ansible kubernetes deployment

ansible/playbooks/deploy_k8s.yml

@@ -0,0 +1,17 @@
+# ------------------------------------------------------------------------------
+# FILE: deploy_k8s.yml
+# ------------------------------------------------------------------------------
+- name: 1. Prepare all nodes for Kubernetes
+  hosts: kube_cluster
+  roles:
+    - role: kubernetes
+
+- name: 2. Initialize and configure the control plane
+  hosts: fastpass_control_plane
+  roles:
+    - role: fastpass-control-plane
+
+- name: 3. Join worker nodes to the cluster
+  hosts: fastpass-workers
+  roles:
+    - role: fastpass-workers

ansible/playbooks/roles/fastpass-control-plane/tasks/main.yml

@@ -0,0 +1,59 @@
+# ------------------------------------------------------------------------------
+# FILE: roles/control-plane/tasks/main.yml
+# ------------------------------------------------------------------------------
+- name: Check if cluster is already initialized
+  ansible.builtin.stat:
+    path: /etc/kubernetes/admin.conf
+  register: kube_init_stat
+
+- name: Initialize the Kubernetes cluster
+  when: not kube_init_stat.stat.exists
+  ansible.builtin.command: >
+    kubeadm init
+    --pod-network-cidr=10.244.0.0/16
+    --control-plane-endpoint={{ inventory_hostname }}
+  register: kubeadm_init
+
+- name: Create .kube directory for the user
+  become: false
+  ansible.builtin.file:
+    path: "{{ ansible_env.HOME }}/.kube"
+    state: directory
+    mode: '0755'
+  delegate_to: localhost
+  run_once: true
+
+- name: Copy admin.conf to user's .kube directory on controller
+  when: not kube_init_stat.stat.exists
+  ansible.builtin.fetch:
+    src: /etc/kubernetes/admin.conf
+    dest: "{{ ansible_env.HOME }}/.kube/config"
+    flat: true
+
+- name: Install Calico CNI
+  become: false
+  ansible.builtin.command: kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.0/manifests/calico.yaml
+  delegate_to: localhost
+  run_once: true
+  when: not kube_init_stat.stat.exists
+
+- name: Generate join command for control plane nodes
+  when: not kube_init_stat.stat.exists
+  ansible.builtin.command: kubeadm token create --print-join-command
+  register: control_plane_join_command_raw
+
+- name: Generate certificate key for control plane join
+  when: not kube_init_stat.stat.exists
+  ansible.builtin.command: kubeadm init phase upload-certs --upload-certs
+  register: control_plane_cert_key
+
+- name: Store control plane join command
+  ansible.builtin.set_fact:
+    control_plane_join_command: "{{ control_plane_join_command_raw.stdout }} --control-plane --certificate-key {{ control_plane_cert_key.stdout_lines[-1] }}"
+  when: not kube_init_stat.stat.exists
+
+- name: Join other control plane nodes to the cluster
+  when:
+    - inventory_hostname != groups['fastpass_control_plane'][0]
+    - not kube_init_stat.stat.exists
+  ansible.builtin.command: "{{ hostvars[groups['fastpass_control_plane'][0]].control_plane_join_command }}"

ansible/playbooks/roles/fastpass-workers/tasks/main.yml

@@ -0,0 +1,35 @@
+# ------------------------------------------------------------------------------
+# FILE: roles/fastpass_workers/tasks/main.yml
+# ------------------------------------------------------------------------------
+- name: Generate join command for worker nodes
+  ansible.builtin.command: kubeadm token create --print-join-command
+  delegate_to: "{{ groups['fastpass_control_plane'][0] }}"
+  run_once: true
+  register: worker_join_command
+
+- name: Join worker nodes to the cluster
+  ansible.builtin.command: "{{ hostvars[groups['fastpass_control_plane'][0]].worker_join_command.stdout }}"
+
+- name: Label and Taint on-stage worker nodes
+  become: false
+  ansible.builtin.command: "kubectl {{ item }}"
+  delegate_to: localhost
+  run_once: true
+  loop:
+    - label node seven-dwarfs-mine-train zone=on-stage --overwrite
+    - taint node seven-dwarfs-mine-train dedicated=external:NoSchedule --overwrite
+  when: "'seven-dwarfs-mine-train' in inventory_hostname"
+
+- name: Label backstage worker node haunted-mansion
+  become: false
+  ansible.builtin.command: "kubectl label node haunted-mansion zone=backstage --overwrite"
+  delegate_to: localhost
+  run_once: true
+  when: "'haunted-mansion' in inventory_hostname"
+
+- name: Label backstage worker node peter-pans-flight
+  become: false
+  ansible.builtin.command: "kubectl label node peter-pans-flight zone=backstage --overwrite"
+  delegate_to: localhost
+  run_once: true
+  when: "'peter-pans-flight' in inventory_hostname"

ansible/playbooks/roles/kubernetes/tasks/main.yml

@@ -0,0 +1,101 @@
+# ------------------------------------------------------------------------------
+# FILE: roles/common/tasks/main.yml
+# ------------------------------------------------------------------------------
+- name: Disable swap
+  ansible.builtin.command: swapoff -a
+  changed_when: false
+
+- name: Persist swap off by commenting out swap in fstab
+  ansible.builtin.replace:
+    path: /etc/fstab
+    regexp: '^(\s*)([^#\n]+\s+swap\s+.*)$'
+    replace: '#\2'
+    backup: true
+
+- name: Load required kernel modules
+  community.general.modprobe:
+    name: "{{ item }}"
+    state: present
+  loop:
+    - overlay
+    - br_netfilter
+
+- name: Persist kernel modules on boot
+  ansible.builtin.copy:
+    dest: /etc/modules-load.d/k8s.conf
+    content: |
+      overlay
+      br_netfilter
+
+- name: Configure required sysctl params for Kubernetes
+  ansible.builtin.copy:
+    dest: /etc/sysctl.d/k8s.conf
+    content: |
+      net.bridge.bridge-nf-call-iptables  = 1
+      net.bridge.bridge-nf-call-ip6tables = 1
+      net.ipv4.ip_forward                 = 1
+
+- name: Apply sysctl params without reboot
+  ansible.builtin.command: sysctl --system
+  changed_when: false
+
+- name: Set SELinux to permissive mode
+  selinux:
+    policy: targeted
+    state: permissive
+
+- name: Install DNF plugins core for managing repositories
+  ansible.builtin.dnf:
+    name: dnf-plugins-core
+    state: present
+
+- name: Add Docker CE repository
+  ansible.builtin.command: dnf config-manager --add-repo https://download.docker.com/linux/fedora/docker-ce.repo
+  args:
+    creates: /etc/yum.repos.d/docker-ce.repo
+
+- name: Install containerd
+  ansible.builtin.dnf:
+    name: containerd.io
+    state: present
+
+- name: Create containerd config directory
+  ansible.builtin.file:
+    path: /etc/containerd
+    state: directory
+
+- name: Generate default containerd config and enable SystemdCgroup
+  ansible.builtin.shell: |
+    containerd config default > /etc/containerd/config.toml
+    sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
+  args:
+    creates: /etc/containerd/config.toml
+
+- name: Restart and enable containerd service
+  ansible.builtin.systemd:
+    name: containerd
+    state: restarted
+    enabled: true
+    daemon_reload: true
+
+- name: Add Kubernetes repository
+  ansible.builtin.yum_repository:
+    name: kubernetes
+    description: Kubernetes
+    baseurl: https://pkgs.k8s.io/core:/stable:/v1.33/rpm/
+    gpgkey: https://pkgs.k8s.io/core:/stable:/v1.33/rpm/repodata/repomd.xml.key
+    gpgcheck: true
+
+- name: Install Kubernetes packages
+  ansible.builtin.dnf:
+    name:
+      - kubelet
+      - kubeadm
+      - kubectl
+    state: present
+    disable_excludes: kubernetes
+
+- name: Enable the kubelet service
+  ansible.builtin.systemd:
+    name: kubelet
+    enabled: true