k3s-ansible/roles/k3s_upgrade/tasks/main.yml

---
# with_fileglob doesn't work with remote_src, it tries to find the file on the
# local control-plane instead of the remote host. Shell supports wildcards.
- name: Get k3s installed version
  ansible.builtin.command: k3s --version
  register: k3s_upgrade_version_output
  changed_when: false
  check_mode: false

- name: Set k3s installed version
  ansible.builtin.set_fact:
    k3s_upgrade_current_version: "{{ k3s_upgrade_version_output.stdout_lines[0].split(' ')[2] }}"
  check_mode: false

# We update the node configuration in the following cases:
#   - the installed version of K3s on the nodes is older than the requested version in ansible vars
#   - the installed version equals the requested version (to apply config changes like extra_server_args/extra_agent_args)
- name: Update node only if needed
  when: k3s_upgrade_current_version is version(k3s_version, '<=')
  block:
    - name: Stage airgap artifacts for upgrade
      when: airgap_dir is defined
      ansible.builtin.include_role:
        name: airgap
        tasks_from: main.yml
        apply:
          tags:
            - distribute_artifacts

    # We must stop the service because we want to modify the service file before starting it again.
    # INSTALL_K3S_SKIP_START does work on upgrades, because the service is already installed and started.
    - name: Stop K3s service
      when: k3s_upgrade_current_version is version(k3s_version, '<')
      ansible.builtin.service:
        state: stopped
        name: "{{ (server_group in group_names) | ternary('k3s', 'k3s-agent') }}"

    # We only save the token if the user did not provide one, leading to an auto-generated token on first install.
    - name: Save the existing K3s token if needed
      when:
        - token is not defined
        - inventory_hostname == groups[server_group][0] or ansible_host == groups[server_group][0]
      ansible.builtin.command: cut -d':' -f4 /var/lib/rancher/k3s/server/node-token
      register: k3s_upgrade_old_token
      changed_when: false

    - name: Install new K3s Version [server]
      # For some reason, ansible-lint thinks using enviroment with command is an error
      # even though its valid https://ansible.readthedocs.io/projects/lint/rules/inline-env-var/#correct-code
      # Skip if only reconfiguring (no version change needed)
      when:
        - k3s_upgrade_current_version is version(k3s_version, '<')
        - server_group in group_names
      ansible.builtin.command: # noqa inline-env-var
        cmd: /usr/local/bin/k3s-install.sh
      environment: >-
          {{ extra_install_envs
             | combine({
               "INSTALL_K3S_SKIP_START": "true",
               "INSTALL_K3S_VERSION": k3s_version,
             })
             | combine(airgap_dir is defined and {"INSTALL_K3S_SKIP_DOWNLOAD": "true"} or {}) }}
      changed_when: true

    - name: Install new K3s Version [agent]
      # For some reason, ansible-lint thinks using enviroment with command is an error
      # even though its valid https://ansible.readthedocs.io/projects/lint/rules/inline-env-var/#correct-code
      # Unlike server, we always run the install command, because we are using it to reconfigure the ENV and Args passed to k3s-agent.
      # Instead we just skip the download/replace if airgapped or no version change is needed.
      when:
        - agent_group in group_names
      # noqa var-naming[no-role-prefix]
      ansible.builtin.command:
        cmd: /usr/local/bin/k3s-install.sh
      environment: "{{ _install_envs }}"
      vars:
        _base_envs:
          INSTALL_K3S_SKIP_DOWNLOAD: "{{ (airgap_dir is defined or k3s_upgrade_current_version == k3s_version) | ternary('true', 'false') }}"
          INSTALL_K3S_SKIP_START: "true"
          INSTALL_K3S_SYSTEMD_DIR: "{{ systemd_dir }}"
          INSTALL_K3S_VERSION: "{{ k3s_version }}"
          INSTALL_K3S_EXEC: "agent --server https://{{ api_endpoint }}:{{ api_port }} {{ extra_agent_args }}"
          K3S_TOKEN: "{{ token if token is defined else k3s_upgrade_old_token.stdout }}"
        # We overrides the extra_install_envs with required keys from _base_envs on purpose
        _install_envs: "{{ extra_install_envs | default({}) | combine(_base_envs) }}"
      changed_when: true

    - name: Regenerate K3s service file [server]
      when: server_group in group_names
      block:
        - name: Determine if tls-san is already in config or args
          # noqa var-naming[no-role-prefix]
          ansible.builtin.set_fact:
            _api_endpoint_in_args: >-
              {% if api_endpoint is defined and extra_server_args | default('') | regex_search('--tls-san[=\s]+' + api_endpoint | regex_escape(), ignorecase=True) %}
              true
              {% else %}
              false
              {% endif %}

        - name: Add TLS SAN to arguments if needed
          when:
            - api_endpoint is defined
            - api_endpoint != ansible_hostname
            - not (_api_endpoint_in_args | trim | bool)
          # noqa var-naming[no-role-prefix]
          ansible.builtin.set_fact:
            opt_tls_san: "--tls-san={{ api_endpoint }}"

        - name: Copy K3s service file [Single/External DB]
          when: groups[server_group] | length == 1 or use_external_database | default(false)
          ansible.builtin.template:
            src: "k3s.service.j2"
            dest: "{{ systemd_dir }}/k3s.service"
            owner: root
            group: root
            mode: "0644"
          vars:
            cluster_init: false
            join: false

        - name: Copy K3s service file [HA - first server]
          when:
            - groups[server_group] | length > 1
            - not use_external_database | default(false)
            - inventory_hostname == groups[server_group][0] or ansible_host == groups[server_group][0]
          ansible.builtin.template:
            src: "k3s.service.j2"
            dest: "{{ systemd_dir }}/k3s.service"
            owner: root
            group: root
            mode: "0644"
          vars:
            cluster_init: true
            join: false

        - name: Copy K3s service file [HA - joining server]
          when:
            - groups[server_group] | length > 1
            - not use_external_database | default(false)
            - inventory_hostname != groups[server_group][0] and ansible_host != groups[server_group][0]
          ansible.builtin.template:
            src: "k3s.service.j2"
            dest: "{{ systemd_dir }}/k3s.service"
            owner: root
            group: root
            mode: "0644"
          vars:
            cluster_init: false
            join: true

    - name: Add token to the environment [server]
      when: server_group in group_names
      no_log: true # avoid logging the server token
      ansible.builtin.lineinfile:
        path: "{{ systemd_dir }}/k3s.service.env"
        regexp: '^K3S_TOKEN='
        line: "K3S_TOKEN={{ token is defined | ternary(token, k3s_upgrade_old_token.stdout) }}"

    - name: Restart K3s service [server]
      when: server_group in group_names
      ansible.builtin.systemd:
        state: restarted
        daemon_reload: true
        name: k3s

    - name: Restart K3s service [agent]
      when: agent_group in group_names
      ansible.builtin.service:
        state: restarted
        name: k3s-agent