diff --git a/.envrc b/.envrc index c84c3f45..3393855a 100644 --- a/.envrc +++ b/.envrc @@ -7,6 +7,8 @@ export VIRTUAL_ENV="$(expand_path ./.venv)" export ANSIBLE_COLLECTIONS_PATH=$(expand_path ./.venv/galaxy) export ANSIBLE_ROLES_PATH=$(expand_path ./.venv/galaxy/ansible_roles) export ANSIBLE_VARS_ENABLED="host_group_vars,community.sops.sops" +export ANSIBLE_LOCALHOST_WARNING="False" +export ANSIBLE_INVENTORY_UNPARSED_WARNING="False" export K8S_AUTH_KUBECONFIG="$(expand_path ./kubeconfig)" # k0s export DISABLE_TELEMETRY="true" diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 0c41e038..57557007 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -2,6 +2,7 @@ name: "e2e" on: + workflow_dispatch: pull_request: branches: ["main"] @@ -10,35 +11,66 @@ concurrency: cancel-in-progress: true jobs: - e2e: - name: e2e + e2e-yay: + name: e2e-yay + runs-on: ubuntu-latest + container: + image: greyltc/archlinux-aur:yay + options: --user root + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Test Arch dependencies + shell: bash + run: >- + sudo -E -u ab -D~ bash -c ' + cd $GITHUB_WORKSPACE; + yay -Syu --needed --noconfirm --noprogressbar go-task; + go-task workstation:yay + ' + + e2e-configure: + name: e2e-configure runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v4 + - name: Setup Homebrew + id: setup-homebrew + uses: Homebrew/actions/setup-homebrew@master + - name: Setup Python uses: actions/setup-python@v5 id: setup-python with: python-version: "3.12" + - name: Cache homebrew packages + if: ${{ github.event_name == 'pull_request' }} + uses: actions/cache@v3 + id: cache-homebrew-packages + with: + key: homebrew-${{ runner.os }}-${{ steps.setup-homebrew.outputs.gems-hash }}-${{ hashFiles('.taskfiles/Workstation/Brewfile') }} + path: /home/linuxbrew/.linuxbrew + - name: Cache venv + if: ${{ github.event_name == 'pull_request' }} uses: actions/cache@v3 with: key: venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('requirements.txt', 'requirements.yaml') }} path: .venv - - name: Setup Homebrew - uses: Homebrew/actions/setup-homebrew@master - - name: Setup Workflow Tools + if: ${{ github.event_name == 'pull_request' && steps.cache-homebrew-packages.outputs.cache-hit != 'true' }} shell: bash run: brew install go-task - name: Install Brew dependencies + if: ${{ github.event_name == 'pull_request' && steps.cache-homebrew-packages.outputs.cache-hit != 'true' }} shell: bash - run: task brew:deps + run: task workstation:brew - name: Initialize Direnv shell: bash @@ -46,13 +78,13 @@ jobs: - name: Initialize Sops Age key shell: bash - run: task sops:init + run: task sops:age-keygen - name: Install Ansible dependencies shell: bash - run: task ansible:deps + run: task ansible:deps force=false - - name: Initialize config + - name: Generate bootstrap config file shell: bash run: | task init @@ -65,7 +97,11 @@ jobs: shell: bash run: task --yes configure - - name: List Hosts + - name: Run kubeconform + shell: bash + run: ./scripts/kubeconform.sh ./kubernetes + + - name: List Hosts with Ansible shell: bash run: task ansible:list diff --git a/.gitignore b/.gitignore index 0aec0a75..c8699cb7 100644 --- a/.gitignore +++ b/.gitignore @@ -14,6 +14,8 @@ kubeconfig .venv* # Taskfile .task +# Brew +Brewfile.lock.json # intellij .idea # wiki diff --git a/.taskfiles/AnsibleTasks.yaml b/.taskfiles/Ansible/Taskfile.yaml similarity index 62% rename from .taskfiles/AnsibleTasks.yaml rename to .taskfiles/Ansible/Taskfile.yaml index 4b3169a1..f92eb45d 100644 --- a/.taskfiles/AnsibleTasks.yaml +++ b/.taskfiles/Ansible/Taskfile.yaml @@ -4,6 +4,7 @@ version: "3" vars: PYTHON_BIN: python3 + ANSIBLE_INVENTORY_FILE: "{{.ANSIBLE_DIR}}/inventory/hosts.yaml" env: PATH: "{{.ROOT_DIR}}/.venv/bin:$PATH" @@ -11,6 +12,8 @@ env: ANSIBLE_COLLECTIONS_PATH: "{{.ROOT_DIR}}/.venv/galaxy" ANSIBLE_ROLES_PATH: "{{.ROOT_DIR}}/.venv/galaxy/ansible_roles" ANSIBLE_VARS_ENABLED: "host_group_vars,community.sops.sops" + ANSIBLE_LOCALHOST_WARNING: "False" + ANSIBLE_INVENTORY_UNPARSED_WARNING: "False" tasks: @@ -18,6 +21,8 @@ tasks: desc: Set up Ansible dependencies for the environment cmds: - task: .venv + vars: + force: '{{.force | default "true"}}' run: desc: Run an Ansible playbook for configuring a cluster @@ -27,46 +32,53 @@ tasks: prompt: Run Ansible playbook '{{.playbook}}'... continue? deps: ["deps"] cmd: | - .venv/bin/ansible-playbook \ - --inventory {{.ANSIBLE_DIR}}/inventory/hosts.yaml \ - {{.ANSIBLE_DIR}}/playbooks/{{.playbook}}.yaml {{.CLI_ARGS}} + .venv/bin/ansible-playbook --inventory {{.ANSIBLE_INVENTORY_FILE}} \ + {{.ANSIBLE_DIR}}/playbooks/{{.playbook}}.yaml {{.CLI_ARGS}} preconditions: - { msg: "Argument (playbook) is required", sh: "test -n {{.playbook}}" } - { msg: "Venv not found", sh: "test -d {{.ROOT_DIR}}/.venv" } - - { msg: "Inventory not found", sh: "test -f {{.ANSIBLE_DIR}}/inventory/hosts.yaml" } + - { msg: "Inventory not found", sh: "test -f {{.ANSIBLE_INVENTORY_FILE}}" } - { msg: "Playbook not found", sh: "test -f {{.ANSIBLE_DIR}}/playbooks/{{.playbook}}.yaml" } poweroff: desc: Shutdown all the k8s nodes deps: ["deps"] - cmd: .venv/bin/ansible kubernetes -i {{.ANSIBLE_DIR}}/inventory/hosts.yaml -a '/usr/bin/systemctl poweroff' --become + cmd: | + .venv/bin/ansible kubernetes --inventory {{.ANSIBLE_INVENTORY_FILE}} \ + -a '/usr/bin/systemctl poweroff' --become preconditions: - { msg: "Venv not found", sh: "test -d {{.ROOT_DIR}}/.venv" } - - { msg: "Inventory not found", sh: "test -f {{.ANSIBLE_DIR}}/inventory/hosts.yaml" } + - { msg: "Inventory not found", sh: "test -f {{.ANSIBLE_INVENTORY_FILE}}" } list: desc: List all the hosts deps: ["deps"] - cmd: .venv/bin/ansible kubernetes -i {{.ANSIBLE_DIR}}/inventory/hosts.yaml --list-hosts + cmd: | + .venv/bin/ansible kubernetes --inventory {{.ANSIBLE_INVENTORY_FILE}} \ + --list-hosts preconditions: - { msg: "Venv not found", sh: "test -d {{.ROOT_DIR}}/.venv" } - - { msg: "Inventory not found", sh: "test -f {{.ANSIBLE_DIR}}/inventory/hosts.yaml" } + - { msg: "Inventory not found", sh: "test -f {{.ANSIBLE_INVENTORY_FILE}}" } ping: desc: Ping all the hosts deps: ["deps"] - cmd: .venv/bin/ansible kubernetes -i {{.ANSIBLE_DIR}}/inventory/hosts.yaml --one-line -m 'ping' + cmd: | + .venv/bin/ansible kubernetes --inventory {{.ANSIBLE_INVENTORY_FILE}} \ + --one-line -m 'ping' preconditions: - { msg: "Venv not found", sh: "test -d {{.ROOT_DIR}}/.venv" } - - { msg: "Inventory not found", sh: "test -f {{.ANSIBLE_DIR}}/inventory/hosts.yaml" } + - { msg: "Inventory not found", sh: "test -f {{.ANSIBLE_INVENTORY_FILE}}" } uptime: desc: Uptime of all the hosts deps: ["deps"] - cmd: .venv/bin/ansible kubernetes -i {{.ANSIBLE_DIR}}/inventory/hosts.yaml --one-line -a 'uptime' + cmd: | + .venv/bin/ansible kubernetes --inventory {{.ANSIBLE_INVENTORY_FILE}} \ + --one-line -a 'uptime' preconditions: - { msg: "Venv not found", sh: "test -d {{.ROOT_DIR}}/.venv" } - - { msg: "Inventory not found", sh: "test -f {{.ANSIBLE_DIR}}/inventory/hosts.yaml" } + - { msg: "Inventory not found", sh: "test -f {{.ANSIBLE_INVENTORY_FILE}}" } .venv: internal: true @@ -74,7 +86,9 @@ tasks: - true && {{.PYTHON_BIN}} -m venv {{.ROOT_DIR}}/.venv - .venv/bin/python3 -m pip install --upgrade pip setuptools wheel - .venv/bin/python3 -m pip install --upgrade --requirement "{{.ROOT_DIR}}/requirements.txt" - - .venv/bin/ansible-galaxy install --role-file "{{.ROOT_DIR}}/requirements.yaml" --force + - .venv/bin/ansible-galaxy install --role-file "{{.ROOT_DIR}}/requirements.yaml" {{if eq .force "true"}}--force{{end}} + vars: + force: '{{.force | default "true"}}' sources: - "{{.ANSIBLE_DIR}}/requirements.txt" - "{{.ANSIBLE_DIR}}/requirements.yaml" diff --git a/.taskfiles/BrewTasks.yaml b/.taskfiles/BrewTasks.yaml deleted file mode 100644 index 60a26cc5..00000000 --- a/.taskfiles/BrewTasks.yaml +++ /dev/null @@ -1,33 +0,0 @@ ---- -# yaml-language-server: $schema=https://taskfile.dev/schema.json -version: "3" - -tasks: - - deps: - desc: Install workstation dependencies with Brew - cmd: brew install {{.DEPS}} {{.CLI_ARGS}} - vars: - DEPS: >- - age - cilium-cli - cloudflared - direnv - fluxcd/tap/flux - helm - jq - k0sproject/tap/k0sctl - k9s - kubeconform - kubecolor/tap/kubecolor - kubernetes-cli - kustomize - moreutils - sops - stern - yq - preconditions: - - sh: command -v brew - msg: | - Homebrew is not installed. Using MacOS, Linux or WSL? - Head over to https://brew.sh to get up and running. diff --git a/.taskfiles/FluxTasks.yaml b/.taskfiles/Flux/Taskfile.yaml similarity index 96% rename from .taskfiles/FluxTasks.yaml rename to .taskfiles/Flux/Taskfile.yaml index 94c912dc..72c26e28 100644 --- a/.taskfiles/FluxTasks.yaml +++ b/.taskfiles/Flux/Taskfile.yaml @@ -57,7 +57,6 @@ tasks: cmd: flux reconcile --namespace flux-system kustomization cluster --with-source github-deploy-key: - cmds: - - sops --decrypt {{.KUBERNETES_DIR}}/bootstrap/github-deploy-key.sops.yaml | kubectl apply --server-side --filename - + cmd: sops --decrypt {{.KUBERNETES_DIR}}/bootstrap/github-deploy-key.sops.yaml | kubectl apply --server-side --filename - preconditions: - { msg: "Flux is not installed", sh: "kubectl get namespace flux-system &>/dev/null && exit 0 || exit 1" } diff --git a/.taskfiles/K0sTasks.yaml b/.taskfiles/K0s/Taskfile.yaml similarity index 100% rename from .taskfiles/K0sTasks.yaml rename to .taskfiles/K0s/Taskfile.yaml diff --git a/.taskfiles/KubernetesTasks.yaml b/.taskfiles/Kubernetes/Taskfile.yaml similarity index 100% rename from .taskfiles/KubernetesTasks.yaml rename to .taskfiles/Kubernetes/Taskfile.yaml diff --git a/.taskfiles/RepoTasks.yaml b/.taskfiles/Repo/Taskfile.yaml similarity index 93% rename from .taskfiles/RepoTasks.yaml rename to .taskfiles/Repo/Taskfile.yaml index d832e500..4c6792e0 100644 --- a/.taskfiles/RepoTasks.yaml +++ b/.taskfiles/Repo/Taskfile.yaml @@ -12,7 +12,7 @@ tasks: - rm -rf {{.ROOT_DIR}}/.github/workflows/e2e.yaml # Move bootstrap directory to gitignored directory - mkdir -p {{.ROOT_DIR}}/.private - - mv {{.ROOT_DIR}}/bootstrap {{.ROOT_DIR}}/.private + - mv {{.ROOT_DIR}}/bootstrap {{.ROOT_DIR}}/.private/bootstrap-{{now | date "150405"}} # Update renovate.json5 - sed -i {{if eq OS "darwin"}}''{{end}} 's/(..\.j2)\?(..\.j2)\?//g' {{.ROOT_DIR}}/.github/renovate.json5 - sed -i {{if eq OS "darwin"}}''{{end}} '/addons/d' {{.ROOT_DIR}}/.github/renovate.json5 diff --git a/.taskfiles/SopsTasks.yaml b/.taskfiles/Sops/Taskfile.yaml similarity index 91% rename from .taskfiles/SopsTasks.yaml rename to .taskfiles/Sops/Taskfile.yaml index 53906ee1..791be5c1 100644 --- a/.taskfiles/SopsTasks.yaml +++ b/.taskfiles/Sops/Taskfile.yaml @@ -4,14 +4,15 @@ version: "3" tasks: - init: - desc: Initialize Sops Age Key + age-keygen: + desc: Initialize Age Key for Sops cmd: age-keygen --output {{.ROOT_DIR}}/age.key status: - test -f "{{.ROOT_DIR}}/age.key" encrypt: desc: Encrypt a secret + aliases: ["e"] summary: | Args: file: Path to file to encrypt (required) @@ -24,6 +25,7 @@ tasks: decrypt: desc: Decrypt a secret + aliases: ["d"] summary: | Args: file: Path to file to decrypt (required) diff --git a/.taskfiles/Workstation/ArchPackages b/.taskfiles/Workstation/ArchPackages new file mode 100644 index 00000000..11e5d5d5 --- /dev/null +++ b/.taskfiles/Workstation/ArchPackages @@ -0,0 +1,17 @@ +age +cilium-cli +cloudflared-bin +direnv +flux-bin +helm +jq +k0sctl-bin +k9s +kubeconform +kubectl-bin +kustomize +moreutils +sops +stern-bin +go-task +go-yq diff --git a/.taskfiles/Workstation/Brewfile b/.taskfiles/Workstation/Brewfile new file mode 100644 index 00000000..1a3cdaf3 --- /dev/null +++ b/.taskfiles/Workstation/Brewfile @@ -0,0 +1,21 @@ +tap "fluxcd/tap" +tap "go-task/tap" +tap "k0sproject/tap" +tap "kubecolor/tap" +brew "age" +brew "cilium-cli" +brew "cloudflared" +brew "direnv" +brew "fluxcd/tap/flux" +brew "helm" +brew "jq" +brew "k0sproject/tap/k0sctl" +brew "k9s" +brew "kubeconform" +brew "kubecolor/tap/kubecolor" +brew "kubernetes-cli" +brew "kustomize" +brew "moreutils" +brew "sops" +brew "stern" +brew "yq" diff --git a/.taskfiles/Workstation/Taskfile.yaml b/.taskfiles/Workstation/Taskfile.yaml new file mode 100644 index 00000000..751605c6 --- /dev/null +++ b/.taskfiles/Workstation/Taskfile.yaml @@ -0,0 +1,25 @@ +--- +# yaml-language-server: $schema=https://taskfile.dev/schema.json +version: "3" + +tasks: + + brew: + desc: Install workstation dependencies with Brew + cmd: brew bundle --file {{.ROOT_DIR}}/.taskfiles/Workstation/Brewfile + preconditions: + - sh: command -v brew + msg: | + Homebrew is not installed. Using MacOS, Linux or WSL? + Head over to https://brew.sh to get up and running. + - { msg: "Brewfile not found", sh: "test -f {{.ROOT_DIR}}/.taskfiles/Workstation/Brewfile" } + + yay: + desc: Install workstation dependencies with Paru + cmd: yay -Syu --needed --noconfirm --noprogressbar $(cat {{.ROOT_DIR}}/.taskfiles/Workstation/ArchPackages | xargs) + preconditions: + - sh: command -v yay + msg: | + Yay is not installed. Using ArchLinux? + Head over to https://github.com/Jguer/yay to get up and running. + - { msg: "ArchPackages not found", sh: "test -f {{.ROOT_DIR}}/.taskfiles/Workstation/ArchPackages" } diff --git a/README.md b/README.md index 2f73352c..b5465870 100644 --- a/README.md +++ b/README.md @@ -144,8 +144,13 @@ Once you have installed Debian on your nodes, there are six stages to getting a 1. Install the most recent version of [task](https://taskfile.dev/), see the [installation docs](https://taskfile.dev/installation/) for other supported platforms. + 📍 _If using **ArchLinux** the `task` command is `go-task` in your shell_ + ```sh + # Homebrew brew install go-task + # Arch / Yay + yay -S go-task ``` 2. Install the most recent version of [direnv](https://direnv.net/), see the [installation docs](https://direnv.net/docs/installation.html) for other supported platforms. @@ -153,25 +158,31 @@ Once you have installed Debian on your nodes, there are six stages to getting a 📍 _After installing `direnv` be sure to **[hook it into your shell](https://direnv.net/docs/hook.html)** and after that is done run `direnv allow` while in your repos' directory._ ```sh + # Homebrew brew install direnv + # or, Arch / Yay + yay -S direnv ``` -3. Setup a Python virual env and install Ansible by running the following task command. +3. Install additional tools: [age](https://github.com/FiloSottile/age), [flux](https://toolkit.fluxcd.io/), [cloudflared](https://github.com/cloudflare/cloudflared), [kubectl](https://kubernetes.io/docs/tasks/tools/), [sops](https://github.com/getsops/sops) - 📍 _This commands requires Python 3.10+ to be installed_ + 📍 _Not using Homebrew or ArchLinux? Make sure to look up how to install the latest version of each of these CLI tools and install them._ + + ```sh + # Homebrew + task workstation:brew + # or, Arch / Paru + go-task workstation:yay + ``` + +4. Setup a Python virual env and install Ansible by running the following task command. + + 📍 _This commands requires Python 3.10+ to be installed._ ```sh task ansible:deps ``` -4. Install the required tools: [age](https://github.com/FiloSottile/age), [flux](https://toolkit.fluxcd.io/), [cloudflared](https://github.com/cloudflare/cloudflared), [kubectl](https://kubernetes.io/docs/tasks/tools/), [sops](https://github.com/getsops/sops), [kubeconform](https://github.com/yannh/kubeconform), [kustomize](https://github.com/kubernetes-sigs/kustomize) - - 📍 _Not using brew? Make sure to look up how to install the latest version of each of these CLI tools yourself._ - - ```sh - task brew:deps - ``` - ### 🔧 Stage 3: Do bootstrap configuration 📍 _Both `bootstrap/vars/config.yaml` and `bootstrap/vars/addons.yaml` files contain necessary information that is **vital** to the bootstrap process._ @@ -191,7 +202,7 @@ Once you have installed Debian on your nodes, there are six stages to getting a 3a. Create a Age private / public key (this file is gitignored) ```sh - age-keygen -o age.key + task sops:age-keygen ``` 3b. Fill out the appropriate vars in `bootstrap/vars/config.yaml` @@ -300,17 +311,12 @@ Once you have installed Debian on your nodes, there are six stages to getting a 3. Install Kubernetes depending on the distribution you chose - * Install k3s - - ```sh - task ansible:run playbook=cluster-installation - ``` - - * Install k0s - - ```sh - task k0s:apply - ``` + ```sh + # Install k3s + task ansible:run playbook=cluster-installation + # or, install k0s + task k0s:apply + ``` 4. Verify the nodes are online @@ -444,17 +450,12 @@ By default Flux will periodically check your git repository for changes. In orde There might be a situation where you want to destroy your Kubernetes cluster. This will completely clean the OS of all traces of the Kubernetes distribution you chose and then reboot the nodes. -* Nuke k3s - - ```sh - task ansible:run playbook=cluster-nuke - ``` - -* Nuke k0s - - ```sh - task k0s:reset - ``` +```sh +# Nuke k3s +task ansible:run playbook=cluster-nuke +# or, Nuke k0s +task k0s:reset +``` ### 🤖 Renovate @@ -617,6 +618,14 @@ The benefits of a public repository include: +## Related Projects + +If this repo is too hot to handle or too cold to hold check out these following projects. + +- [danmanners/aws-argo-cluster-template](https://github.com/danmanners/aws-argo-cluster-template) - _A community opinionated template for deploying Kubernetes clusters on-prem and in AWS using Pulumi, SOPS, Sealed Secrets, GitHub Actions, Renovate, Cilium and more!_ +- [ricsanfre/pi-cluster](https://github.com/ricsanfre/pi-cluster) - _Pi Kubernetes Cluster. Homelab kubernetes cluster automated with Ansible and ArgoCD_ +- [techno-tim/k3s-ansible](https://github.com/techno-tim/k3s-ansible) - _The easiest way to bootstrap a self-hosted High Availability Kubernetes cluster. A fully automated HA k3s etcd install with kube-vip, MetalLB, and more_ + ## 🤝 Thanks Big shout out to all the contributors, sponsors and everyone else who has helped on this project. diff --git a/Taskfile.yaml b/Taskfile.yaml index 2689b402..6f4c468e 100644 --- a/Taskfile.yaml +++ b/Taskfile.yaml @@ -11,15 +11,15 @@ env: KUBECONFIG: "{{.ROOT_DIR}}/kubeconfig" includes: - ansible: .taskfiles/AnsibleTasks.yaml - brew: .taskfiles/BrewTasks.yaml + ansible: .taskfiles/Ansible/Taskfile.yaml kubernetes: aliases: ["k8s"] - taskfile: .taskfiles/KubernetesTasks.yaml - flux: .taskfiles/FluxTasks.yaml - k0s: .taskfiles/K0sTasks.yaml - repo: .taskfiles/RepoTasks.yaml - sops: .taskfiles/SopsTasks.yaml + taskfile: .taskfiles/Kubernetes/Taskfile.yaml + flux: .taskfiles/Flux/Taskfile.yaml + k0s: .taskfiles/K0s/Taskfile.yaml + repo: .taskfiles/Repo/Taskfile.yaml + sops: .taskfiles/Sops/Taskfile.yaml + workstation: .taskfiles/Workstation/Taskfile.yaml tasks: @@ -47,8 +47,6 @@ tasks: configure: desc: Configure repository from Ansible vars prompt: Any conflicting config in the root kubernetes and ansible directories will be overwritten... continue? - cmds: - - ./.venv/bin/ansible-playbook {{.BOOTSTRAP_DIR}}/configure.yaml - - ./scripts/kubeconform.sh {{.KUBERNETES_DIR}} + cmd: ./.venv/bin/ansible-playbook {{.BOOTSTRAP_DIR}}/configure.yaml env: ANSIBLE_DISPLAY_SKIPPED_HOSTS: "false"