Consolidate server templates into a single one (#443)

- Fix linting to achieve production level for k3s-server role

Signed-off-by: Derek Nola <derek.nola@suse.com>

roles/k3s_server/tasks/main.yml

@@ -1,21 +1,21 @@
 ---
 - name: Get k3s installed version
   ansible.builtin.command: k3s --version
-  register: k3s_version_output
+  register: k3s_server_version_output
   changed_when: false
   ignore_errors: true
 
 - name: Set k3s installed version
-  when: not ansible_check_mode and k3s_version_output.rc == 0
+  when: not ansible_check_mode and k3s_server_version_output.rc == 0
   ansible.builtin.set_fact:
-    installed_k3s_version: "{{ k3s_version_output.stdout_lines[0].split(' ')[2] }}"
+    k3s_server_installed_version: "{{ k3s_server_version_output.stdout_lines[0].split(' ')[2] }}"
 
 # If airgapped, all K3s artifacts are already on the node.
 # We should be downloading and installing the newer version only if we are in one of the following cases :
 #   - we couldn't get k3s installed version in the first task of this role
 #   - the installed version of K3s on the nodes is older than the requested version in ansible vars
 - name: Download artifact only if needed
-  when: not ansible_check_mode and airgap_dir is undefined and ( k3s_version_output.rc != 0 or installed_k3s_version is version(k3s_version, '<') )
+  when: not ansible_check_mode and airgap_dir is undefined and ( k3s_server_version_output.rc != 0 or k3s_server_installed_version is version(k3s_version, '<') )
   block:
     - name: Download K3s install script
       ansible.builtin.get_url:
@@ -46,7 +46,8 @@
     regexp: '\.\s+<\(k3s completion bash\)'
     line: ". <(k3s completion bash)  # Added by k3s-ansible"
 
-- name: Compute final server arguments
+- name: Determine if tls-san is already in config or args
+  # noqa var-naming[no-role-prefix]
   ansible.builtin.set_fact:
     _api_endpoint_in_config: >-
       {% if server_config_yaml is defined and api_endpoint is defined and server_config_yaml | regex_search('tls-san:.*' + api_endpoint | regex_escape(), ignorecase=True) %}
@@ -61,13 +62,16 @@
       false
       {% endif %}
 
-- name: Add TLS SAN to server arguments if needed
+- name: Add TLS SAN to agent arguments if needed
+  # noqa var-naming[no-role-prefix]
+  when:
+    - api_endpoint is defined
+    - api_endpoint != ansible_hostname
+    - not _api_endpoint_in_config | bool
+    - not _api_endpoint_in_args | bool
   ansible.builtin.set_fact:
-    final_server_args: >-
+    opt_tls_san: "--tls-san={{ api_endpoint }}"
-      {{ extra_server_args }}
+
-      {% if api_endpoint is defined and api_endpoint != ansible_hostname and _api_endpoint_in_config | bool == false and _api_endpoint_in_args | bool == false %}
-      --tls-san={{ api_endpoint }}
-      {% endif %}
 
 - name: Setup optional config file
   when: server_config_yaml is defined
@@ -78,6 +82,7 @@
         mode: "0755"
         state: directory
     - name: Copy config values
+      # noqa var-naming[no-role-prefix]
       ansible.builtin.copy:
         content: "{{ server_config_yaml }}"
         dest: "/etc/rancher/k3s/config.yaml"
@@ -87,26 +92,34 @@
 - name: Init first server node
   when: inventory_hostname == groups[server_group][0] or ansible_host == groups[server_group][0]
   block:
-    - name: Copy K3s service file [Single]
+    - name: Copy K3s service file [Single/External DB]
+      # noqa var-naming[no-role-prefix]
       when: groups[server_group] | length == 1 or use_external_database
       ansible.builtin.template:
-        src: "k3s-single.service.j2"
+        src: "k3s.service.j2"
         dest: "{{ systemd_dir }}/k3s.service"
         owner: root
         group: root
         mode: "0644"
+      vars:
+        cluster_init: false
+        join: false
       register: service_file_single
 
-    - name: Copy K3s service file [HA]
+    - name: Copy K3s service file [HA-IC]
+      # noqa var-naming[no-role-prefix]
       when:
         - groups[server_group] | length > 1
         - not use_external_database
       ansible.builtin.template:
-        src: "k3s-cluster-init.service.j2"
+        src: "k3s.service.j2"
         dest: "{{ systemd_dir }}/k3s.service"
         owner: root
         group: root
         mode: "0644"
+      vars:
+        cluster_init: true
+        join: false
       register: service_file_ha
 
     - name: Add service environment variables
@@ -155,6 +168,7 @@
         seconds: 10
 
     - name: Check whether kubectl is installed on control node
+      # noqa var-naming[no-role-prefix]
       ansible.builtin.command: 'kubectl'
       register: kubectl_installed
       ignore_errors: true
@@ -170,12 +184,12 @@
         dest: /etc/rancher/k3s/k3s-copy.yaml
         mode: "0600"
         remote_src: true
-      register: copy_k3s_yaml_file
+      register: k3s_server_copy_yaml
 
     - name: Apply K3S kubeconfig to control node
       when:
         - kubectl_installed.rc == 0
-        - copy_k3s_yaml_file.changed
+        - k3s_server_copy_yaml.changed
       block:
         - name: Copy kubeconfig to control node
           ansible.builtin.fetch:
@@ -188,9 +202,9 @@
             KUBECONFIG={{ kubeconfig }} kubectl config set-cluster default --server=https://{{ api_endpoint }}:{{ api_port }}
           delegate_to: 127.0.0.1
           become: false
-          register: csa_result
+          register: k3s_server_csa_result
           changed_when:
-            - csa_result.rc == 0
+            - k3s_server_csa_result.rc == 0
 
         - name: Setup kubeconfig context on control node - {{ cluster_context }}
           when: kubeconfig == "~/.kube/config.new"
@@ -210,9 +224,9 @@
             mv ${TFILE} ~/.kube/config
           delegate_to: 127.0.0.1
           become: false
-          register: mv_result
+          register: k3s_server_mv_result
           changed_when:
-            - mv_result.rc == 0
+            - k3s_server_mv_result.rc == 0
 
     - name: Get the token if randomly generated
       when: token is not defined
@@ -224,11 +238,12 @@
         - name: Read node-token from master
           ansible.builtin.slurp:
             src: /var/lib/rancher/k3s/server/token
-          register: node_token
+          register: k3s_server_node_token
 
         - name: Store Master node-token
+          # noqa var-naming[no-role-prefix]
           ansible.builtin.set_fact:
-            token: "{{ node_token.content | b64decode | regex_replace('\n', '') }}"
+            token: "{{ k3s_server_node_token.content | b64decode | regex_replace('\n', '') }}"
 
 - name: Start other server if any and verify status
   when:
@@ -236,6 +251,7 @@
     - inventory_hostname != groups[server_group][0] and ansible_host != groups[server_group][0]
   block:
     - name: Get the token from the first server
+      # noqa var-naming[no-role-prefix]
       ansible.builtin.set_fact:
         token: "{{ hostvars[groups[server_group][0]].token }}"
 
@@ -260,31 +276,25 @@
       with_items:
         - "K3S_TOKEN={{ token }}"
 
-    - name: Copy K3s service file [HA]
+    # When using an external database, no join is needed, instead, users should be
-      when: not use_external_database
+    # supplying the datastore-endpoint in the extra_server_args or server_config_yaml
+    - name: Copy K3s service file [HA-J]
       ansible.builtin.template:
-        src: "k3s-ha.service.j2"
+        src: "k3s.service.j2"
         dest: "{{ systemd_dir }}/k3s.service"
         owner: root
         group: root
         mode: "0644"
-      register: service_file_ha
+      vars:
-
+        join: "{{ not use_external_database }}"
-    - name: Copy K3s service file [External DB]
+        cluster_init: false
-      when: use_external_database
+      register: k3s_server_service_file
-      ansible.builtin.template:
-        src: "k3s-single.service.j2"
-        dest: "{{ systemd_dir }}/k3s.service"
-        owner: root
-        group: root
-        mode: "0644"
-      register: service_file_external_db
 
     - name: Restart K3s service
       when:
         - ansible_facts.services['k3s.service'] is defined
         - ansible_facts.services['k3s.service'].state == 'running'
-        - service_file_ha.changed or service_file_external_db.changed or _server_config_result.changed
+        - k3s_server_service_file.changed or _server_config_result.changed
       ansible.builtin.systemd:
         name: k3s
         daemon_reload: true
@@ -303,8 +313,8 @@
       ansible.builtin.command:
         cmd: >
           k3s kubectl get nodes -l "node-role.kubernetes.io/control-plane=true" -o=jsonpath="{.items[*].metadata.name}"
-      register: nodes
+      register: k3s_server_nodes
-      until: nodes.rc == 0 and (nodes.stdout.split() | length) == (groups[server_group] | length)
+      until: k3s_server_nodes.rc == 0 and (k3s_server_nodes.stdout.split() | length) == (groups[server_group] | length)
       retries: 20
       delay: 10
       changed_when: false

roles/k3s_server/templates/k3s-cluster-init.service.j2

@@ -1,28 +0,0 @@
-[Unit]
-Description=Lightweight Kubernetes
-Documentation=https://k3s.io
-Wants=network-online.target
-After=network-online.target
-
-[Install]
-WantedBy=multi-user.target
-
-[Service]
-Type=notify
-EnvironmentFile=-/etc/default/%N
-EnvironmentFile=-/etc/sysconfig/%N
-EnvironmentFile=-/etc/systemd/system/k3s.service.env
-KillMode=process
-Delegate=yes
-# Having non-zero Limit*s causes performance problems due to accounting overhead
-# in the kernel. We recommend using cgroups to do container-local accounting.
-LimitNOFILE=1048576
-LimitNPROC=infinity
-LimitCORE=infinity
-TasksMax=infinity
-TimeoutStartSec=0
-Restart=always
-RestartSec=5s
-ExecStartPre=-/sbin/modprobe br_netfilter
-ExecStartPre=-/sbin/modprobe overlay
-ExecStart=/usr/local/bin/k3s server --cluster-init --data-dir {{ k3s_server_location }} {{ final_server_args }}

roles/k3s_server/templates/k3s-single.service.j2

@@ -1,28 +0,0 @@
-[Unit]
-Description=Lightweight Kubernetes
-Documentation=https://k3s.io
-Wants=network-online.target
-After=network-online.target
-
-[Install]
-WantedBy=multi-user.target
-
-[Service]
-Type=notify
-EnvironmentFile=-/etc/default/%N
-EnvironmentFile=-/etc/sysconfig/%N
-EnvironmentFile=-/etc/systemd/system/k3s.service.env
-KillMode=process
-Delegate=yes
-# Having non-zero Limit*s causes performance problems due to accounting overhead
-# in the kernel. We recommend using cgroups to do container-local accounting.
-LimitNOFILE=1048576
-LimitNPROC=infinity
-LimitCORE=infinity
-TasksMax=infinity
-TimeoutStartSec=0
-Restart=always
-RestartSec=5s
-ExecStartPre=-/sbin/modprobe br_netfilter
-ExecStartPre=-/sbin/modprobe overlay
-ExecStart=/usr/local/bin/k3s server --data-dir {{ k3s_server_location }} {{ final_server_args }}

roles/k3s_server/templates/k3s.service.j2

@@ -25,4 +25,7 @@ Restart=always
 RestartSec=5s
 ExecStartPre=-/sbin/modprobe br_netfilter
 ExecStartPre=-/sbin/modprobe overlay
-ExecStart=/usr/local/bin/k3s server --data-dir {{ k3s_server_location }} --server https://{{ api_endpoint }}:{{ api_port }} {{ final_server_args }}
+ExecStart=/usr/local/bin/k3s server --data-dir {{ k3s_server_location }} {% if cluster_init == true %}--cluster-init {% endif %} \
+    {% if join == true %}--server https://{{ api_endpoint }}:{{ api_port }} {% endif %} \
+    {{ opt_tls_san }} \
+    {{ extra_server_args }}