infra/home-cluster
2
0 Fork 0
Code Issues Pull Requests 40 Actions Packages Projects Releases Wiki Activity

feat: update jinja delimiters back to default (#1269)

Browse Source 
* feat: update jinja delimiters back to default

Signed-off-by: Devin Buhl <devin@buhl.casa>

* feat: remove cert-manager promrules

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: update talos csr approver

Signed-off-by: Devin Buhl <devin@buhl.casa>

---------

Signed-off-by: Devin Buhl <devin@buhl.casa>
This commit is contained in:
Devin Buhl authored and GitHub committed 2024-01-29 17:11:37 -05:00
1 parent 5fa8b9685a
commit df642e5425
55 files changed
+295 -358
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2
+1 -1
View File
@@ -2,7 +2,7 @@
k3s_become: true
k3s_etcd_datastore: true
k3s_install_hard_links: true
k3s_registration_address: "#{ cluster.endpoint_vip }#"
k3s_registration_address: "{{ cluster.endpoint_vip }}"
# renovate: datasource=github-releases depName=k3s-io/k3s
k3s_release_version: v1.29.0+k3s1
k3s_server_manifests_templates:
bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2
+15 -15
View File
@@ -1,13 +1,13 @@
---
k3s_control_node: true
k3s_server:
#% if feature_gates.dual_stack_ipv4_first %#
cluster-cidr: "#{ cluster.pod_network.split(',')[0] }#,#{ cluster.pod_network.split(',')[1] }#"
service-cidr: "#{ cluster.service_network.split(',')[0] }#,#{ cluster.service_network.split(',')[1] }#"
#% else %#
cluster-cidr: "#{ cluster.pod_network }#"
service-cidr: "#{ cluster.service_network }#"
#% endif %#
{% if feature_gates.dual_stack_ipv4_first %}
cluster-cidr: "{{ cluster.pod_network.split(',')[0] }},{{ cluster.pod_network.split(',')[1] }}"
service-cidr: "{{ cluster.service_network.split(',')[0] }},{{ cluster.service_network.split(',')[1] }}"
{% else %}
cluster-cidr: "{{ cluster.pod_network }}"
service-cidr: "{{ cluster.service_network }}"
{% endif %}
disable: ["flannel", "local-storage", "metrics-server", "servicelb", "traefik"]
disable-cloud-controller: true
disable-kube-proxy: true
@@ -24,16 +24,16 @@ k3s_server:
kubelet-arg:
- "image-gc-high-threshold=55"
- "image-gc-low-threshold=50"
#% if feature_gates.dual_stack_ipv4_first %#
node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
#% else %#
node-ip: "{{ ansible_host }}"
#% endif %#
{% if feature_gates.dual_stack_ipv4_first %}
node-ip: "{% raw %}{{ ansible_host }}{% endraw %},{% raw %}{{ ansible_default_ipv6.address }}{% endraw %}"
{% else %}
node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
{% endif %}
pause-image: registry.k8s.io/pause:3.9
secrets-encryption: true
tls-san:
- "#{ cluster.endpoint_vip }#"
#% for item in cluster.tls_sans %#
- "{{ cluster.endpoint_vip }}"
{% for item in cluster.tls_sans %}
- "{{ item }}"
#% endfor %#
{% endfor %}
write-kubeconfig-mode: "644"
bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2
+5 -5
View File
@@ -4,9 +4,9 @@ k3s_agent:
kubelet-arg:
- "image-gc-high-threshold=55"
- "image-gc-low-threshold=50"
#% if feature_gates.dual_stack_ipv4_first %#
node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
#% else %#
node-ip: "{{ ansible_host }}"
#% endif %#
{% if feature_gates.dual_stack_ipv4_first %}
node-ip: "{% raw %}{{ ansible_host }}{% endraw %},{% raw %}{{ ansible_default_ipv6.address }}{% endraw %}"
{% else %}
node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
{% endif %}
pause-image: registry.k8s.io/pause:3.9
bootstrap/templates/ansible/inventory/hosts.yaml.j2
+16 -16
View File
@@ -3,21 +3,21 @@ kubernetes:
children:
master:
hosts:
#% for item in cluster.nodes.inventory %#
#% if item.controller %#
"#{ item.name }#":
ansible_user: "#{ item.ssh_username }#"
ansible_host: "#{ item.address }#"
#% endif %#
#% endfor %#
#% if cluster.nodes.inventory | selectattr('controller', 'equalto', False) | list | length %#
{% for item in cluster.nodes.inventory %}
{% if item.controller %}
"{{ item.name }}":
ansible_user: "{{ item.ssh_username }}"
ansible_host: "{{ item.address }}"
{% endif %}
{% endfor %}
{% if cluster.nodes.inventory | selectattr('controller', 'equalto', False) | list | length %}
worker:
hosts:
#% for item in cluster.nodes.inventory %#
#% if not item.controller %#
"#{ item.name }#":
ansible_user: "#{ item.ssh_username }#"
ansible_host: "#{ item.address }#"
#% endif %#
#% endfor %#
#% endif %#
{% for item in cluster.nodes.inventory %}
{% if not item.controller %}
"{{ item.name }}":
ansible_user: "{{ item.ssh_username }}"
ansible_host: "{{ item.address }}"
{% endif %}
{% endfor %}
{% endif %}
bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2
+5 -5
View File
@@ -1,4 +1,4 @@
#% if distribution in ['k3s'] %#
{% if distribution in ['k3s'] %}
---
- name: Cluster Installation
hosts: kubernetes
@@ -39,9 +39,9 @@
or k3s_server_manifests_urls | length > 0)
kubernetes.core.k8s_info:
kubeconfig: /etc/rancher/k3s/k3s.yaml
kind: "{{ item.kind }}"
name: "{{ item.name }}"
namespace: "{{ item.namespace | default('') }}"
kind: "{% raw %}{{ item.kind }}{% endraw %}"
name: "{% raw %}{{ item.name }}{% endraw %}"
namespace: "{% raw %}{{ item.namespace | default('') }}{% endraw %}"
wait: true
wait_sleep: 10
wait_timeout: 360
@@ -55,4 +55,4 @@
- name: Cruft
when: k3s_primary_control_node
ansible.builtin.include_tasks: tasks/cruft.yaml
#% endif %#
{% endif %}
bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2
+6 -6
View File
@@ -10,20 +10,20 @@
ansible.builtin.pause:
seconds: 5
tasks:
#% if distribution in ['k3s'] %#
{% if distribution in ['k3s'] %}
- name: Ensure Kubernetes is running
ansible.builtin.include_role:
name: xanmanning.k3s
public: true
vars:
k3s_state: started
#% endif %#
{% endif %}
- name: Upgrade kube-vip
ansible.builtin.template:
src: templates/kube-vip-ds.yaml.j2
#% if distribution in ['k3s'] %#
dest: "{{ k3s_server_manifests_dir }}/kube-vip-ds.yaml"
#% elif distribution in ['k0s'] %#
{% if distribution in ['k3s'] %}
dest: "{% raw %}{{ k3s_server_manifests_dir }}{% endraw %}/kube-vip-ds.yaml"
{% elif distribution in ['k0s'] %}
dest: "/var/lib/k0s/manifests/kube-vip/kube-vip-ds.yaml"
#% endif %#
{% endif %}
mode: preserve
bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2
+7 -7
View File
@@ -1,4 +1,4 @@
#% if distribution in ['k3s'] %#
{% if distribution in ['k3s'] %}
---
- name: Cluster Nuke
hosts: kubernetes
@@ -37,17 +37,17 @@
block:
- name: Networking | Delete Cilium links
ansible.builtin.command:
cmd: "ip link delete {{ item }}"
removes: "/sys/class/net/{{ item }}"
cmd: "ip link delete {% raw %}{{ item }}{% endraw %}"
removes: "/sys/class/net/{% raw %}{{ item }}{% endraw %}"
loop: ["cilium_host", "cilium_net", "cilium_vxlan"]
- name: Networking | Flush iptables
ansible.builtin.iptables:
table: "{{ item }}"
table: "{% raw %}{{ item }}{% endraw %}"
flush: true
loop: ["filter", "nat", "mangle", "raw"]
- name: Networking | Flush ip6tables
ansible.builtin.iptables:
table: "{{ item }}"
table: "{% raw %}{{ item }}{% endraw %}"
flush: true
ip_version: ipv6
loop: ["filter", "nat", "mangle", "raw"]
@@ -87,7 +87,7 @@
- k3s_install_hard_links
- not ansible_check_mode
ansible.builtin.file:
path: "{{ k3s_install_dir }}/{{ item }}"
path: "{% raw %}{{ k3s_install_dir }}{% endraw %}/{% raw %}{{ item }}{% endraw %}"
state: absent
loop: ["kubectl", "crictl", "ctr"]
@@ -100,4 +100,4 @@
ansible.builtin.reboot:
msg: Rebooting hosts
reboot_timeout: 3600
#% endif %#
{% endif %}
bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2
+15 -15
View File
@@ -1,4 +1,4 @@
#% if distribution in ['k3s'] %#
{% if distribution in ['k3s'] %}
---
- name: Prepare System
hosts: kubernetes
@@ -16,7 +16,7 @@
block:
- name: Locale | Set timezone
community.general.timezone:
name: "#{ timezone }#"
name: "{{ timezone }}"
- name: Packages
block:
@@ -33,12 +33,12 @@
block:
- name: Network Configuration | Set hostname
ansible.builtin.hostname:
name: "{{ inventory_hostname }}"
name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
- name: Network Configuration | Update hosts
ansible.builtin.copy:
content: |
127.0.0.1 localhost
127.0.1.1 {{ inventory_hostname }}
127.0.1.1 {% raw %}{{ inventory_hostname }}{% endraw %}
# The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
@@ -62,10 +62,10 @@
mode: '0644'
dest: /etc/resolv.conf
content: |
search #{ cluster.nodes.search_domain|default('.', true) }#
#% for item in cluster.nodes.dns_servers %#
nameserver #{ item }#
#% endfor %#
search {{ cluster.nodes.search_domain|default('.', true) }}
{% for item in cluster.nodes.dns_servers %}
nameserver {{ item }}
{% endfor %}
- name: System Configuration
notify: Reboot
@@ -78,15 +78,15 @@
masked: true
- name: System Configuration | Disable swap
ansible.posix.mount:
name: "{{ item }}"
name: "{% raw %}{{ item }}{% endraw %}"
fstype: swap
state: absent
loop: ["none", "swap"]
- name: System Configuration | Create Kernel modules
ansible.builtin.copy:
dest: "/etc/modules-load.d/{{ item }}.conf"
dest: "/etc/modules-load.d/{% raw %}{{ item }}{% endraw %}.conf"
mode: "0644"
content: "{{ item }}"
content: "{% raw %}{{ item }}{% endraw %}"
loop: ["br_netfilter", "ceph", "ip_vs", "ip_vs_rr", "nbd", "overlay", "rbd"]
register: modules_status
- name: System Configuration | Reload Kernel modules # noqa: no-changed-when no-handler
@@ -96,11 +96,11 @@
state: restarted
- name: System Configuration | Sysctl
ansible.posix.sysctl:
name: "{{ item.key }}"
value: "{{ item.value }}"
name: "{% raw %}{{ item.key }}{% endraw %}"
value: "{% raw %}{{ item.value }}{% endraw %}"
sysctl_file: /etc/sysctl.d/99-kubernetes.conf
reload: true
with_dict: "{{ sysctl_config }}"
with_dict: "{% raw %}{{ sysctl_config }}{% endraw %}"
vars:
sysctl_config:
fs.inotify.max_queued_events: 65536
@@ -112,4 +112,4 @@
ansible.builtin.reboot:
msg: Rebooting hosts
reboot_timeout: 3600
#% endif %#
{% endif %}
bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2
+21 -21
View File
@@ -12,13 +12,13 @@
seconds: 5
tasks:
- name: Details
#% if distribution in ['k3s'] %#
ansible.builtin.command: "k3s kubectl get node {{ inventory_hostname }} -o json"
#% elif distribution in ['k0s'] %#
ansible.builtin.command: "k0s kubectl get node {{ inventory_hostname }} -o json"
#% endif %#
{% if distribution in ['k3s'] %}
ansible.builtin.command: "k3s kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json"
{% elif distribution in ['k0s'] %}
ansible.builtin.command: "k0s kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json"
{% endif %}
register: kubectl_get_node
delegate_to: "{{ groups['master'][0] }}"
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
failed_when: false
changed_when: false
@@ -31,23 +31,23 @@
block:
- name: Cordon
kubernetes.core.k8s_drain:
name: "{{ inventory_hostname }}"
#% if distribution in ['k3s'] %#
name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
{% if distribution in ['k3s'] %}
kubeconfig: /etc/rancher/k3s/k3s.yaml
#% elif distribution in ['k0s'] %#
{% elif distribution in ['k0s'] %}
kubeconfig: /var/lib/k0s/pki/admin.conf
#% endif %#
{% endif %}
state: cordon
delegate_to: "{{ groups['master'][0] }}"
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
- name: Drain
kubernetes.core.k8s_drain:
name: "{{ inventory_hostname }}"
#% if distribution in ['k3s'] %#
name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
{% if distribution in ['k3s'] %}
kubeconfig: /etc/rancher/k3s/k3s.yaml
#% elif distribution in ['k0s'] %#
{% elif distribution in ['k0s'] %}
kubeconfig: /var/lib/k0s/pki/admin.conf
#% endif %#
{% endif %}
state: drain
delete_options:
delete_emptydir_data: true
@@ -56,7 +56,7 @@
wait_timeout: 900
pod_selectors:
- app!=rook-ceph-osd # Rook Ceph
delegate_to: "{{ groups['master'][0] }}"
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
- name: Update
ansible.builtin.apt:
@@ -77,11 +77,11 @@
- name: Uncordon
kubernetes.core.k8s_drain:
name: "{{ inventory_hostname }}"
#% if distribution in ['k3s'] %#
name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
{% if distribution in ['k3s'] %}
kubeconfig: /etc/rancher/k3s/k3s.yaml
#% elif distribution in ['k0s'] %#
{% elif distribution in ['k0s'] %}
kubeconfig: /var/lib/k0s/pki/admin.conf
#% endif %#
{% endif %}
state: uncordon
delegate_to: "{{ groups['master'][0] }}"
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2
+5 -5
View File
@@ -4,7 +4,7 @@
block:
- name: Cruft | Get list of custom manifests
ansible.builtin.find:
paths: "{{ k3s_server_manifests_dir }}"
paths: "{% raw %}{{ k3s_server_manifests_dir }}{% endraw %}"
file_type: file
use_regex: true
patterns: ["^custom-.*"]
@@ -12,9 +12,9 @@
- name: Cruft | Delete custom manifests
ansible.builtin.file:
path: "{{ item.path }}"
path: "{% raw %}{{ item.path }}{% endraw %}"
state: absent
loop: "{{ custom_manifest.files }}"
loop: "{% raw %}{{ custom_manifest.files }}{% endraw %}"
- name: Cruft | Get list of custom addons
kubernetes.core.k8s_info:
@@ -25,8 +25,8 @@
- name: Cruft | Delete addons
kubernetes.core.k8s:
kubeconfig: /etc/rancher/k3s/k3s.yaml
name: "{{ item.metadata.name }}"
name: "{% raw %}{{ item.metadata.name }}{% endraw %}"
kind: Addon
namespace: kube-system
state: absent
loop: "{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}"
loop: "{% raw %}{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}{% endraw %}"
bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2
+3 -3
View File
@@ -13,7 +13,7 @@
when: k3s_primary_control_node
ansible.builtin.fetch:
src: /etc/rancher/k3s/k3s.yaml
dest: "{{ repository_path.stdout }}/kubeconfig"
dest: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
flat: true
- name: Update kubeconfig with the correct load balancer address
@@ -21,6 +21,6 @@
become: false
run_once: true
ansible.builtin.replace:
path: "{{ repository_path.stdout }}/kubeconfig"
path: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
regexp: https://127.0.0.1:6443
replace: "https://{{ k3s_registration_address }}:6443"
replace: "https://{% raw %}{{ k3s_registration_address }}{% endraw %}:6443"
bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2
+3 -3
View File
@@ -13,6 +13,6 @@ spec:
targetNamespace: kube-system
bootstrap: true
valuesContent: |-
#% filter indent(width=4, first=True) %#
#% include 'partials/cilium-values-init.partial.yaml.j2' %#
#% endfilter %#
{% filter indent(width=4, first=True) %}
{% include 'partials/cilium-values-init.partial.yaml.j2' %}
{% endfilter %}
bootstrap/templates/ansible/playbooks/templates/kube-vip-ds.yaml.j2
+1 -1
View File
@@ -1,2 +1,2 @@
---
#% include 'partials/kube-vip-ds.partial.yaml.j2' %#
{% include 'partials/kube-vip-ds.partial.yaml.j2' %}
bootstrap/templates/ansible/playbooks/templates/kube-vip-rbac.yaml.j2
+1 -1
View File
@@ -1,2 +1,2 @@
---
#% include 'partials/kube-vip-rbac.partial.yaml.j2' %#
{% include 'partials/kube-vip-rbac.partial.yaml.j2' %}
bootstrap/templates/ansible/requirements.yaml.j2
+2 -2
View File
@@ -8,9 +8,9 @@ collections:
version: 8.2.0
- name: kubernetes.core
version: 3.0.0
#% if distribution in ['k3s'] %#
{% if distribution in ['k3s'] %}
roles:
- name: xanmanning.k3s
src: https://github.com/PyratLabs/ansible-role-k3s
version: v3.4.4
#% endif %#
{% endif %}