Helm
|
||||
ansible.builtin.apt:
|
||||
package:
|
||||
- helm
|
||||
state: present
|
||||
69
roles/nfc_kubernetes/tasks/k3s/configure.yaml
Normal file
69
roles/nfc_kubernetes/tasks/k3s/configure.yaml
Normal file
@ -0,0 +1,69 @@
|
||||
---
|
||||
|
||||
- name: Additional config files
|
||||
ansible.builtin.copy:
|
||||
content: |
|
||||
{{ item.content }}
|
||||
dest: "{{ item.path }}/{{ item.name }}"
|
||||
mode: '740'
|
||||
owner: root
|
||||
group: root
|
||||
loop: "{{ k3s.files }}"
|
||||
when: item.when | default(false) | bool
|
||||
|
||||
|
||||
- name: Check if FW dir exists
|
||||
ansible.builtin.stat:
|
||||
name: /etc/iptables.rules.d
|
||||
register: firewall_rules_dir_metadata
|
||||
|
||||
|
||||
- name: Copy Templates
|
||||
ansible.builtin.template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
owner: root
|
||||
mode: '700'
|
||||
force: true
|
||||
notify: "{{ item.notify | default(omit) }}"
|
||||
loop: "{{ templates_to_apply }}"
|
||||
when: >
|
||||
item.when | default(true) | bool
|
||||
vars:
|
||||
templates_to_apply:
|
||||
|
||||
- src: kubernetes-manifest-rbac.yaml.j2
|
||||
dest: /var/lib/rancher/k3s/server/manifests/rbac-authorization-common.yaml
|
||||
when: "{{ kubernetes_config.cluster.prime.name | default(inventory_hostname) == inventory_hostname }}"
|
||||
|
||||
- src: iptables-kubernetes.rules.j2
|
||||
dest: "/etc/iptables.rules.d/iptables-kubernetes.rules"
|
||||
notify: firewall_reloader
|
||||
when: "{{ firewall_rules_dir_metadata.stat.exists }}"
|
||||
|
||||
|
||||
- name: Add Kubernetes Node Labels
|
||||
ansible.builtin.copy:
|
||||
content: |-
|
||||
apiVersion: v1
|
||||
kind: Node
|
||||
metadata:
|
||||
name: "{{ inventory_hostname }}"
|
||||
{% if kubernetes_config.hosts[inventory_hostname].labels | default([]) | list | length > 0 -%}
|
||||
labels:
|
||||
{{ kubernetes_config.hosts[inventory_hostname].labels | to_nice_yaml | indent(4) }}
|
||||
{%- endif +%}
|
||||
{% if kubernetes_config.hosts[inventory_hostname].taints | default([]) | list | length > 0 -%}
|
||||
spec:
|
||||
taints:
|
||||
{{ kubernetes_config.hosts[inventory_hostname].taints | to_nice_yaml(indent=0) | indent(4) }}
|
||||
{% endif %}
|
||||
dest: /var/lib/rancher/k3s/server/manifests/node-manifest-{{ inventory_hostname }}.yaml
|
||||
owner: root
|
||||
group: root
|
||||
mode: '700'
|
||||
delegate_to: "{{ kubernetes_config.cluster.prime.name }}"
|
||||
when:
|
||||
kubernetes_config.hosts[inventory_hostname].labels | default([]) | list | length > 0
|
||||
or
|
||||
kubernetes_config.hosts[inventory_hostname].taints | default([]) | list | length > 0
|
||||
540
roles/nfc_kubernetes/tasks/k3s/install.yaml
Normal file
540
roles/nfc_kubernetes/tasks/k3s/install.yaml
Normal file
@ -0,0 +1,540 @@
|
||||
---
|
||||
|
||||
- name: Check for calico deployment manifest
|
||||
ansible.builtin.stat:
|
||||
name: /var/lib/rancher/k3s/server/manifests/calico.yaml
|
||||
register: file_calico_yaml_metadata
|
||||
|
||||
|
||||
- name: Check for calico Operator deployment manifest
|
||||
ansible.builtin.stat:
|
||||
name: /var/lib/rancher/k3s/ansible/deployment-manifest-calico_operator.yaml
|
||||
register: file_calico_operator_yaml_metadata
|
||||
|
||||
|
||||
- name: Install Software
|
||||
ansible.builtin.include_role:
|
||||
name: nfc_common
|
||||
vars:
|
||||
common_gather_facts: false
|
||||
initial_common_tasks: true # Don't run init tasks
|
||||
aptInstall:
|
||||
- name: curl
|
||||
- name: iptables
|
||||
- name: jq
|
||||
- name: wireguard
|
||||
|
||||
|
||||
- name: Remove swapfile from /etc/fstab
|
||||
ansible.posix.mount:
|
||||
name: "{{ item }}"
|
||||
fstype: swap
|
||||
state: absent
|
||||
with_items:
|
||||
- swap
|
||||
- none
|
||||
when:
|
||||
- ansible_os_family == 'Debian' # ansible_lsb.codename = bullseye, ansible_lsb.major_release = 11
|
||||
tags:
|
||||
- install
|
||||
|
||||
|
||||
- name: Disable swap
|
||||
ansible.builtin.command:
|
||||
cmd: swapoff -a
|
||||
changed_when: false
|
||||
when:
|
||||
- ansible_os_family == 'Debian'
|
||||
tags:
|
||||
- install
|
||||
|
||||
- name: Check an armbian os system
|
||||
ansible.builtin.stat:
|
||||
path: /etc/default/armbian-zram-config
|
||||
register: armbian_stat_result
|
||||
|
||||
|
||||
- name: Armbian Disable Swap
|
||||
ansible.builtin.shell:
|
||||
cmd: |
|
||||
sed -i 's/\# SWAP=false/SWAP=false/g' /etc/default/armbian-zram-config;
|
||||
sed -i 's/ENABLED=true/ENABLED=false/g' /etc/default/armbian-zram-config;
|
||||
args:
|
||||
executable: bash
|
||||
changed_when: false
|
||||
when: armbian_stat_result.stat.exists
|
||||
|
||||
|
||||
- name: Create Required directories
|
||||
ansible.builtin.file:
|
||||
name: "{{ item.name }}"
|
||||
state: "{{ item.state }}"
|
||||
mode: "{{ item.mode }}"
|
||||
loop: "{{ dirs }}"
|
||||
vars:
|
||||
dirs:
|
||||
- name: /etc/rancher/k3s
|
||||
state: directory
|
||||
mode: 700
|
||||
- name: /var/lib/rancher/k3s/server/logs
|
||||
state: directory
|
||||
mode: 700
|
||||
- name: /var/lib/rancher/k3s/server/manifests
|
||||
state: directory
|
||||
mode: 700
|
||||
- name: /var/lib/rancher/k3s/ansible
|
||||
state: directory
|
||||
mode: 700
|
||||
|
||||
|
||||
- name: Add sysctl net.ipv4.ip_forward
|
||||
ansible.posix.sysctl:
|
||||
name: "{{ item.name }}"
|
||||
value: "{{ item.value }}"
|
||||
sysctl_set: true
|
||||
state: present
|
||||
reload: true
|
||||
loop: "{{ settings }}"
|
||||
notify: reboot_host # On change reboot
|
||||
vars:
|
||||
settings:
|
||||
- name: net.ipv4.ip_forward
|
||||
value: '1'
|
||||
- name: fs.inotify.max_user_watches
|
||||
value: '524288'
|
||||
- name: fs.inotify.max_user_instances
|
||||
value: '512'
|
||||
- name: net.ipv6.conf.all.disable_ipv6
|
||||
value: '1'
|
||||
when:
|
||||
- ansible_os_family == 'Debian'
|
||||
|
||||
|
||||
- name: Check for Network Manager Directory
|
||||
ansible.builtin.stat:
|
||||
name: /etc/NetworkManager/conf.d
|
||||
register: directory_network_manager_metadata
|
||||
|
||||
|
||||
- name: Network Manager Setup
|
||||
ansible.builtin.copy:
|
||||
content: |-
|
||||
#
|
||||
# K3s Configuration for Network Manager
|
||||
#
|
||||
# Managed By ansible/role/nfc_kubernetes
|
||||
#
|
||||
# Dont edit this file directly as it will be overwritten.
|
||||
#
|
||||
[keyfile]
|
||||
unmanaged-devices=interface-name:cali*;interface-name:tunl*;interface-name:vxlan.calico;interface-name:vxlan-v6.calico;interface-name:wireguard.cali;interface-name:wg-v6.cali
|
||||
dest: /etc/NetworkManager/conf.d/calico.conf
|
||||
mode: '770'
|
||||
owner: root
|
||||
group: root
|
||||
diff: true
|
||||
when: directory_network_manager_metadata.stat.exists
|
||||
|
||||
|
||||
- name: Check if K3s Installed
|
||||
ansible.builtin.shell:
|
||||
cmd: |
|
||||
if [[ $(service k3s status) ]]; then exit 0; else exit 1; fi
|
||||
executable: /bin/bash
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
register: k3s_installed
|
||||
when: >
|
||||
nfc_role_kubernetes_master | default(false) | bool
|
||||
|
||||
|
||||
- name: Check if K3s Installed
|
||||
ansible.builtin.shell:
|
||||
cmd: |
|
||||
if [[ $(service k3s-agent status) ]]; then exit 0; else exit 1; fi
|
||||
executable: /bin/bash
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
register: k3s_installed
|
||||
when: >
|
||||
not nfc_role_kubernetes_worker | default(false) | bool
|
||||
|
||||
|
||||
- name: Download Install Scripts
|
||||
ansible.builtin.uri:
|
||||
url: "{{ item.url }}"
|
||||
method: GET
|
||||
return_content: true
|
||||
status_code:
|
||||
- 200
|
||||
- 304
|
||||
dest: "{{ item.dest }}"
|
||||
mode: "744"
|
||||
changed_when: false
|
||||
register: k3s_download_script
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
# no_log: true
|
||||
when: >
|
||||
ansible_os_family == 'Debian'
|
||||
and
|
||||
item.when | default(true) | bool
|
||||
loop: "{{ download_files }}"
|
||||
vars:
|
||||
ansible_connection: local
|
||||
download_files:
|
||||
- dest: /tmp/install.sh
|
||||
url: https://get.k3s.io
|
||||
- dest: /tmp/install_olm.sh
|
||||
url: https://raw.githubusercontent.com/operator-framework/operator-lifecycle-manager/v{{ kubernetes_version_olm }}/scripts/install.sh
|
||||
when: "{{ nfc_role_kubernetes_install_olm }}"
|
||||
|
||||
|
||||
- name: Download K3s Binary
|
||||
ansible.builtin.uri:
|
||||
url: |-
|
||||
https://github.com/k3s-io/k3s/releases/download/v
|
||||
{{- KubernetesVersion + KubernetesVersion_k3s_prefix | urlencode -}}
|
||||
/k3s
|
||||
{%- if cpu_arch.key == 'aarch64' -%}
|
||||
-arm64
|
||||
{%- endif %}
|
||||
method: GET
|
||||
return_content: false
|
||||
status_code:
|
||||
- 200
|
||||
- 304
|
||||
dest: "/tmp/k3s.{{ cpu_arch.key }}"
|
||||
mode: "744"
|
||||
changed_when: false
|
||||
register: k3s_download_files
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
# no_log: true
|
||||
when: ansible_os_family == 'Debian'
|
||||
loop: "{{ nfc_kubernetes_install_architectures | dict2items }}"
|
||||
loop_control:
|
||||
loop_var: cpu_arch
|
||||
vars:
|
||||
ansible_connection: local
|
||||
|
||||
|
||||
- name: "[TRACE] Downloaded File SHA256"
|
||||
ansible.builtin.set_fact:
|
||||
hash_sha256_k3s_downloaded_binary: "{{ lookup('ansible.builtin.file', '/tmp/k3s.' + cpu_arch.key) | hash('sha256') | string }}"
|
||||
delegate_to: localhost
|
||||
loop: "{{ nfc_kubernetes_install_architectures | dict2items }}"
|
||||
loop_control:
|
||||
loop_var: cpu_arch
|
||||
|
||||
|
||||
- name: Existing k3s File hash
|
||||
ansible.builtin.stat:
|
||||
checksum_algorithm: sha256
|
||||
name: /usr/local/bin/k3s
|
||||
register: hash_sha256_k3s_existing_binary
|
||||
|
||||
|
||||
- name: Copy K3s binary to Host
|
||||
ansible.builtin.copy:
|
||||
src: "/tmp/k3s.{{ ansible_architecture }}"
|
||||
dest: "/usr/local/bin/k3s"
|
||||
mode: '741'
|
||||
owner: root
|
||||
group: root
|
||||
when: hash_sha256_k3s_existing_binary.stat.checksum | default('0') != hash_sha256_k3s_downloaded_binary
|
||||
|
||||
|
||||
- name: Copy install scripts to Host
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.path }}"
|
||||
dest: "{{ item.path }}"
|
||||
mode: '755'
|
||||
owner: root
|
||||
group: root
|
||||
changed_when: false
|
||||
loop: "{{ install_scripts }}"
|
||||
vars:
|
||||
install_scripts:
|
||||
- path: "/tmp/install.sh"
|
||||
- path: "/tmp/install_olm.sh"
|
||||
when: "{{ nfc_role_kubernetes_install_olm }}"
|
||||
when: >
|
||||
item.when | default(true) | bool
|
||||
|
||||
|
||||
- name: Required Initial config files
|
||||
ansible.builtin.copy:
|
||||
content: |
|
||||
{{ item.content }}
|
||||
dest: "{{ item.path }}/{{ item.name }}"
|
||||
mode: '740'
|
||||
owner: root
|
||||
group: root
|
||||
loop: "{{ k3s.files }}"
|
||||
when: >
|
||||
item.when | default(true) | bool
|
||||
# kubernetes_config.cluster.prime.name == inventory_hostname
|
||||
|
||||
|
||||
- name: Copy Intial required templates
|
||||
ansible.builtin.template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
owner: root
|
||||
mode: '700'
|
||||
force: true
|
||||
notify: "{{ item.notify | default(omit) }}"
|
||||
loop: "{{ templates_to_apply }}"
|
||||
diff: true
|
||||
when: >
|
||||
item.when | default(true) | bool
|
||||
vars:
|
||||
templates_to_apply:
|
||||
- src: k3s-config.yaml.j2
|
||||
dest: /etc/rancher/k3s/config.yaml
|
||||
notify: kubernetes_restart
|
||||
- src: "calico.yaml.j2"
|
||||
dest: /var/lib/rancher/k3s/server/manifests/calico.yaml
|
||||
when: >
|
||||
{{
|
||||
kubernetes_config.cluster.prime.name | default(inventory_hostname) == inventory_hostname
|
||||
and
|
||||
(
|
||||
(
|
||||
not file_calico_operator_yaml_metadata.stat.exists
|
||||
and
|
||||
file_calico_yaml_metadata.stat.exists
|
||||
and
|
||||
k3s_installed.rc == 0
|
||||
)
|
||||
or
|
||||
'calico_manifest' in ansible_run_tags
|
||||
)
|
||||
}}
|
||||
- src: k3s-registries.yaml.j2
|
||||
dest: /etc/rancher/k3s/registries.yaml
|
||||
notify: kubernetes_restart
|
||||
when: "{{ (kubernetes_private_container_registry | default([])) | from_yaml | list | length > 0 }}"
|
||||
|
||||
|
||||
# - name: Templates IPv6
|
||||
# ansible.builtin.template:
|
||||
# src: iptables-kubernetes.rules.j2
|
||||
# dest: "/etc/ip6tables.rules.d/ip6tables-kubernetes.rules"
|
||||
# owner: root
|
||||
# mode: '700'
|
||||
# force: true
|
||||
# vars:
|
||||
# ipv6: true
|
||||
|
||||
|
||||
- name: Set IPTables to legacy mode
|
||||
ansible.builtin.command:
|
||||
cmd: update-alternatives --set iptables /usr/sbin/iptables-legacy
|
||||
changed_when: false
|
||||
|
||||
|
||||
- name: Install K3s (prime master)
|
||||
ansible.builtin.shell:
|
||||
cmd: |
|
||||
INSTALL_K3S_SKIP_DOWNLOAD=true \
|
||||
INSTALL_K3S_VERSION="v{{ KubernetesVersion }}{{ KubernetesVersion_k3s_prefix }}" \
|
||||
/tmp/install.sh {% if nfc_role_kubernetes_etcd_enabled %}--cluster-init{% endif %}
|
||||
changed_when: false
|
||||
when: >
|
||||
kubernetes_config.cluster.prime.name | default(inventory_hostname) == inventory_hostname
|
||||
and
|
||||
k3s_installed.rc == 1
|
||||
|
||||
|
||||
- name: Install Calico Operator
|
||||
ansible.builtin.include_tasks:
|
||||
file: migrate_to_operator.yaml
|
||||
apply:
|
||||
tags:
|
||||
- always
|
||||
when: >-
|
||||
(
|
||||
(
|
||||
'operator_migrate_calico' in ansible_run_tags
|
||||
or
|
||||
'operator_calico' in ansible_run_tags
|
||||
)
|
||||
or
|
||||
not file_calico_yaml_metadata.stat.exists
|
||||
)
|
||||
and
|
||||
'calico_manifest' not in ansible_run_tags
|
||||
and
|
||||
kubernetes_config.cluster.prime.name | default(inventory_hostname) == inventory_hostname
|
||||
|
||||
|
||||
- name: Install MetalLB Operator
|
||||
ansible.builtin.include_tasks:
|
||||
file: manifest_apply.yaml
|
||||
apply:
|
||||
tags:
|
||||
- always
|
||||
loop: "{{ manifests }}"
|
||||
loop_control:
|
||||
loop_var: manifest
|
||||
vars:
|
||||
manifests:
|
||||
- name: MetalLB Operator
|
||||
template: Deployment-manifest-MetalLB_Operator.yaml
|
||||
when: >-
|
||||
nfc_kubernetes_enable_metallb | default(false) | bool
|
||||
and
|
||||
kubernetes_config.cluster.prime.name | default(inventory_hostname) == inventory_hostname
|
||||
|
||||
|
||||
- name: Wait for kubernetes prime to be ready
|
||||
ansible.builtin.shell:
|
||||
cmd: |
|
||||
set -o pipefail
|
||||
if [ `which jq` ]; then
|
||||
echo $(kubectl get no $(hostname) -o json | jq .status.conditions[4].status | tr -d '"');
|
||||
else
|
||||
echo jq command not found;
|
||||
exit 127;
|
||||
fi
|
||||
executable: /bin/bash
|
||||
delegate_to: "{{ kubernetes_config.cluster.prime.name | default(inventory_hostname) }}"
|
||||
run_once: true
|
||||
register: kubernetes_ready_check
|
||||
retries: 30
|
||||
delay: 10
|
||||
until: >
|
||||
kubernetes_ready_check.stdout | default(false) | bool
|
||||
or
|
||||
kubernetes_ready_check.rc != 0
|
||||
changed_when: false
|
||||
failed_when: kubernetes_ready_check.rc != 0
|
||||
|
||||
|
||||
- name: Install olm
|
||||
ansible.builtin.shell:
|
||||
cmd: |
|
||||
/tmp/install_olm.sh v{{ kubernetes_version_olm }}
|
||||
changed_when: false
|
||||
failed_when: >
|
||||
'already installed' not in install_olm.stdout
|
||||
and
|
||||
install_olm.rc == 1
|
||||
register: install_olm
|
||||
when: >
|
||||
kubernetes_config.cluster.prime.name | default(inventory_hostname) == inventory_hostname
|
||||
and
|
||||
nfc_role_kubernetes_install_olm | default(false) | bool
|
||||
|
||||
|
||||
- name: Uninstall OLM
|
||||
ansible.builtin.shell:
|
||||
cmd: |
|
||||
kubectl delete -n olm deployment packageserver;
|
||||
kubectl delete -n olm deployment catalog-operator;
|
||||
kubectl delete -n olm deployment olm-operator;
|
||||
|
||||
kubectl delete crd catalogsources.operators.coreos.com;
|
||||
kubectl delete crd clusterserviceversions.operators.coreos.com;
|
||||
kubectl delete crd installplans.operators.coreos.com;
|
||||
kubectl delete crd olmconfigs.operators.coreos.com;
|
||||
kubectl delete crd operatorconditions.operators.coreos.com;
|
||||
kubectl delete crd operatorgroups.operators.coreos.com;
|
||||
kubectl delete crd operators.operators.coreos.com;
|
||||
kubectl delete crd subscriptions.operators.coreos.com;
|
||||
|
||||
kubectl delete namespace operators --force;
|
||||
kubectl delete namespace olm --force;
|
||||
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
register: install_olm
|
||||
when: >
|
||||
kubernetes_config.cluster.prime.name | default(inventory_hostname) == inventory_hostname
|
||||
and
|
||||
'olm_uninstall' in ansible_run_tags
|
||||
|
||||
|
||||
- name: Enable Cluster Encryption
|
||||
ansible.builtin.command:
|
||||
cmd: kubectl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true,"wireguardEnabledV6":true}}'
|
||||
changed_when: false
|
||||
failed_when: false # New cluster will fail
|
||||
when: >
|
||||
kubernetes_config.cluster.prime.name | default(inventory_hostname) == inventory_hostname
|
||||
and
|
||||
kubernetes_config.cluster.networking.encrypt | default(false) | bool
|
||||
and
|
||||
(
|
||||
'calico_manifest' in ansible_run_tags
|
||||
or
|
||||
(
|
||||
'operator_migrate_calico' not in ansible_run_tags
|
||||
or
|
||||
'operator_calico' not in ansible_run_tags
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
- name: Fetch Join Token
|
||||
ansible.builtin.slurp:
|
||||
src: /var/lib/rancher/k3s/server/token
|
||||
delegate_to: "{{ kubernetes_config.cluster.prime.name | default(inventory_hostname) }}"
|
||||
run_once: true
|
||||
register: k3s_join_token
|
||||
no_log: true # Value is sensitive
|
||||
|
||||
|
||||
- name: Create Token fact
|
||||
ansible.builtin.set_fact:
|
||||
k3s_join_token: "{{ k3s_join_token.content | b64decode | replace('\n', '') }}"
|
||||
delegate_to: "{{ kubernetes_config.cluster.prime.name | default(inventory_hostname) }}"
|
||||
run_once: true
|
||||
no_log: true # Value is sensitive
|
||||
|
||||
|
||||
- name: Install K3s (master nodes)
|
||||
ansible.builtin.shell:
|
||||
cmd: |
|
||||
INSTALL_K3S_EXEC="server" \
|
||||
INSTALL_K3S_SKIP_DOWNLOAD=true \
|
||||
INSTALL_K3S_VERSION="v{{ KubernetesVersion }}{{ KubernetesVersion_k3s_prefix }}" \
|
||||
K3S_TOKEN="{{ k3s_join_token }}" \
|
||||
/tmp/install.sh
|
||||
executable: /bin/bash
|
||||
changed_when: false
|
||||
when: >
|
||||
nfc_role_kubernetes_master | default(false) | bool
|
||||
and
|
||||
not kubernetes_config.cluster.prime.name | default(inventory_hostname) == inventory_hostname
|
||||
and
|
||||
k3s_installed.rc == 1
|
||||
|
||||
|
||||
- name: Install K3s (worker nodes)
|
||||
ansible.builtin.shell:
|
||||
cmd: |
|
||||
set -o pipefail
|
||||
INSTALL_K3S_EXEC="agent" \
|
||||
INSTALL_K3S_SKIP_DOWNLOAD=true \
|
||||
INSTALL_K3S_VERSION="v{{ KubernetesVersion }}{{ KubernetesVersion_k3s_prefix }}" \
|
||||
K3S_TOKEN="{{ k3s_join_token }}" \
|
||||
K3S_URL="https://{{ hostvars[kubernetes_config.cluster.prime.name | default(inventory_hostname)].ansible_host }}:6443" \
|
||||
/tmp/install.sh -
|
||||
executable: /bin/bash
|
||||
changed_when: false
|
||||
when: >
|
||||
not nfc_role_kubernetes_master | default(false) | bool
|
||||
and
|
||||
not kubernetes_config.cluster.prime.name | default(inventory_hostname) == inventory_hostname
|
||||
and
|
||||
k3s_installed.rc == 1
|
||||
|
||||
|
||||
- name: Set Kubernetes Final Install Fact
|
||||
ansible.builtin.set_fact:
|
||||
kubernetes_installed: true
|
||||
# Clear Token as no llonger required and due to being a sensitive value
|
||||
k3s_join_token: null
|
||||
49
roles/nfc_kubernetes/tasks/k3s/manifest_apply.yaml
Normal file
49
roles/nfc_kubernetes/tasks/k3s/manifest_apply.yaml
Normal file
@ -0,0 +1,49 @@
|
||||
---
|
||||
|
||||
# Save the manifests in a dir so that diff's can be shown for changes
|
||||
- name: Copy Manifest for addition - {{ manifest.name }}
|
||||
ansible.builtin.template:
|
||||
src: "{{ manifest.template }}"
|
||||
dest: "/var/lib/rancher/k3s/ansible/{{ manifest.template | lower | replace('.j2', '') }}"
|
||||
mode: '744'
|
||||
become: true
|
||||
diff: true
|
||||
|
||||
|
||||
- name: Try / Catch
|
||||
block:
|
||||
|
||||
# Try to create first, if fail use replace.
|
||||
- name: Apply Manifest Create - {{ manifest.name }}
|
||||
ansible.builtin.command:
|
||||
cmd: "kubectl create -f /var/lib/rancher/k3s/ansible/{{ manifest.template | lower | replace('.j2', '') }}"
|
||||
become: true
|
||||
changed_when: false
|
||||
failed_when: >
|
||||
'Error from server' in manifest_stdout.stderr
|
||||
register: manifest_stdout
|
||||
|
||||
|
||||
rescue:
|
||||
|
||||
|
||||
- name: TRACE - Manifest Create - {{ manifest.name }}
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ manifest_stdout }}"
|
||||
|
||||
|
||||
- name: Replace Manifests - "Rescue" - {{ manifest.name }}
|
||||
ansible.builtin.command:
|
||||
cmd: "kubectl replace -f /var/lib/rancher/k3s/ansible/{{ manifest.template | lower | replace('.j2', '') }}"
|
||||
become: true
|
||||
changed_when: false
|
||||
failed_when: >
|
||||
'Error from server' in manifest_stdout.stderr
|
||||
and
|
||||
'ensure CRDs are installed first' in manifest_stdout.stderr
|
||||
register: manifest_stdout
|
||||
|
||||
|
||||
- name: TRACE - Replace Manifest - "Rescue" - {{ manifest.name }}
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ manifest_stdout }}"
|
||||
198
roles/nfc_kubernetes/tasks/k3s/migrate_to_operator.yaml
Normal file
198
roles/nfc_kubernetes/tasks/k3s/migrate_to_operator.yaml
Normal file
@ -0,0 +1,198 @@
|
||||
---
|
||||
|
||||
# Reference https://docs.tigera.io/calico/3.25/operations/operator-migration
|
||||
|
||||
# Script creation of imageset: https://docs.tigera.io/calico/latest/operations/image-options/imageset#create-an-imageset
|
||||
# above may pull sha for arch of machine who ran the script
|
||||
|
||||
- name: Try / Catch
|
||||
vars:
|
||||
operator_manifests:
|
||||
- Deployment-manifest-Calico_Operator.yaml.j2
|
||||
- Installation-manifest-Calico_Cluster.yaml.j2
|
||||
- FelixConfiguration-manifest-Calico_Cluster.yaml
|
||||
- IPPool-manifest-Calico_Cluster.yaml.j2
|
||||
- APIServer-manifest-Calico_Cluster.yaml
|
||||
- ConfigMap-manifest-Calico_Service_Endpoint.yaml.j2
|
||||
block:
|
||||
|
||||
|
||||
- name: Move Calico Manifest from addons directory
|
||||
ansible.builtin.command:
|
||||
cmd: mv /var/lib/rancher/k3s/server/manifests/calico.yaml /tmp/
|
||||
become: true
|
||||
changed_when: false
|
||||
when: file_calico_yaml_metadata.stat.exists
|
||||
|
||||
|
||||
- name: Remove addon from Kubernetes
|
||||
ansible.builtin.command:
|
||||
cmd: kubectl delete addon -n kube-system calico
|
||||
become: true
|
||||
changed_when: false
|
||||
when: file_calico_yaml_metadata.stat.exists
|
||||
|
||||
|
||||
- name: Uninstall Calico
|
||||
ansible.builtin.command:
|
||||
cmd: kubectl delete -f /tmp/calico.yaml
|
||||
become: true
|
||||
changed_when: false
|
||||
when: file_calico_yaml_metadata.stat.exists
|
||||
|
||||
|
||||
# Save the manifests in a dir so that diff's can be shown for changes
|
||||
- name: Copy Manifest for addition
|
||||
ansible.builtin.template:
|
||||
src: "{{ item }}"
|
||||
dest: "/var/lib/rancher/k3s/ansible/{{ item | lower | replace('.j2', '') }}"
|
||||
mode: '744'
|
||||
become: true
|
||||
diff: true
|
||||
loop: "{{ operator_manifests }}"
|
||||
|
||||
|
||||
- name: Try / Catch
|
||||
block:
|
||||
|
||||
|
||||
- name: Apply Operator Manifests
|
||||
ansible.builtin.command:
|
||||
cmd: "kubectl create -f /var/lib/rancher/k3s/ansible/{{ item | lower | replace('.j2', '') }}"
|
||||
become: true
|
||||
changed_when: false
|
||||
failed_when: >
|
||||
'Error from server' in operator_manifest_stdout.stderr
|
||||
loop: "{{ operator_manifests }}"
|
||||
register: operator_manifest_stdout
|
||||
|
||||
|
||||
rescue:
|
||||
|
||||
|
||||
- name: TRACE - Operator manifest apply
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ operator_manifest_stdout }}"
|
||||
|
||||
|
||||
- name: Apply Operator Manifests - "Rescue"
|
||||
ansible.builtin.command:
|
||||
cmd: "kubectl replace -f /var/lib/rancher/k3s/ansible/{{ item | lower | replace('.j2', '') }}"
|
||||
become: true
|
||||
changed_when: false
|
||||
failed_when: >
|
||||
'Error from server' in operator_manifest_stdout.stderr
|
||||
and
|
||||
'ensure CRDs are installed first' in operator_manifest_stdout.stderr
|
||||
loop: "{{ operator_manifests }}"
|
||||
register: operator_manifest_stdout
|
||||
|
||||
|
||||
- name: TRACE - Operator manifest apply. Rescued
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ operator_manifest_stdout }}"
|
||||
|
||||
|
||||
- name: Fetch Calico Kubectl Plugin
|
||||
ansible.builtin.uri:
|
||||
url: |-
|
||||
https://github.com/projectcalico/calico/releases/download/{{ nfc_role_kubernetes_calico_version }}/calicoctl-linux-
|
||||
{%- if cpu_arch.key == 'aarch64' -%}
|
||||
arm64
|
||||
{%- else -%}
|
||||
amd64
|
||||
{%- endif %}
|
||||
status_code:
|
||||
- 200
|
||||
- 304
|
||||
dest: "/tmp/kubectl-calico.{{ cpu_arch.key }}"
|
||||
mode: '777'
|
||||
owner: root
|
||||
group: 'root'
|
||||
changed_when: false
|
||||
become: true
|
||||
delegate_to: localhost
|
||||
loop: "{{ nfc_kubernetes_install_architectures | dict2items }}"
|
||||
loop_control:
|
||||
loop_var: cpu_arch
|
||||
vars:
|
||||
ansible_connection: local
|
||||
|
||||
|
||||
- name: Add calico Plugin
|
||||
ansible.builtin.copy:
|
||||
src: "/tmp/kubectl-calico.{{ ansible_architecture }}"
|
||||
dest: /usr/local/bin/kubectl-calico
|
||||
mode: '770'
|
||||
owner: root
|
||||
group: 'root'
|
||||
become: true
|
||||
when: nfc_role_kubernetes_master
|
||||
|
||||
|
||||
- name: Setup Automagic Host Endpoints
|
||||
ansible.builtin.shell:
|
||||
cmd: |-
|
||||
kubectl calico \
|
||||
patch kubecontrollersconfiguration \
|
||||
default --patch='{"spec": {"controllers": {"node": {"hostEndpoint": {"autoCreate": "Enabled"}}}}}'
|
||||
executable: bash
|
||||
become: true
|
||||
changed_when: false
|
||||
failed_when: false # fixme
|
||||
|
||||
|
||||
- name: Remove calico migration label
|
||||
ansible.builtin.shell:
|
||||
cmd: |-
|
||||
kubectl label \
|
||||
{{ inventory_hostname }} \
|
||||
projectcalico.org/operator-node-migration-
|
||||
executable: bash
|
||||
become: true
|
||||
delegate_to: "{{ kubernetes_config.cluster.prime.name | default(inventory_hostname) }}"
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
loop: "{{ groups[kubernetes_config.cluster.group_name | default('make_me_optional')] | default([]) }}"
|
||||
|
||||
# kubectl label node ip-10-229-92-202.eu-west-1.compute.internal projectcalico.org/operator-node-migration-
|
||||
# migration started
|
||||
|
||||
rescue:
|
||||
|
||||
|
||||
- name: Remove Operator Manifests
|
||||
ansible.builtin.command:
|
||||
cmd: "kubectl delete -f /var/lib/rancher/k3s/ansible/{{ item | lower | replace('.j2', '') }}"
|
||||
become: true
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
loop: "{{ operator_manifests }}"
|
||||
when: file_calico_yaml_metadata.stat.exists # Only rescue if it was a migration
|
||||
|
||||
|
||||
- name: Move Calico Manifest from addons directory
|
||||
ansible.builtin.command:
|
||||
cmd: mv /tmp/calico.yaml /var/lib/rancher/k3s/server/manifests/
|
||||
become: true
|
||||
changed_when: false
|
||||
when: file_calico_yaml_metadata.stat.exists
|
||||
|
||||
|
||||
- name: Re-install Calico
|
||||
ansible.builtin.command:
|
||||
cmd: kubectl apply -f /var/lib/rancher/k3s/server/manifests/calico.yaml
|
||||
become: true
|
||||
changed_when: false
|
||||
when: file_calico_yaml_metadata.stat.exists
|
||||
|
||||
|
||||
always:
|
||||
|
||||
|
||||
- name: Clean-up Temp File
|
||||
ansible.builtin.file:
|
||||
name: /tmp/calico.yaml
|
||||
state: absent
|
||||
become: true
|
||||
when: file_calico_yaml_metadata.stat.exists
|
||||
72
roles/nfc_kubernetes/tasks/kubevirt/main.yaml
Normal file
72
roles/nfc_kubernetes/tasks/kubevirt/main.yaml
Normal file
@ -0,0 +1,72 @@
|
||||
---
|
||||
|
||||
- name: Validate Virtualization Support
|
||||
ansible.builtin.include_tasks:
|
||||
file: kubevirt/validate.yaml
|
||||
apply:
|
||||
tags:
|
||||
- always
|
||||
tags:
|
||||
- always
|
||||
|
||||
|
||||
- name: Deploy KubeVirt
|
||||
ansible.builtin.template:
|
||||
src: "{{ item }}"
|
||||
dest: "/var/lib/rancher/k3s/server/manifests/{{ item | replace('.j2', '') | lower }}"
|
||||
owner: root
|
||||
mode: '700'
|
||||
force: true
|
||||
notify: "{{ item.notify | default(omit) }}"
|
||||
loop: "{{ templates_to_apply }}"
|
||||
diff: true
|
||||
vars:
|
||||
templates_to_apply:
|
||||
- kubevirt-operator.yaml.j2
|
||||
- kubevirt-cr.yaml.j2
|
||||
|
||||
|
||||
- name: Fetch virtctl Kubectl Plugin
|
||||
ansible.builtin.uri:
|
||||
url: |-
|
||||
https://github.com/kubevirt/kubevirt/releases/download/{{
|
||||
nfc_role_kubernetes_container_images.kubevirt_operator.tag }}/virtctl-{{
|
||||
nfc_role_kubernetes_container_images.kubevirt_operator.tag }}-linux-
|
||||
{%- if cpu_arch.key == 'aarch64' -%}
|
||||
arm64
|
||||
{%- else -%}
|
||||
amd64
|
||||
{%- endif %}
|
||||
status_code:
|
||||
- 200
|
||||
- 304
|
||||
dest: "/tmp/kubectl-virtctl.{{ cpu_arch.key }}"
|
||||
mode: '777'
|
||||
owner: root
|
||||
group: 'root'
|
||||
changed_when: false
|
||||
become: true
|
||||
delegate_to: localhost
|
||||
loop: "{{ nfc_kubernetes_install_architectures | dict2items }}"
|
||||
loop_control:
|
||||
loop_var: cpu_arch
|
||||
vars:
|
||||
ansible_connection: local
|
||||
|
||||
|
||||
- name: Add virtctl Plugin
|
||||
ansible.builtin.copy:
|
||||
src: "/tmp/kubectl-virtctl.{{ ansible_architecture }}"
|
||||
dest: /usr/local/bin/kubectl-virt
|
||||
mode: '770'
|
||||
owner: root
|
||||
group: 'root'
|
||||
become: true
|
||||
when: nfc_role_kubernetes_master
|
||||
|
||||
|
||||
- name: Wait for KubeVirt to initialize
|
||||
ansible.builtin.command:
|
||||
cmd: kubectl -n kubevirt wait kv kubevirt --for condition=Available
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
25
roles/nfc_kubernetes/tasks/kubevirt/validate.yaml
Normal file
25
roles/nfc_kubernetes/tasks/kubevirt/validate.yaml
Normal file
@ -0,0 +1,25 @@
|
||||
---
|
||||
|
||||
- name: Install LibVirt-Clients
|
||||
ansible.builtin.apt:
|
||||
name: libvirt-clients
|
||||
state: present
|
||||
|
||||
|
||||
- name: Confirm Virtualization Support
|
||||
ansible.builtin.command:
|
||||
cmd: virt-host-validate qemu
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
register: virt_support_check_command
|
||||
|
||||
|
||||
- name: Confirm No QEMU failures
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- (": FAIL" | string) not in (item | string)
|
||||
- |
|
||||
(": PASS" | string) in (item | string)
|
||||
or
|
||||
(": WARN" | string) in (item | string)
|
||||
loop: "{{ virt_support_check_command.stdout_lines }}"
|
||||
101
roles/nfc_kubernetes/tasks/main.yml
Normal file
101
roles/nfc_kubernetes/tasks/main.yml
Normal file
@ -0,0 +1,101 @@
|
||||
---
|
||||
|
||||
- name: Get Hostname
|
||||
ansible.builtin.command:
|
||||
cmd: hostname
|
||||
changed_when: false
|
||||
register: hostname_to_check
|
||||
|
||||
|
||||
- name: Hostname Check
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- hostname_to_check.stdout == inventory_hostname
|
||||
msg: The hostname must match the inventory_hostname
|
||||
|
||||
|
||||
- name: Check Machine Architecture
|
||||
ansible.builtin.set_fact:
|
||||
nfc_kubernetes_install_architectures: "{{ nfc_kubernetes_install_architectures | default({}) | combine({ansible_architecture: ''}) }}"
|
||||
|
||||
|
||||
- name: Firewall Rules
|
||||
ansible.builtin.include_role:
|
||||
name: nfc_firewall
|
||||
vars:
|
||||
nfc_firewall_enabled_kubernetes: "{{ nfc_kubernetes.enable_firewall | default(false) | bool }}"
|
||||
tags:
|
||||
- never
|
||||
- install
|
||||
|
||||
|
||||
# fix, reload firewall `iptables-reloader`
|
||||
- name: Reload iptables
|
||||
ansible.builtin.command:
|
||||
cmd: bash -c /usr/bin/iptables-reloader
|
||||
changed_when: false
|
||||
tags:
|
||||
- never
|
||||
- install
|
||||
|
||||
|
||||
# kubernetes_installed
|
||||
|
||||
- name: K3s Install
|
||||
ansible.builtin.include_tasks:
|
||||
file: k3s/install.yaml
|
||||
apply:
|
||||
tags:
|
||||
- always
|
||||
when: >
|
||||
install_kubernetes | default(true) | bool
|
||||
and
|
||||
not kubernetes_installed | default(false) | bool
|
||||
tags:
|
||||
- always
|
||||
|
||||
|
||||
- name: K3s Configure
|
||||
ansible.builtin.include_tasks:
|
||||
file: k3s/configure.yaml
|
||||
apply:
|
||||
tags:
|
||||
- always
|
||||
when: >
|
||||
install_kubernetes | default(true) | bool
|
||||
and
|
||||
kubernetes_installed | default(false) | bool
|
||||
tags:
|
||||
- always
|
||||
|
||||
|
||||
- name: Kubevert
|
||||
ansible.builtin.include_tasks:
|
||||
file: kubevirt/main.yaml
|
||||
apply:
|
||||
tags:
|
||||
- always
|
||||
when: >
|
||||
kubernetes_installed | default(false) | bool
|
||||
and
|
||||
kubernetes_config.kube_virt.enabled | default(nfc_role_kubernetes_install_kubevirt)
|
||||
and
|
||||
inventory_hostname in kubernetes_config.kube_virt.nodes | default([ inventory_hostname ]) | list
|
||||
tags:
|
||||
- always
|
||||
|
||||
|
||||
- name: Helm
|
||||
ansible.builtin.include_tasks:
|
||||
file: helm/main.yaml
|
||||
apply:
|
||||
tags:
|
||||
- always
|
||||
when: >
|
||||
kubernetes_installed | default(false) | bool
|
||||
and
|
||||
kubernetes_config.helm.enabled | default(nfc_role_kubernetes_install_helm)
|
||||
and
|
||||
nfc_role_kubernetes_master
|
||||
tags:
|
||||
- always
|
||||
Reference in New Issue
Block a user