forked from tim/k3s-ansible
Timothy Stewart
57a22e364d
- pin kube-vip and cluster traffic to the private guest interface\n- disable disposable guest firewalls and verify API reachability before joins\n- keep control-plane orchestration on the primary and preserve failure diagnostics
79 lines
2.5 KiB
YAML
79 lines
2.5 KiB
YAML
---
|
|
- name: Apply overrides
|
|
ansible.builtin.import_playbook: >-
|
|
{{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
|
|
|
|
- name: Network setup
|
|
hosts: all
|
|
tasks:
|
|
- name: Gather service facts
|
|
ansible.builtin.service_facts:
|
|
|
|
- name: Disable guest firewall services
|
|
# The disposable test guests use an isolated VirtualBox network. A distro
|
|
# firewall can allow ICMP while silently blocking the inter-node Kubernetes
|
|
# API connection, so disable the known guest firewalls consistently.
|
|
# When building your own cluster, please DO NOT blindly copy this. Instead,
|
|
# please create a custom firewall configuration that fits your network design
|
|
# and security needs.
|
|
ansible.builtin.systemd:
|
|
name: "{{ item }}"
|
|
enabled: false
|
|
state: stopped
|
|
become: true
|
|
loop:
|
|
- firewalld.service
|
|
- nftables.service
|
|
- ufw.service
|
|
when: item in ansible_facts.services
|
|
|
|
- name: Verify the private cluster interface
|
|
ansible.builtin.assert:
|
|
that:
|
|
- flannel_iface in ansible_facts
|
|
- ansible_facts[flannel_iface].ipv4 is defined
|
|
- ansible_facts[flannel_iface].ipv4.address is defined
|
|
fail_msg: >-
|
|
The Vagrant private interface {{ flannel_iface }} does not have an
|
|
IPv4 address on {{ inventory_hostname }}.
|
|
|
|
- name: Verify guest-to-guest cluster network reachability
|
|
ansible.builtin.command:
|
|
argv:
|
|
- ping
|
|
- -c
|
|
- "1"
|
|
- -W
|
|
- "1"
|
|
- >-
|
|
{{ hostvars[groups[group_name_master | default('master')][0]].k3s_node_ip
|
|
| split(',') | first }}
|
|
register: primary_cluster_ping
|
|
until: primary_cluster_ping.rc == 0
|
|
retries: 6
|
|
delay: 2
|
|
changed_when: false
|
|
|
|
- name: Verify GitHub release host DNS
|
|
ansible.builtin.getent:
|
|
database: hosts
|
|
key: github.com
|
|
register: github_dns
|
|
retries: 6
|
|
delay: 5
|
|
until: github_dns is succeeded
|
|
|
|
- name: Verify k3s checksum URL is reachable
|
|
ansible.builtin.uri:
|
|
url: >-
|
|
https://github.com/k3s-io/k3s/releases/download/{{ k3s_version
|
|
}}/sha256sum-amd64.txt
|
|
method: HEAD
|
|
follow_redirects: safe
|
|
status_code: [200, 302]
|
|
timeout: 15
|
|
register: k3s_checksum_request
|
|
retries: 3
|
|
delay: 5
|
|
until: k3s_checksum_request.status in [200, 302]
|