diff --git a/infra-config/04-vm-templates/README.md b/infra-config/04-vm-templates/README.md index eb91961..16ad067 100644 --- a/infra-config/04-vm-templates/README.md +++ b/infra-config/04-vm-templates/README.md @@ -24,6 +24,12 @@ fedora-/ │ └── ks.cfg # Source block for Apache image └── README.md +# Disable the firewall before starting + +```bash +sudo systemctl stop firewalld +``` + # Create templates ```bash diff --git a/infra-config/10-internal-cluster/01-dhcp/host-reservations.yml b/infra-config/10-internal-cluster/01-dhcp/host-reservations.yml new file mode 100644 index 0000000..838c2b7 --- /dev/null +++ b/infra-config/10-internal-cluster/01-dhcp/host-reservations.yml @@ -0,0 +1,13 @@ +--- +- name: Dnsmasq + hosts: localhost + become: yes + vars: + - additional_dhcp_hosts: + ethernet_switch: + desc: "SNO Hub Cluster" + mac: 98:b7:85:1e:c6:f1 + ip: 10.1.71.10 + + roles: + - role: ricsanfre.dnsmasq \ No newline at end of file diff --git a/infra-config/10-internal-cluster/01-dns/.terraform.lock.hcl b/infra-config/10-internal-cluster/01-dns/.terraform.lock.hcl new file mode 100644 index 0000000..eaa91ba --- /dev/null +++ b/infra-config/10-internal-cluster/01-dns/.terraform.lock.hcl @@ -0,0 +1,24 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/rework-space-com/freeipa" { + version = "5.0.0" + constraints = "5.0.0" + hashes = [ + "h1:6EquDv6GgQO2HjZUUoRIUVzYa951n+wb4Uk7ggD6XD0=", + "zh:098607e559c3b696401034ff494ba8068962b45059ee067a54b58334b6ee0f2c", + "zh:18b806a14bb9d9382213c6929af35f5a65f16c17ff526d475f1eab33d1470290", + "zh:2c8c74668844d256b7fdc503cd736a20b7e58db5b31880d1ad8090c1af04e24c", + "zh:3bba458b9a6df99c21da58750dd6586b93bdcc557e4a2d695e801ada39e8de1e", + "zh:58f728d9e98cc7aae3841c07318be64b6dcb2f51c041f04bba977e61104a2333", + "zh:597dfbefbfe111a31e9ff3c4fc14fc8e12c1e255454087d3eebd2ec6c7aa9bf3", + "zh:6093d6db13d834c23f5482efae80c8e1ae046028fccf24242f0f1c1935e6aa70", + "zh:87271fa234a57ce05d4166e444002bd66976f971b434f7add45c874c9587129d", + "zh:89f7f6be64b6bf9e708fbafd22f410cf3f50b1fcd4cd6c61e9ffffd6180ea839", + "zh:9bdd7a984f845ff6f4bc4df5cc41a9de019639fceca62e60fc7c0f098ad2695c", + "zh:a0551311c96b86050d15854b4fca2beaa06b2e1964f97945824567d0b90db580", + "zh:c3daa12021725883bd32d7d852a2de845bb7a5f18009a45be7c2c2d891631713", + "zh:d7871eb99683934a30b9d47508379e6d16978f3dcd73601af2204652668592aa", + "zh:e8f72fd7750e6c1f0f97d039fea66cb85f457cf22908b7c3f14c7d2cf990ee84", + ] +} diff --git a/infra-config/10-internal-cluster/01-dns/README.md b/infra-config/10-internal-cluster/01-dns/README.md new file mode 100644 index 0000000..90b034d --- /dev/null +++ b/infra-config/10-internal-cluster/01-dns/README.md @@ -0,0 +1,3 @@ +# DNS Provider Configuration + +This directory contains the configuration to updateFreeIPA DNS for the Hub Cluster. diff --git a/infra-config/10-internal-cluster/01-dns/dns.tf b/infra-config/10-internal-cluster/01-dns/dns.tf new file mode 100644 index 0000000..83fb427 --- /dev/null +++ b/infra-config/10-internal-cluster/01-dns/dns.tf @@ -0,0 +1,39 @@ +resource "freeipa_dns_record" "ocp-hub" { + zone_name = "int.mk-labs.cloud." + name = "ocp-hub" + type = "A" + records = [ + "10.1.71.10", + ] + ttl = 60 +} + +resource "freeipa_dns_record" "api" { + zone_name = "int.mk-labs.cloud." + name = "api.hub" + type = "A" + records = [ + "10.1.71.10", + ] + ttl = 60 +} + +resource "freeipa_dns_record" "api-int" { + zone_name = "int.mk-labs.cloud." + name = "api-int.hub" + type = "A" + records = [ + "10.1.71.10", + ] + ttl = 60 +} + +resource "freeipa_dns_record" "wildcard-apps" { + zone_name = "int.mk-labs.cloud." + name = "*.apps.hub" + type = "A" + records = [ + "10.1.71.10", + ] + ttl = 60 +} diff --git a/infra-config/10-internal-cluster/01-dns/provider.tf b/infra-config/10-internal-cluster/01-dns/provider.tf new file mode 100644 index 0000000..4d1c4f8 --- /dev/null +++ b/infra-config/10-internal-cluster/01-dns/provider.tf @@ -0,0 +1,22 @@ +# Configure the DNS Provider +provider "freeipa" { + host = "infra01.int.mk-labs.cloud" + username = "admin" + password = var.freeipa_password + insecure = true +} + +variable "freeipa_password" { + description = "The password for the FreeIPA provider" + type = string + sensitive = true +} + +terraform { + required_providers { + freeipa = { + source = "rework-space-com/freeipa" + version = "5.0.0" + } + } +} diff --git a/infra-config/10-internal-cluster/02-dhcp/README.md b/infra-config/10-internal-cluster/02-dhcp/README.md new file mode 100644 index 0000000..4fad815 --- /dev/null +++ b/infra-config/10-internal-cluster/02-dhcp/README.md @@ -0,0 +1 @@ +# Add/modify entry in DNSmasq diff --git a/infra-config/10-internal-cluster/02-dhcp/ip-reservations.yml b/infra-config/10-internal-cluster/02-dhcp/ip-reservations.yml new file mode 100644 index 0000000..0993f40 --- /dev/null +++ b/infra-config/10-internal-cluster/02-dhcp/ip-reservations.yml @@ -0,0 +1,28 @@ +--- +- name: Ensure dnsmasq is installed + ansible.builtin.apt: + name: dnsmasq + state: present + become: true + when: ansible_os_family == "Debian" + +- name: Ensure dnsmasq is installed + ansible.builtin.dnf: + name: dnsmasq + state: present + become: true + when: ansible_os_family == "RedHat" + +- name: Add host reservation to dnsmasq + ansible.builtin.lineinfile: + path: /etc/dnsmasq.d/hosts.conf + regexp: "^dhcp-host={{ hostvars['ocp-hub'].mac_address }}" + line: "dhcp-host={{ hostvars['ocp-hub'].mac_address }},{{ hostvars['ocp-hub'].ip_address }} #{{ hostvars['ocp-hub'].hostname }}" + state: present + become: true + +- name: Restart dnsmasq service + ansible.builtin.service: + name: dnsmasq + state: restarted + become: true diff --git a/infra-config/10-internal-cluster/03-openshift-image/README.md b/infra-config/10-internal-cluster/03-openshift-image/README.md new file mode 100644 index 0000000..e8786db --- /dev/null +++ b/infra-config/10-internal-cluster/03-openshift-image/README.md @@ -0,0 +1,7 @@ +# Configure the OpenShift Agent Installer and Matchbox + +## Reference Document + + + +Recap of image creation is in 10-sno-hub-cluster/02-matchbox/.openshift_install.log diff --git a/infra-config/10-internal-cluster/03-openshift-image/create-openshift-image.yml b/infra-config/10-internal-cluster/03-openshift-image/create-openshift-image.yml new file mode 100644 index 0000000..c01c43e --- /dev/null +++ b/infra-config/10-internal-cluster/03-openshift-image/create-openshift-image.yml @@ -0,0 +1,5 @@ +--- +- name: OpenShift image creation + ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files + args: + chdir: 03-openshift-image diff --git a/infra-config/10-internal-cluster/03-openshift-image/move-pxe-assets.yml b/infra-config/10-internal-cluster/03-openshift-image/move-pxe-assets.yml new file mode 100644 index 0000000..81bfb4e --- /dev/null +++ b/infra-config/10-internal-cluster/03-openshift-image/move-pxe-assets.yml @@ -0,0 +1,16 @@ +--- +- name: Create a directory if it does not exist + ansible.builtin.file: + path: "{{ hostvars[groups['matchbox'][0]].assets }}/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}" + state: directory + mode: '0755' + become: true + +- name: Copy file with owner and permissions + ansible.builtin.copy: + src: 03-openshift-image/boot-artifacts/ + dest: "{{ hostvars[groups['matchbox'][0]].assets }}/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}/" + owner: matchbox + group: matchbox + mode: '0644' + become: true diff --git a/infra-config/10-internal-cluster/03-openshift-image/templates/agent-config.yaml.j2 b/infra-config/10-internal-cluster/03-openshift-image/templates/agent-config.yaml.j2 new file mode 100644 index 0000000..70ca0e0 --- /dev/null +++ b/infra-config/10-internal-cluster/03-openshift-image/templates/agent-config.yaml.j2 @@ -0,0 +1,33 @@ +apiVersion: v1alpha1 +kind: AgentConfig +metadata: + name: {{ hostvars[groups['hub_cluster'][0]].cluster_name }} +rendezvousIP: {{ hostvars['ocp-hub'].ip_address }} +bootArtifactsBaseURL: {{ hostvars[groups['matchbox'][0]].http_endpoint }}/assets/hub/ +hosts: + - hostname: {{ hostvars['ocp-hub'].hostname }} + role: master + interfaces: + - name: {{ hostvars['ocp-hub'].primary_interface }} + macAddress: {{ hostvars['ocp-hub'].mac_address }} + networkConfig: + interfaces: + - name: {{ hostvars['ocp-hub'].primary_interface }} + type: ethernet + state: up + identifier: mac-address + mac-address: {{ hostvars['ocp-hub'].mac_address }} + ipv4: + enabled: true + dhcp: true + dns-resolver: + config: + server: + - 10.1.71.251 + - 10.1.71.252 + routes: + config: + - destination: 0.0.0.0/0 + next-hop-address: 10.1.71.1 + next-hop-interface: {{ hostvars['ocp-hub'].primary_interface }} + table-id: 254 diff --git a/infra-config/10-internal-cluster/03-openshift-image/templates/install-config.yaml.j2 b/infra-config/10-internal-cluster/03-openshift-image/templates/install-config.yaml.j2 new file mode 100644 index 0000000..c250cce --- /dev/null +++ b/infra-config/10-internal-cluster/03-openshift-image/templates/install-config.yaml.j2 @@ -0,0 +1,25 @@ +apiVersion: v1 +baseDomain: {{ hostvars[groups['hub_cluster'][0]].base_domain }} +compute: +- name: worker + replicas: {{ hostvars[groups['hub_cluster'][0]].worker_node_count }} +controlPlane: + hyperthreading: Enabled + name: master + replicas: {{ hostvars[groups['hub_cluster'][0]].master_node_count }} +metadata: + name: {{ hostvars[groups['hub_cluster'][0]].cluster_name }} +networking: + clusterNetwork: + - cidr: {{ hostvars[groups['hub_cluster'][0]].cluster_network }} + hostPrefix: {{ hostvars[groups['hub_cluster'][0]].cluster_network_host_prefix }} + machineNetwork: + - cidr: {{ hostvars[groups['hub_cluster'][0]].machine_network }} + networkType: OVNKubernetes + serviceNetwork: + - {{ hostvars[groups['hub_cluster'][0]].service_network }} +platform: + {{ hostvars[groups['hub_cluster'][0]].platform_type }}: {} +fips: false +pullSecret: '{{ vault_pull_secret }}' +sshKey: '{{ vault_ssh_key }}' diff --git a/infra-config/10-internal-cluster/04-matchbox/templates/groups.tf.j2 b/infra-config/10-internal-cluster/04-matchbox/templates/groups.tf.j2 new file mode 100644 index 0000000..ae7ef1b --- /dev/null +++ b/infra-config/10-internal-cluster/04-matchbox/templates/groups.tf.j2 @@ -0,0 +1,8 @@ +// Matcher group for OCP Internal machines +resource "matchbox_group" "{{ hostvars[groups['hub_cluster'][0]].cluster_name }}" { + name = "{{ hostvars['ocp-hub'].hostname }}" # Physical Server + profile = matchbox_profile.openshift-agent-install.name + selector = { + mac = "{{ hostvars['ocp-hub'].mac_address }}" # PXE boots and installs to 10GbE NIC + } +} diff --git a/infra-config/10-internal-cluster/04-matchbox/templates/profiles.tf.j2 b/infra-config/10-internal-cluster/04-matchbox/templates/profiles.tf.j2 new file mode 100644 index 0000000..5e54f8e --- /dev/null +++ b/infra-config/10-internal-cluster/04-matchbox/templates/profiles.tf.j2 @@ -0,0 +1,16 @@ +// Fedora CoreOS profile +resource "matchbox_profile" "openshift-agent-install" { + name = "{{ hostvars[groups['hub_cluster'][0]].cluster_name }}" + kernel = "/assets/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}/agent.x86_64-vmlinuz" + initrd = [ + "--name initrd /assets/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}/agent.x86_64-initrd.img" + ] + + args = [ + "initrd=initrd", + "coreos.live.rootfs_url={{ hostvars[groups['matchbox'][0]].http_endpoint }}/assets/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}/agent.x86_64-rootfs.img", + "rw", + "ignition.firstboot", + "ignition.platform.id=metal", + ] +} diff --git a/infra-config/10-internal-cluster/04-matchbox/templates/provider.tf.j2 b/infra-config/10-internal-cluster/04-matchbox/templates/provider.tf.j2 new file mode 100644 index 0000000..2c6c8b8 --- /dev/null +++ b/infra-config/10-internal-cluster/04-matchbox/templates/provider.tf.j2 @@ -0,0 +1,20 @@ +// Configure the matchbox provider +provider "matchbox" { + endpoint = "{{ hostvars[groups['matchbox'][0]].rpc_endpoint }}" + client_cert = file("/etc/matchbox/client.crt") + client_key = file("/etc/matchbox/client.key") + ca = file("/etc/matchbox/ca.crt") +} + +terraform { + required_providers { + ct = { + source = "poseidon/ct" + version = "0.13.0" + } + matchbox = { + source = "poseidon/matchbox" + version = "0.5.4" + } + } +} diff --git a/infra-config/10-internal-cluster/05-bootstrap-acm/README.md b/infra-config/10-internal-cluster/05-bootstrap-acm/README.md new file mode 100644 index 0000000..e69de29 diff --git a/infra-config/10-internal-cluster/05-bootstrap-acm/install2.yml b/infra-config/10-internal-cluster/05-bootstrap-acm/install2.yml new file mode 100644 index 0000000..53e60b0 --- /dev/null +++ b/infra-config/10-internal-cluster/05-bootstrap-acm/install2.yml @@ -0,0 +1,13 @@ +--- +- name: Run all tasks necessary to configure matchbox to install the cluster + hosts: matchbox + connection: local + gather_facts: true + + tasks: + - name: Clone Git repository + ansible.builtin.git: + repo: "https://github.com/redhatryan/acm-hub-bootstrap.git" + dest: 05-bootstrap-acm + version: main + become: true diff --git a/infra-config/10-internal-cluster/install.yml b/infra-config/10-internal-cluster/install.yml new file mode 100644 index 0000000..bacdafe --- /dev/null +++ b/infra-config/10-internal-cluster/install.yml @@ -0,0 +1,62 @@ +--- +- name: Run all tasks necessary to configure matchbox to install the cluster + hosts: matchbox + connection: local + gather_facts: true + + tasks: + - name: Deploy DNS entries for cluster via Terraform + community.general.terraform: + project_path: 01-dns/ + variables: + freeipa_password: "{{ vault_freeipa_password }}" + state: present + force_init: true + + - name: Deploy DHCP entries for cluster via Terraform + ansible.builtin.include_tasks: + file: 02-dhcp/ip-reservations.yml + + - name: OpenShift Installer install-config.yaml + ansible.builtin.template: + src: 03-openshift-image/templates/install-config.yaml.j2 + dest: 03-openshift-image/install-config.yaml + mode: '0644' + + - name: OpenShift Installer agent-config.yaml + ansible.builtin.template: + src: 03-openshift-image/templates/agent-config.yaml.j2 + dest: 03-openshift-image/agent-config.yaml + mode: '0644' + + - name: Create OpenShift image + ansible.builtin.include_tasks: + file: 03-openshift-image/create-openshift-image.yml + + - name: Move PXE assets to matchbox + ansible.builtin.include_tasks: + file: 03-openshift-image/move-pxe-assets.yml + + - name: Terraform matchbox groups file + ansible.builtin.template: + src: 04-matchbox/templates/groups.tf.j2 + dest: 04-matchbox/groups.tf + mode: '0644' + + - name: Terraform matchbox profiles file + ansible.builtin.template: + src: 04-matchbox/templates/profiles.tf.j2 + dest: 04-matchbox/profiles.tf + mode: '0644' + + - name: Terraform matchbox provider file + ansible.builtin.template: + src: 04-matchbox/templates/provider.tf.j2 + dest: 04-matchbox/provider.tf + mode: '0644' + + - name: Configure Matchbox via Terraform + community.general.terraform: + project_path: 04-matchbox/ + state: present + force_init: true diff --git a/infra-config/ansible/group_vars/unbound_servers/main.yml b/infra-config/ansible/group_vars/unbound_servers/main.yml deleted file mode 100644 index e8a7191..0000000 --- a/infra-config/ansible/group_vars/unbound_servers/main.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -unbound_do_ip6: "no" -#unbound_forward_zones: -unbound_chroot: "/etc/unbound" -#unbound_pidfile: "/etc/unbound/unbound.pid" diff --git a/infra-config/ansible/host_vars/unbound/vars/main.yml b/infra-config/ansible/host_vars/unbound/vars/main.yml deleted file mode 100644 index 478667a..0000000 --- a/infra-config/ansible/host_vars/unbound/vars/main.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -hostname: unbound.int.mk-labs.cloud diff --git a/infra-config/ansible/host_vars/unbound01.yml b/infra-config/ansible/host_vars/unbound01.yml deleted file mode 100644 index 3f2df67..0000000 --- a/infra-config/ansible/host_vars/unbound01.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -hostname: unbound01.int.mk-labs.cloud diff --git a/infra-config/ansible/host_vars/unbound02.yml b/infra-config/ansible/host_vars/unbound02.yml deleted file mode 100644 index 7b8dd5a..0000000 --- a/infra-config/ansible/host_vars/unbound02.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -hostname: unbound02.int.mk-labs.cloud diff --git a/infra-config/ansible/inventory b/infra-config/ansible/inventory index bce93cb..4c3980c 100644 --- a/infra-config/ansible/inventory +++ b/infra-config/ansible/inventory @@ -1,27 +1,9 @@ --- -proxmox: - hosts: - pve01: - ansible_host: 10.1.71.51 - pve02: - ansible_host: 10.1.71.52 - pve03: - ansible_host: 10.1.71.53 - backup: hosts: backup: ansible_host: 10.1.71.9 -unbound_servers: - hosts: - unbound: - ansible_host: 10.1.71.254 - unbound01: - ansible_host: 10.1.71.254 - unbound02: - ansible_host: 10.1.71.253 - ipaserver: hosts: infra01: @@ -29,8 +11,6 @@ ipaserver: ipareplicas: hosts: -# infra02.int.mk-labs.cloud: -# ansible_host: 10.1.71.6 #infra: # hosts: diff --git a/infra-config/ansible/roles/unbound/files/unbound.conf b/infra-config/ansible/roles/unbound/files/unbound.conf deleted file mode 100644 index 2fa5684..0000000 --- a/infra-config/ansible/roles/unbound/files/unbound.conf +++ /dev/null @@ -1,236 +0,0 @@ -## Authoritative, validating, recursive caching DNS -## unbound.conf -- https://calomel.org -# -server: - # log verbosity - verbosity: 1 - chroot: "" - - # specify the interfaces to answer queries from by ip-address. The default - # is to listen to localhost (127.0.0.1 and ::1). specify 0.0.0.0 and ::0 to - # bind to all available interfaces. specify every interface[@port] on a new - # 'interface:' labeled line. The listen interfaces are not changed on - # reload, only on restart. - interface: 0.0.0.0 - - # port to answer queries from - port: 53 - - # Enable IPv4, "yes" or "no". - do-ip4: yes - - # Enable IPv6, "yes" or "no". - do-ip6: no - - # Enable UDP, "yes" or "no". - do-udp: yes - - # Enable TCP, "yes" or "no". If TCP is not needed, Unbound is actually - # quicker to resolve as the functions related to TCP checks are not done.i - # NOTE: you may need tcp enabled to get the DNSSEC results from *.edu domains - # due to their size. - do-tcp: yes - - # control which client ips are allowed to make (recursive) queries to this - # server. Specify classless netblocks with /size and action. By default - # everything is refused, except for localhost. Choose deny (drop message), - # refuse (polite error reply), allow (recursive ok), allow_snoop (recursive - # and nonrecursive ok) - access-control: 192.168.1.0/24 allow - access-control: 192.168.3.0/24 allow - access-control: 192.168.10.0/24 allow - access-control: 10.1.71.0/24 allow - - # Read the root hints from this file. Default is nothing, using built in - # hints for the IN class. The file has the format of zone files, with root - # nameserver names and addresses only. The default may become outdated, - # when servers change, therefore it is good practice to use a root-hints - # file. get one from https://www.internic.net/domain/named.root - root-hints: "/etc/unbound/root.hints" - - # enable to not answer id.server and hostname.bind queries. - hide-identity: yes - - # enable to not answer version.server and version.bind queries. - hide-version: yes - - # Will trust glue only if it is within the servers authority. - # Harden against out of zone rrsets, to avoid spoofing attempts. - # Hardening queries multiple name servers for the same data to make - # spoofing significantly harder and does not mandate dnssec. - harden-glue: yes - - # Require DNSSEC data for trust-anchored zones, if such data is absent, the - # zone becomes bogus. Harden against receiving dnssec-stripped data. If you - # turn it off, failing to validate dnskey data for a trustanchor will trigger - # insecure mode for that zone (like without a trustanchor). Default on, - # which insists on dnssec data for trust-anchored zones. - harden-dnssec-stripped: yes - - # Use 0x20-encoded random bits in the query to foil spoof attempts. - # http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00 - # While upper and lower case letters are allowed in domain names, no significance - # is attached to the case. That is, two names with the same spelling but - # different case are to be treated as if identical. This means calomel.org is the - # same as CaLoMeL.Org which is the same as CALOMEL.ORG. - use-caps-for-id: yes - - # the time to live (TTL) value lower bound, in seconds. Default 0. - # If more than an hour could easily give trouble due to stale data. - cache-min-ttl: 3600 - - # the time to live (TTL) value cap for RRsets and messages in the - # cache. Items are not cached for longer. In seconds. - cache-max-ttl: 86400 - - # perform prefetching of close to expired message cache entries. If a client - # requests the dns lookup and the TTL of the cached hostname is going to - # expire in less than 10% of its TTL, unbound will (1st) return the ip of the - # host to the client and (2nd) pre-fetch the dns request from the remote dns - # server. This method has been shown to increase the amount of cached hits by - # local clients by 10% on average. - prefetch: yes - - # number of threads to create. 1 disables threading. This should equal the number - # of CPU cores in the machine. Our example machine has 4 CPU cores. - num-threads: 2 - - - ## Unbound Optimization and Speed Tweaks ### - - # the number of slabs to use for cache and must be a power of 2 times the - # number of num-threads set above. more slabs reduce lock contention, but - # fragment memory usage. - msg-cache-slabs: 8 - rrset-cache-slabs: 8 - infra-cache-slabs: 8 - key-cache-slabs: 8 - - # Increase the memory size of the cache. Use roughly twice as much rrset cache - # memory as you use msg cache memory. Due to malloc overhead, the total memory - # usage is likely to rise to double (or 2.5x) the total cache memory. The test - # box has 4gig of ram so 256meg for rrset allows a lot of room for cacheed objects. - rrset-cache-size: 256m - msg-cache-size: 128m - - # buffer size for UDP port 53 incoming (SO_RCVBUF socket option). This sets - # the kernel buffer larger so that no messages are lost in spikes in the traffic. - so-rcvbuf: 1m - - ## Unbound Optimization and Speed Tweaks ### - - - # Enforce privacy of these addresses. Strips them away from answers. It may - # cause DNSSEC validation to additionally mark it as bogus. Protects against - # 'DNS Rebinding' (uses browser as network proxy). Only 'private-domain' and - # 'local-data' names are allowed to have these private addresses. No default. - private-address: 192.168.1.0/24 - private-address: 192.168.3.0/24 - private-address: 192.168.10.0/24 - private-address: 10.1.71.0/24 - - # Allow the domain (and its subdomains) to contain private addresses. - # local-data statements are allowed to contain private addresses too. - private-domain: "mk-labs.cloud" - - # If nonzero, unwanted replies are not only reported in statistics, but also - # a running total is kept per thread. If it reaches the threshold, a warning - # is printed and a defensive action is taken, the cache is cleared to flush - # potential poison out of it. A suggested value is 10000000, the default is - # 0 (turned off). We think 10K is a good value. - unwanted-reply-threshold: 10000 - - # IMPORTANT FOR TESTING: If you are testing and setup NSD or BIND on - # localhost you will want to allow the resolver to send queries to localhost. - # Make sure to set do-not-query-localhost: yes . If yes, the above default - # do-not-query-address entries are present. if no, localhost can be queried - # (for testing and debugging). - do-not-query-localhost: no - - # File with trusted keys, kept up to date using RFC5011 probes, initial file - # like trust-anchor-file, then it stores metadata. Use several entries, one - # per domain name, to track multiple zones. If you use forward-zone below to - # query the Google DNS servers you MUST comment out this option or all DNS - # queries will fail. - #auto-trust-anchor-file: "/etc/unbound/root.key" - - # Should additional section of secure message also be kept clean of unsecure - # data. Useful to shield the users of this validator from potential bogus - # data in the additional section. All unsigned data in the additional section - # is removed from secure messages. - val-clean-additional: yes - - # Blocking Ad Server domains. Google's AdSense, DoubleClick and Yahoo - # account for a 70 percent share of all advertising traffic. Block them. - # local-zone: "doubleclick.net" redirect - # local-data: "doubleclick.net A 127.0.0.1" - # local-zone: "googlesyndication.com" redirect - # local-data: "googlesyndication.com A 127.0.0.1" - # local-zone: "googleadservices.com" redirect - # local-data: "googleadservices.com A 127.0.0.1" - # local-zone: "google-analytics.com" redirect - # local-data: "google-analytics.com A 127.0.0.1" - # local-zone: "ads.youtube.com" redirect - # local-data: "ads.youtube.com A 127.0.0.1" - # local-zone: "adserver.yahoo.com" redirect - # local-data: "adserver.yahoo.com A 127.0.0.1" - # local-zone: "ask.com" redirect - # local-data: "ask.com A 127.0.0.1" - - # Unbound will not load if you specify the same local-zone and local-data - # servers in the main configuration as well as in this "include:" file. We - # suggest commenting out any of the local-zone and local-data lines above if - # you suspect they could be included in the unbound_ad_servers servers file. - #include: "/etc/unbound/unbound_ad_servers" - - # locally served zones can be configured for the machines on the LAN. - -# local-zone: "home.lan." static - -# local-data: "firewall.home.lan. IN A 10.0.0.1" - -# local-data-ptr: "10.0.0.1 firewall.home.lan" - - # Unbound can query your NSD or BIND server for private domain queries too. - # On our NSD page we have NSD configured to serve the private domain, - # "home.lan". Here we can tell Unbound to connect to the NSD server when it - # needs to resolve a *.home.lan hostname or IP. - # - # private-domain: "home.lan" - # local-zone: "0.0.10.in-addr.arpa." nodefault - # stub-zone: - # name: "home.lan" - # stub-addr: 10.0.0.111@53 - - # If you have an internal or private DNS names the external DNS servers can - # not resolve, then you can assign domain name strings to be redirected to a - # seperate dns server. For example, our comapny has the domain - # organization.com and the domain name internal.organization.com can not be - # resolved by Google's public DNS, but can be resolved by our private DNS - # server located at 1.1.1.1. The following tells Unbound that any - # organization.com domain, i.e. *.organization.com be dns resolved by 1.1.1.1 - # instead of the public dns servers. - # - forward-zone: - name: "int.mk-labs.cloud" - forward-addr: 10.1.71.5 # Internal or private DNS - - # Use the following forward-zone to forward all queries to Google DNS, - # OpenDNS.com or your local ISP's dns servers for example. To test resolution - # speeds use "drill calomel.org @8.8.8.8" and look for the "Query time:" in - # milliseconds. - # - forward-zone: - name: "." - forward-addr: 1.0.0.1@53#one.one.one.one - forward-addr: 1.1.1.1@53#one.one.one.one -# forward-addr: 8.8.8.8@53#dns.google -# forward-addr: 9.9.9.9@53#dns.quad9.net -# forward-addr: 1.0.0.1@53#one.one.one.one -# forward-addr: 8.8.4.4@53#dns.google -# forward-addr: 149.112.112.112@53#dns.quad9.net - -# -# -## Authoritative, validating, recursive caching DNS -## unbound.conf -- https://calomel.org \ No newline at end of file diff --git a/infra-config/group_vars/internal_cluster/vars b/infra-config/group_vars/internal_cluster/vars new file mode 100644 index 0000000..429665b --- /dev/null +++ b/infra-config/group_vars/internal_cluster/vars @@ -0,0 +1,10 @@ +cluster_name: "openshift" +cluster_version: "4.17.20" +#base_domain: "int.mk-labs.cloud" +worker_node_count: 1 +master_node_count: 3 +cluster_network: "10.128.0.0/14" +cluster_network_host_prefix: 23 +machine_network: "10.1.71.0/24" +service_network: "172.30.0.0/16" +platform_type: "none" diff --git a/infra-config/ansible/group_vars/ipaserver/main.yml b/infra-config/group_vars/ipaserver/main.yml similarity index 100% rename from infra-config/ansible/group_vars/ipaserver/main.yml rename to infra-config/group_vars/ipaserver/main.yml diff --git a/infra-config/group_vars/unbound_servers/vars.yml b/infra-config/group_vars/unbound_servers/vars.yml index 68775a1..1ed812f 100644 --- a/infra-config/group_vars/unbound_servers/vars.yml +++ b/infra-config/group_vars/unbound_servers/vars.yml @@ -3,7 +3,8 @@ ### Server ### -unbound_num_threads: 1 +unbound_chroot: '""' +unbound_num_threads: 2 unbound_interfaces: - "{{ ip_address }}" #unbound_do_ip4: "yes" @@ -58,10 +59,10 @@ unbound_rpz_zones: [] # list of dicts unbound_stub_zones: [] # list of dicts unbound_forward_zones: - name: 'int.mk-labs.cloud' - forward-addrs: + forward-addr: - '10.1.71.5' - - name: "." - forward-addrs: + - name: '.' + forward-addr: - '1.0.0.1@53#one.one.one.one' - '1.1.1.1@53#one.one.one.one' diff --git a/infra-config/host_vars/int-master01/vars b/infra-config/host_vars/int-master01/vars new file mode 100644 index 0000000..c559848 --- /dev/null +++ b/infra-config/host_vars/int-master01/vars @@ -0,0 +1,9 @@ +--- +# file: host_vars/int-master01/vars + +# Networking +# primary_interface: "enp1s0f0" +mac_address: "54:bf:64:60:52:2d" +ip_address: 10.1.71.61 + +hostname: "{{ inventory_hostname }}.{{ base_domain }}" diff --git a/infra-config/host_vars/int-master02/vars b/infra-config/host_vars/int-master02/vars new file mode 100644 index 0000000..77aa4f8 --- /dev/null +++ b/infra-config/host_vars/int-master02/vars @@ -0,0 +1,9 @@ +--- +# file: host_vars/int-master01/vars + +# Networking +# primary_interface: "enp1s0f0" +mac_address: "54:bf:64:5f:a2:80" +ip_address: 10.1.71.62 + +hostname: "{{ inventory_hostname }}.{{ base_domain }}" diff --git a/infra-config/host_vars/int-master03/vars b/infra-config/host_vars/int-master03/vars new file mode 100644 index 0000000..def32e2 --- /dev/null +++ b/infra-config/host_vars/int-master03/vars @@ -0,0 +1,9 @@ +--- +# file: host_vars/int-master01/vars + +# Networking +# primary_interface: "enp1s0f0" +mac_address: "d8:9e:f3:4c:02:a9" +ip_address: 10.1.71.63 + +hostname: "{{ inventory_hostname }}.{{ base_domain }}" diff --git a/infra-config/host_vars/int-worker01/vars b/infra-config/host_vars/int-worker01/vars new file mode 100644 index 0000000..883ee92 --- /dev/null +++ b/infra-config/host_vars/int-worker01/vars @@ -0,0 +1,9 @@ +--- +# file: host_vars/int-master01/vars + +# Networking +# primary_interface: "enp1s0f0" +mac_address: "54:bf:64:60:52:2d" +ip_address: 10.1.71.64 + +hostname: "{{ inventory_hostname }}.{{ base_domain }}" diff --git a/infra-config/inventory.yml b/infra-config/inventory.yml index a5b39df..49de0f0 100644 --- a/infra-config/inventory.yml +++ b/infra-config/inventory.yml @@ -10,7 +10,7 @@ dhcp_server: unbound_servers: hosts: unbound01: -# unbound02: + unbound02: backup_servers: hosts: @@ -48,6 +48,13 @@ hub_cluster: hosts: ocp-hub: +internal_cluster: + hosts: + int-master01: + int-master02: + int-master03: + int-worker01: + sql_servers: hosts: sql01: diff --git a/infra-config/playbooks/configure_prometheus.yml b/infra-config/playbooks/configure_prometheus.yml new file mode 100644 index 0000000..67af753 --- /dev/null +++ b/infra-config/playbooks/configure_prometheus.yml @@ -0,0 +1,16 @@ +--- +- name: Master playbook to install and configure prometheus + hosts: prometheus_server + become: true + + tasks: + - name: Permit traffic in default zone for dns service + firewalld: + port: 9090/tcp + permanent: true + immediate: true + state: enabled + + - name: Install unbound via role + ansible.builtin.import_role: + name: prometheus.prometheus.prometheus diff --git a/infra-config/playbooks/configure_unbound copy.yml b/infra-config/playbooks/configure_unbound copy.yml new file mode 100644 index 0000000..674340a --- /dev/null +++ b/infra-config/playbooks/configure_unbound copy.yml @@ -0,0 +1,10 @@ +--- +- name: Master playbook to configure openshift cluster (internal) + hosts: internal_cluster + become: true + + tasks: + + - name: Install unbound via role + ansible.builtin.import_role: + name: Anthony25.unbound diff --git a/infra-config/playbooks/configure_unbound.yml b/infra-config/playbooks/configure_unbound.yml index 10c2fbd..48212f8 100644 --- a/infra-config/playbooks/configure_unbound.yml +++ b/infra-config/playbooks/configure_unbound.yml @@ -1,34 +1,37 @@ --- - name: Master playbook to install and configure unbound hosts: unbound_servers + become: true tasks: + - name: Permit traffic in default zone for dns service + ansible.posix.firewalld: + service: dns + permanent: true + immediate: true + state: enabled + + - name: Create the directory + ansible.builtin.file: + path: /etc/systemd/resolved.conf.d + state: directory + mode: '0755' + owner: root + group: root + + - name: Put `unbound.conf` in the correct place + ansible.builtin.copy: + src: ../roles/common/files/unbound.conf + dest: /etc/systemd/resolved.conf.d/unbound.conf + mode: '0644' + owner: root + group: root + + - name: Restart service systemd-resolved + ansible.builtin.service: + name: systemd-resolved + state: restarted + - name: Install unbound via role -# delegate_to: "localhost" ansible.builtin.import_role: name: Anthony25.unbound - # vars: - # server: - # interface: "{{ ip_address }}" - # access_control: - # - '192.168.1.0/24 allow' - # - '192.168.3.0/24 allow' - # - '192.168.5.0/24 allow' - # - '192.168.10.0/24 allow' - # - '10.1.71.0/24 allow' - # private_address: - # - '192.168.1.0/24' - # - '192.168.3.0/24' - # - '192.168.5.0/24' - # - '192.168.10.0/24' - # - '10.1.71.0/24' - # private-domain: - # - 'mk-labs.cloud' - # forward_zone: - # - name: 'int.mk-labs.cloud' - # forward-addrs: - # - '10.1.71.5' - # - name: "." - # forward-addrs: - # - '1.0.0.1@53#one.one.one.one' - # - '1.1.1.1@53#one.one.one.one' diff --git a/infra-config/ansible/idm-servers.yml b/infra-config/playbooks/idm-servers.yml similarity index 54% rename from infra-config/ansible/idm-servers.yml rename to infra-config/playbooks/idm-servers.yml index dfe4d7d..2d4a988 100644 --- a/infra-config/ansible/idm-servers.yml +++ b/infra-config/playbooks/idm-servers.yml @@ -3,8 +3,8 @@ hosts: ipaserver become: true vars_files: - - idm-vault.yml + - idm-vault.yml roles: - - role: freeipa.ansible_freeipa.ipaserver - state: present + - role: freeipa.ansible_freeipa.ipaserver + state: present diff --git a/infra-config/ansible/roles/unbound/files/resolved_unbound.conf b/infra-config/roles/common/files/unbound.conf similarity index 64% rename from infra-config/ansible/roles/unbound/files/resolved_unbound.conf rename to infra-config/roles/common/files/unbound.conf index 1d85020..6d8f61d 100644 --- a/infra-config/ansible/roles/unbound/files/resolved_unbound.conf +++ b/infra-config/roles/common/files/unbound.conf @@ -1,4 +1,4 @@ [Resolve] DNS=127.0.0.1 DNSSEC=yes -DNSStubListener=no +DNSStubListener=no \ No newline at end of file diff --git a/infra-config/roles/requirements.yml b/infra-config/roles/requirements.yml index b6075f5..4ad69f8 100644 --- a/infra-config/roles/requirements.yml +++ b/infra-config/roles/requirements.yml @@ -9,5 +9,5 @@ collections: - name: somaz94.ansible_k8s_iac_tool version: 1.1.6 - - name: bodsch.dns - version: 1.2.0 + - name: prometheus.prometheus + version: 0.27.0 \ No newline at end of file