feat!: Refector directories and flux apps (#559)

This commit is contained in:
Devin Buhl authored and GitHub committed 2022-12-21 14:22:18 -05:00
1 parent a43e2325f1
commit 4e6edcc66a
163 files changed
+1194 -1060

No files matched your search

@@ -0,0 +1,60 @@
---
#
# Below vars are for the xanmanning.k3s role
# ...see https://github.com/PyratLabs/ansible-role-k3s
#
# (string) Use a specific version of k3s
# renovate: datasource=github-releases depName=k3s-io/k3s
k3s_release_version: "v1.24.8+k3s1"
# (bool) Install using hard links rather than symbolic links.
k3s_install_hard_links: true
# (bool) Escalate user privileges for all tasks
k3s_become: true
# (bool) Enable debug logging on the k3s service
k3s_debug: false
# (bool) Enable etcd embedded datastore
k3s_etcd_datastore: true
# (bool) Allow the use of unsupported configurations in k3s
k3s_use_unsupported_config: true
# (string) Control Plane registration address
k3s_registration_address: "{{ kubevip_address }}"
# (list) A list of URLs to deploy on the primary control plane. Read notes below.
k3s_server_manifests_urls:
# Kube-vip
- url: https://kube-vip.io/manifests/rbac.yaml
filename: kube-vip-rbac.yaml
# Tigera Operator
# https://github.com/projectcalico/calico/issues/7003
- url: https://raw.githubusercontent.com/projectcalico/calico/v3.24.2/manifests/tigera-operator.yaml
filename: tigera-operator.yaml
# Prometheus Operator
- url: https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.60.1/example/prometheus-operator-crd/monitoring.coreos.com_alertmanagerconfigs.yaml
filename: alertmanagerconfigs.yaml
- url: https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.60.1/example/prometheus-operator-crd/monitoring.coreos.com_alertmanagers.yaml
filename: alertmanagers.yaml
- url: https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.60.1/example/prometheus-operator-crd/monitoring.coreos.com_podmonitors.yaml
filename: podmonitors.yaml
- url: https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.60.1/example/prometheus-operator-crd/monitoring.coreos.com_probes.yaml
filename: probes.yaml
- url: https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.60.1/example/prometheus-operator-crd/monitoring.coreos.com_prometheuses.yaml
filename: prometheuses.yaml
- url: https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.60.1/example/prometheus-operator-crd/monitoring.coreos.com_prometheusrules.yaml
filename: prometheusrules.yaml
- url: https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.60.1/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml
filename: servicemonitors.yaml
- url: https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.60.1/example/prometheus-operator-crd/monitoring.coreos.com_thanosrulers.yaml
filename: thanosrulers.yaml
# (list) A flat list of templates to deploy on the primary control plane
# /var/lib/rancher/k3s/server/manifests
k3s_server_manifests_templates:
- calico-installation.yaml.j2
- kube-vip-daemonset.yaml.j2
@@ -0,0 +1,35 @@
---
# (string) Timezone for the servers
# timezone: "America/New_York"
# (list) Additional ssh public keys to add to the nodes
# ssh_authorized_keys:
fedora:
packages:
- dnf-plugin-system-upgrade
- dnf-utils
- hdparm
- htop
- intel-gpu-tools
- ipvsadm
- lm_sensors
- nano
- nvme-cli
- socat
- python3-kubernetes
- python3-libselinux
- python3-pyyaml
ubuntu:
packages:
- hdparm
- htop
- intel-gpu-tools
- ipvsadm
- lm-sensors
- nano
- nvme-cli
- socat
- python3-kubernetes
- python3-yaml
@@ -0,0 +1,45 @@
---
# https://rancher.com/docs/k3s/latest/en/installation/install-options/server-config/
# https://github.com/PyratLabs/ansible-role-k3s
# (bool) Specify if a host (or host group) are part of the control plane
k3s_control_node: true
# (dict) k3s settings for all control-plane nodes
k3s_server:
node-ip: "{{ ansible_host }}"
tls-san:
- "{{ kubevip_address }}"
# Disable Docker - this will use the default containerd CRI
docker: false
flannel-backend: "none" # This needs to be in quotes
disable:
# Disable flannel - replaced with Calico
- flannel
# Disable traefik - replaced with ingress-nginx
- traefik
# Disable servicelb - replaced with metallb and install with Flux
- servicelb
# Disable metrics-server - installed with Flux
- metrics-server
disable-network-policy: true
disable-cloud-controller: true
write-kubeconfig-mode: "644"
# Network CIDR to use for pod IPs
cluster-cidr: "10.42.0.0/16"
# Network CIDR to use for service IPs
service-cidr: "10.43.0.0/16"
kube-controller-manager-arg:
# Required to monitor kube-controller-manager with kube-prometheus-stack
- "bind-address=0.0.0.0"
kube-proxy-arg:
# Required to monitor kube-proxy with kube-prometheus-stack
- "metrics-bind-address=0.0.0.0"
kube-scheduler-arg:
# Required to monitor kube-scheduler with kube-prometheus-stack
- "bind-address=0.0.0.0"
# Required to monitor etcd with kube-prometheus-stack
etcd-expose-metrics: true
kube-apiserver-arg:
# Required for HAProxy health-checks
- "anonymous-auth=true"
@@ -0,0 +1,10 @@
---
# https://rancher.com/docs/k3s/latest/en/installation/install-options/agent-config/
# https://github.com/PyratLabs/ansible-role-k3s
# (bool) Specify if a host (or host group) are part of the control plane
k3s_control_node: false
# (dict) k3s settings for all worker nodes
k3s_agent:
node-ip: "{{ ansible_host }}"
Whitespace-only changes.
+119
View File
@@ -0,0 +1,119 @@
---
- hosts:
- master
- worker
become: true
gather_facts: true
any_errors_fatal: true
pre_tasks:
- name: Pausing for 5 seconds...
ansible.builtin.pause:
seconds: 5
tasks:
- name: Check if cluster is installed
check_mode: false
ansible.builtin.stat:
path: "/etc/rancher/k3s/config.yaml"
register: k3s_check_installed
- name: Set manifest facts
ansible.builtin.set_fact:
k3s_server_manifests_templates: []
k3s_server_manifests_urls: []
when: k3s_check_installed.stat.exists
- name: Install Kubernetes
ansible.builtin.include_role:
name: xanmanning.k3s
public: true
vars:
k3s_state: installed
- name: Get absolute path to this Git repository
delegate_to: localhost
become: false
run_once: true
check_mode: false
ansible.builtin.command: |-
git rev-parse --show-toplevel
register: repo_abs_path
- name: Copy kubeconfig project directory
run_once: true
ansible.builtin.fetch:
src: "/etc/rancher/k3s/k3s.yaml"
dest: "{{ repo_abs_path.stdout }}/kubeconfig"
flat: true
when:
- k3s_control_node is defined
- k3s_control_node
- name: Update kubeconfig with the correct IPv4 address
delegate_to: localhost
become: false
run_once: true
ansible.builtin.replace:
path: "{{ repo_abs_path.stdout }}/kubeconfig"
regexp: "https://127.0.0.1:6443"
replace: "https://{{ k3s_registration_address }}:6443"
- name: Resource Readiness Check
run_once: true
kubernetes.core.k8s_info:
kubeconfig: /etc/rancher/k3s/k3s.yaml
kind: "{{ item.kind }}"
name: "{{ item.name }}"
namespace: "{{ item.namespace | default('') }}"
wait: true
wait_sleep: 10
wait_timeout: 360
loop:
- kind: Deployment
name: tigera-operator
namespace: tigera-operator
- kind: DaemonSet
name: kube-vip
namespace: kube-system
- kind: Installation
name: default
- kind: CustomResourceDefinition
name: alertmanagerconfigs.monitoring.coreos.com
- kind: CustomResourceDefinition
name: alertmanagers.monitoring.coreos.com
- kind: CustomResourceDefinition
name: podmonitors.monitoring.coreos.com
- kind: CustomResourceDefinition
name: probes.monitoring.coreos.com
- kind: CustomResourceDefinition
name: prometheuses.monitoring.coreos.com
- kind: CustomResourceDefinition
name: prometheusrules.monitoring.coreos.com
- kind: CustomResourceDefinition
name: servicemonitors.monitoring.coreos.com
- kind: CustomResourceDefinition
name: thanosrulers.monitoring.coreos.com
when:
- k3s_server_manifests_templates | length > 0
or k3s_server_manifests_urls | length > 0
- k3s_control_node is defined
- k3s_control_node
# Cleaning up the manifests from the /var/lib/rancher/k3s/server/manifests
# directory is needed because k3s has an awesome "feature" to always deploy
# these on restarting the k3s systemd service. Removing them does NOT
# uninstall the manifests.
# Removing them means we can manage the lifecycle of these components
# outside of the /var/lib/rancher/k3s/server/manifests directory
- name: Remove deployed manifest templates
ansible.builtin.file:
path: "{{ k3s_server_manifests_dir }}/{{ item | basename | regex_replace('\\.j2$', '') }}"
state: absent
loop: "{{ k3s_server_manifests_templates | default([]) }}"
- name: Remove deployed manifest urls
ansible.builtin.file:
path: "{{ k3s_server_manifests_dir }}/{{ item.filename }}"
state: absent
loop: "{{ k3s_server_manifests_urls | default([]) }}"
+41
View File
@@ -0,0 +1,41 @@
---
- hosts:
- master
- worker
become: true
gather_facts: true
any_errors_fatal: true
vars_prompt:
- name: nuke
prompt: |-
Are you sure you want to nuke this cluster?
Type YES I WANT TO DESTROY THIS CLUSTER to proceed
default: "n"
private: false
pre_tasks:
- name: Check for confirmation
ansible.builtin.fail:
msg: Aborted nuking the cluster
when: nuke != 'YES I WANT TO DESTROY THIS CLUSTER'
- name: Pausing for 5 seconds...
ansible.builtin.pause:
seconds: 5
tasks:
- name: Uninstall k3s
ansible.builtin.include_role:
name: xanmanning.k3s
public: true
vars:
k3s_state: uninstalled
- name: Gather list of CNI files
ansible.builtin.find:
paths: /etc/cni/net.d
patterns: "*"
hidden: true
register: directory_contents
- name: Delete CNI files
ansible.builtin.file:
path: "{{ item.path }}"
state: absent
loop: "{{ directory_contents.files }}"
+135
View File
@@ -0,0 +1,135 @@
---
- hosts:
- master
- worker
become: true
gather_facts: true
any_errors_fatal: true
pre_tasks:
- name: Pausing for 5 seconds...
ansible.builtin.pause:
seconds: 5
tasks:
- name: Locale
block:
- name: Locale | Set timezone
community.general.timezone:
name: "{{ timezone | default('Etc/UTC') }}"
- name: Networking
block:
- name: Networking | Set hostname to inventory hostname
ansible.builtin.hostname:
name: "{{ inventory_hostname }}"
- name: Networking | Update /etc/hosts to include inventory hostname
ansible.builtin.blockinfile:
path: /etc/hosts
block: |
127.0.1.1 {{ inventory_hostname }}
- name: Packages | Fedora
block:
- name: Packages | Install required packages
ansible.builtin.dnf:
name: "{{ fedora.packages | default([]) }}"
state: present
update_cache: true
- name: Packages | Remove leaf packages
ansible.builtin.dnf:
autoremove: true
when: ansible_facts['distribution'] == 'Fedora'
- name: Packages | Ubuntu
block:
- name: Packages | Install required packages
ansible.builtin.apt:
name: "{{ ubuntu.packages | default([]) }}"
state: present
update_cache: true
- name: Packages | Remove leaf packages
ansible.builtin.apt:
autoremove: true
when: ansible_facts['distribution'] == 'Ubuntu'
- name: User Configuration
block:
- name: User Configuration | Add additional SSH public keys
ansible.posix.authorized_key:
user: "{{ ansible_user }}"
key: "{{ item }}"
loop: "{{ public_ssh_keys | default([]) }}"
- name: System Configuration (1)
block:
- name: System Configuration (1) | Disable firewalld | Fedora
ansible.builtin.systemd:
service: firewalld.service
enabled: false
masked: true
state: stopped
when: ansible_facts['distribution'] == 'Fedora'
- name: System Configuration (1) | Disable ufw | Ubuntu
ansible.builtin.systemd:
service: ufw.service
enabled: false
masked: true
state: stopped
when: ansible_facts['distribution'] == 'Ubuntu'
- name: System Configuration (1) | Enable fstrim
ansible.builtin.systemd:
service: fstrim.timer
enabled: true
- name: System Configuration (2)
block:
- name: System Configuration (2) | Enable kernel modules now
community.general.modprobe:
name: "{{ item }}"
state: present
loop: [br_netfilter, overlay, rbd]
- name: System Configuration (2) | Enable kernel modules on boot
ansible.builtin.copy:
mode: 0644
content: "{{ item }}"
dest: "/etc/modules-load.d/{{ item }}.conf"
loop: [br_netfilter, overlay, rbd]
- name: System Configuration (2) | Set sysctls
ansible.posix.sysctl:
name: "{{ item.key }}"
value: "{{ item.value }}"
sysctl_file: /etc/sysctl.d/99-kubernetes.conf
reload: true
with_dict: "{{ sysctl_config }}"
vars:
sysctl_config:
net.ipv4.ip_forward: 1
net.ipv4.conf.all.forwarding: 1
net.ipv4.conf.all.rp_filter: 0
net.ipv4.conf.default.rp_filter: 0
net.ipv6.conf.all.forwarding: 1
net.bridge.bridge-nf-call-iptables: 1
net.bridge.bridge-nf-call-ip6tables: 1
fs.inotify.max_user_watches: 524288
fs.inotify.max_user_instances: 512
- name: System Configuration (2) | Disable swap | Fedora
ansible.builtin.dnf:
name: zram-generator-defaults
state: absent
when: ansible_facts['distribution'] == 'Fedora'
- name: System Configuration (2) | Disable swap at runtime | Ubuntu
ansible.builtin.command: swapoff -a
when:
- ansible_facts['distribution'] == 'Ubuntu'
- ansible_swaptotal_mb > 0
- name: System Configuration (2) | Disable swap at boot | Ubuntu
ansible.posix.mount:
name: "{{ item }}"
fstype: swap
state: absent
loop: ["none", "swap"]
when: ansible_facts['distribution'] == 'Ubuntu'
- name: System Configuration (2) | Permissive SELinux | Fedora
ansible.posix.selinux:
state: permissive
policy: targeted
when: ansible_facts['distribution'] == 'Fedora'
notify: Reboot
handlers:
- name: Reboot
ansible.builtin.reboot:
msg: Rebooting nodes
+15
View File
@@ -0,0 +1,15 @@
---
- hosts:
- master
- worker
become: true
gather_facts: true
any_errors_fatal: true
pre_tasks:
- name: Pausing for 5 seconds...
ansible.builtin.pause:
seconds: 5
tasks:
- name: Reboot
ansible.builtin.reboot:
msg: Rebooting nodes
@@ -0,0 +1,22 @@
---
apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
name: default
spec:
registry: quay.io
imagePath: calico
calicoNetwork:
# https://projectcalico.docs.tigera.io/networking/ip-autodetection
nodeAddressAutodetectionV4:
cidrs:
- "{{ (ansible_default_ipv4.network + '/' + ansible_default_ipv4.netmask) | ansible.utils.ipaddr('network/prefix') }}"
# Note: The ipPools section cannot be modified post-install.
ipPools:
- blockSize: 26
cidr: "{{ k3s_server['cluster-cidr'] }}"
encapsulation: "VXLANCrossSubnet"
natOutgoing: Enabled
nodeSelector: all()
nodeMetricsPort: 9091
typhaMetricsPort: 9093
@@ -0,0 +1,72 @@
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: kube-vip
namespace: kube-system
labels:
app.kubernetes.io/instance: kube-vip
app.kubernetes.io/name: kube-vip
spec:
selector:
matchLabels:
app.kubernetes.io/instance: kube-vip
app.kubernetes.io/name: kube-vip
template:
metadata:
labels:
app.kubernetes.io/instance: kube-vip
app.kubernetes.io/name: kube-vip
spec:
containers:
- name: kube-vip
image: ghcr.io/kube-vip/kube-vip:v0.5.7
imagePullPolicy: IfNotPresent
args: ["manager"]
env:
- name: vip_arp
value: "true"
- name: port
value: "6443"
- name: vip_cidr
value: "32"
- name: cp_enable
value: "true"
- name: cp_namespace
value: kube-system
- name: svc_enable
value: "false"
- name: vip_leaderelection
value: "true"
- name: vip_leaseduration
value: "15"
- name: vip_renewdeadline
value: "10"
- name: vip_retryperiod
value: "2"
- name: address
value: "{{ k3s_registration_address }}"
securityContext:
capabilities:
add: ["NET_ADMIN", "NET_RAW"]
hostAliases:
- hostnames:
- kubernetes
ip: 127.0.0.1
hostNetwork: true
serviceAccountName: kube-vip
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: node-role.kubernetes.io/master
operator: Exists
- matchExpressions:
- key: node-role.kubernetes.io/control-plane
operator: Exists
tolerations:
- effect: NoSchedule
operator: Exists
- effect: NoExecute
operator: Exists
+16
View File
@@ -0,0 +1,16 @@
---
collections:
- name: community.general
version: 6.1.0
- name: community.sops
version: 1.5.0
- name: ansible.posix
version: 1.4.0
- name: ansible.utils
version: 2.8.0
- name: kubernetes.core
version: 2.3.2
roles:
- name: xanmanning.k3s
src: https://github.com/PyratLabs/ansible-role-k3s.git
version: v3.3.1