sync repo to git

infra-config/04-vm-templates/README.md

@@ -24,6 +24,12 @@ fedora-<version>/
 │   └── ks.cfg              # Source block for Apache image
 └── README.md
 
+# Disable the firewall before starting
+
+```bash
+sudo systemctl stop firewalld
+```
+
 # Create templates
 
 ```bash

infra-config/10-internal-cluster/01-dhcp/host-reservations.yml

@@ -0,0 +1,13 @@
+---
+- name: Dnsmasq
+  hosts: localhost
+  become: yes
+  vars:
+    - additional_dhcp_hosts:
+        ethernet_switch:
+          desc: "SNO Hub Cluster"
+          mac: 98:b7:85:1e:c6:f1
+          ip: 10.1.71.10
+
+  roles:
+    - role: ricsanfre.dnsmasq

infra-config/10-internal-cluster/01-dns/.terraform.lock.hcl

@@ -0,0 +1,24 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/rework-space-com/freeipa" {
+  version     = "5.0.0"
+  constraints = "5.0.0"
+  hashes = [
+    "h1:6EquDv6GgQO2HjZUUoRIUVzYa951n+wb4Uk7ggD6XD0=",
+    "zh:098607e559c3b696401034ff494ba8068962b45059ee067a54b58334b6ee0f2c",
+    "zh:18b806a14bb9d9382213c6929af35f5a65f16c17ff526d475f1eab33d1470290",
+    "zh:2c8c74668844d256b7fdc503cd736a20b7e58db5b31880d1ad8090c1af04e24c",
+    "zh:3bba458b9a6df99c21da58750dd6586b93bdcc557e4a2d695e801ada39e8de1e",
+    "zh:58f728d9e98cc7aae3841c07318be64b6dcb2f51c041f04bba977e61104a2333",
+    "zh:597dfbefbfe111a31e9ff3c4fc14fc8e12c1e255454087d3eebd2ec6c7aa9bf3",
+    "zh:6093d6db13d834c23f5482efae80c8e1ae046028fccf24242f0f1c1935e6aa70",
+    "zh:87271fa234a57ce05d4166e444002bd66976f971b434f7add45c874c9587129d",
+    "zh:89f7f6be64b6bf9e708fbafd22f410cf3f50b1fcd4cd6c61e9ffffd6180ea839",
+    "zh:9bdd7a984f845ff6f4bc4df5cc41a9de019639fceca62e60fc7c0f098ad2695c",
+    "zh:a0551311c96b86050d15854b4fca2beaa06b2e1964f97945824567d0b90db580",
+    "zh:c3daa12021725883bd32d7d852a2de845bb7a5f18009a45be7c2c2d891631713",
+    "zh:d7871eb99683934a30b9d47508379e6d16978f3dcd73601af2204652668592aa",
+    "zh:e8f72fd7750e6c1f0f97d039fea66cb85f457cf22908b7c3f14c7d2cf990ee84",
+  ]
+}

infra-config/10-internal-cluster/01-dns/README.md

@@ -0,0 +1,3 @@
+# DNS Provider Configuration
+
+This directory contains the configuration to updateFreeIPA DNS for the Hub Cluster.

infra-config/10-internal-cluster/01-dns/dns.tf

@@ -0,0 +1,39 @@
+resource "freeipa_dns_record" "ocp-hub" {
+  zone_name = "int.mk-labs.cloud."
+  name = "ocp-hub"
+  type = "A"
+  records = [
+    "10.1.71.10",
+  ]
+  ttl = 60
+}
+
+resource "freeipa_dns_record" "api" {
+  zone_name = "int.mk-labs.cloud."
+  name = "api.hub"
+  type = "A"
+  records = [
+    "10.1.71.10",
+  ]
+  ttl = 60
+}
+
+resource "freeipa_dns_record" "api-int" {
+  zone_name = "int.mk-labs.cloud."
+  name = "api-int.hub"
+  type = "A"
+  records = [
+    "10.1.71.10",
+  ]
+  ttl = 60
+}
+
+resource "freeipa_dns_record" "wildcard-apps" {
+  zone_name = "int.mk-labs.cloud."
+  name = "*.apps.hub"
+  type = "A"
+  records = [
+    "10.1.71.10",
+  ]
+  ttl = 60
+}

infra-config/10-internal-cluster/01-dns/provider.tf

@@ -0,0 +1,22 @@
+# Configure the DNS Provider
+provider "freeipa" {
+  host        = "infra01.int.mk-labs.cloud"
+  username    = "admin"
+  password    = var.freeipa_password
+  insecure    = true
+}
+
+variable "freeipa_password" {
+  description = "The password for the FreeIPA provider"
+  type        = string
+  sensitive   = true
+}
+
+terraform {
+  required_providers {
+    freeipa = {
+      source = "rework-space-com/freeipa"
+      version = "5.0.0"
+    }
+  }
+}

infra-config/10-internal-cluster/02-dhcp/README.md

@@ -0,0 +1 @@
+# Add/modify entry in DNSmasq

infra-config/10-internal-cluster/02-dhcp/ip-reservations.yml

@@ -0,0 +1,28 @@
+---
+- name: Ensure dnsmasq is installed
+  ansible.builtin.apt:
+    name: dnsmasq
+    state: present
+  become: true
+  when: ansible_os_family == "Debian"
+
+- name: Ensure dnsmasq is installed
+  ansible.builtin.dnf:
+    name: dnsmasq
+    state: present
+  become: true
+  when: ansible_os_family == "RedHat"
+
+- name: Add host reservation to dnsmasq
+  ansible.builtin.lineinfile:
+    path: /etc/dnsmasq.d/hosts.conf
+    regexp: "^dhcp-host={{ hostvars['ocp-hub'].mac_address }}"
+    line: "dhcp-host={{ hostvars['ocp-hub'].mac_address }},{{ hostvars['ocp-hub'].ip_address }} #{{ hostvars['ocp-hub'].hostname }}"
+    state: present
+  become: true
+
+- name: Restart dnsmasq service
+  ansible.builtin.service:
+    name: dnsmasq
+    state: restarted
+  become: true

infra-config/10-internal-cluster/03-openshift-image/README.md

@@ -0,0 +1,7 @@
+# Configure the OpenShift Agent Installer and Matchbox
+
+## Reference Document
+
+<https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/epub/installing_an_on-premise_cluster_with_the_agent-based_installer/prepare-pxe-assets-agent#prepare-pxe-assets-agent>
+
+Recap of image creation is in 10-sno-hub-cluster/02-matchbox/.openshift_install.log

infra-config/10-internal-cluster/03-openshift-image/create-openshift-image.yml

@@ -0,0 +1,5 @@
+---
+- name: OpenShift image creation
+  ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
+  args:
+    chdir: 03-openshift-image

infra-config/10-internal-cluster/03-openshift-image/move-pxe-assets.yml

@@ -0,0 +1,16 @@
+---
+- name: Create a directory if it does not exist
+  ansible.builtin.file:
+    path: "{{ hostvars[groups['matchbox'][0]].assets }}/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}"
+    state: directory
+    mode: '0755'
+  become: true
+
+- name: Copy file with owner and permissions
+  ansible.builtin.copy:
+    src: 03-openshift-image/boot-artifacts/
+    dest: "{{ hostvars[groups['matchbox'][0]].assets }}/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}/"
+    owner: matchbox
+    group: matchbox
+    mode: '0644'
+  become: true

infra-config/10-internal-cluster/03-openshift-image/templates/agent-config.yaml.j2

@@ -0,0 +1,33 @@
+apiVersion: v1alpha1
+kind: AgentConfig
+metadata:
+  name: {{ hostvars[groups['hub_cluster'][0]].cluster_name }}
+rendezvousIP: {{ hostvars['ocp-hub'].ip_address }}
+bootArtifactsBaseURL: {{ hostvars[groups['matchbox'][0]].http_endpoint }}/assets/hub/
+hosts:
+  - hostname: {{ hostvars['ocp-hub'].hostname }}
+    role: master
+    interfaces:
+      - name: {{ hostvars['ocp-hub'].primary_interface }}
+        macAddress: {{ hostvars['ocp-hub'].mac_address }}
+    networkConfig:
+      interfaces:
+        - name: {{ hostvars['ocp-hub'].primary_interface }}
+          type: ethernet
+          state: up
+          identifier: mac-address
+          mac-address: {{ hostvars['ocp-hub'].mac_address }}
+          ipv4:
+            enabled: true
+            dhcp: true
+      dns-resolver:
+        config:
+          server:
+            - 10.1.71.251
+            - 10.1.71.252
+      routes:
+        config:
+          - destination: 0.0.0.0/0
+            next-hop-address: 10.1.71.1
+            next-hop-interface: {{ hostvars['ocp-hub'].primary_interface }}
+            table-id: 254

infra-config/10-internal-cluster/03-openshift-image/templates/install-config.yaml.j2

@@ -0,0 +1,25 @@
+apiVersion: v1
+baseDomain: {{ hostvars[groups['hub_cluster'][0]].base_domain }}
+compute:
+- name: worker
+  replicas: {{ hostvars[groups['hub_cluster'][0]].worker_node_count }}
+controlPlane:
+  hyperthreading: Enabled
+  name: master
+  replicas: {{ hostvars[groups['hub_cluster'][0]].master_node_count }}
+metadata:
+  name: {{ hostvars[groups['hub_cluster'][0]].cluster_name }}
+networking:
+  clusterNetwork:
+  - cidr: {{ hostvars[groups['hub_cluster'][0]].cluster_network }}
+    hostPrefix: {{ hostvars[groups['hub_cluster'][0]].cluster_network_host_prefix }}
+  machineNetwork:
+  - cidr: {{ hostvars[groups['hub_cluster'][0]].machine_network }}
+  networkType: OVNKubernetes
+  serviceNetwork:
+  - {{ hostvars[groups['hub_cluster'][0]].service_network }}
+platform:
+  {{ hostvars[groups['hub_cluster'][0]].platform_type }}: {}
+fips: false
+pullSecret: '{{ vault_pull_secret }}'
+sshKey: '{{ vault_ssh_key }}'

infra-config/10-internal-cluster/04-matchbox/templates/groups.tf.j2

@@ -0,0 +1,8 @@
+// Matcher group for OCP Internal machines
+resource "matchbox_group" "{{ hostvars[groups['hub_cluster'][0]].cluster_name }}" {
+  name = "{{ hostvars['ocp-hub'].hostname }}" # Physical Server
+  profile = matchbox_profile.openshift-agent-install.name
+  selector = {
+    mac = "{{ hostvars['ocp-hub'].mac_address }}" # PXE boots and installs to 10GbE NIC
+  }
+}

infra-config/10-internal-cluster/04-matchbox/templates/profiles.tf.j2

@@ -0,0 +1,16 @@
+// Fedora CoreOS profile
+resource "matchbox_profile" "openshift-agent-install" {
+  name   = "{{ hostvars[groups['hub_cluster'][0]].cluster_name }}"
+  kernel = "/assets/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}/agent.x86_64-vmlinuz"
+  initrd = [
+    "--name initrd /assets/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}/agent.x86_64-initrd.img"
+  ]
+
+  args = [
+    "initrd=initrd",
+    "coreos.live.rootfs_url={{ hostvars[groups['matchbox'][0]].http_endpoint }}/assets/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}/agent.x86_64-rootfs.img",
+    "rw",
+    "ignition.firstboot",
+    "ignition.platform.id=metal",
+  ]
+}

infra-config/10-internal-cluster/04-matchbox/templates/provider.tf.j2

@@ -0,0 +1,20 @@
+// Configure the matchbox provider
+provider "matchbox" {
+  endpoint    = "{{ hostvars[groups['matchbox'][0]].rpc_endpoint }}"
+  client_cert = file("/etc/matchbox/client.crt")
+  client_key  = file("/etc/matchbox/client.key")
+  ca          = file("/etc/matchbox/ca.crt")
+}
+
+terraform {
+  required_providers {
+    ct = {
+      source  = "poseidon/ct"
+      version = "0.13.0"
+    }
+    matchbox = {
+      source  = "poseidon/matchbox"
+      version = "0.5.4"
+    }
+  }
+}

infra-config/10-internal-cluster/05-bootstrap-acm/install2.yml

@@ -0,0 +1,13 @@
+---
+- name: Run all tasks necessary to configure matchbox to install the cluster
+  hosts: matchbox
+  connection: local
+  gather_facts: true
+
+  tasks:
+    - name: Clone Git repository
+      ansible.builtin.git:
+        repo: "https://github.com/redhatryan/acm-hub-bootstrap.git"
+        dest: 05-bootstrap-acm
+        version: main
+      become: true

infra-config/10-internal-cluster/install.yml

@@ -0,0 +1,62 @@
+---
+- name: Run all tasks necessary to configure matchbox to install the cluster
+  hosts: matchbox
+  connection: local
+  gather_facts: true
+
+  tasks:
+    - name: Deploy DNS entries for cluster via Terraform
+      community.general.terraform:
+        project_path: 01-dns/
+        variables:
+          freeipa_password: "{{ vault_freeipa_password }}"
+        state: present
+        force_init: true
+
+    - name: Deploy DHCP entries for cluster via Terraform
+      ansible.builtin.include_tasks:
+        file: 02-dhcp/ip-reservations.yml
+
+    - name: OpenShift Installer install-config.yaml
+      ansible.builtin.template:
+        src: 03-openshift-image/templates/install-config.yaml.j2
+        dest: 03-openshift-image/install-config.yaml
+        mode: '0644'
+
+    - name: OpenShift Installer agent-config.yaml
+      ansible.builtin.template:
+        src: 03-openshift-image/templates/agent-config.yaml.j2
+        dest: 03-openshift-image/agent-config.yaml
+        mode: '0644'
+
+    - name: Create OpenShift image
+      ansible.builtin.include_tasks:
+        file: 03-openshift-image/create-openshift-image.yml
+
+    - name: Move PXE assets to matchbox
+      ansible.builtin.include_tasks:
+        file: 03-openshift-image/move-pxe-assets.yml
+
+    - name: Terraform matchbox groups file
+      ansible.builtin.template:
+        src: 04-matchbox/templates/groups.tf.j2
+        dest: 04-matchbox/groups.tf
+        mode: '0644'
+
+    - name: Terraform matchbox profiles file
+      ansible.builtin.template:
+        src: 04-matchbox/templates/profiles.tf.j2
+        dest: 04-matchbox/profiles.tf
+        mode: '0644'
+
+    - name: Terraform matchbox provider file
+      ansible.builtin.template:
+        src: 04-matchbox/templates/provider.tf.j2
+        dest: 04-matchbox/provider.tf
+        mode: '0644'
+
+    - name: Configure Matchbox via Terraform
+      community.general.terraform:
+        project_path: 04-matchbox/
+        state: present
+        force_init: true

infra-config/ansible/group_vars/unbound_servers/main.yml

@@ -1,5 +0,0 @@
----
-unbound_do_ip6: "no"
-#unbound_forward_zones:
-unbound_chroot: "/etc/unbound"
-#unbound_pidfile: "/etc/unbound/unbound.pid"

infra-config/ansible/host_vars/unbound/vars/main.yml

@@ -1,2 +0,0 @@
----
-hostname: unbound.int.mk-labs.cloud

infra-config/ansible/host_vars/unbound01.yml

@@ -1,2 +0,0 @@
----
-hostname: unbound01.int.mk-labs.cloud

infra-config/ansible/host_vars/unbound02.yml

@@ -1,2 +0,0 @@
----
-hostname: unbound02.int.mk-labs.cloud

infra-config/ansible/inventory

@@ -1,27 +1,9 @@
 ---
-proxmox:
-  hosts:
-    pve01:
-      ansible_host: 10.1.71.51
-    pve02:
-      ansible_host: 10.1.71.52
-    pve03:
-      ansible_host: 10.1.71.53
-
 backup:
   hosts:
     backup:
       ansible_host: 10.1.71.9
 
-unbound_servers:
-  hosts:
-    unbound:
-      ansible_host: 10.1.71.254
-    unbound01:
-      ansible_host: 10.1.71.254
-    unbound02:
-      ansible_host: 10.1.71.253
-
 ipaserver:
   hosts:
     infra01:
@@ -29,8 +11,6 @@ ipaserver:
 
 ipareplicas:
   hosts:
-#    infra02.int.mk-labs.cloud:
-#      ansible_host: 10.1.71.6
       
 #infra:
 #  hosts:

infra-config/ansible/roles/unbound/files/unbound.conf

@@ -1,236 +0,0 @@
-## Authoritative, validating, recursive caching DNS
-## unbound.conf -- https://calomel.org
-#
-server:
-  # log verbosity
-    verbosity: 1
-    chroot: ""
-
-  # specify the interfaces to answer queries from by ip-address.  The default
-  # is to listen to localhost (127.0.0.1 and ::1).  specify 0.0.0.0 and ::0 to
-  # bind to all available interfaces.  specify every interface[@port] on a new
-  # 'interface:' labeled line.  The listen interfaces are not changed on
-  # reload, only on restart.
-    interface: 0.0.0.0
-
-  # port to answer queries from
-    port: 53
-
-  # Enable IPv4, "yes" or "no".
-    do-ip4: yes
-
-  # Enable IPv6, "yes" or "no".
-    do-ip6: no
-
-  # Enable UDP, "yes" or "no".
-    do-udp: yes
-
-  # Enable TCP, "yes" or "no". If TCP is not needed, Unbound is actually
-  # quicker to resolve as the functions related to TCP checks are not done.i
-  # NOTE: you may need tcp enabled to get the DNSSEC results from *.edu domains
-  # due to their size.
-    do-tcp: yes
-
-  # control which client ips are allowed to make (recursive) queries to this
-  # server. Specify classless netblocks with /size and action.  By default
-  # everything is refused, except for localhost.  Choose deny (drop message),
-  # refuse (polite error reply), allow (recursive ok), allow_snoop (recursive
-  # and nonrecursive ok)
-    access-control: 192.168.1.0/24 allow
-    access-control: 192.168.3.0/24 allow
-    access-control: 192.168.10.0/24 allow
-    access-control: 10.1.71.0/24 allow
-
-  # Read  the  root  hints from this file. Default is nothing, using built in
-  # hints for the IN class. The file has the format of  zone files,  with  root
-  # nameserver  names  and  addresses  only. The default may become outdated,
-  # when servers change,  therefore  it is good practice to use a root-hints
-  # file.  get one from https://www.internic.net/domain/named.root 
-    root-hints: "/etc/unbound/root.hints"
-
-  # enable to not answer id.server and hostname.bind queries.
-    hide-identity: yes
-
-  # enable to not answer version.server and version.bind queries.
-    hide-version: yes
-
-  # Will trust glue only if it is within the servers authority.
-  # Harden against out of zone rrsets, to avoid spoofing attempts. 
-  # Hardening queries multiple name servers for the same data to make
-  # spoofing significantly harder and does not mandate dnssec.
-    harden-glue: yes
-
-  # Require DNSSEC data for trust-anchored zones, if such data is absent, the
-  # zone becomes  bogus.  Harden against receiving dnssec-stripped data. If you
-  # turn it off, failing to validate dnskey data for a trustanchor will trigger
-  # insecure mode for that zone (like without a trustanchor).  Default on,
-  # which insists on dnssec data for trust-anchored zones.
-    harden-dnssec-stripped: yes
-
-  # Use 0x20-encoded random bits in the query to foil spoof attempts.
-  # http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00
-  # While upper and lower case letters are allowed in domain names, no significance
-  # is attached to the case. That is, two names with the same spelling but
-  # different case are to be treated as if identical. This means calomel.org is the
-  # same as CaLoMeL.Org which is the same as CALOMEL.ORG.
-    use-caps-for-id: yes
-
-  # the time to live (TTL) value lower bound, in seconds. Default 0.
-  # If more than an hour could easily give trouble due to stale data.
-    cache-min-ttl: 3600
-
-  # the time to live (TTL) value cap for RRsets and messages in the
-  # cache. Items are not cached for longer. In seconds.
-    cache-max-ttl: 86400
-
-  # perform prefetching of close to expired message cache entries.  If a client
-  # requests the dns lookup and the TTL of the cached hostname is going to
-  # expire in less than 10% of its TTL, unbound will (1st) return the ip of the
-  # host to the client and (2nd) pre-fetch the dns request from the remote dns
-  # server. This method has been shown to increase the amount of cached hits by
-  # local clients by 10% on average.
-    prefetch: yes
-
-  # number of threads to create. 1 disables threading. This should equal the number
-  # of CPU cores in the machine. Our example machine has 4 CPU cores.
-    num-threads: 2
-
-
-  ## Unbound Optimization and Speed Tweaks ###
-
-  # the number of slabs to use for cache and must be a power of 2 times the
-  # number of num-threads set above. more slabs reduce lock contention, but
-  # fragment memory usage.
-    msg-cache-slabs: 8
-    rrset-cache-slabs: 8
-    infra-cache-slabs: 8
-    key-cache-slabs: 8
-
-  # Increase the memory size of the cache. Use roughly twice as much rrset cache
-  # memory as you use msg cache memory. Due to malloc overhead, the total memory
-  # usage is likely to rise to double (or 2.5x) the total cache memory. The test
-  # box has 4gig of ram so 256meg for rrset allows a lot of room for cacheed objects.
-    rrset-cache-size: 256m
-    msg-cache-size: 128m
-
-  # buffer size for UDP port 53 incoming (SO_RCVBUF socket option). This sets
-  # the kernel buffer larger so that no messages are lost in spikes in the traffic.
-    so-rcvbuf: 1m
-
-  ## Unbound Optimization and Speed Tweaks ###
-
-
-  # Enforce privacy of these addresses. Strips them away from answers.  It may
-  # cause DNSSEC validation to additionally mark it as bogus.  Protects against
-  # 'DNS Rebinding' (uses browser as network proxy).  Only 'private-domain' and
-  # 'local-data' names are allowed to have these private addresses. No default.
-    private-address: 192.168.1.0/24
-    private-address: 192.168.3.0/24
-    private-address: 192.168.10.0/24
-    private-address: 10.1.71.0/24
-
-  # Allow the domain (and its subdomains) to contain private addresses.
-  # local-data statements are allowed to contain private addresses too.
-    private-domain: "mk-labs.cloud"
-
-  # If nonzero, unwanted replies are not only reported in statistics, but also
-  # a running total is kept per thread. If it reaches the threshold, a warning
-  # is printed and a defensive action is taken, the cache is cleared to flush
-  # potential poison out of it.  A suggested value is 10000000, the default is
-  # 0 (turned off). We think 10K is a good value.
-    unwanted-reply-threshold: 10000
-
-  # IMPORTANT FOR TESTING: If you are testing and setup NSD or BIND  on
-  # localhost you will want to allow the resolver to send queries to localhost.
-  # Make sure to set do-not-query-localhost: yes . If yes, the above default
-  # do-not-query-address entries are present.  if no, localhost can be queried
-  # (for testing and debugging). 
-    do-not-query-localhost: no
-
-  # File with trusted keys, kept up to date using RFC5011 probes, initial file
-  # like trust-anchor-file, then it stores metadata.  Use several entries, one
-  # per domain name, to track multiple zones. If you use forward-zone below to
-  # query the Google DNS servers you MUST comment out this option or all DNS
-  # queries will fail.
-   #auto-trust-anchor-file: "/etc/unbound/root.key"
-
-  # Should additional section of secure message also be kept clean of unsecure
-  # data. Useful to shield the users of this validator from potential bogus
-  # data in the additional section. All unsigned data in the additional section
-  # is removed from secure messages.
-    val-clean-additional: yes
-
-  # Blocking Ad Server domains. Google's AdSense, DoubleClick and Yahoo
-  # account for a 70 percent share of all advertising traffic. Block them.
-  # local-zone: "doubleclick.net" redirect
-  # local-data: "doubleclick.net A 127.0.0.1"
-  # local-zone: "googlesyndication.com" redirect
-  # local-data: "googlesyndication.com A 127.0.0.1"
-  # local-zone: "googleadservices.com" redirect
-  # local-data: "googleadservices.com A 127.0.0.1"
-  # local-zone: "google-analytics.com" redirect
-  # local-data: "google-analytics.com A 127.0.0.1"
-  # local-zone: "ads.youtube.com" redirect
-  # local-data: "ads.youtube.com A 127.0.0.1"
-  # local-zone: "adserver.yahoo.com" redirect
-  # local-data: "adserver.yahoo.com A 127.0.0.1"
-  # local-zone: "ask.com" redirect
-  # local-data: "ask.com A 127.0.0.1"
-
-  # Unbound will not load if you specify the same local-zone and local-data
-  # servers in the main configuration as well as in this "include:" file. We
-  # suggest commenting out any of the local-zone and local-data lines above if
-  # you suspect they could be included in the unbound_ad_servers servers file.
-  #include: "/etc/unbound/unbound_ad_servers"
-
-  # locally served zones can be configured for the machines on the LAN.
-
-#    local-zone: "home.lan." static
-
-#    local-data: "firewall.home.lan.  IN A 10.0.0.1"
-
-#    local-data-ptr: "10.0.0.1  firewall.home.lan"
-
-  # Unbound can query your NSD or BIND server for private domain queries too.
-  # On our NSD page we have NSD configured to serve the private domain,
-  # "home.lan". Here we can tell Unbound to connect to the NSD server when it
-  # needs to resolve a *.home.lan hostname or IP.
-  #
-  # private-domain: "home.lan"
-  # local-zone: "0.0.10.in-addr.arpa." nodefault
-  # stub-zone:
-  #      name: "home.lan"
-  #      stub-addr: 10.0.0.111@53
-
-  # If you have an internal or private DNS names the external DNS servers can
-  # not resolve, then you can assign domain name strings to be redirected to a
-  # seperate dns server. For example, our comapny has the domain
-  # organization.com and the domain name internal.organization.com can not be
-  # resolved by Google's public DNS, but can be resolved by our private DNS
-  # server located at 1.1.1.1. The following tells Unbound that any
-  # organization.com domain, i.e. *.organization.com be dns resolved by 1.1.1.1
-  # instead of the public dns servers.
-  #
-  forward-zone:
-      name: "int.mk-labs.cloud"
-      forward-addr: 10.1.71.5        # Internal or private DNS
-
-  # Use the following forward-zone to forward all queries to Google DNS,
-  # OpenDNS.com or your local ISP's dns servers for example. To test resolution
-  # speeds use "drill calomel.org @8.8.8.8" and look for the "Query time:" in
-  # milliseconds.
-  #
-  forward-zone:
-    name: "."
-    forward-addr: 1.0.0.1@53#one.one.one.one
-    forward-addr: 1.1.1.1@53#one.one.one.one
-#   forward-addr: 8.8.8.8@53#dns.google
-#   forward-addr: 9.9.9.9@53#dns.quad9.net
-#   forward-addr: 1.0.0.1@53#one.one.one.one
-#   forward-addr: 8.8.4.4@53#dns.google
-#   forward-addr: 149.112.112.112@53#dns.quad9.net
-
-#
-#
-## Authoritative, validating, recursive caching DNS
-## unbound.conf -- https://calomel.org

infra-config/group_vars/internal_cluster/vars

@@ -0,0 +1,10 @@
+cluster_name: "openshift"
+cluster_version: "4.17.20"
+#base_domain: "int.mk-labs.cloud"
+worker_node_count: 1
+master_node_count: 3
+cluster_network: "10.128.0.0/14"
+cluster_network_host_prefix: 23
+machine_network: "10.1.71.0/24"
+service_network: "172.30.0.0/16"
+platform_type: "none"

infra-config/group_vars/unbound_servers/vars.yml

@@ -3,7 +3,8 @@
 
 ### Server ###
 
-unbound_num_threads: 1
+unbound_chroot: '""'
+unbound_num_threads: 2
 unbound_interfaces:
   - "{{ ip_address }}"
 #unbound_do_ip4: "yes"
@@ -58,10 +59,10 @@ unbound_rpz_zones: []  # list of dicts
 unbound_stub_zones: []  # list of dicts
 unbound_forward_zones:
   - name: 'int.mk-labs.cloud'
-    forward-addrs:
+    forward-addr:
       - '10.1.71.5'
-  - name: "."
+  - name: '.'
-    forward-addrs:
+    forward-addr:
       - '1.0.0.1@53#one.one.one.one'
       - '1.1.1.1@53#one.one.one.one'
 

infra-config/host_vars/int-master01/vars

@@ -0,0 +1,9 @@
+---
+# file: host_vars/int-master01/vars
+
+# Networking
+# primary_interface: "enp1s0f0"
+mac_address: "54:bf:64:60:52:2d"
+ip_address: 10.1.71.61
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"

infra-config/host_vars/int-master02/vars

@@ -0,0 +1,9 @@
+---
+# file: host_vars/int-master01/vars
+
+# Networking
+# primary_interface: "enp1s0f0"
+mac_address: "54:bf:64:5f:a2:80"
+ip_address: 10.1.71.62
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"

infra-config/host_vars/int-master03/vars

@@ -0,0 +1,9 @@
+---
+# file: host_vars/int-master01/vars
+
+# Networking
+# primary_interface: "enp1s0f0"
+mac_address: "d8:9e:f3:4c:02:a9"
+ip_address: 10.1.71.63
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"

infra-config/host_vars/int-worker01/vars

@@ -0,0 +1,9 @@
+---
+# file: host_vars/int-master01/vars
+
+# Networking
+# primary_interface: "enp1s0f0"
+mac_address: "54:bf:64:60:52:2d"
+ip_address: 10.1.71.64
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"

infra-config/inventory.yml

@@ -10,7 +10,7 @@ dhcp_server:
 unbound_servers:
   hosts:
     unbound01:
-#    unbound02:
+    unbound02:
 
 backup_servers:
   hosts:
@@ -48,6 +48,13 @@ hub_cluster:
   hosts:
     ocp-hub:
 
+internal_cluster:
+  hosts:
+    int-master01:
+    int-master02:
+    int-master03:
+    int-worker01:
+
 sql_servers:
   hosts:
     sql01:

infra-config/playbooks/configure_prometheus.yml

@@ -0,0 +1,16 @@
+---
+- name: Master playbook to install and configure prometheus
+  hosts: prometheus_server
+  become: true
+
+  tasks:
+    - name: Permit traffic in default zone for dns service
+      firewalld:
+        port: 9090/tcp
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Install unbound via role
+      ansible.builtin.import_role:
+        name: prometheus.prometheus.prometheus

infra-config/playbooks/configure_unbound copy.yml

@@ -0,0 +1,10 @@
+---
+- name: Master playbook to configure openshift cluster (internal)
+  hosts: internal_cluster
+  become: true
+
+  tasks:
+
+    - name: Install unbound via role
+      ansible.builtin.import_role:
+        name: Anthony25.unbound

infra-config/playbooks/configure_unbound.yml

@@ -1,34 +1,37 @@
 ---
 - name: Master playbook to install and configure unbound
   hosts: unbound_servers
+  become: true
 
   tasks:
+    - name: Permit traffic in default zone for dns service
+      ansible.posix.firewalld:
+        service: dns
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Create the directory
+      ansible.builtin.file:
+        path: /etc/systemd/resolved.conf.d
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+
+    - name: Put `unbound.conf` in the correct place
+      ansible.builtin.copy:
+        src: ../roles/common/files/unbound.conf
+        dest: /etc/systemd/resolved.conf.d/unbound.conf
+        mode: '0644'
+        owner: root
+        group: root
+
+    - name: Restart service systemd-resolved
+      ansible.builtin.service:
+        name: systemd-resolved
+        state: restarted
+
     - name: Install unbound via role
-#      delegate_to: "localhost"
       ansible.builtin.import_role:
         name: Anthony25.unbound
-      # vars:
-      #   server:
-      #     interface: "{{ ip_address }}"
-      #     access_control:
-      #       - '192.168.1.0/24 allow'
-      #       - '192.168.3.0/24 allow'
-      #       - '192.168.5.0/24 allow'
-      #       - '192.168.10.0/24 allow'
-      #       - '10.1.71.0/24 allow'
-      #     private_address:
-      #       - '192.168.1.0/24'
-      #       - '192.168.3.0/24'
-      #       - '192.168.5.0/24'
-      #       - '192.168.10.0/24'
-      #       - '10.1.71.0/24'
-      #     private-domain:
-      #       - 'mk-labs.cloud'
-      #   forward_zone:
-      #     - name: 'int.mk-labs.cloud'
-      #       forward-addrs:
-      #         - '10.1.71.5'
-      #     - name: "."
-      #       forward-addrs:
-      #         - '1.0.0.1@53#one.one.one.one'
-      #         - '1.1.1.1@53#one.one.one.one'

infra-config/playbooks/idm-servers.yml

@@ -3,8 +3,8 @@
   hosts: ipaserver
   become: true
   vars_files:
-  - idm-vault.yml
+    - idm-vault.yml
 
   roles:
-  - role: freeipa.ansible_freeipa.ipaserver
+    - role: freeipa.ansible_freeipa.ipaserver
-    state: present
+      state: present

infra-config/roles/common/files/unbound.conf

@@ -1,4 +1,4 @@
 [Resolve]
 DNS=127.0.0.1
 DNSSEC=yes
-DNSStubListener=no
+DNSStubListener=no

infra-config/roles/requirements.yml

@@ -9,5 +9,5 @@ collections:
   - name: somaz94.ansible_k8s_iac_tool
     version: 1.1.6
 
-  - name: bodsch.dns
+  - name: prometheus.prometheus
-    version: 1.2.0
+    version: 0.27.0