feat!: Refector directories and flux apps (#559)
This commit is contained in:
Devin Buhl authored and GitHub committed
1 parent
a43e2325f1
commit
4e6edcc66a
163 files changed
+1194
-1060
No files matched your search
@@ -0,0 +1,119 @@
|
||||
---
|
||||
- hosts:
|
||||
- master
|
||||
- worker
|
||||
become: true
|
||||
gather_facts: true
|
||||
any_errors_fatal: true
|
||||
pre_tasks:
|
||||
- name: Pausing for 5 seconds...
|
||||
ansible.builtin.pause:
|
||||
seconds: 5
|
||||
tasks:
|
||||
- name: Check if cluster is installed
|
||||
check_mode: false
|
||||
ansible.builtin.stat:
|
||||
path: "/etc/rancher/k3s/config.yaml"
|
||||
register: k3s_check_installed
|
||||
|
||||
- name: Set manifest facts
|
||||
ansible.builtin.set_fact:
|
||||
k3s_server_manifests_templates: []
|
||||
k3s_server_manifests_urls: []
|
||||
when: k3s_check_installed.stat.exists
|
||||
|
||||
- name: Install Kubernetes
|
||||
ansible.builtin.include_role:
|
||||
name: xanmanning.k3s
|
||||
public: true
|
||||
vars:
|
||||
k3s_state: installed
|
||||
|
||||
- name: Get absolute path to this Git repository
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
run_once: true
|
||||
check_mode: false
|
||||
ansible.builtin.command: |-
|
||||
git rev-parse --show-toplevel
|
||||
register: repo_abs_path
|
||||
|
||||
- name: Copy kubeconfig project directory
|
||||
run_once: true
|
||||
ansible.builtin.fetch:
|
||||
src: "/etc/rancher/k3s/k3s.yaml"
|
||||
dest: "{{ repo_abs_path.stdout }}/kubeconfig"
|
||||
flat: true
|
||||
when:
|
||||
- k3s_control_node is defined
|
||||
- k3s_control_node
|
||||
|
||||
- name: Update kubeconfig with the correct IPv4 address
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
run_once: true
|
||||
ansible.builtin.replace:
|
||||
path: "{{ repo_abs_path.stdout }}/kubeconfig"
|
||||
regexp: "https://127.0.0.1:6443"
|
||||
replace: "https://{{ k3s_registration_address }}:6443"
|
||||
|
||||
- name: Resource Readiness Check
|
||||
run_once: true
|
||||
kubernetes.core.k8s_info:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
kind: "{{ item.kind }}"
|
||||
name: "{{ item.name }}"
|
||||
namespace: "{{ item.namespace | default('') }}"
|
||||
wait: true
|
||||
wait_sleep: 10
|
||||
wait_timeout: 360
|
||||
loop:
|
||||
- kind: Deployment
|
||||
name: tigera-operator
|
||||
namespace: tigera-operator
|
||||
- kind: DaemonSet
|
||||
name: kube-vip
|
||||
namespace: kube-system
|
||||
- kind: Installation
|
||||
name: default
|
||||
- kind: CustomResourceDefinition
|
||||
name: alertmanagerconfigs.monitoring.coreos.com
|
||||
- kind: CustomResourceDefinition
|
||||
name: alertmanagers.monitoring.coreos.com
|
||||
- kind: CustomResourceDefinition
|
||||
name: podmonitors.monitoring.coreos.com
|
||||
- kind: CustomResourceDefinition
|
||||
name: probes.monitoring.coreos.com
|
||||
- kind: CustomResourceDefinition
|
||||
name: prometheuses.monitoring.coreos.com
|
||||
- kind: CustomResourceDefinition
|
||||
name: prometheusrules.monitoring.coreos.com
|
||||
- kind: CustomResourceDefinition
|
||||
name: servicemonitors.monitoring.coreos.com
|
||||
- kind: CustomResourceDefinition
|
||||
name: thanosrulers.monitoring.coreos.com
|
||||
when:
|
||||
- k3s_server_manifests_templates | length > 0
|
||||
or k3s_server_manifests_urls | length > 0
|
||||
- k3s_control_node is defined
|
||||
- k3s_control_node
|
||||
|
||||
# Cleaning up the manifests from the /var/lib/rancher/k3s/server/manifests
|
||||
# directory is needed because k3s has an awesome "feature" to always deploy
|
||||
# these on restarting the k3s systemd service. Removing them does NOT
|
||||
# uninstall the manifests.
|
||||
|
||||
# Removing them means we can manage the lifecycle of these components
|
||||
# outside of the /var/lib/rancher/k3s/server/manifests directory
|
||||
|
||||
- name: Remove deployed manifest templates
|
||||
ansible.builtin.file:
|
||||
path: "{{ k3s_server_manifests_dir }}/{{ item | basename | regex_replace('\\.j2$', '') }}"
|
||||
state: absent
|
||||
loop: "{{ k3s_server_manifests_templates | default([]) }}"
|
||||
|
||||
- name: Remove deployed manifest urls
|
||||
ansible.builtin.file:
|
||||
path: "{{ k3s_server_manifests_dir }}/{{ item.filename }}"
|
||||
state: absent
|
||||
loop: "{{ k3s_server_manifests_urls | default([]) }}"
|
||||
@@ -0,0 +1,41 @@
|
||||
---
|
||||
- hosts:
|
||||
- master
|
||||
- worker
|
||||
become: true
|
||||
gather_facts: true
|
||||
any_errors_fatal: true
|
||||
vars_prompt:
|
||||
- name: nuke
|
||||
prompt: |-
|
||||
Are you sure you want to nuke this cluster?
|
||||
Type YES I WANT TO DESTROY THIS CLUSTER to proceed
|
||||
default: "n"
|
||||
private: false
|
||||
pre_tasks:
|
||||
- name: Check for confirmation
|
||||
ansible.builtin.fail:
|
||||
msg: Aborted nuking the cluster
|
||||
when: nuke != 'YES I WANT TO DESTROY THIS CLUSTER'
|
||||
|
||||
- name: Pausing for 5 seconds...
|
||||
ansible.builtin.pause:
|
||||
seconds: 5
|
||||
tasks:
|
||||
- name: Uninstall k3s
|
||||
ansible.builtin.include_role:
|
||||
name: xanmanning.k3s
|
||||
public: true
|
||||
vars:
|
||||
k3s_state: uninstalled
|
||||
- name: Gather list of CNI files
|
||||
ansible.builtin.find:
|
||||
paths: /etc/cni/net.d
|
||||
patterns: "*"
|
||||
hidden: true
|
||||
register: directory_contents
|
||||
- name: Delete CNI files
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.path }}"
|
||||
state: absent
|
||||
loop: "{{ directory_contents.files }}"
|
||||
@@ -0,0 +1,135 @@
|
||||
---
|
||||
- hosts:
|
||||
- master
|
||||
- worker
|
||||
become: true
|
||||
gather_facts: true
|
||||
any_errors_fatal: true
|
||||
pre_tasks:
|
||||
- name: Pausing for 5 seconds...
|
||||
ansible.builtin.pause:
|
||||
seconds: 5
|
||||
tasks:
|
||||
- name: Locale
|
||||
block:
|
||||
- name: Locale | Set timezone
|
||||
community.general.timezone:
|
||||
name: "{{ timezone | default('Etc/UTC') }}"
|
||||
- name: Networking
|
||||
block:
|
||||
- name: Networking | Set hostname to inventory hostname
|
||||
ansible.builtin.hostname:
|
||||
name: "{{ inventory_hostname }}"
|
||||
- name: Networking | Update /etc/hosts to include inventory hostname
|
||||
ansible.builtin.blockinfile:
|
||||
path: /etc/hosts
|
||||
block: |
|
||||
127.0.1.1 {{ inventory_hostname }}
|
||||
- name: Packages | Fedora
|
||||
block:
|
||||
- name: Packages | Install required packages
|
||||
ansible.builtin.dnf:
|
||||
name: "{{ fedora.packages | default([]) }}"
|
||||
state: present
|
||||
update_cache: true
|
||||
- name: Packages | Remove leaf packages
|
||||
ansible.builtin.dnf:
|
||||
autoremove: true
|
||||
when: ansible_facts['distribution'] == 'Fedora'
|
||||
- name: Packages | Ubuntu
|
||||
block:
|
||||
- name: Packages | Install required packages
|
||||
ansible.builtin.apt:
|
||||
name: "{{ ubuntu.packages | default([]) }}"
|
||||
state: present
|
||||
update_cache: true
|
||||
- name: Packages | Remove leaf packages
|
||||
ansible.builtin.apt:
|
||||
autoremove: true
|
||||
when: ansible_facts['distribution'] == 'Ubuntu'
|
||||
- name: User Configuration
|
||||
block:
|
||||
- name: User Configuration | Add additional SSH public keys
|
||||
ansible.posix.authorized_key:
|
||||
user: "{{ ansible_user }}"
|
||||
key: "{{ item }}"
|
||||
loop: "{{ public_ssh_keys | default([]) }}"
|
||||
- name: System Configuration (1)
|
||||
block:
|
||||
- name: System Configuration (1) | Disable firewalld | Fedora
|
||||
ansible.builtin.systemd:
|
||||
service: firewalld.service
|
||||
enabled: false
|
||||
masked: true
|
||||
state: stopped
|
||||
when: ansible_facts['distribution'] == 'Fedora'
|
||||
- name: System Configuration (1) | Disable ufw | Ubuntu
|
||||
ansible.builtin.systemd:
|
||||
service: ufw.service
|
||||
enabled: false
|
||||
masked: true
|
||||
state: stopped
|
||||
when: ansible_facts['distribution'] == 'Ubuntu'
|
||||
- name: System Configuration (1) | Enable fstrim
|
||||
ansible.builtin.systemd:
|
||||
service: fstrim.timer
|
||||
enabled: true
|
||||
- name: System Configuration (2)
|
||||
block:
|
||||
- name: System Configuration (2) | Enable kernel modules now
|
||||
community.general.modprobe:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
loop: [br_netfilter, overlay, rbd]
|
||||
- name: System Configuration (2) | Enable kernel modules on boot
|
||||
ansible.builtin.copy:
|
||||
mode: 0644
|
||||
content: "{{ item }}"
|
||||
dest: "/etc/modules-load.d/{{ item }}.conf"
|
||||
loop: [br_netfilter, overlay, rbd]
|
||||
- name: System Configuration (2) | Set sysctls
|
||||
ansible.posix.sysctl:
|
||||
name: "{{ item.key }}"
|
||||
value: "{{ item.value }}"
|
||||
sysctl_file: /etc/sysctl.d/99-kubernetes.conf
|
||||
reload: true
|
||||
with_dict: "{{ sysctl_config }}"
|
||||
vars:
|
||||
sysctl_config:
|
||||
net.ipv4.ip_forward: 1
|
||||
net.ipv4.conf.all.forwarding: 1
|
||||
net.ipv4.conf.all.rp_filter: 0
|
||||
net.ipv4.conf.default.rp_filter: 0
|
||||
net.ipv6.conf.all.forwarding: 1
|
||||
net.bridge.bridge-nf-call-iptables: 1
|
||||
net.bridge.bridge-nf-call-ip6tables: 1
|
||||
fs.inotify.max_user_watches: 524288
|
||||
fs.inotify.max_user_instances: 512
|
||||
- name: System Configuration (2) | Disable swap | Fedora
|
||||
ansible.builtin.dnf:
|
||||
name: zram-generator-defaults
|
||||
state: absent
|
||||
when: ansible_facts['distribution'] == 'Fedora'
|
||||
- name: System Configuration (2) | Disable swap at runtime | Ubuntu
|
||||
ansible.builtin.command: swapoff -a
|
||||
when:
|
||||
- ansible_facts['distribution'] == 'Ubuntu'
|
||||
- ansible_swaptotal_mb > 0
|
||||
- name: System Configuration (2) | Disable swap at boot | Ubuntu
|
||||
ansible.posix.mount:
|
||||
name: "{{ item }}"
|
||||
fstype: swap
|
||||
state: absent
|
||||
loop: ["none", "swap"]
|
||||
when: ansible_facts['distribution'] == 'Ubuntu'
|
||||
- name: System Configuration (2) | Permissive SELinux | Fedora
|
||||
ansible.posix.selinux:
|
||||
state: permissive
|
||||
policy: targeted
|
||||
when: ansible_facts['distribution'] == 'Fedora'
|
||||
notify: Reboot
|
||||
|
||||
handlers:
|
||||
- name: Reboot
|
||||
ansible.builtin.reboot:
|
||||
msg: Rebooting nodes
|
||||
@@ -0,0 +1,15 @@
|
||||
---
|
||||
- hosts:
|
||||
- master
|
||||
- worker
|
||||
become: true
|
||||
gather_facts: true
|
||||
any_errors_fatal: true
|
||||
pre_tasks:
|
||||
- name: Pausing for 5 seconds...
|
||||
ansible.builtin.pause:
|
||||
seconds: 5
|
||||
tasks:
|
||||
- name: Reboot
|
||||
ansible.builtin.reboot:
|
||||
msg: Rebooting nodes
|
||||
@@ -0,0 +1,22 @@
|
||||
---
|
||||
apiVersion: operator.tigera.io/v1
|
||||
kind: Installation
|
||||
metadata:
|
||||
name: default
|
||||
spec:
|
||||
registry: quay.io
|
||||
imagePath: calico
|
||||
calicoNetwork:
|
||||
# https://projectcalico.docs.tigera.io/networking/ip-autodetection
|
||||
nodeAddressAutodetectionV4:
|
||||
cidrs:
|
||||
- "{{ (ansible_default_ipv4.network + '/' + ansible_default_ipv4.netmask) | ansible.utils.ipaddr('network/prefix') }}"
|
||||
# Note: The ipPools section cannot be modified post-install.
|
||||
ipPools:
|
||||
- blockSize: 26
|
||||
cidr: "{{ k3s_server['cluster-cidr'] }}"
|
||||
encapsulation: "VXLANCrossSubnet"
|
||||
natOutgoing: Enabled
|
||||
nodeSelector: all()
|
||||
nodeMetricsPort: 9091
|
||||
typhaMetricsPort: 9093
|
||||
@@ -0,0 +1,72 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: kube-vip
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app.kubernetes.io/instance: kube-vip
|
||||
app.kubernetes.io/name: kube-vip
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: kube-vip
|
||||
app.kubernetes.io/name: kube-vip
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: kube-vip
|
||||
app.kubernetes.io/name: kube-vip
|
||||
spec:
|
||||
containers:
|
||||
- name: kube-vip
|
||||
image: ghcr.io/kube-vip/kube-vip:v0.5.7
|
||||
imagePullPolicy: IfNotPresent
|
||||
args: ["manager"]
|
||||
env:
|
||||
- name: vip_arp
|
||||
value: "true"
|
||||
- name: port
|
||||
value: "6443"
|
||||
- name: vip_cidr
|
||||
value: "32"
|
||||
- name: cp_enable
|
||||
value: "true"
|
||||
- name: cp_namespace
|
||||
value: kube-system
|
||||
- name: svc_enable
|
||||
value: "false"
|
||||
- name: vip_leaderelection
|
||||
value: "true"
|
||||
- name: vip_leaseduration
|
||||
value: "15"
|
||||
- name: vip_renewdeadline
|
||||
value: "10"
|
||||
- name: vip_retryperiod
|
||||
value: "2"
|
||||
- name: address
|
||||
value: "{{ k3s_registration_address }}"
|
||||
securityContext:
|
||||
capabilities:
|
||||
add: ["NET_ADMIN", "NET_RAW"]
|
||||
hostAliases:
|
||||
- hostnames:
|
||||
- kubernetes
|
||||
ip: 127.0.0.1
|
||||
hostNetwork: true
|
||||
serviceAccountName: kube-vip
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: node-role.kubernetes.io/master
|
||||
operator: Exists
|
||||
- matchExpressions:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
tolerations:
|
||||
- effect: NoSchedule
|
||||
operator: Exists
|
||||
- effect: NoExecute
|
||||
operator: Exists
|
||||
Reference in new issue
Block a user