From 027d3b2dbdb43d2d86093d9c0b0452e26a5f403e Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Sat, 15 Jul 2023 14:44:06 -0400 Subject: [PATCH] feat: move system-upgrade-controller to addons Signed-off-by: Devin Buhl --- bootstrap/tasks/addons/main.yaml | 4 ++ .../addons/system_upgrade_controller.yaml | 63 +++++++++++++++++++ .../app/kustomization.yaml.j2 | 0 .../system-upgrade-controller/ks.yaml.j2 | 0 .../plans/agent.yaml.j2 | 0 .../plans/kustomization.yaml.j2 | 0 .../plans/server.yaml.j2 | 0 .../apps/system-upgrade/kustomization.yaml.j2 | 7 +-- bootstrap/vars/addons.sample.yaml | 7 +++ 9 files changed, 77 insertions(+), 4 deletions(-) create mode 100644 bootstrap/tasks/addons/system_upgrade_controller.yaml rename bootstrap/templates/{kubernetes/apps/system-upgrade => addons}/system-upgrade-controller/app/kustomization.yaml.j2 (100%) rename bootstrap/templates/{kubernetes/apps/system-upgrade => addons}/system-upgrade-controller/ks.yaml.j2 (100%) rename bootstrap/templates/{kubernetes/apps/system-upgrade => addons}/system-upgrade-controller/plans/agent.yaml.j2 (100%) rename bootstrap/templates/{kubernetes/apps/system-upgrade => addons}/system-upgrade-controller/plans/kustomization.yaml.j2 (100%) rename bootstrap/templates/{kubernetes/apps/system-upgrade => addons}/system-upgrade-controller/plans/server.yaml.j2 (100%) diff --git a/bootstrap/tasks/addons/main.yaml b/bootstrap/tasks/addons/main.yaml index cb5eae8f..c7ff626c 100644 --- a/bootstrap/tasks/addons/main.yaml +++ b/bootstrap/tasks/addons/main.yaml @@ -20,6 +20,10 @@ when: kube_prometheus_stack.enabled | default(false) ansible.builtin.include_tasks: kube_prometheus_stack.yaml +- name: Process addon system-upgrade-controller + when: system_upgrade_controller.enabled | default(false) + ansible.builtin.include_tasks: system_upgrade_controller.yaml + - name: Process addon weave-gitops when: weave_gitops.enabled | default(false) ansible.builtin.include_tasks: weave_gitops.yaml diff --git a/bootstrap/tasks/addons/system_upgrade_controller.yaml b/bootstrap/tasks/addons/system_upgrade_controller.yaml new file mode 100644 index 00000000..b968b529 --- /dev/null +++ b/bootstrap/tasks/addons/system_upgrade_controller.yaml @@ -0,0 +1,63 @@ +--- +- name: Set addon facts + ansible.builtin.set_fact: + addon_name: system-upgrade-controller + addon_namespace: system-upgrade + +- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }} + when: item.state == 'directory' + ansible.builtin.file: + path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}" + state: directory + mode: "0755" + with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] + +- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }} + when: item.state == 'file' and 'sops' not in item.path + ansible.builtin.template: + src: "{{ item.src }}" + dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" + mode: "0644" + with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] + +# https://github.com/ansible-collections/community.sops/issues/153 +- name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }} + block: + - name: Rename Sops configuration file + ansible.builtin.copy: + src: "{{ repository_path }}/.sops.yaml" + dest: "{{ repository_path }}/.sops.yaml.orig" + mode: "0644" + - name: Remove Sops configuration file + ansible.builtin.file: + path: "{{ repository_path }}/.sops.yaml" + state: absent + - name: Template encrypted files + when: item.state == 'file' and 'sops' in item.path + community.sops.sops_encrypt: + path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" + encrypted_regex: ^(data|stringData)$ + age: ["{{ bootstrap_age_public_key }}"] + content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}" + mode: "0644" + force: true + with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] + - name: Restore Sops configuration file + ansible.builtin.copy: + src: "{{ repository_path }}/.sops.yaml.orig" + dest: "{{ repository_path }}/.sops.yaml" + mode: "0644" + - name: Remove backed up Sops configuration file + ansible.builtin.file: + path: "{{ repository_path }}/.sops.yaml.orig" + state: absent + rescue: + - name: Restore Sops configuration file + ansible.builtin.copy: + src: "{{ repository_path }}/.sops.yaml.orig" + dest: "{{ repository_path }}/.sops.yaml" + mode: "0644" + - name: Remove backed up Sops configuration file + ansible.builtin.file: + path: "{{ repository_path }}/.sops.yaml.orig" + state: absent diff --git a/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/kustomization.yaml.j2 b/bootstrap/templates/addons/system-upgrade-controller/app/kustomization.yaml.j2 similarity index 100% rename from bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/kustomization.yaml.j2 rename to bootstrap/templates/addons/system-upgrade-controller/app/kustomization.yaml.j2 diff --git a/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/ks.yaml.j2 b/bootstrap/templates/addons/system-upgrade-controller/ks.yaml.j2 similarity index 100% rename from bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/ks.yaml.j2 rename to bootstrap/templates/addons/system-upgrade-controller/ks.yaml.j2 diff --git a/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/agent.yaml.j2 b/bootstrap/templates/addons/system-upgrade-controller/plans/agent.yaml.j2 similarity index 100% rename from bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/agent.yaml.j2 rename to bootstrap/templates/addons/system-upgrade-controller/plans/agent.yaml.j2 diff --git a/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/kustomization.yaml.j2 b/bootstrap/templates/addons/system-upgrade-controller/plans/kustomization.yaml.j2 similarity index 100% rename from bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/kustomization.yaml.j2 rename to bootstrap/templates/addons/system-upgrade-controller/plans/kustomization.yaml.j2 diff --git a/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/server.yaml.j2 b/bootstrap/templates/addons/system-upgrade-controller/plans/server.yaml.j2 similarity index 100% rename from bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/server.yaml.j2 rename to bootstrap/templates/addons/system-upgrade-controller/plans/server.yaml.j2 diff --git a/bootstrap/templates/kubernetes/apps/system-upgrade/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/system-upgrade/kustomization.yaml.j2 index 7e5f85e1..3ca4ad87 100644 --- a/bootstrap/templates/kubernetes/apps/system-upgrade/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/system-upgrade/kustomization.yaml.j2 @@ -3,7 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./namespace.yaml - # NOTE: Only enable system-upgrade-controller if you also update the version of k3s in the following file - # otherwise if you run ansible against an already provisioned cluster you might downgrade it - # https://github.com/onedr0p/flux-cluster-template/blob/main/ansible/inventory/group_vars/kubernetes/main.yaml - # - ./system-upgrade-controller/ks.yaml + {% if system_upgrade_controller.enabled | default(false) %} + - ./system-upgrade-controller/ks.yaml + {% endif %} diff --git a/bootstrap/vars/addons.sample.yaml b/bootstrap/vars/addons.sample.yaml index fcba9b92..46419a28 100644 --- a/bootstrap/vars/addons.sample.yaml +++ b/bootstrap/vars/addons.sample.yaml @@ -33,3 +33,10 @@ csi_driver_nfs: # server: # dns name or ip address of nfs server # share: # exported share (path) # ... + +# https://github.com/rancher/system-upgrade-controller +system_upgrade_controller: + # WARNING: Only enable this if you also track the version of k3s in the + # ansible configuration files. Running ansible against an already provisioned + # cluster with this enabled might cause your cluster to be downgraded. + enabled: false