From ef563a44726372740c4dfbc9fdec35b69021db1f Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Tue, 30 Jan 2024 14:33:16 -0500 Subject: [PATCH] feat: add prevent downgrades check in k3s ansible Signed-off-by: Devin Buhl --- README.md | 2 +- .../playbooks/cluster-installation.yaml.j2 | 4 ++++ .../ansible/playbooks/tasks/cruft.yaml.j2 | 1 - .../playbooks/tasks/version-check.yaml.j2 | 18 ++++++++++++++++++ 4 files changed, 23 insertions(+), 2 deletions(-) create mode 100644 bootstrap/templates/ansible/playbooks/tasks/version-check.yaml.j2 diff --git a/README.md b/README.md index 8bbc826a..0166ffc9 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@ The features included will depend on the type of configuration you want to use. 2. "**Flux cluster**" - Add-on to the "**Bare cluster**" to deploy an opinionated implementation of [Flux](https://github.com/fluxcd/flux2) using [GitHub](https://github.com/) as GitOps provider and [sops](https://github.com/getsops/sops) to manage secrets. - - **Apps included:** [flux](https://github.com/fluxcd/flux2), [cert-manager](https://github.com/cert-manager/cert-manager), [spegel](https://github.com/XenitAB/spegel), [reloader](https://github.com/stakater/Reloader) [system-upgrade-controller](https://github.com/rancher/system-upgrade-controller), and [openebs](https://github.com/openebs/openebs) in [Local PV / Hostpath](https://openebs.io/docs/concepts/localpv) mode. + - **Apps included:** [flux](https://github.com/fluxcd/flux2), [cert-manager](https://github.com/cert-manager/cert-manager), [spegel](https://github.com/XenitAB/spegel), [reloader](https://github.com/stakater/Reloader), [system-upgrade-controller](https://github.com/rancher/system-upgrade-controller), and [openebs](https://github.com/openebs/openebs) in [Local PV / Hostpath](https://openebs.io/docs/concepts/localpv) mode. 3. "**Flux cluster with Cloudflare**" - Add-on to the "**Flux cluster**" that provides DNS and SSL with [Cloudflare](https://www.cloudflare.com/). [Cloudflare Tunnel](https://www.cloudflare.com/products/tunnel/) is also included to provide external access to certain applications deployed in your cluster. diff --git a/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 index de0c0937..951cc17f 100644 --- a/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 @@ -22,6 +22,10 @@ k3s_server_manifests_templates: [] k3s_server_manifests_urls: [] + - name: Prevent downgrades + when: k3s_installed.stat.exists + ansible.builtin.include_tasks: tasks/version-check.yaml + - name: Install Kubernetes ansible.builtin.include_role: name: xanmanning.k3s diff --git a/bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2 b/bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2 index 3a37c1a0..18b75750 100644 --- a/bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2 @@ -1,5 +1,4 @@ --- -# https://github.com/k3s-io/k3s/issues/1971 - name: Cruft block: - name: Cruft | Get list of custom manifests diff --git a/bootstrap/templates/ansible/playbooks/tasks/version-check.yaml.j2 b/bootstrap/templates/ansible/playbooks/tasks/version-check.yaml.j2 new file mode 100644 index 00000000..24dd068c --- /dev/null +++ b/bootstrap/templates/ansible/playbooks/tasks/version-check.yaml.j2 @@ -0,0 +1,18 @@ +--- +- name: Version Check + block: + - name: Get deployed k3s version + ansible.builtin.command: k3s --version + register: k3s_version + changed_when: false + failed_when: false + + - name: Extract k3s version + ansible.builtin.set_fact: + current_k3s_version: "{{ k3s_version.stdout | regex_replace('(?im)k3s version (?P[a-z0-9\\.\\+]+).*\n.*', '\\g') }}" + + - name: Check if upgrades are allowed + ansible.builtin.assert: + that: + - "k3s_release_version is version(current_k3s_version, '>=')" + fail_msg: "Unable to upgrade k3s because the deployed version is higher than the one specified in the configuration"