mirror of
https://github.com/k3s-io/k3s-ansible.git
synced 2026-10-23 03:22:03 +02:00
Kris
1a600b60d3
* feat: make the server config file mode configurable /etc/rancher/k3s/config.yaml holds the cluster token. The server and upgrade roles write it at 0644, so every local account on a server node can read the credential that joins a node to the cluster. k3s_server_config_mode sets the mode of that file in both roles. It defaults to 0644, so behaviour is unchanged unless it is set. Signed-off-by: Kristofer <kristofer@atlascloud.is> * docs: describe the server config file contents accurately /etc/rancher/k3s/config.yaml does not always carry the cluster token. A first server that lets K3s generate one writes the file without it, so the file can contain the token rather than always holding it. Correct that claim in the README, the inventory sample and the role default, and use the US spelling of "honors". Signed-off-by: Kristofer <kristofer@atlascloud.is> * Name the floor the config file mode can be narrowed to Saying any mode root can read works leaves the reader to work out what that means in practice. The file is read only by k3s, running as root, so 0600 is the tightest mode that still works. Signed-off-by: Kristofer <kristofer@atlascloud.is> * Run the basic integration job with a non-default config file mode The templated mode was only ever rendered with its default in CI, which is the one value that cannot tell a working template from a broken one. The basic inventory sets 0640 and the job reads the mode back off the installed file. Signed-off-by: Kristofer <kristofer@atlascloud.is> --------- Signed-off-by: Kristofer <kristofer@atlascloud.is>
56 lines
2.5 KiB
YAML
56 lines
2.5 KiB
YAML
---
|
|
k3s_cluster:
|
|
children:
|
|
server:
|
|
hosts:
|
|
192.16.35.11:
|
|
agent:
|
|
hosts:
|
|
192.16.35.12:
|
|
192.16.35.13:
|
|
|
|
# Required Vars
|
|
vars:
|
|
ansible_port: 22
|
|
ansible_user: debian
|
|
k3s_version: v1.31.12+k3s1
|
|
# The token should be a random string of reasonable length. You can generate
|
|
# one with the following commands:
|
|
# - openssl rand -base64 64
|
|
# - pwgen -s 64 1
|
|
# You can use ansible-vault to encrypt this value / keep it secret.
|
|
# Or you can omit it if not using Vagrant and let the first server automatically generate one.
|
|
token: "changeme!"
|
|
api_endpoint: "{{ hostvars[groups['server'][0]]['ansible_host'] | default(groups['server'][0]) }}"
|
|
|
|
# Optional vars
|
|
# extra_server_args: ""
|
|
# extra_agent_args: ""
|
|
# extra_install_envs: { 'INSTALL_K3S_SKIP_SELINUX_RPM': 'true' }
|
|
# cluster_context: k3s-ansible
|
|
# api_port: 6443
|
|
# k3s_server_location: /var/lib/rancher/k3s
|
|
# systemd_dir: /etc/systemd/system
|
|
# extra_service_envs: [ 'ENV_VAR1=VALUE1', 'ENV_VAR2=VALUE2' ]
|
|
# user_kubectl: true, by default kubectl is symlinked and configured for use by ansible_user. Set to false to only kubectl via root user.
|
|
# manage_firewall: false
|
|
# k3s_server_config_mode: "0644", mode of /etc/rancher/k3s/config.yaml on server nodes. The file can contain the cluster token; set "0640" to keep it off other local accounts.
|
|
|
|
# Manifests or Airgap should be either full paths or relative to the playbook directory.
|
|
# List of locally available manifests to apply to the cluster, useful for PVCs or Traefik modifications.
|
|
# extra_manifests: [ '/path/to/manifest1.yaml', '/path/to/manifest2.yaml' ]
|
|
# airgap_dir: /tmp/k3s-airgap-images
|
|
|
|
# server_config_yaml: |
|
|
# This is now an inner yaml file. Maintain the indentation.
|
|
# YAML here will be placed as the content of /etc/rancher/k3s/config.yaml
|
|
# See https://docs.k3s.io/installation/configuration#configuration-file
|
|
# agent_config_yaml: |
|
|
# Same as server_config_yaml, but for the agent nodes.
|
|
# YAML here will be placed as the content of /etc/rancher/k3s/config.yaml
|
|
# See https://docs.k3s.io/installation/configuration#configuration-file
|
|
# registries_config_yaml: |
|
|
# Containerd can be configured to connect to private registries and use them to pull images as needed by the kubelet.
|
|
# YAML here will be placed as the content of /etc/rancher/k3s/registries.yaml
|
|
# See https://docs.k3s.io/installation/private-registry
|