feat: do not template out k3s ansible when k0s is choosen
Signed-off-by: Devin Buhl <devin@buhl.casa>
This commit is contained in:
29 files changed
+33
-15
No files matched your search
@@ -1,66 +0,0 @@
|
||||
#jinja2: trim_blocks: True, lstrip_blocks: True
|
||||
---
|
||||
- name: Cluster Installation
|
||||
hosts: kubernetes
|
||||
become: true
|
||||
gather_facts: true
|
||||
any_errors_fatal: true
|
||||
pre_tasks:
|
||||
- name: Pausing for 5 seconds...
|
||||
ansible.builtin.pause:
|
||||
seconds: 5
|
||||
tasks:
|
||||
- name: Check if cluster is installed
|
||||
check_mode: false
|
||||
ansible.builtin.stat:
|
||||
path: /etc/rancher/k3s/config.yaml
|
||||
register: k3s_installed
|
||||
|
||||
- name: Ignore manifests templates and urls if the cluster is already installed
|
||||
when: k3s_installed.stat.exists
|
||||
ansible.builtin.set_fact:
|
||||
k3s_server_manifests_templates: []
|
||||
k3s_server_manifests_urls: []
|
||||
|
||||
- name: Install Kubernetes
|
||||
ansible.builtin.include_role:
|
||||
name: xanmanning.k3s
|
||||
public: true
|
||||
vars:
|
||||
k3s_state: installed
|
||||
|
||||
- name: Kubeconfig
|
||||
ansible.builtin.include_tasks: tasks/kubeconfig.yaml
|
||||
|
||||
- name: Wait for custom manifests to rollout
|
||||
when:
|
||||
- k3s_primary_control_node
|
||||
- (k3s_server_manifests_templates | length > 0
|
||||
or k3s_server_manifests_urls | length > 0)
|
||||
kubernetes.core.k8s_info:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
kind: "{% raw %}{{ item.kind }}{% endraw %}"
|
||||
name: "{% raw %}{{ item.name }}{% endraw %}"
|
||||
namespace: "{% raw %}{{ item.namespace | default('') }}{% endraw %}"
|
||||
wait: true
|
||||
wait_sleep: 10
|
||||
wait_timeout: 360
|
||||
loop:
|
||||
- { name: cilium, kind: HelmChart, namespace: kube-system }
|
||||
- { name: coredns, kind: HelmChart, namespace: kube-system }
|
||||
{% if not bootstrap_ipv6_enabled | default(false) %}
|
||||
- { name: policy, kind: CiliumL2AnnouncementPolicy }
|
||||
- { name: pool, kind: CiliumLoadBalancerIPPool }
|
||||
{% endif %}
|
||||
|
||||
- name: Coredns
|
||||
when: k3s_primary_control_node
|
||||
ansible.builtin.include_tasks: tasks/coredns.yaml
|
||||
|
||||
- name: Cilium
|
||||
when: k3s_primary_control_node
|
||||
ansible.builtin.include_tasks: tasks/cilium.yaml
|
||||
|
||||
- name: Cruft
|
||||
when: k3s_primary_control_node
|
||||
ansible.builtin.include_tasks: tasks/cruft.yaml
|
||||
@@ -1,24 +0,0 @@
|
||||
---
|
||||
- name: Cluster kube-vip
|
||||
hosts: master
|
||||
serial: 1
|
||||
become: true
|
||||
gather_facts: true
|
||||
any_errors_fatal: true
|
||||
pre_tasks:
|
||||
- name: Pausing for 5 seconds...
|
||||
ansible.builtin.pause:
|
||||
seconds: 5
|
||||
tasks:
|
||||
- name: Ensure Kubernetes is running
|
||||
ansible.builtin.include_role:
|
||||
name: xanmanning.k3s
|
||||
public: true
|
||||
vars:
|
||||
k3s_state: started
|
||||
|
||||
- name: Upgrade kube-vip
|
||||
ansible.builtin.template:
|
||||
src: templates/kube-vip-static-pod.yaml.j2
|
||||
dest: "{% raw %}{{ k3s_server_pod_manifests_dir }}{% endraw %}/kube-vip-static-pod.yaml"
|
||||
mode: preserve
|
||||
@@ -1,106 +0,0 @@
|
||||
#jinja2: trim_blocks: True, lstrip_blocks: True
|
||||
---
|
||||
- name: Cluster Nuke
|
||||
hosts: kubernetes
|
||||
become: true
|
||||
gather_facts: true
|
||||
any_errors_fatal: true
|
||||
vars_prompt:
|
||||
- name: nuke
|
||||
prompt: |-
|
||||
Are you sure you want to nuke this cluster?
|
||||
Type 'YES I WANT TO DESTROY THIS CLUSTER' to proceed
|
||||
default: "n"
|
||||
private: false
|
||||
pre_tasks:
|
||||
- name: Check for confirmation
|
||||
ansible.builtin.fail:
|
||||
msg: Aborted nuking the cluster
|
||||
when: nuke != 'YES I WANT TO DESTROY THIS CLUSTER'
|
||||
|
||||
- name: Pausing for 5 seconds...
|
||||
ansible.builtin.pause:
|
||||
seconds: 5
|
||||
tasks:
|
||||
{% if bootstrap_distribution == "k3s" %}
|
||||
- name: Stop Kubernetes # noqa: ignore-errors
|
||||
ignore_errors: true
|
||||
block:
|
||||
- name: Stop Kubernetes
|
||||
ansible.builtin.include_role:
|
||||
name: xanmanning.k3s
|
||||
public: true
|
||||
vars:
|
||||
k3s_state: stopped
|
||||
{% endif %}
|
||||
|
||||
# https://github.com/k3s-io/docs/blob/main/docs/installation/network-options.md
|
||||
- name: Networking
|
||||
block:
|
||||
- name: Networking | Delete Cilium links
|
||||
ansible.builtin.command:
|
||||
cmd: "ip link delete {% raw %}{{ item }}{% endraw %}"
|
||||
removes: "/sys/class/net/{% raw %}{{ item }}{% endraw %}"
|
||||
loop: ["cilium_host", "cilium_net", "cilium_vxlan"]
|
||||
- name: Networking | Flush iptables
|
||||
ansible.builtin.iptables:
|
||||
table: "{% raw %}{{ item }}{% endraw %}"
|
||||
flush: true
|
||||
loop: ["filter", "nat", "mangle", "raw"]
|
||||
- name: Networking | Flush ip6tables
|
||||
ansible.builtin.iptables:
|
||||
table: "{% raw %}{{ item }}{% endraw %}"
|
||||
flush: true
|
||||
ip_version: ipv6
|
||||
loop: ["filter", "nat", "mangle", "raw"]
|
||||
- name: Networking | Delete CNI directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/cni/net.d
|
||||
state: absent
|
||||
|
||||
{% if bootstrap_distribution == "k3s" %}
|
||||
- name: Check to see if k3s-killall.sh exits
|
||||
ansible.builtin.stat:
|
||||
path: /usr/local/bin/k3s-killall.sh
|
||||
register: check_k3s_killall_script
|
||||
|
||||
- name: Check to see if k3s-uninstall.sh exits
|
||||
ansible.builtin.stat:
|
||||
path: /usr/local/bin/k3s-uninstall.sh
|
||||
register: check_k3s_uninstall_script
|
||||
|
||||
- name: Run k3s-killall.sh
|
||||
when: check_k3s_killall_script.stat.exists
|
||||
ansible.builtin.command:
|
||||
cmd: /usr/local/bin/k3s-killall.sh
|
||||
register: k3s_killall
|
||||
changed_when: k3s_killall.rc == 0
|
||||
|
||||
- name: Run k3s-uninstall.sh
|
||||
when: check_k3s_uninstall_script.stat.exists
|
||||
ansible.builtin.command:
|
||||
cmd: /usr/local/bin/k3s-uninstall.sh
|
||||
args:
|
||||
removes: /usr/local/bin/k3s-uninstall.sh
|
||||
register: k3s_uninstall
|
||||
changed_when: k3s_uninstall.rc == 0
|
||||
|
||||
- name: Ensure hard links are removed
|
||||
when:
|
||||
- k3s_install_hard_links
|
||||
- not ansible_check_mode
|
||||
ansible.builtin.file:
|
||||
path: "{% raw %}{{ k3s_install_dir }}/{{ item }}{% endraw %}"
|
||||
state: absent
|
||||
loop: ["kubectl", "crictl", "ctr"]
|
||||
{% endif %}
|
||||
|
||||
- name: Remove local storage path
|
||||
ansible.builtin.file:
|
||||
path: "{% raw %}{{ bootstrap_local_storage_path }}{% endraw %}"
|
||||
state: absent
|
||||
|
||||
- name: Reboot
|
||||
ansible.builtin.reboot:
|
||||
msg: Rebooting nodes
|
||||
reboot_timeout: 3600
|
||||
@@ -1,132 +0,0 @@
|
||||
---
|
||||
- name: Prepare System
|
||||
hosts: kubernetes
|
||||
become: true
|
||||
gather_facts: true
|
||||
any_errors_fatal: true
|
||||
pre_tasks:
|
||||
- name: Pausing for 5 seconds...
|
||||
ansible.builtin.pause:
|
||||
seconds: 5
|
||||
- name: Populate service facts
|
||||
ansible.builtin.service_facts:
|
||||
tasks:
|
||||
- name: Locale
|
||||
block:
|
||||
- name: Locale | Set timezone
|
||||
community.general.timezone:
|
||||
name: "{% raw %}{{ timezone | default('Etc/UTC') }}{% endraw %}"
|
||||
|
||||
- name: Packages
|
||||
block:
|
||||
- name: Packages | Install
|
||||
ansible.builtin.apt:
|
||||
name: apt-transport-https,ca-certificates,conntrack,curl,dirmngr,gdisk,gnupg,hdparm,htop,
|
||||
iptables,iputils-ping,ipvsadm,libseccomp2,lm-sensors,neofetch,net-tools,nfs-common,
|
||||
nvme-cli,open-iscsi,parted,psmisc,python3,python3-apt,python3-kubernetes,python3-yaml,
|
||||
smartmontools,socat,software-properties-common,unzip,util-linux
|
||||
install_recommends: false
|
||||
|
||||
- name: User Configuration
|
||||
block:
|
||||
- name: User Configuration | SSH keys
|
||||
ansible.posix.authorized_key:
|
||||
user: "{% raw %}{{ ansible_user }}{% endraw %}"
|
||||
key: "https://github.com/{% raw %}{{ github_username }}{% endraw %}.keys"
|
||||
- name: User Configuration | Silence login
|
||||
ansible.builtin.file:
|
||||
dest: "{% raw %}{{ '/home/' + ansible_user if ansible_user != 'root' else '/root' }}{% endraw %}/.hushlogin"
|
||||
state: touch
|
||||
owner: "{% raw %}{{ ansible_user }}{% endraw %}"
|
||||
group: "{% raw %}{{ ansible_user }}{% endraw %}"
|
||||
mode: "0644"
|
||||
modification_time: preserve
|
||||
access_time: preserve
|
||||
|
||||
- name: Network Configuration
|
||||
notify: Reboot
|
||||
block:
|
||||
- name: Network Configuration | Set hostname
|
||||
ansible.builtin.hostname:
|
||||
name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
|
||||
- name: Network Configuration | Update hosts
|
||||
ansible.builtin.copy:
|
||||
content: |
|
||||
127.0.0.1 localhost
|
||||
127.0.1.1 {% raw %}{{ inventory_hostname }}{% endraw %}
|
||||
|
||||
# The following lines are desirable for IPv6 capable hosts
|
||||
::1 localhost ip6-localhost ip6-loopback
|
||||
ff02::1 ip6-allnodes
|
||||
ff02::2 ip6-allrouters
|
||||
dest: /etc/hosts
|
||||
mode: preserve
|
||||
# https://github.com/onedr0p/flux-cluster-template/discussions/635
|
||||
- name: Network Configuration | Remove immutable flag from /etc/resolv.conf
|
||||
ansible.builtin.file:
|
||||
attributes: -i
|
||||
path: /etc/resolv.conf
|
||||
- name: Network Configuration | Remove /etc/resolv.conf
|
||||
ansible.builtin.file:
|
||||
attributes: -i
|
||||
path: /etc/resolv.conf
|
||||
state: absent
|
||||
- name: Network Configuration | Add custom /etc/resolv.conf
|
||||
ansible.builtin.copy:
|
||||
attributes: +i
|
||||
mode: '0644'
|
||||
dest: /etc/resolv.conf
|
||||
content: |
|
||||
search .
|
||||
nameserver 1.1.1.1
|
||||
|
||||
- name: System Configuration
|
||||
notify: Reboot
|
||||
block:
|
||||
- name: System Configuration | Neofetch
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/profile.d/neofetch.sh
|
||||
mode: "0755"
|
||||
content: neofetch --config none
|
||||
- name: System Configuration | Disable apparmor
|
||||
when: ansible_facts.services['apparmor.service'] is defined
|
||||
ansible.builtin.systemd:
|
||||
name: apparmor
|
||||
state: stopped
|
||||
masked: true
|
||||
- name: System Configuration | Disable swap
|
||||
ansible.posix.mount:
|
||||
name: "{% raw %}{{ item }}{% endraw %}"
|
||||
fstype: swap
|
||||
state: absent
|
||||
loop: ["none", "swap"]
|
||||
- name: System Configuration | Create Kernel modules
|
||||
ansible.builtin.copy:
|
||||
dest: "/etc/modules-load.d/{% raw %}{{ item }}{% endraw %}.conf"
|
||||
mode: "0644"
|
||||
content: "{% raw %}{{ item }}{% endraw %}"
|
||||
loop: ["br_netfilter", "ceph", "ip_vs", "ip_vs_rr", "nbd", "overlay", "rbd"]
|
||||
register: modules_status
|
||||
- name: System Configuration | Reload Kernel modules # noqa: no-changed-when no-handler
|
||||
when: modules_status.changed
|
||||
ansible.builtin.systemd:
|
||||
name: systemd-modules-load
|
||||
state: restarted
|
||||
- name: System Configuration | Sysctl
|
||||
ansible.posix.sysctl:
|
||||
name: "{% raw %}{{ item.key }}{% endraw %}"
|
||||
value: "{% raw %}{{ item.value }}{% endraw %}"
|
||||
sysctl_file: /etc/sysctl.d/99-kubernetes.conf
|
||||
reload: true
|
||||
with_dict: "{% raw %}{{ sysctl_config }}{% endraw %}"
|
||||
vars:
|
||||
sysctl_config:
|
||||
fs.inotify.max_queued_events: 65536
|
||||
fs.inotify.max_user_watches: 524288
|
||||
fs.inotify.max_user_instances: 8192
|
||||
|
||||
handlers:
|
||||
- name: Reboot
|
||||
ansible.builtin.reboot:
|
||||
msg: Rebooting nodes
|
||||
reboot_timeout: 3600
|
||||
@@ -1,15 +0,0 @@
|
||||
---
|
||||
- name: Reboot
|
||||
hosts: kubernetes
|
||||
become: true
|
||||
gather_facts: true
|
||||
any_errors_fatal: true
|
||||
pre_tasks:
|
||||
- name: Pausing for 5 seconds...
|
||||
ansible.builtin.pause:
|
||||
seconds: 5
|
||||
tasks:
|
||||
- name: Reboot
|
||||
ansible.builtin.reboot:
|
||||
msg: Rebooting nodes
|
||||
reboot_timeout: 3600
|
||||
@@ -1,72 +0,0 @@
|
||||
---
|
||||
# https://github.com/kevincoakley/ansible-role-k8s-rolling-update
|
||||
- name: Cluster rollout update
|
||||
hosts: kubernetes
|
||||
become: true
|
||||
gather_facts: true
|
||||
any_errors_fatal: true
|
||||
serial: 1
|
||||
pre_tasks:
|
||||
- name: Pausing for 5 seconds...
|
||||
ansible.builtin.pause:
|
||||
seconds: 5
|
||||
tasks:
|
||||
- name: Details
|
||||
ansible.builtin.command: "kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json"
|
||||
register: kubectl_get_node
|
||||
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
|
||||
- name: Update
|
||||
when:
|
||||
# When status.conditions[x].type == Ready then check stats.conditions[x].status for True|False
|
||||
- kubectl_get_node['stdout'] | from_json | json_query("status.conditions[?type == 'Ready'].status")
|
||||
# If spec.unschedulable is defined then the node is cordoned
|
||||
- not (kubectl_get_node['stdout'] | from_json).spec.unschedulable is defined
|
||||
block:
|
||||
- name: Cordon
|
||||
kubernetes.core.k8s_drain:
|
||||
name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
state: cordon
|
||||
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
|
||||
|
||||
- name: Drain
|
||||
kubernetes.core.k8s_drain:
|
||||
name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
state: drain
|
||||
delete_options:
|
||||
delete_emptydir_data: true
|
||||
ignore_daemonsets: true
|
||||
terminate_grace_period: 600
|
||||
wait_timeout: 900
|
||||
pod_selectors:
|
||||
# Rook Ceph
|
||||
- app!=rook-ceph-osd
|
||||
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
|
||||
|
||||
- name: Update
|
||||
ansible.builtin.apt:
|
||||
upgrade: dist
|
||||
update_cache: true
|
||||
|
||||
- name: Check if reboot is required
|
||||
ansible.builtin.stat:
|
||||
path: /var/run/reboot-required
|
||||
register: reboot_required
|
||||
|
||||
- name: Reboot
|
||||
when: reboot_required.stat.exists
|
||||
ansible.builtin.reboot:
|
||||
msg: Rebooting node
|
||||
post_reboot_delay: 60
|
||||
reboot_timeout: 3600
|
||||
|
||||
- name: Uncordon
|
||||
kubernetes.core.k8s_drain:
|
||||
name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
state: uncordon
|
||||
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
|
||||
@@ -1,56 +0,0 @@
|
||||
---
|
||||
- name: Cilium
|
||||
block:
|
||||
- name: Cilium | Check if Cilium HelmChart exists
|
||||
kubernetes.core.k8s_info:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: cilium
|
||||
kind: HelmChart
|
||||
namespace: kube-system
|
||||
register: cilium_helmchart
|
||||
|
||||
- name: Cilium | Wait for Cilium to rollout
|
||||
when: cilium_helmchart.resources | count > 0
|
||||
kubernetes.core.k8s_info:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: helm-install-cilium
|
||||
kind: Job
|
||||
namespace: kube-system
|
||||
wait: true
|
||||
wait_condition:
|
||||
type: Complete
|
||||
status: true
|
||||
wait_timeout: 360
|
||||
|
||||
- name: Cilium | Patch the Cilium HelmChart to unmanage it
|
||||
when: cilium_helmchart.resources | count > 0
|
||||
kubernetes.core.k8s_json_patch:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: cilium
|
||||
kind: HelmChart
|
||||
namespace: kube-system
|
||||
patch:
|
||||
- op: add
|
||||
path: /metadata/annotations/helmcharts.helm.cattle.io~1unmanaged
|
||||
value: "true"
|
||||
|
||||
- name: Cilium | Delete the Cilium HelmChart CR
|
||||
when: cilium_helmchart.resources | count > 0
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: cilium
|
||||
kind: HelmChart
|
||||
namespace: kube-system
|
||||
state: absent
|
||||
|
||||
- name: Cilium | Force delete the Cilium HelmChart
|
||||
when: cilium_helmchart.resources | count > 0
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: cilium
|
||||
kind: HelmChart
|
||||
namespace: kube-system
|
||||
state: patched
|
||||
definition:
|
||||
metadata:
|
||||
finalizers: []
|
||||
@@ -1,56 +0,0 @@
|
||||
---
|
||||
- name: Coredns
|
||||
block:
|
||||
- name: Coredns | Check if Coredns HelmChart exists
|
||||
kubernetes.core.k8s_info:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: coredns
|
||||
kind: HelmChart
|
||||
namespace: kube-system
|
||||
register: coredns_helmchart
|
||||
|
||||
- name: Coredns | Wait for Coredns to rollout
|
||||
when: coredns_helmchart.resources | count > 0
|
||||
kubernetes.core.k8s_info:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: helm-install-coredns
|
||||
kind: Job
|
||||
namespace: kube-system
|
||||
wait: true
|
||||
wait_condition:
|
||||
type: Complete
|
||||
status: true
|
||||
wait_timeout: 360
|
||||
|
||||
- name: Coredns | Patch the Coredns HelmChart to unmanage it
|
||||
when: coredns_helmchart.resources | count > 0
|
||||
kubernetes.core.k8s_json_patch:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: coredns
|
||||
kind: HelmChart
|
||||
namespace: kube-system
|
||||
patch:
|
||||
- op: add
|
||||
path: /metadata/annotations/helmcharts.helm.cattle.io~1unmanaged
|
||||
value: "true"
|
||||
|
||||
- name: Coredns | Delete the Coredns HelmChart CR
|
||||
when: coredns_helmchart.resources | count > 0
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: coredns
|
||||
kind: HelmChart
|
||||
namespace: kube-system
|
||||
state: absent
|
||||
|
||||
- name: Coredns | Force delete the Coredns HelmChart
|
||||
when: coredns_helmchart.resources | count > 0
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: coredns
|
||||
kind: HelmChart
|
||||
namespace: kube-system
|
||||
state: patched
|
||||
definition:
|
||||
metadata:
|
||||
finalizers: []
|
||||
@@ -1,32 +0,0 @@
|
||||
---
|
||||
# https://github.com/k3s-io/k3s/issues/1971
|
||||
- name: Cruft
|
||||
block:
|
||||
- name: Cruft | Get list of custom mantifests
|
||||
ansible.builtin.find:
|
||||
paths: "{% raw %}{{ k3s_server_manifests_dir }}{% endraw %}"
|
||||
file_type: file
|
||||
use_regex: true
|
||||
patterns: ["^custom-.*"]
|
||||
register: custom_manifest
|
||||
|
||||
- name: Cruft | Delete custom mantifests
|
||||
ansible.builtin.file:
|
||||
path: "{% raw %}{{ item.path }}{% endraw %}"
|
||||
state: absent
|
||||
loop: "{% raw %}{{ custom_manifest.files }}{% endraw %}"
|
||||
|
||||
- name: Cruft | Get list of custom addons
|
||||
kubernetes.core.k8s_info:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
kind: Addon
|
||||
register: addons_list
|
||||
|
||||
- name: Cruft | Delete addons
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: "{% raw %}{{ item.metadata.name }}{% endraw %}"
|
||||
kind: Addon
|
||||
namespace: kube-system
|
||||
state: absent
|
||||
loop: "{% raw %}{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}{% endraw %}"
|
||||
@@ -1,26 +0,0 @@
|
||||
---
|
||||
- name: Get absolute path to this Git repository # noqa: command-instead-of-module
|
||||
ansible.builtin.command: git rev-parse --show-toplevel
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
run_once: true
|
||||
register: repository_path
|
||||
changed_when: false
|
||||
check_mode: false
|
||||
failed_when: repository_path.rc != 0
|
||||
|
||||
- name: Copy kubeconfig to the project directory
|
||||
when: k3s_primary_control_node
|
||||
ansible.builtin.fetch:
|
||||
src: /etc/rancher/k3s/k3s.yaml
|
||||
dest: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
|
||||
flat: true
|
||||
|
||||
- name: Update kubeconfig with the correct load balancer address
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
run_once: true
|
||||
ansible.builtin.replace:
|
||||
path: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
|
||||
regexp: https://127.0.0.1:6443
|
||||
replace: "https://{% raw %}{{ k3s_registration_address }}{% endraw %}:6443"
|
||||
@@ -1,64 +0,0 @@
|
||||
#jinja2: trim_blocks: True, lstrip_blocks: True
|
||||
---
|
||||
# https://docs.k3s.io/helm
|
||||
apiVersion: helm.cattle.io/v1
|
||||
kind: HelmChart
|
||||
metadata:
|
||||
name: cilium
|
||||
namespace: kube-system
|
||||
spec:
|
||||
# renovate: datasource=helm
|
||||
repo: https://helm.cilium.io/
|
||||
chart: cilium
|
||||
version: 1.14.5
|
||||
targetNamespace: kube-system
|
||||
bootstrap: true
|
||||
valuesContent: |-
|
||||
autoDirectNodeRoutes: true
|
||||
bpf:
|
||||
masquerade: true
|
||||
bgp:
|
||||
enabled: false
|
||||
cluster:
|
||||
name: home-cluster
|
||||
id: 1
|
||||
containerRuntime:
|
||||
integration: containerd
|
||||
socketPath: /var/run/k3s/containerd/containerd.sock
|
||||
endpointRoutes:
|
||||
enabled: true
|
||||
hubble:
|
||||
enabled: false
|
||||
ipam:
|
||||
mode: kubernetes
|
||||
ipv4NativeRoutingCIDR: "{% raw %}{{ cluster_cidr }}{% endraw %}"
|
||||
{% if bootstrap_ipv6_enabled | default(false) %}
|
||||
ipv6NativeRoutingCIDR: "{% raw %}{{ cluster_cidr_v6 }}{% endraw %}"
|
||||
ipv6:
|
||||
enabled: true
|
||||
{% endif %}
|
||||
k8sServiceHost: "{% raw %}{{ kubeapi_addr }}{% endraw %}"
|
||||
k8sServicePort: 6443
|
||||
kubeProxyReplacement: true
|
||||
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
|
||||
l2announcements:
|
||||
{% if bootstrap_ipv6_enabled | default(false) %}
|
||||
enabled: false
|
||||
{% else %}
|
||||
enabled: true
|
||||
# https://github.com/cilium/cilium/issues/26586
|
||||
leaseDuration: 120s
|
||||
leaseRenewDeadline: 60s
|
||||
leaseRetryPeriod: 1s
|
||||
{% endif %}
|
||||
loadBalancer:
|
||||
algorithm: maglev
|
||||
mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }}
|
||||
localRedirectPolicy: true
|
||||
operator:
|
||||
replicas: 1
|
||||
rollOutPods: true
|
||||
rollOutCiliumPods: true
|
||||
routingMode: native
|
||||
securityContext:
|
||||
privileged: true
|
||||
@@ -1,22 +0,0 @@
|
||||
---
|
||||
# https://docs.cilium.io/en/latest/network/l2-announcements
|
||||
apiVersion: cilium.io/v2alpha1
|
||||
kind: CiliumL2AnnouncementPolicy
|
||||
metadata:
|
||||
name: policy
|
||||
spec:
|
||||
loadBalancerIPs: true
|
||||
# NOTE: This might need to be set if you have more than one active NIC on your nodes
|
||||
# interfaces:
|
||||
# - ^eno[0-9]+
|
||||
nodeSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/os: linux
|
||||
---
|
||||
apiVersion: cilium.io/v2alpha1
|
||||
kind: CiliumLoadBalancerIPPool
|
||||
metadata:
|
||||
name: pool
|
||||
spec:
|
||||
cidrs:
|
||||
- cidr: "{% raw %}{{ node_cidr }}{% endraw %}"
|
||||
@@ -1,78 +0,0 @@
|
||||
#jinja2: trim_blocks: True, lstrip_blocks: True
|
||||
---
|
||||
# https://docs.k3s.io/helm
|
||||
apiVersion: helm.cattle.io/v1
|
||||
kind: HelmChart
|
||||
metadata:
|
||||
name: coredns
|
||||
namespace: kube-system
|
||||
spec:
|
||||
# renovate: datasource=helm
|
||||
repo: https://coredns.github.io/helm
|
||||
chart: coredns
|
||||
version: 1.29.0
|
||||
targetNamespace: kube-system
|
||||
bootstrap: true
|
||||
valuesContent: |-
|
||||
fullnameOverride: coredns
|
||||
replicaCount: 1
|
||||
k8sAppLabelOverride: kube-dns
|
||||
service:
|
||||
name: kube-dns
|
||||
clusterIP: "{% raw %}{{ coredns_addr }}{% endraw %}"
|
||||
serviceAccount:
|
||||
create: true
|
||||
deployment:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
servers:
|
||||
- zones:
|
||||
- zone: .
|
||||
scheme: dns://
|
||||
use_tcp: true
|
||||
port: 53
|
||||
plugins:
|
||||
- name: log
|
||||
- name: errors
|
||||
- name: health
|
||||
configBlock: |-
|
||||
lameduck 5s
|
||||
- name: ready
|
||||
- name: kubernetes
|
||||
parameters: cluster.local in-addr.arpa ip6.arpa
|
||||
configBlock: |-
|
||||
pods insecure
|
||||
fallthrough in-addr.arpa ip6.arpa
|
||||
ttl 30
|
||||
- name: prometheus
|
||||
parameters: 0.0.0.0:9153
|
||||
- name: forward
|
||||
parameters: . /etc/resolv.conf
|
||||
- name: cache
|
||||
parameters: 30
|
||||
- name: loop
|
||||
- name: reload
|
||||
- name: loadbalance
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
tolerations:
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
- key: node-role.kubernetes.io/master
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: 1
|
||||
topologyKey: kubernetes.io/hostname
|
||||
whenUnsatisfiable: DoNotSchedule
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: coredns
|
||||
@@ -1,59 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: kube-vip
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app.kubernetes.io/instance: kube-vip
|
||||
app.kubernetes.io/name: kube-vip
|
||||
spec:
|
||||
containers:
|
||||
- name: kube-vip
|
||||
image: ghcr.io/kube-vip/kube-vip:v0.6.4
|
||||
imagePullPolicy: IfNotPresent
|
||||
args: ["manager"]
|
||||
env:
|
||||
- name: address
|
||||
value: "{% raw %}{{ kubeapi_addr }}{% endraw %}"
|
||||
- name: vip_arp
|
||||
value: "true"
|
||||
- name: lb_enable
|
||||
value: "true"
|
||||
- name: port
|
||||
value: "6443"
|
||||
- name: vip_cidr
|
||||
value: "32"
|
||||
- name: cp_enable
|
||||
value: "true"
|
||||
- name: cp_namespace
|
||||
value: kube-system
|
||||
- name: vip_ddns
|
||||
value: "false"
|
||||
- name: svc_enable
|
||||
value: "false"
|
||||
- name: vip_leaderelection
|
||||
value: "true"
|
||||
- name: vip_leaseduration
|
||||
value: "15"
|
||||
- name: vip_renewdeadline
|
||||
value: "10"
|
||||
- name: vip_retryperiod
|
||||
value: "2"
|
||||
- name: prometheus_server
|
||||
value: :2112
|
||||
securityContext:
|
||||
capabilities:
|
||||
add: ["NET_ADMIN", "NET_RAW"]
|
||||
volumeMounts:
|
||||
- mountPath: /etc/kubernetes/admin.conf
|
||||
name: kubeconfig
|
||||
hostAliases:
|
||||
- hostnames:
|
||||
- kubernetes
|
||||
ip: 127.0.0.1
|
||||
hostNetwork: true
|
||||
volumes:
|
||||
- name: kubeconfig
|
||||
hostPath:
|
||||
path: /etc/rancher/k3s/k3s.yaml
|
||||
Reference in new issue
Block a user