mirror of
https://github.com/techno-tim/k3s-ansible.git
synced 2026-09-16 17:13:19 +02:00
Compare commits
6 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Techno Tim
|
1d26a37bbf | ||
|
Techno Tim
|
658802d580 | ||
 edoziw
|
5334dda6e5 | ||
 kip
|
e3a95bb5a2 | ||
|
kip
|
13deec85b3 | ||
|
kip
|
fe4407db0e |
@@ -18,4 +18,3 @@ exclude_paths:
|
||||
|
||||
skip_list:
|
||||
- 'fqcn-builtins'
|
||||
- var-naming[no-role-prefix]
|
||||
|
||||
@@ -51,9 +51,6 @@ extra_agent_args: ""
|
||||
|
||||
kube_vip_tag_version: ""
|
||||
|
||||
kube_vip_cloud_provider_tag_version: ""
|
||||
kube_vip_lb_ip_range: ""
|
||||
|
||||
metal_lb_speaker_tag_version: ""
|
||||
metal_lb_controller_tag_version: ""
|
||||
|
||||
|
||||
@@ -11,19 +11,19 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Check out the codebase
|
||||
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # 4.1.2
|
||||
uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v3 2.5.0
|
||||
with:
|
||||
ref: ${{ github.event.pull_request.head.sha }}
|
||||
|
||||
- name: Set up Python ${{ env.PYTHON_VERSION }}
|
||||
uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # 5.0.0
|
||||
uses: actions/setup-python@75f3110429a8c05be0e1bf360334e4cced2b63fa # 2.3.3
|
||||
with:
|
||||
python-version: ${{ env.PYTHON_VERSION }}
|
||||
cache: 'pip' # caching pip dependencies
|
||||
|
||||
- name: Cache Vagrant boxes
|
||||
id: cache-vagrant
|
||||
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # 4.0
|
||||
uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # 4.0
|
||||
with:
|
||||
lookup-only: true #if it exists, we don't need to restore and can skip the next step
|
||||
path: |
|
||||
|
||||
@@ -2,20 +2,11 @@
|
||||
name: "CI"
|
||||
on:
|
||||
pull_request:
|
||||
types:
|
||||
- opened
|
||||
- synchronize
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
paths-ignore:
|
||||
- '**/.gitignore'
|
||||
- '**/FUNDING.yml'
|
||||
- '**/host.ini'
|
||||
- '**/*.md'
|
||||
- '**/.editorconfig'
|
||||
- '**/ansible.example.cfg'
|
||||
- '**/deploy.sh'
|
||||
- '**/LICENSE'
|
||||
- '**/reboot.sh'
|
||||
- '**/reset.sh'
|
||||
- '**/README.md'
|
||||
jobs:
|
||||
pre:
|
||||
uses: ./.github/workflows/cache.yml
|
||||
|
||||
@@ -11,18 +11,18 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Check out the codebase
|
||||
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # 4.1.2
|
||||
uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v3 2.5.0
|
||||
with:
|
||||
ref: ${{ github.event.pull_request.head.sha }}
|
||||
|
||||
- name: Set up Python ${{ env.PYTHON_VERSION }}
|
||||
uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # 5.0.0
|
||||
uses: actions/setup-python@75f3110429a8c05be0e1bf360334e4cced2b63fa # 2.3.3
|
||||
with:
|
||||
python-version: ${{ env.PYTHON_VERSION }}
|
||||
cache: 'pip' # caching pip dependencies
|
||||
|
||||
- name: Restore Ansible cache
|
||||
uses: actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # 4.0
|
||||
uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # 4.0
|
||||
with:
|
||||
path: ~/.ansible/collections
|
||||
key: ansible-${{ hashFiles('collections/requirements.yml') }}
|
||||
@@ -38,16 +38,16 @@ jobs:
|
||||
echo "::endgroup::"
|
||||
|
||||
- name: Run pre-commit
|
||||
uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # 3.0.1
|
||||
uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # 3.0.0
|
||||
|
||||
ensure-pinned-actions:
|
||||
name: Ensure SHA Pinned Actions
|
||||
runs-on: self-hosted
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # 4.1.2
|
||||
uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v3 2.5.0
|
||||
- name: Ensure SHA pinned actions
|
||||
uses: zgosalvez/github-actions-ensure-sha-pinned-actions@ba37328d4ea95eaf8b3bd6c6cef308f709a5f2ec # 3.0.3
|
||||
uses: zgosalvez/github-actions-ensure-sha-pinned-actions@af2eb3226618e2494e3d9084f515ad6dcf16e229 # 2.0.1
|
||||
with:
|
||||
allowlist: |
|
||||
aws-actions/
|
||||
|
||||
@@ -10,18 +10,16 @@ jobs:
|
||||
matrix:
|
||||
scenario:
|
||||
- default
|
||||
# - ipv6
|
||||
- ipv6
|
||||
- single_node
|
||||
- calico
|
||||
- cilium
|
||||
- kube-vip
|
||||
fail-fast: false
|
||||
env:
|
||||
PYTHON_VERSION: "3.11"
|
||||
|
||||
steps:
|
||||
- name: Check out the codebase
|
||||
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # 4.1.2
|
||||
uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v3 2.5.0
|
||||
with:
|
||||
ref: ${{ github.event.pull_request.head.sha }}
|
||||
|
||||
@@ -59,13 +57,13 @@ jobs:
|
||||
EOF
|
||||
|
||||
- name: Set up Python ${{ env.PYTHON_VERSION }}
|
||||
uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # 5.0.0
|
||||
uses: actions/setup-python@75f3110429a8c05be0e1bf360334e4cced2b63fa # 2.3.3
|
||||
with:
|
||||
python-version: ${{ env.PYTHON_VERSION }}
|
||||
cache: 'pip' # caching pip dependencies
|
||||
|
||||
- name: Restore vagrant Boxes cache
|
||||
uses: actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # 4.0
|
||||
uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # 4.0
|
||||
with:
|
||||
path: ~/.vagrant.d/boxes
|
||||
key: vagrant-boxes-${{ hashFiles('**/molecule.yml') }}
|
||||
@@ -118,9 +116,8 @@ jobs:
|
||||
|
||||
- name: Upload log files
|
||||
if: always() # do this even if a step before has failed
|
||||
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # 4.3.1
|
||||
uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # 3.1.1
|
||||
with:
|
||||
name: logs
|
||||
path: |
|
||||
${{ runner.temp }}/logs
|
||||
overwrite: true
|
||||
|
||||
+3
-1
@@ -1,4 +1,6 @@
|
||||
.env/
|
||||
*.log
|
||||
ansible.cfg
|
||||
kubeconfig
|
||||
|
||||
__pycache__/
|
||||
*.py[cod]
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
repos:
|
||||
- repo: https://github.com/pre-commit/pre-commit-hooks
|
||||
rev: v4.5.0
|
||||
rev: f71fa2c1f9cf5cb705f73dffe4b21f7c61470ba9 # frozen: v4.4.0
|
||||
hooks:
|
||||
- id: requirements-txt-fixer
|
||||
- id: sort-simple-yaml
|
||||
@@ -12,24 +12,24 @@ repos:
|
||||
- id: trailing-whitespace
|
||||
args: [--markdown-linebreak-ext=md]
|
||||
- repo: https://github.com/adrienverge/yamllint.git
|
||||
rev: v1.33.0
|
||||
rev: b05e028c5881819161d11cb543fd96a30c06cceb # frozen: v1.32.0
|
||||
hooks:
|
||||
- id: yamllint
|
||||
args: [-c=.yamllint]
|
||||
- repo: https://github.com/ansible-community/ansible-lint.git
|
||||
rev: v6.22.2
|
||||
rev: 3293b64b939c0de16ef8cb81dd49255e475bf89a # frozen: v6.17.2
|
||||
hooks:
|
||||
- id: ansible-lint
|
||||
- repo: https://github.com/shellcheck-py/shellcheck-py
|
||||
rev: v0.9.0.6
|
||||
rev: 375289a39f5708101b1f916eb729e8d6da96993f # frozen: v0.9.0.5
|
||||
hooks:
|
||||
- id: shellcheck
|
||||
- repo: https://github.com/Lucas-C/pre-commit-hooks
|
||||
rev: v1.5.4
|
||||
rev: 12885e376b93dc4536ad68d156065601e4433665 # frozen: v1.5.1
|
||||
hooks:
|
||||
- id: remove-crlf
|
||||
- id: remove-tabs
|
||||
- repo: https://github.com/sirosen/texthooks
|
||||
rev: 0.6.4
|
||||
rev: c4ffd3e31669dd4fa4d31a23436cc13839730084 # frozen: 0.5.0
|
||||
hooks:
|
||||
- id: fix-smartquotes
|
||||
|
||||
@@ -73,6 +73,21 @@ This requires at least k3s version `1.19.1` however the version is configurable
|
||||
|
||||
If needed, you can also edit `inventory/my-cluster/group_vars/all.yml` to match your environment.
|
||||
|
||||
#### verify routing prefixes and ip addresses in all.yml
|
||||
Ensure that the ip routing prefix matches the the one from the flannel_iface (`eth0` by default) for each host.
|
||||
Example `192.168.30` is the default routing prefix, and it is used in the following variables:
|
||||
- apiserver_endpoint
|
||||
- metal_lb_bgp_peer_address (commented by default)
|
||||
- metal_lb_ip_range
|
||||
Also Ensure that the apiserver_endpoint is not in the metal_lb_ip_range
|
||||
|
||||
For your convience The playbook site.yml verifies the above elements of the config are valid.
|
||||
* Optionally to skip these verifications set, in all.yml `verify_config: false`
|
||||
* Optionally to just verify the config Run
|
||||
`ansible-playbook -i inventory/my-cluster/hosts.ini verify_config.yml`
|
||||
* Optionally manually recover ip routing prefix based on inet and netmask from
|
||||
`ansible -i inventory/my-cluster/hosts.ini --become -m shell -a 'ifconfig eth0 | grep "inet "' all`
|
||||
|
||||
### ☸️ Create Cluster
|
||||
|
||||
Start provisioning of the cluster using the following command:
|
||||
@@ -96,22 +111,8 @@ ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini
|
||||
To copy your `kube config` locally so that you can access your **Kubernetes** cluster run:
|
||||
|
||||
```bash
|
||||
scp debian@master_ip:/etc/rancher/k3s/k3s.yaml ~/.kube/config
|
||||
scp debian@master_ip:~/.kube/config ~/.kube/config
|
||||
```
|
||||
If you get file Permission denied, go into the node and temporarly run:
|
||||
```bash
|
||||
sudo chmod 777 /etc/rancher/k3s/k3s.yaml
|
||||
```
|
||||
Then copy with the scp command and reset the permissions back to:
|
||||
```bash
|
||||
sudo chmod 600 /etc/rancher/k3s/k3s.yaml
|
||||
```
|
||||
|
||||
You'll then want to modify the config to point to master IP by running:
|
||||
```bash
|
||||
sudo nano ~/.kube/config
|
||||
```
|
||||
Then change `server: https://127.0.0.1:6443` to match your master IP: `server: https://192.168.1.222:6443`
|
||||
|
||||
### 🔨 Testing your cluster
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
k3s_version: v1.29.2+k3s1
|
||||
k3s_version: v1.29.0+k3s1
|
||||
# this is the user that has ssh access to these machines
|
||||
ansible_user: ansibleuser
|
||||
systemd_dir: /etc/systemd/system
|
||||
@@ -13,26 +13,8 @@ flannel_iface: "eth0"
|
||||
# uncomment calico_iface to use tigera operator/calico cni instead of flannel https://docs.tigera.io/calico/latest/about
|
||||
# calico_iface: "eth0"
|
||||
calico_ebpf: false # use eBPF dataplane instead of iptables
|
||||
calico_tag: "v3.27.2" # calico version tag
|
||||
|
||||
# uncomment cilium_iface to use cilium cni instead of flannel or calico
|
||||
# ensure v4.19.57, v5.1.16, v5.2.0 or more recent kernel
|
||||
# cilium_iface: "eth0"
|
||||
cilium_mode: "native" # native when nodes on same subnet or using bgp, else set routed
|
||||
cilium_tag: "v1.15.2" # cilium version tag
|
||||
cilium_hubble: true # enable hubble observability relay and ui
|
||||
|
||||
# if using calico or cilium, you may specify the cluster pod cidr pool
|
||||
cluster_cidr: "10.52.0.0/16"
|
||||
|
||||
# enable cilium bgp control plane for lb services and pod cidrs. disables metallb.
|
||||
cilium_bgp: false
|
||||
|
||||
# bgp parameters for cilium cni. only active when cilium_iface is defined and cilium_bgp is true.
|
||||
cilium_bgp_my_asn: "64513"
|
||||
cilium_bgp_peer_asn: "64512"
|
||||
cilium_bgp_peer_address: "192.168.30.1"
|
||||
cilium_bgp_lb_cidr: "192.168.31.0/24" # cidr for cilium loadbalancer ipam
|
||||
calico_cidr: "10.52.0.0/16" # calico cluster pod cidr pool
|
||||
calico_tag: "v3.27.0" # calico version tag
|
||||
|
||||
# apiserver_endpoint is virtual ip-address which will be configured on each master
|
||||
apiserver_endpoint: "192.168.30.222"
|
||||
@@ -44,25 +26,25 @@ k3s_token: "some-SUPER-DEDEUPER-secret-password"
|
||||
# The IP on which the node is reachable in the cluster.
|
||||
# Here, a sensible default is provided, you can still override
|
||||
# it for each of your hosts, though.
|
||||
k3s_node_ip: "{{ ansible_facts[(cilium_iface | default(calico_iface | default(flannel_iface)))]['ipv4']['address'] }}"
|
||||
k3s_node_ip: "{{ ansible_facts[(calico_iface | default(flannel_iface))]['ipv4']['address'] }}"
|
||||
|
||||
# Disable the taint manually by setting: k3s_master_taint = false
|
||||
k3s_master_taint: "{{ true if groups['node'] | default([]) | length >= 1 else false }}"
|
||||
|
||||
# these arguments are recommended for servers as well as agents:
|
||||
extra_args: >-
|
||||
{{ '--flannel-iface=' + flannel_iface if calico_iface is not defined and cilium_iface is not defined else '' }}
|
||||
{{ '--flannel-iface=' + flannel_iface if calico_iface is not defined else '' }}
|
||||
--node-ip={{ k3s_node_ip }}
|
||||
|
||||
# change these to your liking, the only required are: --disable servicelb, --tls-san {{ apiserver_endpoint }}
|
||||
# the contents of the if block is also required if using calico or cilium
|
||||
# the contents of the if block is also required if using calico
|
||||
extra_server_args: >-
|
||||
{{ extra_args }}
|
||||
{{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
|
||||
{% if calico_iface is defined or cilium_iface is defined %}
|
||||
{% if calico_iface is defined %}
|
||||
--flannel-backend=none
|
||||
--disable-network-policy
|
||||
--cluster-cidr={{ cluster_cidr | default('10.52.0.0/16') }}
|
||||
--cluster-cidr={{ calico_cidr | default('10.52.0.0/16') }}
|
||||
{% endif %}
|
||||
--tls-san {{ apiserver_endpoint }}
|
||||
--disable servicelb
|
||||
@@ -72,14 +54,7 @@ extra_agent_args: >-
|
||||
{{ extra_args }}
|
||||
|
||||
# image tag for kube-vip
|
||||
kube_vip_tag_version: "v0.7.2"
|
||||
|
||||
# tag for kube-vip-cloud-provider manifest
|
||||
# kube_vip_cloud_provider_tag_version: "main"
|
||||
|
||||
# kube-vip ip range for load balancer
|
||||
# (uncomment to use kube-vip for services instead of MetalLB)
|
||||
# kube_vip_lb_ip_range: "192.168.30.80-192.168.30.90"
|
||||
kube_vip_tag_version: "v0.6.4"
|
||||
|
||||
# metallb type frr or native
|
||||
metal_lb_type: "native"
|
||||
@@ -93,8 +68,8 @@ metal_lb_mode: "layer2"
|
||||
# metal_lb_bgp_peer_address: "192.168.30.1"
|
||||
|
||||
# image tag for metal lb
|
||||
metal_lb_speaker_tag_version: "v0.14.3"
|
||||
metal_lb_controller_tag_version: "v0.14.3"
|
||||
metal_lb_speaker_tag_version: "v0.13.12"
|
||||
metal_lb_controller_tag_version: "v0.13.12"
|
||||
|
||||
# metallb ip range for load balancer
|
||||
metal_lb_ip_range: "192.168.30.80-192.168.30.90"
|
||||
@@ -160,12 +135,10 @@ custom_registries_yaml: |
|
||||
username: yourusername
|
||||
password: yourpassword
|
||||
|
||||
# On some distros like Diet Pi, there is no dbus installed. dbus required by the default reboot command.
|
||||
# Uncomment if you need a custom reboot command
|
||||
# custom_reboot_command: /usr/sbin/shutdown -r now
|
||||
|
||||
# Only enable and configure these if you access the internet through a proxy
|
||||
# proxy_env:
|
||||
# HTTP_PROXY: "http://proxy.domain.local:3128"
|
||||
# HTTPS_PROXY: "http://proxy.domain.local:3128"
|
||||
# NO_PROXY: "*.domain.local,127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
|
||||
|
||||
verify_config: true
|
||||
|
||||
@@ -15,10 +15,6 @@ We have these scenarios:
|
||||
Very similar to the default scenario, but uses only a single node for all cluster functionality.
|
||||
- **calico**:
|
||||
The same as single node, but uses calico cni instead of flannel.
|
||||
- **cilium**:
|
||||
The same as single node, but uses cilium cni instead of flannel.
|
||||
- **kube-vip**
|
||||
The same as single node, but uses kube-vip as service loadbalancer instead of MetalLB
|
||||
|
||||
## How to execute
|
||||
|
||||
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
dependency:
|
||||
name: galaxy
|
||||
driver:
|
||||
name: vagrant
|
||||
platforms:
|
||||
- name: control1
|
||||
box: generic/ubuntu2204
|
||||
memory: 4096
|
||||
cpus: 4
|
||||
config_options:
|
||||
# We currently can not use public-key based authentication on Ubuntu 22.04,
|
||||
# see: https://github.com/chef/bento/issues/1405
|
||||
ssh.username: "vagrant"
|
||||
ssh.password: "vagrant"
|
||||
groups:
|
||||
- k3s_cluster
|
||||
- master
|
||||
interfaces:
|
||||
- network_name: private_network
|
||||
ip: 192.168.30.63
|
||||
provisioner:
|
||||
name: ansible
|
||||
env:
|
||||
ANSIBLE_VERBOSITY: 1
|
||||
playbooks:
|
||||
converge: ../resources/converge.yml
|
||||
side_effect: ../resources/reset.yml
|
||||
verify: ../resources/verify.yml
|
||||
inventory:
|
||||
links:
|
||||
group_vars: ../../inventory/sample/group_vars
|
||||
scenario:
|
||||
test_sequence:
|
||||
- dependency
|
||||
- cleanup
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
- prepare
|
||||
- converge
|
||||
# idempotence is not possible with the playbook in its current form.
|
||||
- verify
|
||||
# We are repurposing side_effect here to test the reset playbook.
|
||||
# This is why we do not run it before verify (which tests the cluster),
|
||||
# but after the verify step.
|
||||
- side_effect
|
||||
- cleanup
|
||||
- destroy
|
||||
@@ -1,16 +0,0 @@
|
||||
---
|
||||
- name: Apply overrides
|
||||
hosts: all
|
||||
tasks:
|
||||
- name: Override host variables
|
||||
ansible.builtin.set_fact:
|
||||
# See:
|
||||
# https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant
|
||||
cilium_iface: eth1
|
||||
|
||||
# The test VMs might be a bit slow, so we give them more time to join the cluster:
|
||||
retry_count: 45
|
||||
|
||||
# Make sure that our IP ranges do not collide with those of the other scenarios
|
||||
apiserver_endpoint: "192.168.30.225"
|
||||
metal_lb_ip_range: "192.168.30.110-192.168.30.119"
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
dependency:
|
||||
name: galaxy
|
||||
driver:
|
||||
name: vagrant
|
||||
platforms:
|
||||
- name: control1
|
||||
box: generic/ubuntu2204
|
||||
memory: 4096
|
||||
cpus: 4
|
||||
config_options:
|
||||
# We currently can not use public-key based authentication on Ubuntu 22.04,
|
||||
# see: https://github.com/chef/bento/issues/1405
|
||||
ssh.username: "vagrant"
|
||||
ssh.password: "vagrant"
|
||||
groups:
|
||||
- k3s_cluster
|
||||
- master
|
||||
interfaces:
|
||||
- network_name: private_network
|
||||
ip: 192.168.30.62
|
||||
provisioner:
|
||||
name: ansible
|
||||
env:
|
||||
ANSIBLE_VERBOSITY: 1
|
||||
playbooks:
|
||||
converge: ../resources/converge.yml
|
||||
side_effect: ../resources/reset.yml
|
||||
verify: ../resources/verify.yml
|
||||
inventory:
|
||||
links:
|
||||
group_vars: ../../inventory/sample/group_vars
|
||||
scenario:
|
||||
test_sequence:
|
||||
- dependency
|
||||
- cleanup
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
- prepare
|
||||
- converge
|
||||
# idempotence is not possible with the playbook in its current form.
|
||||
- verify
|
||||
# We are repurposing side_effect here to test the reset playbook.
|
||||
# This is why we do not run it before verify (which tests the cluster),
|
||||
# but after the verify step.
|
||||
- side_effect
|
||||
- cleanup
|
||||
- destroy
|
||||
@@ -1,17 +0,0 @@
|
||||
---
|
||||
- name: Apply overrides
|
||||
hosts: all
|
||||
tasks:
|
||||
- name: Override host variables
|
||||
ansible.builtin.set_fact:
|
||||
# See:
|
||||
# https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant
|
||||
flannel_iface: eth1
|
||||
|
||||
# The test VMs might be a bit slow, so we give them more time to join the cluster:
|
||||
retry_count: 45
|
||||
|
||||
# Make sure that our IP ranges do not collide with those of the other scenarios
|
||||
apiserver_endpoint: "192.168.30.225"
|
||||
# Use kube-vip instead of MetalLB
|
||||
kube_vip_lb_ip_range: "192.168.30.110-192.168.30.119"
|
||||
@@ -6,5 +6,4 @@
|
||||
- name: Reboot the nodes (and Wait upto 5 mins max)
|
||||
become: true
|
||||
reboot:
|
||||
reboot_command: "{{ custom_reboot_command | default(omit) }}"
|
||||
reboot_timeout: 300
|
||||
|
||||
+3
-3
@@ -6,7 +6,7 @@
|
||||
#
|
||||
ansible-compat==4.1.11
|
||||
# via molecule
|
||||
ansible-core==2.16.4
|
||||
ansible-core==2.16.2
|
||||
# via
|
||||
# -r requirements.in
|
||||
# ansible-compat
|
||||
@@ -77,7 +77,7 @@ molecule==6.0.3
|
||||
# via
|
||||
# -r requirements.in
|
||||
# molecule-plugins
|
||||
molecule-plugins[vagrant]==23.5.3
|
||||
molecule-plugins[vagrant]==23.5.0
|
||||
# via -r requirements.in
|
||||
netaddr==0.10.1
|
||||
# via -r requirements.in
|
||||
@@ -96,7 +96,7 @@ platformdirs==4.1.0
|
||||
# via virtualenv
|
||||
pluggy==1.3.0
|
||||
# via molecule
|
||||
pre-commit==3.6.2
|
||||
pre-commit==3.6.0
|
||||
# via -r requirements.in
|
||||
pre-commit-hooks==4.5.0
|
||||
# via -r requirements.in
|
||||
|
||||
@@ -12,7 +12,6 @@
|
||||
- name: Reboot and wait for node to come back up
|
||||
become: true
|
||||
reboot:
|
||||
reboot_command: "{{ custom_reboot_command | default(omit) }}"
|
||||
reboot_timeout: 3600
|
||||
|
||||
- name: Revert changes to Proxmox cluster
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
---
|
||||
|
||||
- name: Create k3s-node.service.d directory
|
||||
file:
|
||||
path: '{{ systemd_dir }}/k3s-node.service.d'
|
||||
@@ -6,7 +7,7 @@
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
when: proxy_env is defined
|
||||
|
||||
|
||||
- name: Copy K3s http_proxy conf file
|
||||
template:
|
||||
@@ -15,4 +16,3 @@
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
when: proxy_env is defined
|
||||
|
||||
@@ -1,35 +1,19 @@
|
||||
---
|
||||
- name: Check for PXE-booted system
|
||||
block:
|
||||
- name: Check if system is PXE-booted
|
||||
ansible.builtin.command:
|
||||
cmd: cat /proc/cmdline
|
||||
register: boot_cmdline
|
||||
changed_when: false
|
||||
check_mode: false
|
||||
|
||||
- name: Set fact for PXE-booted system
|
||||
ansible.builtin.set_fact:
|
||||
is_pxe_booted: "{{ 'root=/dev/nfs' in boot_cmdline.stdout }}"
|
||||
when: boot_cmdline.stdout is defined
|
||||
|
||||
- name: Include http_proxy configuration tasks
|
||||
ansible.builtin.include_tasks: http_proxy.yml
|
||||
|
||||
- name: Deploy K3s http_proxy conf
|
||||
include_tasks: http_proxy.yml
|
||||
when: proxy_env is defined
|
||||
|
||||
- name: Configure the k3s service
|
||||
ansible.builtin.template:
|
||||
- name: Copy K3s service file
|
||||
template:
|
||||
src: "k3s.service.j2"
|
||||
dest: "{{ systemd_dir }}/k3s-node.service"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
mode: 0755
|
||||
|
||||
- name: Manage k3s service
|
||||
ansible.builtin.systemd:
|
||||
- name: Enable and check K3s service
|
||||
systemd:
|
||||
name: k3s-node
|
||||
daemon_reload: true
|
||||
state: restarted
|
||||
|
||||
@@ -7,14 +7,11 @@ After=network-online.target
|
||||
Type=notify
|
||||
ExecStartPre=-/sbin/modprobe br_netfilter
|
||||
ExecStartPre=-/sbin/modprobe overlay
|
||||
# Conditional snapshotter based on PXE boot status
|
||||
ExecStart=/usr/local/bin/k3s agent \
|
||||
--server https://{{ apiserver_endpoint | ansible.utils.ipwrap }}:6443 \
|
||||
{% if is_pxe_booted | default(false) %}--snapshotter native \
|
||||
{% endif %}--token {{ hostvars[groups[group_name_master | default('master')][0]]['token'] | default(k3s_token) }} \
|
||||
{{ extra_agent_args | default("") }}
|
||||
ExecStart=/usr/local/bin/k3s agent --server https://{{ apiserver_endpoint | ansible.utils.ipwrap }}:6443 --token {{ hostvars[groups[group_name_master | default('master')][0]]['token'] | default(k3s_token) }} {{ extra_agent_args | default("") }}
|
||||
KillMode=process
|
||||
Delegate=yes
|
||||
# Having non-zero Limit*s causes performance problems due to accounting overhead
|
||||
# in the kernel. We recommend using cgroups to do container-local accounting.
|
||||
LimitNOFILE=1048576
|
||||
LimitNPROC=infinity
|
||||
LimitCORE=infinity
|
||||
|
||||
@@ -1,27 +0,0 @@
|
||||
---
|
||||
- name: Create manifests directory on first master
|
||||
file:
|
||||
path: /var/lib/rancher/k3s/server/manifests
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
|
||||
|
||||
- name: Download vip cloud provider manifest to first master
|
||||
ansible.builtin.get_url:
|
||||
url: "https://raw.githubusercontent.com/kube-vip/kube-vip-cloud-provider/{{ kube_vip_cloud_provider_tag_version | default('main') }}/manifest/kube-vip-cloud-controller.yaml" # noqa yaml[line-length]
|
||||
dest: "/var/lib/rancher/k3s/server/manifests/kube-vip-cloud-controller.yaml"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
|
||||
|
||||
- name: Copy kubevip configMap manifest to first master
|
||||
template:
|
||||
src: "kubevip.yaml.j2"
|
||||
dest: "/var/lib/rancher/k3s/server/manifests/kubevip.yaml"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
|
||||
@@ -29,12 +29,6 @@
|
||||
- name: Deploy metallb manifest
|
||||
include_tasks: metallb.yml
|
||||
tags: metallb
|
||||
when: kube_vip_lb_ip_range is not defined and (not cilium_bgp or cilium_iface is not defined)
|
||||
|
||||
- name: Deploy kube-vip manifest
|
||||
include_tasks: kube-vip.yml
|
||||
tags: kubevip
|
||||
when: kube_vip_lb_ip_range is defined
|
||||
|
||||
- name: Init cluster inside the transient k3s-init service
|
||||
command:
|
||||
|
||||
@@ -10,7 +10,7 @@
|
||||
|
||||
- name: Download vip rbac manifest to first master
|
||||
ansible.builtin.get_url:
|
||||
url: "https://kube-vip.io/manifests/rbac.yaml"
|
||||
url: "https://raw.githubusercontent.com/kube-vip/kube-vip/{{ kube_vip_tag_version }}/docs/manifests/rbac.yaml"
|
||||
dest: "/var/lib/rancher/k3s/server/manifests/vip-rbac.yaml"
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
@@ -1,13 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: kubevip
|
||||
namespace: kube-system
|
||||
data:
|
||||
{% if kube_vip_lb_ip_range is string %}
|
||||
{# kube_vip_lb_ip_range was used in the legacy way: single string instead of a list #}
|
||||
{# => transform to list with single element #}
|
||||
{% set kube_vip_lb_ip_range = [kube_vip_lb_ip_range] %}
|
||||
{% endif %}
|
||||
range-global: {{ kube_vip_lb_ip_range | join(',') }}
|
||||
@@ -43,7 +43,7 @@ spec:
|
||||
- name: vip_ddns
|
||||
value: "false"
|
||||
- name: svc_enable
|
||||
value: "{{ 'true' if kube_vip_lb_ip_range is defined else 'false' }}"
|
||||
value: "false"
|
||||
- name: vip_leaderelection
|
||||
value: "true"
|
||||
- name: vip_leaseduration
|
||||
|
||||
@@ -48,7 +48,7 @@
|
||||
k3s kubectl wait {{ item.type }}/{{ item.name }}
|
||||
--namespace='tigera-operator'
|
||||
--for=condition=Available=True
|
||||
--timeout=30s
|
||||
--timeout=7s
|
||||
register: tigera_result
|
||||
changed_when: false
|
||||
until: tigera_result is succeeded
|
||||
@@ -87,7 +87,7 @@
|
||||
--namespace='{{ item.namespace }}'
|
||||
--for=condition=Available
|
||||
{% endif %}
|
||||
--timeout=30s
|
||||
--timeout=7s
|
||||
register: cr_result
|
||||
changed_when: false
|
||||
until: cr_result is succeeded
|
||||
|
||||
@@ -1,253 +0,0 @@
|
||||
---
|
||||
- name: Prepare Cilium CLI on first master and deploy CNI
|
||||
when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
|
||||
run_once: true
|
||||
block:
|
||||
- name: Create tmp directory on first master
|
||||
file:
|
||||
path: /tmp/k3s
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
|
||||
- name: Check if Cilium CLI is installed
|
||||
ansible.builtin.command: cilium version
|
||||
register: cilium_cli_installed
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
|
||||
- name: Check for Cilium CLI version in command output
|
||||
set_fact:
|
||||
installed_cli_version: >-
|
||||
{{
|
||||
cilium_cli_installed.stdout_lines
|
||||
| join(' ')
|
||||
| regex_findall('cilium-cli: (v\d+\.\d+\.\d+)')
|
||||
| first
|
||||
| default('unknown')
|
||||
}}
|
||||
when: cilium_cli_installed.rc == 0
|
||||
|
||||
- name: Get latest stable Cilium CLI version file
|
||||
ansible.builtin.get_url:
|
||||
url: "https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt"
|
||||
dest: "/tmp/k3s/cilium-cli-stable.txt"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
|
||||
- name: Read Cilium CLI stable version from file
|
||||
ansible.builtin.command: cat /tmp/k3s/cilium-cli-stable.txt
|
||||
register: cli_ver
|
||||
changed_when: false
|
||||
|
||||
- name: Log installed Cilium CLI version
|
||||
ansible.builtin.debug:
|
||||
msg: "Installed Cilium CLI version: {{ installed_cli_version | default('Not installed') }}"
|
||||
|
||||
- name: Log latest stable Cilium CLI version
|
||||
ansible.builtin.debug:
|
||||
msg: "Latest Cilium CLI version: {{ cli_ver.stdout }}"
|
||||
|
||||
- name: Determine if Cilium CLI needs installation or update
|
||||
set_fact:
|
||||
cilium_cli_needs_update: >-
|
||||
{{
|
||||
cilium_cli_installed.rc != 0 or
|
||||
(cilium_cli_installed.rc == 0 and
|
||||
installed_cli_version != cli_ver.stdout)
|
||||
}}
|
||||
|
||||
- name: Install or update Cilium CLI
|
||||
when: cilium_cli_needs_update
|
||||
block:
|
||||
- name: Set architecture variable
|
||||
ansible.builtin.set_fact:
|
||||
cli_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}"
|
||||
|
||||
- name: Download Cilium CLI and checksum
|
||||
ansible.builtin.get_url:
|
||||
url: "{{ cilium_base_url }}/cilium-linux-{{ cli_arch }}{{ item }}"
|
||||
dest: "/tmp/k3s/cilium-linux-{{ cli_arch }}{{ item }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
loop:
|
||||
- ".tar.gz"
|
||||
- ".tar.gz.sha256sum"
|
||||
vars:
|
||||
cilium_base_url: "https://github.com/cilium/cilium-cli/releases/download/{{ cli_ver.stdout }}"
|
||||
|
||||
- name: Verify the downloaded tarball
|
||||
ansible.builtin.shell: |
|
||||
cd /tmp/k3s && sha256sum --check cilium-linux-{{ cli_arch }}.tar.gz.sha256sum
|
||||
args:
|
||||
executable: /bin/bash
|
||||
changed_when: false
|
||||
|
||||
- name: Extract Cilium CLI to /usr/local/bin
|
||||
ansible.builtin.unarchive:
|
||||
src: "/tmp/k3s/cilium-linux-{{ cli_arch }}.tar.gz"
|
||||
dest: /usr/local/bin
|
||||
remote_src: true
|
||||
|
||||
- name: Remove downloaded tarball and checksum file
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: absent
|
||||
loop:
|
||||
- "/tmp/k3s/cilium-linux-{{ cli_arch }}.tar.gz"
|
||||
- "/tmp/k3s/cilium-linux-{{ cli_arch }}.tar.gz.sha256sum"
|
||||
|
||||
- name: Wait for connectivity to kube VIP
|
||||
ansible.builtin.command: ping -c 1 {{ apiserver_endpoint }}
|
||||
register: ping_result
|
||||
until: ping_result.rc == 0
|
||||
retries: 21
|
||||
delay: 1
|
||||
ignore_errors: true
|
||||
changed_when: false
|
||||
|
||||
- name: Fail if kube VIP not reachable
|
||||
ansible.builtin.fail:
|
||||
msg: "API endpoint {{ apiserver_endpoint }} is not reachable"
|
||||
when: ping_result.rc != 0
|
||||
|
||||
- name: Test for existing Cilium install
|
||||
ansible.builtin.command: k3s kubectl -n kube-system get daemonsets cilium
|
||||
register: cilium_installed
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
|
||||
- name: Check existing Cilium install
|
||||
when: cilium_installed.rc == 0
|
||||
block:
|
||||
|
||||
- name: Check Cilium version
|
||||
ansible.builtin.command: cilium version
|
||||
register: cilium_version
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
|
||||
- name: Parse installed Cilium version
|
||||
set_fact:
|
||||
installed_cilium_version: >-
|
||||
{{
|
||||
cilium_version.stdout_lines
|
||||
| join(' ')
|
||||
| regex_findall('cilium image.+(\d+\.\d+\.\d+)')
|
||||
| first
|
||||
| default('unknown')
|
||||
}}
|
||||
|
||||
- name: Determine if Cilium needs update
|
||||
set_fact:
|
||||
cilium_needs_update: >-
|
||||
{{ 'v' + installed_cilium_version != cilium_tag }}
|
||||
|
||||
- name: Log result
|
||||
ansible.builtin.debug:
|
||||
msg: >
|
||||
Installed Cilium version: {{ installed_cilium_version }},
|
||||
Target Cilium version: {{ cilium_tag }},
|
||||
Update needed: {{ cilium_needs_update }}
|
||||
|
||||
- name: Install Cilium
|
||||
ansible.builtin.command: >-
|
||||
{% if cilium_installed.rc != 0 %}
|
||||
cilium install
|
||||
{% else %}
|
||||
cilium upgrade
|
||||
{% endif %}
|
||||
--version "{{ cilium_tag }}"
|
||||
--helm-set operator.replicas="1"
|
||||
{{ '--helm-set devices=' + cilium_iface if cilium_iface != 'auto' else '' }}
|
||||
--helm-set ipam.operator.clusterPoolIPv4PodCIDRList={{ cluster_cidr }}
|
||||
{% if cilium_mode == "native" or (cilium_bgp and cilium_exportPodCIDR != 'false') %}
|
||||
--helm-set ipv4NativeRoutingCIDR={{ cluster_cidr }}
|
||||
{% endif %}
|
||||
--helm-set k8sServiceHost="127.0.0.1"
|
||||
--helm-set k8sServicePort="6444"
|
||||
--helm-set routingMode={{ cilium_mode | default("native") }}
|
||||
--helm-set autoDirectNodeRoutes={{ "true" if cilium_mode == "native" else "false" }}
|
||||
--helm-set kubeProxyReplacement={{ kube_proxy_replacement | default("true") }}
|
||||
--helm-set bpf.masquerade={{ enable_bpf_masquerade | default("true") }}
|
||||
--helm-set bgpControlPlane.enabled={{ cilium_bgp | default("false") }}
|
||||
--helm-set hubble.enabled={{ "true" if cilium_hubble else "false" }}
|
||||
--helm-set hubble.relay.enabled={{ "true" if cilium_hubble else "false" }}
|
||||
--helm-set hubble.ui.enabled={{ "true" if cilium_hubble else "false" }}
|
||||
{% if kube_proxy_replacement is not false %}
|
||||
--helm-set bpf.loadBalancer.algorithm={{ bpf_lb_algorithm | default("maglev") }}
|
||||
--helm-set bpf.loadBalancer.mode={{ bpf_lb_mode | default("hybrid") }}
|
||||
{% endif %}
|
||||
environment:
|
||||
KUBECONFIG: "{{ ansible_user_dir }}/.kube/config"
|
||||
register: cilium_install_result
|
||||
changed_when: cilium_install_result.rc == 0
|
||||
when: cilium_installed.rc != 0 or cilium_needs_update
|
||||
|
||||
- name: Wait for Cilium resources
|
||||
command: >-
|
||||
{% if item.type == 'daemonset' %}
|
||||
k3s kubectl wait pods
|
||||
--namespace=kube-system
|
||||
--selector='k8s-app=cilium'
|
||||
--for=condition=Ready
|
||||
{% else %}
|
||||
k3s kubectl wait {{ item.type }}/{{ item.name }}
|
||||
--namespace=kube-system
|
||||
--for=condition=Available
|
||||
{% endif %}
|
||||
--timeout=30s
|
||||
register: cr_result
|
||||
changed_when: false
|
||||
until: cr_result is succeeded
|
||||
retries: 30
|
||||
delay: 7
|
||||
with_items:
|
||||
- {name: cilium-operator, type: deployment}
|
||||
- {name: cilium, type: daemonset, selector: 'k8s-app=cilium'}
|
||||
- {name: hubble-relay, type: deployment, check_hubble: true}
|
||||
- {name: hubble-ui, type: deployment, check_hubble: true}
|
||||
loop_control:
|
||||
label: "{{ item.type }}/{{ item.name }}"
|
||||
when: >-
|
||||
not item.check_hubble | default(false) or (item.check_hubble | default(false) and cilium_hubble)
|
||||
|
||||
- name: Configure Cilium BGP
|
||||
when: cilium_bgp
|
||||
block:
|
||||
|
||||
- name: Copy BGP manifests to first master
|
||||
ansible.builtin.template:
|
||||
src: "cilium.crs.j2"
|
||||
dest: /tmp/k3s/cilium-bgp.yaml
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
|
||||
- name: Apply BGP manifests
|
||||
ansible.builtin.command:
|
||||
cmd: kubectl apply -f /tmp/k3s/cilium-bgp.yaml
|
||||
register: apply_cr
|
||||
changed_when: "'configured' in apply_cr.stdout or 'created' in apply_cr.stdout"
|
||||
failed_when: "'is invalid' in apply_cr.stderr"
|
||||
ignore_errors: true
|
||||
|
||||
- name: Print error message if BGP manifests application fails
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ apply_cr.stderr }}"
|
||||
when: "'is invalid' in apply_cr.stderr"
|
||||
|
||||
- name: Test for BGP config resources
|
||||
ansible.builtin.command: "{{ item }}"
|
||||
loop:
|
||||
- k3s kubectl get CiliumBGPPeeringPolicy.cilium.io
|
||||
- k3s kubectl get CiliumLoadBalancerIPPool.cilium.io
|
||||
changed_when: false
|
||||
loop_control:
|
||||
label: "{{ item }}"
|
||||
@@ -2,17 +2,11 @@
|
||||
- name: Deploy calico
|
||||
include_tasks: calico.yml
|
||||
tags: calico
|
||||
when: calico_iface is defined and cilium_iface is not defined
|
||||
|
||||
- name: Deploy cilium
|
||||
include_tasks: cilium.yml
|
||||
tags: cilium
|
||||
when: cilium_iface is defined
|
||||
when: calico_iface is defined
|
||||
|
||||
- name: Deploy metallb pool
|
||||
include_tasks: metallb.yml
|
||||
tags: metallb
|
||||
when: kube_vip_lb_ip_range is not defined and (not cilium_bgp or cilium_iface is not defined)
|
||||
|
||||
- name: Remove tmp directory used for manifests
|
||||
file:
|
||||
|
||||
@@ -8,27 +8,6 @@
|
||||
with_items: "{{ groups[group_name_master | default('master')] }}"
|
||||
run_once: true
|
||||
|
||||
- name: Delete outdated metallb replicas
|
||||
shell: |-
|
||||
set -o pipefail
|
||||
|
||||
REPLICAS=$(k3s kubectl --namespace='metallb-system' get replicasets \
|
||||
-l 'component=controller,app=metallb' \
|
||||
-o jsonpath='{.items[0].spec.template.spec.containers[0].image}, {.items[0].metadata.name}' 2>/dev/null || true)
|
||||
REPLICAS_SETS=$(echo ${REPLICAS} | grep -v '{{ metal_lb_controller_tag_version }}' | sed -e "s/^.*\s//g")
|
||||
if [ -n "${REPLICAS_SETS}" ] ; then
|
||||
for REPLICAS in "${REPLICAS_SETS}"
|
||||
do
|
||||
k3s kubectl --namespace='metallb-system' \
|
||||
delete rs "${REPLICAS}"
|
||||
done
|
||||
fi
|
||||
args:
|
||||
executable: /bin/bash
|
||||
changed_when: false
|
||||
run_once: true
|
||||
with_items: "{{ groups[group_name_master | default('master')] }}"
|
||||
|
||||
- name: Copy metallb CRs manifest to first master
|
||||
template:
|
||||
src: "metallb.crs.j2"
|
||||
|
||||
@@ -10,7 +10,7 @@ spec:
|
||||
# Note: The ipPools section cannot be modified post-install.
|
||||
ipPools:
|
||||
- blockSize: {{ calico_blockSize | default('26') }}
|
||||
cidr: {{ cluster_cidr | default('10.52.0.0/16') }}
|
||||
cidr: {{ calico_cidr | default('10.52.0.0/16') }}
|
||||
encapsulation: {{ calico_encapsulation | default('VXLANCrossSubnet') }}
|
||||
natOutgoing: {{ calico_natOutgoing | default('Enabled') }}
|
||||
nodeSelector: {{ calico_nodeSelector | default('all()') }}
|
||||
|
||||
@@ -1,29 +0,0 @@
|
||||
apiVersion: "cilium.io/v2alpha1"
|
||||
kind: CiliumBGPPeeringPolicy
|
||||
metadata:
|
||||
name: 01-bgp-peering-policy
|
||||
spec: # CiliumBGPPeeringPolicySpec
|
||||
virtualRouters: # []CiliumBGPVirtualRouter
|
||||
- localASN: {{ cilium_bgp_my_asn }}
|
||||
exportPodCIDR: {{ cilium_exportPodCIDR | default('true') }}
|
||||
neighbors: # []CiliumBGPNeighbor
|
||||
- peerAddress: '{{ cilium_bgp_peer_address + "/32"}}'
|
||||
peerASN: {{ cilium_bgp_peer_asn }}
|
||||
eBGPMultihopTTL: 10
|
||||
connectRetryTimeSeconds: 120
|
||||
holdTimeSeconds: 90
|
||||
keepAliveTimeSeconds: 30
|
||||
gracefulRestart:
|
||||
enabled: true
|
||||
restartTimeSeconds: 120
|
||||
serviceSelector:
|
||||
matchExpressions:
|
||||
- {key: somekey, operator: NotIn, values: ['never-used-value']}
|
||||
---
|
||||
apiVersion: "cilium.io/v2alpha1"
|
||||
kind: CiliumLoadBalancerIPPool
|
||||
metadata:
|
||||
name: "01-lb-pool"
|
||||
spec:
|
||||
cidrs:
|
||||
- cidr: "{{ cilium_bgp_lb_cidr }}"
|
||||
@@ -2,5 +2,4 @@
|
||||
- name: Reboot server
|
||||
become: true
|
||||
reboot:
|
||||
reboot_command: "{{ custom_reboot_command | default(omit) }}"
|
||||
listen: reboot server
|
||||
|
||||
@@ -1,5 +1,4 @@
|
||||
---
|
||||
- name: Reboot
|
||||
reboot:
|
||||
reboot_command: "{{ custom_reboot_command | default(omit) }}"
|
||||
listen: reboot
|
||||
|
||||
@@ -1,27 +1,7 @@
|
||||
---
|
||||
- name: Test for cmdline path
|
||||
stat:
|
||||
path: /boot/firmware/cmdline.txt
|
||||
register: boot_cmdline_path
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
|
||||
- name: Set cmdline path based on Debian version and command result
|
||||
set_fact:
|
||||
cmdline_path: >-
|
||||
{{
|
||||
(
|
||||
boot_cmdline_path.stat.exists and
|
||||
ansible_facts.lsb.description | default('') is match('Debian.*(?!(bookworm|sid))')
|
||||
) | ternary(
|
||||
'/boot/firmware/cmdline.txt',
|
||||
'/boot/cmdline.txt'
|
||||
)
|
||||
}}
|
||||
|
||||
- name: Activating cgroup support
|
||||
lineinfile:
|
||||
path: "{{ cmdline_path }}"
|
||||
path: /boot/cmdline.txt
|
||||
regexp: '^((?!.*\bcgroup_enable=cpuset cgroup_memory=1 cgroup_enable=memory\b).*)$'
|
||||
line: '\1 cgroup_enable=cpuset cgroup_memory=1 cgroup_enable=memory'
|
||||
backrefs: true
|
||||
|
||||
@@ -0,0 +1,13 @@
|
||||
---
|
||||
# To be ran on localhost after verify_config_gather role.
|
||||
# Verifies gatherd facts.
|
||||
- name: Collect all routing4_prefixes into a list
|
||||
set_fact:
|
||||
all_routing4_prefixes: "{{ groups['all'] | map('extract', hostvars, 'routing4_prefix') | list }}"
|
||||
routing4_prefix: "{{ groups['all'] | map('extract', hostvars, 'routing4_prefix') | list | first }}"
|
||||
|
||||
- name: Ensure all hosts have the same routing4_prefix
|
||||
assert:
|
||||
that: all_routing4_prefixes | unique | length == 1
|
||||
fail_msg: "Not all hosts have the same routing4_prefix."
|
||||
success_msg: "Using verified routing prefix {{ routing4_prefix }} across all hosts"
|
||||
@@ -0,0 +1,53 @@
|
||||
import netaddr
|
||||
|
||||
''' returns True if ip is in range
|
||||
examples:
|
||||
- see test functions below
|
||||
'''
|
||||
def test(ip, range, expected):
|
||||
assert netaddr_ip_in_dash_range(ip, range) == expected
|
||||
|
||||
def test_netaddr_ip_in_dash_range():
|
||||
# ipv4
|
||||
test('192.168.1.1', '192.168.1.1-192.168.1.2', True)
|
||||
test('192.168.1.1', '192.168.1.1', True)
|
||||
test('192.168.1.1', '192.168.1.2-192.168.1.3', False)
|
||||
test('192.168.1.1', '192.168.1.2', False)
|
||||
|
||||
# ipv6 style
|
||||
test('::ffff:192.168.1.1', '::ffff:192.168.1.1-::ffff:192.168.1.8', True)
|
||||
test('::ffff:192.168.1.1', '::ffff:192.168.1.1', True)
|
||||
test('::ffff:192.168.1.1', '::ffff:192.168.1.2-::ffff:192.168.1.8', False)
|
||||
test('::ffff:192.168.1.1', '::ffff:192.168.1.2', False)
|
||||
|
||||
# Note I expedted true but apperently the netaddr library does not support this?? or I don't understand ipv6 :)
|
||||
test('::2:1', '::2:1-::2:2', False)
|
||||
'''
|
||||
todo: ?
|
||||
- netaddr_ip_in_dash_range('192.168.1.1', '192.168.1.0/24') => True (TODO: test, implement)
|
||||
- netaddr_ip_in_dash_range('192.168.99.1', '192.168.1.0/24') => False (TODO: test, implement)
|
||||
'''
|
||||
|
||||
def netaddr_ip_in_dash_range(ip, range):
|
||||
# return False early if range is invalid
|
||||
if '-' not in range:
|
||||
ip_start = range
|
||||
ip_end = range
|
||||
else:
|
||||
ip_start = range.split('-')[0]
|
||||
ip_end = range.split('-')[1]
|
||||
return ip in [str(ip) for ip in netaddr.iter_iprange(ip_start, ip_end)]
|
||||
|
||||
|
||||
class FilterModule(object):
|
||||
''' Ansible filters. Interface to custom netaddr methods.
|
||||
https://pypi.org/project/netaddr/
|
||||
'''
|
||||
|
||||
def filters(self):
|
||||
return {
|
||||
'netaddr_ip_in_dash_range' : netaddr_ip_in_dash_range
|
||||
}
|
||||
|
||||
if __name__ == '__main__':
|
||||
test_netaddr_ip_in_dash_range()
|
||||
@@ -0,0 +1,117 @@
|
||||
---
|
||||
# To be ran on all hosts before role verify_config.
|
||||
# Gathers facts and ensures they are set
|
||||
|
||||
- name: Set routing4_prefix from regex
|
||||
set_fact:
|
||||
routing4_prefix: "{{ hostvars[inventory_hostname]['ansible_' ~ flannel_iface]['ipv4']['broadcast']
|
||||
| regex_replace('\\.?255', '') }}"
|
||||
routing6_cidr: "{{ hostvars[inventory_hostname]['ansible_' ~ flannel_iface]['ipv6'][0]['address'] }}/{{
|
||||
hostvars[inventory_hostname]['ansible_' ~ flannel_iface]['ipv6'][0]['prefix'] }}"
|
||||
|
||||
- name: Check if fact routing4_prefix exists and is not empty
|
||||
assert:
|
||||
that:
|
||||
- routing4_prefix is defined
|
||||
- routing4_prefix is not none
|
||||
- routing4_prefix != ''
|
||||
fail_msg: >-
|
||||
The fact 'routing_4prefix' is not defined, is null, or is empty
|
||||
(based on flannel_iface: {{ flannel_iface }} ipv4 broadcast).
|
||||
|
||||
# metal_lb_bgp_peer_address
|
||||
- name: Assert that metal_lb_bgp_peer_address starts with routing4_prefix, or is ipv6
|
||||
assert:
|
||||
that:
|
||||
- >
|
||||
metal_lb_bgp_peer_address.startswith(routing4_prefix)
|
||||
or metal_lb_bgp_peer_address.matches('.*:.*')
|
||||
fail_msg: >
|
||||
The fact 'metal_lb_bgp_peer_address' <{{ metal_lb_bgp_peer_address }}>
|
||||
doesn't start with the routing prefix <{{ routing4_prefix }}>
|
||||
when: metal_lb_bgp_peer_address is defined
|
||||
|
||||
# metal_lb_ip_range
|
||||
- name: >
|
||||
Assert that metal_lb_ip_range (when string) contains <ipv4>-<ipv4>
|
||||
and both ips start with routing4_prefix, skip any containing ':' (ipv6)
|
||||
assert:
|
||||
that:
|
||||
- metal_lb_ip_range | regex_search('^{{ routing4_prefix }}\.[0-9]{1,3}-{{ routing4_prefix }}\.[0-9]{1,3}$|.*:.*')
|
||||
fail_msg: >
|
||||
metal_lb_ip_range <{{ metal_lb_ip_range }}> has one or more ipv4s
|
||||
that don't start with the routing prefix <{{ routing4_prefix }}>
|
||||
when: metal_lb_ip_range is string
|
||||
|
||||
- name: Assert that metal_lb_ip_ranges (when list) has only strings that match the regexes in the task above
|
||||
assert:
|
||||
that:
|
||||
- >
|
||||
( metal_lb_ip_range
|
||||
| select('match', '^{{ routing4_prefix }}\.[0-9]{1,3}-{{ routing4_prefix }}\.[0-9]{1,3}$|.*:.*')
|
||||
| list | length
|
||||
)
|
||||
==
|
||||
(metal_lb_ip_range
|
||||
| length
|
||||
)
|
||||
fail_msg: >
|
||||
metal_lb_ip_range <{{ metal_lb_ip_range }}> has one or more values with ipv4s
|
||||
that don't start with the routing prefix <{{ routing4_prefix }}>
|
||||
when: metal_lb_ip_range is not string and metal_lb_ip_range is not mapping and metal_lb_ip_range is iterable
|
||||
|
||||
# apiserver_endpoint
|
||||
- name: Assert that apiserver_endpoint is not in metal_lb_ip_range (when string) using network_in_usable
|
||||
# For /<mask> ranges
|
||||
assert:
|
||||
that:
|
||||
- not ( metal_lb_ip_range | ansible.utils.network_in_usable( apiserver_endpoint ))
|
||||
fail_msg: "apiserver_endpoint {{ apiserver_endpoint }} cannot be in the metal_lb_ip_range {{ metal_lb_ip_range }}"
|
||||
success_msg: >
|
||||
apiserver_endpoint {{ apiserver_endpoint }} is *probably* not in the metal_lb_ip_range {{ metal_lb_ip_range }}
|
||||
when: metal_lb_ip_range is string
|
||||
|
||||
- name: >
|
||||
Assert that apiserver_endpoint is not in metal_lb_ip_range (when string)
|
||||
using custom filter netaddr_ip_in_dash_range
|
||||
# For <ip>-<ip> ranges. Not sure this works for ipv6
|
||||
assert:
|
||||
that:
|
||||
- not (apiserver_endpoint | netaddr_ip_in_dash_range(metal_lb_ip_range))
|
||||
fail_msg: "apiserver_endpoint {{ apiserver_endpoint }} cannot be in the metal_lb_ip_range {{ metal_lb_ip_range }}"
|
||||
success_msg: >
|
||||
apiserver_endpoint {{ apiserver_endpoint }} is *probably* not in the metal_lb_ip_range {{ metal_lb_ip_range }}
|
||||
when: metal_lb_ip_range is string
|
||||
# *probably* in the success_msg sections of the prior two tasks because not all cases may work
|
||||
|
||||
- name: Assert that apiserver_endpoint is not in metal_lb_ip_ranges (when list) using logic of the task above
|
||||
assert:
|
||||
that:
|
||||
- not (apiserver_endpoint | netaddr_ip_in_dash_range(item))
|
||||
# this probably fails on an ipv6 range ''::1-::2', and on <ipv4or6>/<mask> ranges
|
||||
fail_msg: "apiserver_endpoint {{ apiserver_endpoint }} cannot be in the metal_lb_ip_range item {{ item }}"
|
||||
success_msg: >
|
||||
apiserver_endpoint {{ apiserver_endpoint }} is *probably* not in the metal_lb_ip_range item {{ item }}
|
||||
loop: "{{ metal_lb_ip_range | list }}"
|
||||
when: metal_lb_ip_range is not string and metal_lb_ip_range is not mapping and metal_lb_ip_range is iterable
|
||||
# these (when string, when list tasks) smell funny.
|
||||
# It seems there should be a way in one task to handle an object that is a string or a list
|
||||
# and loop on {{ [metal_lb_ip_range] }} or {{ metal_lb_ip_range }} respectively
|
||||
# when it is a string it skips each char :(
|
||||
# I tried the select pattern like in the task
|
||||
# 'assert that metal_lb_ip_ranges (when list) has only strings that match the regexes in the task above'
|
||||
# but it didn't work
|
||||
|
||||
- name: Assert that apiserver_endpoint, is ipv4 and starts with routing4_prefix, or is ipv6 and is in routing6_cidr
|
||||
assert:
|
||||
that:
|
||||
- apiserver_endpoint is defined
|
||||
- apiserver_endpoint is not none
|
||||
- >-
|
||||
( apiserver_endpoint | ansible.utils.ipv4 and apiserver_endpoint.startswith(routing4_prefix) )
|
||||
or
|
||||
( apiserver_endpoint | ansible.utils.ipv6 and apiserver_endpoint | ansible.utils.ipaddr(routing6_cidr))
|
||||
fail_msg: >
|
||||
The fact 'apiserver_endpoint' <{{ apiserver_endpoint }}>
|
||||
doesn't start with the routing prefix <{{ routing4_prefix }}>
|
||||
or is not in the routing6_cidr <{{ routing6_cidr }}>
|
||||
@@ -1,12 +1,6 @@
|
||||
---
|
||||
- name: Pre tasks
|
||||
hosts: all
|
||||
pre_tasks:
|
||||
- name: Verify Ansible is version 2.11 or above. (If this fails you may need to update Ansible)
|
||||
assert:
|
||||
that: "ansible_version.full is version_compare('2.11', '>=')"
|
||||
msg: >
|
||||
"Ansible is out of date. See here for more info: https://docs.technotim.live/posts/ansible-automation/"
|
||||
- name: Import verify_config playbook
|
||||
ansible.builtin.import_playbook: verify_config.yml
|
||||
|
||||
- name: Prepare Proxmox cluster
|
||||
hosts: proxmox
|
||||
@@ -55,14 +49,3 @@
|
||||
roles:
|
||||
- role: k3s_server_post
|
||||
become: true
|
||||
|
||||
- name: Storing kubeconfig in the playbook directory
|
||||
hosts: master
|
||||
environment: "{{ proxy_env | default({}) }}"
|
||||
tasks:
|
||||
- name: Copying kubeconfig from {{ hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname'] }}
|
||||
ansible.builtin.fetch:
|
||||
src: "{{ ansible_user_dir }}/.kube/config"
|
||||
dest: ./kubeconfig
|
||||
flat: true
|
||||
when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
---
|
||||
- name: Gather config for verify
|
||||
hosts: all
|
||||
gather_facts: true
|
||||
roles:
|
||||
- role: verify_config_gather
|
||||
when: verify_config is not defined or verify_config
|
||||
|
||||
- name: Verify config
|
||||
hosts: localhost
|
||||
gather_facts: false
|
||||
roles:
|
||||
- role: verify_config
|
||||
when: verify_config is not defined or verify_config
|
||||
Reference in New Issue
Block a user