sync current state
This commit is contained in:
@@ -1,16 +0,0 @@
|
||||
---
|
||||
- name: Master playbook to install and configure prometheus
|
||||
hosts: prometheus_server
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: Permit traffic in default zone for dns service
|
||||
firewalld:
|
||||
port: 9090/tcp
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
|
||||
- name: Install unbound via role
|
||||
ansible.builtin.import_role:
|
||||
name: prometheus.prometheus.prometheus
|
||||
44
ansible/playbooks/deploy-fastpass-4step.yml
Normal file
44
ansible/playbooks/deploy-fastpass-4step.yml
Normal file
@@ -0,0 +1,44 @@
|
||||
---
|
||||
- name: Step 1 - Install Prerequisites
|
||||
hosts: fastpass
|
||||
become: true
|
||||
gather_facts: true
|
||||
roles:
|
||||
- role: kubernetes-prerequisites
|
||||
|
||||
- name: Step 2 - Deploy First Control Plane Node
|
||||
hosts: fastpass_control_plane[0]
|
||||
become: true
|
||||
gather_facts: false
|
||||
roles:
|
||||
- role: fastpass-first-control-plane
|
||||
|
||||
- name: Step 3 - Deploy Additional Control Plane Nodes
|
||||
hosts: fastpass_control_plane[1:]
|
||||
become: true
|
||||
gather_facts: false
|
||||
roles:
|
||||
- role: fastpass-additional-control-plane
|
||||
|
||||
- name: Step 4 - Deploy Worker Nodes
|
||||
hosts: fastpass_workers
|
||||
become: true
|
||||
gather_facts: false
|
||||
roles:
|
||||
- role: fastpass-workers
|
||||
|
||||
- name: Final Cluster Validation
|
||||
hosts: fastpass_control_plane[0]
|
||||
become: false
|
||||
gather_facts: false
|
||||
environment:
|
||||
KUBECONFIG: "{{ kubeconfig_path }}"
|
||||
tasks:
|
||||
- name: Display cluster status
|
||||
ansible.builtin.command: kubectl get nodes
|
||||
delegate_to: localhost
|
||||
|
||||
- name: Display all pods
|
||||
ansible.builtin.command: kubectl get pods -A
|
||||
delegate_to: localhost
|
||||
|
||||
157
ansible/playbooks/deploy-fastpass-cluster.yml
Normal file
157
ansible/playbooks/deploy-fastpass-cluster.yml
Normal file
@@ -0,0 +1,157 @@
|
||||
---
|
||||
# FastPass Kubernetes Cluster Deployment
|
||||
# This playbook deploys a complete Kubernetes cluster on Fedora
|
||||
|
||||
- name: 1. Preflight checks and system preparation
|
||||
hosts: fastpass
|
||||
become: true
|
||||
gather_facts: true
|
||||
roles:
|
||||
- role: kubernetes
|
||||
|
||||
- name: 2. Initialize first control plane node
|
||||
hosts: fastpass_control_plane[0]
|
||||
become: true
|
||||
gather_facts: false
|
||||
roles:
|
||||
- role: fastpass-control-plane
|
||||
|
||||
- name: 3. Install Calico CNI
|
||||
hosts: fastpass_control_plane[0]
|
||||
become: false
|
||||
gather_facts: false
|
||||
environment:
|
||||
KUBECONFIG: "{{ kubeconfig_path }}"
|
||||
tasks:
|
||||
- name: Check if Calico is already installed
|
||||
ansible.builtin.shell: kubectl get pods -n kube-system -l k8s-app=calico-node --no-headers | wc -l
|
||||
delegate_to: localhost
|
||||
register: calico_check
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display Calico check result
|
||||
ansible.builtin.debug:
|
||||
msg: "Calico pods found: {{ calico_check.stdout | trim }}"
|
||||
delegate_to: localhost
|
||||
|
||||
- name: Install Calico CNI
|
||||
ansible.builtin.command: kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/{{ calico_version | default('v3.28.0') }}/manifests/calico.yaml
|
||||
delegate_to: localhost
|
||||
when: calico_check.stdout | trim == "0"
|
||||
register: calico_install_result
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display Calico installation result
|
||||
ansible.builtin.debug:
|
||||
msg: "Calico install stdout: {{ calico_install_result.stdout }}"
|
||||
delegate_to: localhost
|
||||
when: calico_check.stdout | trim == "0"
|
||||
|
||||
- name: Wait for Calico node pods to be ready
|
||||
ansible.builtin.command: kubectl wait --for=condition=ready pod -l k8s-app=calico-node -n kube-system --timeout=300s
|
||||
delegate_to: localhost
|
||||
when: calico_check.stdout | trim == "0"
|
||||
|
||||
- name: 4. Wait for first control plane to be fully ready
|
||||
hosts: fastpass_control_plane[0]
|
||||
become: false
|
||||
gather_facts: false
|
||||
environment:
|
||||
KUBECONFIG: "{{ kubeconfig_path }}"
|
||||
tasks:
|
||||
- name: Wait for API server to be ready on first node
|
||||
ansible.builtin.wait_for:
|
||||
host: "{{ inventory_hostname }}"
|
||||
port: "{{ control_plane_port | default('6443') }}"
|
||||
timeout: 300
|
||||
delegate_to: localhost
|
||||
|
||||
- name: Wait for first control plane node to be ready
|
||||
ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} wait --for=condition=ready node {{ inventory_hostname }} --timeout=300s
|
||||
delegate_to: localhost
|
||||
|
||||
- name: Verify control plane status
|
||||
ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} get nodes -o wide
|
||||
delegate_to: localhost
|
||||
register: node_status
|
||||
|
||||
- name: Display cluster status
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ node_status.stdout_lines }}"
|
||||
|
||||
- name: 5. Join additional control plane nodes
|
||||
hosts: fastpass_control_plane[1:]
|
||||
become: true
|
||||
gather_facts: false
|
||||
roles:
|
||||
- role: fastpass-control-plane-join
|
||||
|
||||
- name: 6. Wait for all control plane nodes to be ready
|
||||
hosts: fastpass_control_plane[0]
|
||||
become: false
|
||||
gather_facts: false
|
||||
environment:
|
||||
KUBECONFIG: "{{ kubeconfig_path }}"
|
||||
tasks:
|
||||
- name: Wait for all control plane nodes to be ready
|
||||
ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} wait --for=condition=ready node --selector=node-role.kubernetes.io/control-plane --timeout=600s
|
||||
delegate_to: localhost
|
||||
|
||||
- name: Display all control plane nodes
|
||||
ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} get nodes --selector=node-role.kubernetes.io/control-plane -o wide
|
||||
delegate_to: localhost
|
||||
register: control_plane_status
|
||||
|
||||
- name: Show control plane status
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ control_plane_status.stdout_lines }}"
|
||||
|
||||
- name: 7. Join worker nodes
|
||||
hosts: fastpass_workers
|
||||
become: true
|
||||
gather_facts: false
|
||||
roles:
|
||||
- role: fastpass-workers
|
||||
|
||||
- name: 8. Final cluster validation
|
||||
hosts: fastpass_control_plane[0]
|
||||
become: false
|
||||
gather_facts: false
|
||||
environment:
|
||||
KUBECONFIG: "{{ kubeconfig_path }}"
|
||||
tasks:
|
||||
- name: Wait for all nodes to be ready
|
||||
ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} wait --for=condition=ready node --all --timeout=300s
|
||||
delegate_to: localhost
|
||||
|
||||
- name: Verify all pods are running
|
||||
ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} get pods --all-namespaces
|
||||
delegate_to: localhost
|
||||
register: pod_status
|
||||
|
||||
- name: Display final cluster status
|
||||
ansible.builtin.debug:
|
||||
msg: |
|
||||
========================================
|
||||
FastPass Kubernetes Cluster Status
|
||||
========================================
|
||||
{{ pod_status.stdout }}
|
||||
========================================
|
||||
|
||||
- name: Show final node status
|
||||
ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} get nodes -o wide
|
||||
delegate_to: localhost
|
||||
register: final_node_status
|
||||
|
||||
- name: Display final node status
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ final_node_status.stdout_lines }}"
|
||||
|
||||
- name: Test DNS-based control plane endpoint
|
||||
ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} cluster-info
|
||||
delegate_to: localhost
|
||||
register: cluster_info
|
||||
|
||||
- name: Display cluster info
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ cluster_info.stdout_lines }}"
|
||||
@@ -2,7 +2,7 @@
|
||||
# FILE: deploy_k8s.yml
|
||||
# ------------------------------------------------------------------------------
|
||||
- name: 1. Prepare all nodes for Kubernetes
|
||||
hosts: kube_cluster
|
||||
hosts: fastpass
|
||||
roles:
|
||||
- role: kubernetes
|
||||
|
||||
@@ -12,6 +12,6 @@
|
||||
- role: fastpass-control-plane
|
||||
|
||||
- name: 3. Join worker nodes to the cluster
|
||||
hosts: fastpass-workers
|
||||
hosts: fastpass_workers
|
||||
roles:
|
||||
- role: fastpass-workers
|
||||
|
||||
5
ansible/playbooks/deploy_ntp_servers.yml
Normal file
5
ansible/playbooks/deploy_ntp_servers.yml
Normal file
@@ -0,0 +1,5 @@
|
||||
- name: 1. Deploy NTP servers
|
||||
hosts: ntp_servers
|
||||
gather_facts: true
|
||||
roles:
|
||||
- role: ntp-server
|
||||
67
ansible/playbooks/install_monitoring.yml
Normal file
67
ansible/playbooks/install_monitoring.yml
Normal file
@@ -0,0 +1,67 @@
|
||||
---
|
||||
- name: Master playbook to install and configure prometheus
|
||||
hosts: prometheus_server
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: Install prerequisite software
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- tar
|
||||
- python3-dnf
|
||||
state: present
|
||||
|
||||
- name: Permit prometheus metrics in default zone for dns service
|
||||
ansible.posix.firewalld:
|
||||
port: 9100/tcp
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
|
||||
- name: Permit traffic in default zone for dns service
|
||||
ansible.posix.firewalld:
|
||||
port: 9090/tcp
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
|
||||
- name: Install prometheus via role
|
||||
ansible.builtin.import_role:
|
||||
name: prometheus.prometheus.prometheus
|
||||
vars:
|
||||
prometheus_targets:
|
||||
node:
|
||||
- targets:
|
||||
- localhost:9100
|
||||
labels:
|
||||
env: mk-labs
|
||||
|
||||
- name: Permit grafana in default zone for dns service
|
||||
ansible.posix.firewalld:
|
||||
port: 3000/tcp
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
|
||||
- name: Install grafana via role
|
||||
ansible.builtin.import_role:
|
||||
name: grafana.grafana.grafana
|
||||
|
||||
# - name: Create/Update Data sources
|
||||
# grafana.grafana.datasource:
|
||||
# dataSource: |
|
||||
# {
|
||||
# "name": "Prometheus",
|
||||
# "type": "prometheus",
|
||||
# "access": "proxy",
|
||||
# "url": "http://localhost:9090",
|
||||
# "jsonData": {
|
||||
# "httpMethod": "POST",
|
||||
# "manageAlerts": true,
|
||||
# "prometheusType": "Prometheus",
|
||||
# "cacheLevel": "High"
|
||||
# }
|
||||
# }
|
||||
# grafana_url: "{{ grafana_url }}"
|
||||
# grafana_api_key: "{{ grafana_api_key }}"
|
||||
# state: present
|
||||
16
ansible/playbooks/node_explorer.yml
Normal file
16
ansible/playbooks/node_explorer.yml
Normal file
@@ -0,0 +1,16 @@
|
||||
---
|
||||
- name: Master playbook to install and configure prometheus node explorer
|
||||
hosts: prometheus_server
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: Permit prometheus metrics in default zone for dns service
|
||||
ansible.posix.firewalld:
|
||||
port: 9100/tcp
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
|
||||
- name: Install prometheus node exporter via role
|
||||
ansible.builtin.import_role:
|
||||
name: prometheus.prometheus.node_exporter
|
||||
143
ansible/playbooks/prometheus_grafana_server.yml
Normal file
143
ansible/playbooks/prometheus_grafana_server.yml
Normal file
@@ -0,0 +1,143 @@
|
||||
---
|
||||
- name: Install Prometheus and Grafana on control node
|
||||
hosts: prometheus_server
|
||||
become: true
|
||||
# vars_files:
|
||||
# - vars.yml
|
||||
tasks:
|
||||
- name: Install prerequisite software
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- tar
|
||||
- wget
|
||||
state: present
|
||||
|
||||
- name: Download Prometheus
|
||||
ansible.builtin.get_url:
|
||||
url: "{{ prometheus_installer_download_url }}"
|
||||
dest: "/tmp/{{ prometheus_installer_file }}"
|
||||
|
||||
- name: Extract Prometheus
|
||||
ansible.builtin.unarchive:
|
||||
src: "/tmp/{{ prometheus_installer_file }}"
|
||||
dest: "/usr/local/bin/"
|
||||
remote_src: true
|
||||
|
||||
- name: Create Prometheus user
|
||||
user:
|
||||
name: prometheus
|
||||
shell: /bin/false
|
||||
state: present
|
||||
|
||||
- name: Create Prometheus directories
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
owner: prometheus
|
||||
group: prometheus
|
||||
with_items:
|
||||
- /etc/prometheus
|
||||
- /var/lib/prometheus
|
||||
|
||||
- name: Move Prometheus binaries
|
||||
ansible.builtin.command: "mv /usr/local/bin/prometheus-{{ prometheus_version }}.linux-amd64/prometheus /usr/local/bin/prometheus"
|
||||
|
||||
- name: Move Prometheus tool
|
||||
ansible.builtin.command: "mv /usr/local/bin/prometheus-{{ prometheus_version }}.linux-amd64/promtool /usr/local/bin/promtool"
|
||||
|
||||
- name: Create Prometheus configuration file
|
||||
ansible.builtin.copy:
|
||||
dest: "/etc/prometheus/prometheus.yml"
|
||||
content: |
|
||||
global:
|
||||
scrape_interval: 15s
|
||||
evaluation_interval: 15s
|
||||
|
||||
scrape_configs:
|
||||
- job_name: 'prometheus'
|
||||
static_configs:
|
||||
- targets: ['localhost:9090']
|
||||
|
||||
- job_name: 'nodes'
|
||||
static_configs:
|
||||
- targets:
|
||||
{% for ip in prometheus_nodes %}
|
||||
- '{{ ip }}:9100'
|
||||
{% endfor %}
|
||||
|
||||
- name: Create Prometheus service file
|
||||
ansible.builtin.copy:
|
||||
dest: "/etc/systemd/system/prometheus.service"
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Prometheus
|
||||
Wants=network-online.target
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
User=prometheus
|
||||
Group=prometheus
|
||||
Type=simple
|
||||
ExecStart=/usr/local/bin/prometheus \
|
||||
--config.file=/etc/prometheus/prometheus.yml \
|
||||
--storage.tsdb.path=/var/lib/prometheus/ \
|
||||
--web.console.templates=/etc/prometheus/consoles \
|
||||
--web.console.libraries=/etc/prometheus/console_libraries
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
||||
register: prometheus_service_status
|
||||
ignore_errors: true
|
||||
|
||||
- name: Check if Prometheus service is running
|
||||
ansible.builtin.command: systemctl is-active prometheus
|
||||
register: prometheus_status
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
|
||||
- name: Permit prometheus endpoint in default zone for dns service
|
||||
firewalld:
|
||||
port: 9090/tcp
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
|
||||
- name: Permit prometheus metrics in default zone for dns service
|
||||
firewalld:
|
||||
port: 9100/tcp
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
|
||||
- name: Permit grafana traffic in default zone for dns service
|
||||
firewalld:
|
||||
port: 3000/tcp
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
|
||||
- name: Manage Prometheus service state
|
||||
systemd:
|
||||
name: prometheus
|
||||
state: "{{ 'restarted' if prometheus_status.rc == 0 else 'started' }}"
|
||||
enabled: true
|
||||
|
||||
- name: Add repository
|
||||
ansible.builtin.yum_repository:
|
||||
name: grafana
|
||||
description: Grafana OSS repo
|
||||
baseurl: https://rpm.grafana.com
|
||||
gpgkey: https://rpm.grafana.com/gpg.key
|
||||
|
||||
- name: Install Grafana
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- grafana
|
||||
state: present
|
||||
|
||||
- name: Start Grafana service
|
||||
systemd:
|
||||
name: grafana-server
|
||||
state: started
|
||||
enabled: true
|
||||
@@ -22,7 +22,7 @@
|
||||
name: "{{ inventory_hostname }}"
|
||||
node: "{{ proxmox_clone_node }}"
|
||||
storage: "{{ vm_storage }}"
|
||||
format: raw
|
||||
format: qcow2 # raw
|
||||
timeout: 600
|
||||
|
||||
# - name: Add VM to HA group
|
||||
|
||||
@@ -15,18 +15,26 @@
|
||||
node: "{{ proxmox_clone_node }}"
|
||||
state: started
|
||||
|
||||
# - name: Wait for the VM to start
|
||||
# delegate_to: "localhost"
|
||||
# wait_for:
|
||||
# port: 22
|
||||
# host: "{{ inventory_hostname }}"
|
||||
# search_regex: OpenSSH
|
||||
# delay: 10
|
||||
# timeout: 60
|
||||
- name: Wait for SSH service to be ready
|
||||
delegate_to: "localhost"
|
||||
when: platform is defined and platform == "proxmox"
|
||||
ansible.builtin.wait_for:
|
||||
port: 22
|
||||
host: "{{ inventory_hostname }}"
|
||||
search_regex: OpenSSH
|
||||
timeout: 300
|
||||
msg: "Waiting for SSH service to be ready on {{ inventory_hostname }}"
|
||||
|
||||
# - name: Wait for the reboot to complete if there was a change.
|
||||
# wait_for_connection:
|
||||
# connect_timeout: 10
|
||||
# sleep: 5
|
||||
# delay: 5
|
||||
# timeout: 300
|
||||
- name: Wait for VM to be fully booted and responsive
|
||||
delegate_to: "localhost"
|
||||
when: platform is defined and platform == "proxmox"
|
||||
ansible.builtin.wait_for_connection:
|
||||
connect_timeout: 10
|
||||
sleep: 5
|
||||
timeout: 300
|
||||
|
||||
- name: Display VM startup completion
|
||||
delegate_to: "localhost"
|
||||
when: platform is defined and platform == "proxmox"
|
||||
ansible.builtin.debug:
|
||||
msg: "✅ {{ inventory_hostname }} is now running and accessible via SSH"
|
||||
|
||||
115
ansible/playbooks/reset-fastpass-cluster.yml
Normal file
115
ansible/playbooks/reset-fastpass-cluster.yml
Normal file
@@ -0,0 +1,115 @@
|
||||
---
|
||||
- name: Reset FastPass Kubernetes Cluster
|
||||
hosts: fastpass
|
||||
become: true
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Stop and disable kubelet service
|
||||
ansible.builtin.systemd:
|
||||
name: kubelet
|
||||
state: stopped
|
||||
enabled: false
|
||||
ignore_errors: true
|
||||
|
||||
- name: Stop and disable containerd service
|
||||
ansible.builtin.systemd:
|
||||
name: containerd
|
||||
state: stopped
|
||||
enabled: false
|
||||
ignore_errors: true
|
||||
|
||||
- name: Remove Kubernetes packages
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- kubelet
|
||||
- kubeadm
|
||||
- kubectl
|
||||
- kubernetes-cni
|
||||
- containernetworking-plugins
|
||||
state: absent
|
||||
ignore_errors: true
|
||||
|
||||
- name: Remove containerd
|
||||
ansible.builtin.dnf:
|
||||
name: containerd
|
||||
state: absent
|
||||
ignore_errors: true
|
||||
|
||||
- name: Remove Docker repository
|
||||
ansible.builtin.file:
|
||||
path: /etc/yum.repos.d/docker-ce.repo
|
||||
state: absent
|
||||
ignore_errors: true
|
||||
|
||||
- name: Remove Kubernetes repository
|
||||
ansible.builtin.file:
|
||||
path: /etc/yum.repos.d/kubernetes.repo
|
||||
state: absent
|
||||
ignore_errors: true
|
||||
|
||||
- name: Remove Kubernetes directories
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: absent
|
||||
loop:
|
||||
- /etc/kubernetes
|
||||
- /var/lib/kubelet
|
||||
- /var/lib/etcd
|
||||
- /etc/cni/net.d
|
||||
- /opt/cni/bin
|
||||
- /var/lib/containerd
|
||||
- /etc/containerd
|
||||
ignore_errors: true
|
||||
|
||||
- name: Remove CNI plugins
|
||||
ansible.builtin.file:
|
||||
path: /opt/cni
|
||||
state: absent
|
||||
ignore_errors: true
|
||||
|
||||
- name: Remove iptables rules
|
||||
ansible.builtin.shell: |
|
||||
iptables -F
|
||||
iptables -t nat -F
|
||||
iptables -t mangle -F
|
||||
iptables -X
|
||||
ignore_errors: true
|
||||
|
||||
- name: Remove firewall Kubernetes service
|
||||
ansible.builtin.file:
|
||||
path: /etc/firewalld/services/kubernetes.xml
|
||||
state: absent
|
||||
ignore_errors: true
|
||||
|
||||
- name: Remove firewall rules for Kubernetes
|
||||
ansible.builtin.shell: |
|
||||
firewall-cmd --permanent --remove-service=kubernetes || true
|
||||
firewall-cmd --reload || true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Reset network interfaces
|
||||
ansible.builtin.shell: |
|
||||
ip link delete cni0 || true
|
||||
ip link delete flannel.1 || true
|
||||
ip link delete cali* || true
|
||||
ignore_errors: true
|
||||
|
||||
- name: Clean up systemd drop-in files
|
||||
ansible.builtin.file:
|
||||
path: /usr/lib/systemd/system/kubelet.service.d
|
||||
state: absent
|
||||
ignore_errors: true
|
||||
|
||||
- name: Reset hostname to original
|
||||
ansible.builtin.hostname:
|
||||
name: "{{ inventory_hostname }}"
|
||||
|
||||
- name: Clean package cache
|
||||
ansible.builtin.dnf:
|
||||
clean: all
|
||||
ignore_errors: true
|
||||
|
||||
- name: Reboot system
|
||||
ansible.builtin.reboot:
|
||||
reboot_timeout: 300
|
||||
|
||||
@@ -1,59 +0,0 @@
|
||||
# ------------------------------------------------------------------------------
|
||||
# FILE: roles/control-plane/tasks/main.yml
|
||||
# ------------------------------------------------------------------------------
|
||||
- name: Check if cluster is already initialized
|
||||
ansible.builtin.stat:
|
||||
path: /etc/kubernetes/admin.conf
|
||||
register: kube_init_stat
|
||||
|
||||
- name: Initialize the Kubernetes cluster
|
||||
when: not kube_init_stat.stat.exists
|
||||
ansible.builtin.command: >
|
||||
kubeadm init
|
||||
--pod-network-cidr=10.244.0.0/16
|
||||
--control-plane-endpoint={{ inventory_hostname }}
|
||||
register: kubeadm_init
|
||||
|
||||
- name: Create .kube directory for the user
|
||||
become: false
|
||||
ansible.builtin.file:
|
||||
path: "{{ ansible_env.HOME }}/.kube"
|
||||
state: directory
|
||||
mode: '0755'
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
|
||||
- name: Copy admin.conf to user's .kube directory on controller
|
||||
when: not kube_init_stat.stat.exists
|
||||
ansible.builtin.fetch:
|
||||
src: /etc/kubernetes/admin.conf
|
||||
dest: "{{ ansible_env.HOME }}/.kube/config"
|
||||
flat: true
|
||||
|
||||
- name: Install Calico CNI
|
||||
become: false
|
||||
ansible.builtin.command: kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.0/manifests/calico.yaml
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
when: not kube_init_stat.stat.exists
|
||||
|
||||
- name: Generate join command for control plane nodes
|
||||
when: not kube_init_stat.stat.exists
|
||||
ansible.builtin.command: kubeadm token create --print-join-command
|
||||
register: control_plane_join_command_raw
|
||||
|
||||
- name: Generate certificate key for control plane join
|
||||
when: not kube_init_stat.stat.exists
|
||||
ansible.builtin.command: kubeadm init phase upload-certs --upload-certs
|
||||
register: control_plane_cert_key
|
||||
|
||||
- name: Store control plane join command
|
||||
ansible.builtin.set_fact:
|
||||
control_plane_join_command: "{{ control_plane_join_command_raw.stdout }} --control-plane --certificate-key {{ control_plane_cert_key.stdout_lines[-1] }}"
|
||||
when: not kube_init_stat.stat.exists
|
||||
|
||||
- name: Join other control plane nodes to the cluster
|
||||
when:
|
||||
- inventory_hostname != groups['fastpass_control_plane'][0]
|
||||
- not kube_init_stat.stat.exists
|
||||
ansible.builtin.command: "{{ hostvars[groups['fastpass_control_plane'][0]].control_plane_join_command }}"
|
||||
@@ -1,35 +0,0 @@
|
||||
# ------------------------------------------------------------------------------
|
||||
# FILE: roles/fastpass_workers/tasks/main.yml
|
||||
# ------------------------------------------------------------------------------
|
||||
- name: Generate join command for worker nodes
|
||||
ansible.builtin.command: kubeadm token create --print-join-command
|
||||
delegate_to: "{{ groups['fastpass_control_plane'][0] }}"
|
||||
run_once: true
|
||||
register: worker_join_command
|
||||
|
||||
- name: Join worker nodes to the cluster
|
||||
ansible.builtin.command: "{{ hostvars[groups['fastpass_control_plane'][0]].worker_join_command.stdout }}"
|
||||
|
||||
- name: Label and Taint on-stage worker nodes
|
||||
become: false
|
||||
ansible.builtin.command: "kubectl {{ item }}"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
loop:
|
||||
- label node seven-dwarfs-mine-train zone=on-stage --overwrite
|
||||
- taint node seven-dwarfs-mine-train dedicated=external:NoSchedule --overwrite
|
||||
when: "'seven-dwarfs-mine-train' in inventory_hostname"
|
||||
|
||||
- name: Label backstage worker node haunted-mansion
|
||||
become: false
|
||||
ansible.builtin.command: "kubectl label node haunted-mansion zone=backstage --overwrite"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
when: "'haunted-mansion' in inventory_hostname"
|
||||
|
||||
- name: Label backstage worker node peter-pans-flight
|
||||
become: false
|
||||
ansible.builtin.command: "kubectl label node peter-pans-flight zone=backstage --overwrite"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
when: "'peter-pans-flight' in inventory_hostname"
|
||||
@@ -0,0 +1,47 @@
|
||||
---
|
||||
# Kubernetes Prerequisites Role Defaults
|
||||
|
||||
# Kubernetes version to install (should be overridden in group_vars)
|
||||
kubernetes_version: "v1.33"
|
||||
|
||||
# Container runtime (containerd is default)
|
||||
container_runtime: "containerd"
|
||||
|
||||
# CNI plugin to install
|
||||
cni_plugin: "calico"
|
||||
|
||||
# Firewall configuration
|
||||
configure_firewall: true
|
||||
|
||||
# Time synchronization
|
||||
configure_ntp: true
|
||||
|
||||
# SELinux configuration
|
||||
selinux_state: "permissive"
|
||||
|
||||
# Swap configuration
|
||||
disable_swap: true
|
||||
|
||||
# Kernel modules to load
|
||||
required_kernel_modules:
|
||||
- overlay
|
||||
- br_netfilter
|
||||
|
||||
# Sysctl parameters for Kubernetes
|
||||
k8s_sysctl_params:
|
||||
net.bridge.bridge-nf-call-iptables: 1
|
||||
net.bridge.bridge-nf-call-ip6tables: 1
|
||||
net.ipv4.ip_forward: 1
|
||||
|
||||
# Kubernetes firewall ports
|
||||
k8s_firewall_ports:
|
||||
- { protocol: "tcp", port: "6443" } # API server
|
||||
- { protocol: "tcp", port: "2379" } # etcd client
|
||||
- { protocol: "tcp", port: "2380" } # etcd peer
|
||||
- { protocol: "tcp", port: "10250" } # kubelet
|
||||
- { protocol: "tcp", port: "10251" } # kube-scheduler
|
||||
- { protocol: "tcp", port: "10252" } # kube-controller-manager
|
||||
- { protocol: "tcp", port: "10255" } # kubelet read-only
|
||||
- { protocol: "tcp", port: "30000-32767" } # NodePort services
|
||||
- { protocol: "udp", port: "4789" } # VXLAN (Flannel)
|
||||
- { protocol: "tcp", port: "179" } # BGP (Calico)
|
||||
210
ansible/playbooks/roles/kubernetes-prerequisites/tasks/main.yml
Normal file
210
ansible/playbooks/roles/kubernetes-prerequisites/tasks/main.yml
Normal file
@@ -0,0 +1,210 @@
|
||||
---
|
||||
- name: Set Kubernetes-compatible hostname
|
||||
ansible.builtin.hostname:
|
||||
name: "{{ kubernetes_hostnames[inventory_hostname] | default(inventory_hostname) }}"
|
||||
|
||||
- name: Remove zram-generator-defaults
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/zram-generator.conf
|
||||
state: absent
|
||||
|
||||
- name: Disable swap
|
||||
ansible.builtin.shell: swapoff -a
|
||||
when: disable_swap | default(true)
|
||||
|
||||
- name: Persist swap off by commenting out swap in fstab
|
||||
ansible.builtin.replace:
|
||||
path: /etc/fstab
|
||||
regexp: '^([^#].*?\sswap\s+sw\s+.*)$'
|
||||
replace: '# \1'
|
||||
when: disable_swap | default(true)
|
||||
|
||||
- name: Load required kernel modules
|
||||
ansible.builtin.modprobe:
|
||||
name: "{{ item }}"
|
||||
loop: "{{ required_kernel_modules }}"
|
||||
|
||||
- name: Persist kernel modules on boot
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/modules-load.d/k8s.conf
|
||||
content: "{{ required_kernel_modules | join('\n') }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Configure required sysctl params for Kubernetes
|
||||
ansible.builtin.template:
|
||||
dest: /etc/sysctl.d/k8s.conf
|
||||
src: k8s-sysctl.conf.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Apply sysctl params without reboot
|
||||
ansible.builtin.shell: sysctl --system
|
||||
|
||||
- name: Install python3-libselinux for managing selinux
|
||||
ansible.builtin.dnf:
|
||||
name: python3-libselinux
|
||||
state: present
|
||||
|
||||
- name: Set SELinux to permissive mode
|
||||
ansible.posix.selinux:
|
||||
policy: targeted
|
||||
state: "{{ selinux_state }}"
|
||||
|
||||
- name: Install and configure chrony for time synchronization
|
||||
ansible.builtin.dnf:
|
||||
name: chrony
|
||||
state: present
|
||||
when: configure_ntp | default(true)
|
||||
|
||||
- name: Start and enable chronyd
|
||||
ansible.builtin.systemd:
|
||||
name: chronyd
|
||||
state: started
|
||||
enabled: true
|
||||
when: configure_ntp | default(true)
|
||||
|
||||
- name: Force time synchronization
|
||||
ansible.builtin.shell: chronyc makestep
|
||||
ignore_errors: true
|
||||
when: configure_ntp | default(true)
|
||||
|
||||
- name: Install firewalld
|
||||
ansible.builtin.dnf:
|
||||
name: firewalld
|
||||
state: present
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Start and enable firewalld
|
||||
ansible.builtin.systemd:
|
||||
name: firewalld
|
||||
state: started
|
||||
enabled: true
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Create Kubernetes service definition
|
||||
ansible.builtin.template:
|
||||
dest: /etc/firewalld/services/kubernetes.xml
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
src: kubernetes-firewall-service.xml.j2
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Reload firewalld to load new service
|
||||
ansible.builtin.shell: firewall-cmd --reload
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Add Kubernetes service to default zone
|
||||
ansible.builtin.shell: firewall-cmd --permanent --add-service=kubernetes
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Add SSH service to default zone (ensure SSH access)
|
||||
ansible.builtin.shell: firewall-cmd --permanent --add-service=ssh
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Reload firewalld to apply changes
|
||||
ansible.builtin.shell: firewall-cmd --reload
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Verify Kubernetes service is active
|
||||
ansible.builtin.shell: firewall-cmd --list-services
|
||||
register: active_services
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Display active firewall services
|
||||
ansible.builtin.debug:
|
||||
msg: "Active firewall services: {{ active_services.stdout }}"
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Install DNF plugins core for managing repositories
|
||||
ansible.builtin.dnf:
|
||||
name: dnf-plugins-core
|
||||
state: present
|
||||
|
||||
- name: Add Docker CE repository
|
||||
ansible.builtin.shell: |
|
||||
curl -fsSL https://download.docker.com/linux/fedora/docker-ce.repo -o /etc/yum.repos.d/docker-ce.repo
|
||||
|
||||
- name: Install containerd
|
||||
ansible.builtin.dnf:
|
||||
name: containerd
|
||||
state: present
|
||||
|
||||
- name: Create containerd config directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/containerd
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: Generate default containerd config and enable SystemdCgroup
|
||||
ansible.builtin.shell: |
|
||||
containerd config default > /etc/containerd/config.toml
|
||||
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
|
||||
|
||||
- name: Restart and enable containerd service
|
||||
ansible.builtin.systemd:
|
||||
name: containerd
|
||||
state: restarted
|
||||
enabled: true
|
||||
|
||||
- name: Add Kubernetes repository
|
||||
ansible.builtin.template:
|
||||
dest: /etc/yum.repos.d/kubernetes.repo
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
src: kubernetes.repo.j2
|
||||
|
||||
- name: Install Kubernetes packages
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- kubelet
|
||||
- kubeadm
|
||||
- kubectl
|
||||
- kubernetes-cni
|
||||
state: present
|
||||
|
||||
- name: Create kubelet config directory
|
||||
ansible.builtin.file:
|
||||
path: /var/lib/kubelet
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: Create initial kubelet config file
|
||||
ansible.builtin.copy:
|
||||
dest: /var/lib/kubelet/config.yaml
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
content: |
|
||||
apiVersion: kubelet.config.k8s.io/v1beta1
|
||||
kind: KubeletConfiguration
|
||||
cgroupDriver: systemd
|
||||
containerRuntimeEndpoint: unix:///run/containerd/containerd.sock
|
||||
|
||||
- name: Install CNI plugins via dnf
|
||||
ansible.builtin.dnf:
|
||||
name: containernetworking-plugins
|
||||
state: present
|
||||
|
||||
- name: Verify CNI plugins installation
|
||||
ansible.builtin.shell: ls -la /opt/cni/bin/ || echo "CNI plugins not found in /opt/cni/bin/"
|
||||
register: cni_plugins
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display installed CNI plugins
|
||||
ansible.builtin.debug:
|
||||
msg: "CNI plugins status: {{ cni_plugins.stdout }}"
|
||||
|
||||
- name: Enable kubelet service (but don't start yet)
|
||||
ansible.builtin.systemd:
|
||||
name: kubelet
|
||||
enabled: true
|
||||
state: stopped
|
||||
@@ -0,0 +1,9 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<service>
|
||||
<short>Kubernetes</short>
|
||||
<description>Kubernetes cluster communication ports</description>
|
||||
{% for port in k8s_firewall_ports %}
|
||||
<port protocol="{{ port.protocol }}" port="{{ port.port }}"/>
|
||||
{% endfor %}
|
||||
</service>
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
[kubernetes]
|
||||
name=Kubernetes
|
||||
baseurl=https://pkgs.k8s.io/core:/stable:/v{{ kubernetes_version | default('1.33') | regex_replace('^v?(.*)$', '\\1') | regex_replace('^(\\d+\\.\\d+).*$', '\\1') }}/rpm/
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
gpgkey=https://pkgs.k8s.io/core:/stable:/v{{ kubernetes_version | default('1.33') | regex_replace('^v?(.*)$', '\\1') | regex_replace('^(\\d+\\.\\d+).*$', '\\1') }}/rpm/repodata/repomd.xml.key
|
||||
|
||||
@@ -1,11 +1,25 @@
|
||||
# ------------------------------------------------------------------------------
|
||||
# FILE: roles/common/tasks/main.yml
|
||||
# ------------------------------------------------------------------------------
|
||||
- name: Set Kubernetes-compatible hostname
|
||||
become: true
|
||||
ansible.builtin.hostname:
|
||||
name: "{{ kubernetes_hostnames[inventory_hostname] | default(inventory_hostname) }}"
|
||||
when: kubernetes_hostnames is defined
|
||||
|
||||
- name: Remove zram-generator-defaults
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: zram-generator-defaults
|
||||
state: absent
|
||||
|
||||
- name: Disable swap
|
||||
ansible.builtin.command: swapoff -a
|
||||
become: true
|
||||
changed_when: false
|
||||
|
||||
- name: Persist swap off by commenting out swap in fstab
|
||||
become: true
|
||||
ansible.builtin.replace:
|
||||
path: /etc/fstab
|
||||
regexp: '^(\s*)([^#\n]+\s+swap\s+.*)$'
|
||||
@@ -13,6 +27,7 @@
|
||||
backup: true
|
||||
|
||||
- name: Load required kernel modules
|
||||
become: true
|
||||
community.general.modprobe:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
@@ -21,50 +36,121 @@
|
||||
- br_netfilter
|
||||
|
||||
- name: Persist kernel modules on boot
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/modules-load.d/k8s.conf
|
||||
mode: '0644'
|
||||
content: |
|
||||
overlay
|
||||
br_netfilter
|
||||
|
||||
- name: Configure required sysctl params for Kubernetes
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/sysctl.d/k8s.conf
|
||||
mode: '0644'
|
||||
content: |
|
||||
net.bridge.bridge-nf-call-iptables = 1
|
||||
net.bridge.bridge-nf-call-ip6tables = 1
|
||||
net.ipv4.ip_forward = 1
|
||||
|
||||
- name: Apply sysctl params without reboot
|
||||
become: true
|
||||
ansible.builtin.command: sysctl --system
|
||||
changed_when: false
|
||||
|
||||
- name: Install python3-libselinux for managing selinux
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: python3-libselinux
|
||||
state: present
|
||||
|
||||
- name: Set SELinux to permissive mode
|
||||
selinux:
|
||||
become: true
|
||||
ansible.posix.selinux:
|
||||
policy: targeted
|
||||
state: permissive
|
||||
|
||||
- name: Create Kubernetes service definition
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/firewalld/services/kubernetes.xml
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
content: |
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<service>
|
||||
<short>Kubernetes</short>
|
||||
<description>Kubernetes cluster communication ports</description>
|
||||
<port protocol="tcp" port="6443"/>
|
||||
<port protocol="tcp" port="2379"/>
|
||||
<port protocol="tcp" port="2380"/>
|
||||
<port protocol="tcp" port="10250"/>
|
||||
<port protocol="tcp" port="10251"/>
|
||||
<port protocol="tcp" port="10252"/>
|
||||
<port protocol="tcp" port="10255"/>
|
||||
<port protocol="tcp" port="30000-32767"/>
|
||||
<port protocol="udp" port="4789"/>
|
||||
<port protocol="tcp" port="179"/>
|
||||
</service>
|
||||
|
||||
- name: Reload firewalld to load new service
|
||||
become: true
|
||||
ansible.builtin.command: firewall-cmd --reload
|
||||
|
||||
- name: Add Kubernetes service to default zone
|
||||
become: true
|
||||
ansible.builtin.command: firewall-cmd --permanent --add-service=kubernetes
|
||||
|
||||
- name: Add SSH service to default zone (ensure SSH access)
|
||||
become: true
|
||||
ansible.builtin.command: firewall-cmd --permanent --add-service=ssh
|
||||
|
||||
- name: Reload firewalld to apply changes
|
||||
become: true
|
||||
ansible.builtin.command: firewall-cmd --reload
|
||||
|
||||
- name: Verify Kubernetes service is active
|
||||
become: true
|
||||
ansible.builtin.command: firewall-cmd --list-services
|
||||
register: firewall_services
|
||||
changed_when: false
|
||||
|
||||
- name: Display active firewall services
|
||||
ansible.builtin.debug:
|
||||
msg: "Active firewall services: {{ firewall_services.stdout }}"
|
||||
|
||||
- name: Install DNF plugins core for managing repositories
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: dnf-plugins-core
|
||||
state: present
|
||||
|
||||
- name: Add Docker CE repository
|
||||
ansible.builtin.command: dnf config-manager --add-repo https://download.docker.com/linux/fedora/docker-ce.repo
|
||||
args:
|
||||
creates: /etc/yum.repos.d/docker-ce.repo
|
||||
become: true
|
||||
ansible.builtin.yum_repository:
|
||||
name: docker-ce
|
||||
baseurl: https://download.docker.com/linux/fedora/docker-ce.repo
|
||||
gpgcheck: false
|
||||
enabled: true
|
||||
description: "Docker repository"
|
||||
|
||||
- name: Install containerd
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: containerd.io
|
||||
name: containerd
|
||||
state: present
|
||||
|
||||
- name: Create containerd config directory
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /etc/containerd
|
||||
mode: '0755'
|
||||
state: directory
|
||||
|
||||
- name: Generate default containerd config and enable SystemdCgroup
|
||||
become: true
|
||||
ansible.builtin.shell: |
|
||||
containerd config default > /etc/containerd/config.toml
|
||||
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
|
||||
@@ -72,6 +158,7 @@
|
||||
creates: /etc/containerd/config.toml
|
||||
|
||||
- name: Restart and enable containerd service
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
name: containerd
|
||||
state: restarted
|
||||
@@ -79,6 +166,7 @@
|
||||
daemon_reload: true
|
||||
|
||||
- name: Add Kubernetes repository
|
||||
become: true
|
||||
ansible.builtin.yum_repository:
|
||||
name: kubernetes
|
||||
description: Kubernetes
|
||||
@@ -87,6 +175,7 @@
|
||||
gpgcheck: true
|
||||
|
||||
- name: Install Kubernetes packages
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- kubelet
|
||||
@@ -95,7 +184,73 @@
|
||||
state: present
|
||||
disable_excludes: kubernetes
|
||||
|
||||
- name: Enable the kubelet service
|
||||
- name: Create kubelet config directory
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /var/lib/kubelet
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: Create initial kubelet config file
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
dest: /var/lib/kubelet/config.yaml
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
content: |
|
||||
apiVersion: kubelet.config.k8s.io/v1beta1
|
||||
kind: KubeletConfiguration
|
||||
authentication:
|
||||
anonymous:
|
||||
enabled: false
|
||||
webhook:
|
||||
enabled: true
|
||||
x509:
|
||||
clientCAFile: /etc/kubernetes/pki/ca.crt
|
||||
authorization:
|
||||
mode: Webhook
|
||||
clusterDomain: cluster.local
|
||||
clusterDNS:
|
||||
- 10.96.0.10
|
||||
cpuManagerPolicy: none
|
||||
evictionHard:
|
||||
imagefs.available: 15%
|
||||
memory.available: 100Mi
|
||||
nodefs.available: 10%
|
||||
nodefs.inodesFree: 5%
|
||||
maxPods: 110
|
||||
podCIDR: {{ pod_network_cidr | default('10.244.0.0/16') }}
|
||||
resolvConf: /etc/resolv.conf
|
||||
runtimeRequestTimeout: 2m
|
||||
staticPodPath: /etc/kubernetes/manifests
|
||||
streamingConnectionIdleTimeout: 4h0m0s
|
||||
syncFrequency: 1m0s
|
||||
volumeStatsAggPeriod: 1m0s
|
||||
|
||||
- name: Install CNI plugins via dnf
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: containernetworking-plugins
|
||||
state: present
|
||||
|
||||
- name: Verify CNI plugins installation
|
||||
become: true
|
||||
ansible.builtin.command: ls -la /usr/libexec/cni/
|
||||
register: cni_plugins_list
|
||||
changed_when: false
|
||||
|
||||
|
||||
|
||||
- name: Display installed CNI plugins
|
||||
ansible.builtin.debug:
|
||||
msg: "Installed CNI plugins: {{ cni_plugins_list.stdout_lines }}"
|
||||
|
||||
- name: Enable and start the kubelet service
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
name: kubelet
|
||||
enabled: true
|
||||
enabled: true
|
||||
state: started
|
||||
|
||||
46
ansible/playbooks/roles/ntp-server/tasks/main.yml
Normal file
46
ansible/playbooks/roles/ntp-server/tasks/main.yml
Normal file
@@ -0,0 +1,46 @@
|
||||
---
|
||||
# Role to install and configure an Chrony NTP server
|
||||
|
||||
- name: 1. Install Chrony NTP for time synchronization
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: chrony
|
||||
state: present
|
||||
|
||||
- name: 2.1 Remove DHCP NTP servers from config
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/chrony.conf
|
||||
line: "server unifi.int.mk-labs.cloud iburst"
|
||||
state: absent
|
||||
|
||||
- name: 2.2 Ensure specific NTP servers are present
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/chrony.conf
|
||||
line: "server {{ item }} iburst"
|
||||
state: present
|
||||
loop: "{{ ntp_servers }}"
|
||||
|
||||
- name: 3. Ensure network allowed are present
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/chrony.conf
|
||||
line: "allow {{ item }}"
|
||||
state: present
|
||||
loop: "{{ allowed_networks }}"
|
||||
|
||||
- name: 4.Restart ntpd service
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
name: chronyd
|
||||
state: restarted
|
||||
enabled: true
|
||||
|
||||
- name: 5. Allow NTP traffic
|
||||
become: true
|
||||
ansible.posix.firewalld:
|
||||
service: ntp
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
@@ -9,3 +9,8 @@
|
||||
delegate_to: "{{ inventory_hostname }}"
|
||||
ansible.builtin.hostname:
|
||||
name: "{{ hostname }}"
|
||||
|
||||
- name: Set timezone to US/Central
|
||||
become: true
|
||||
community.general.timezone:
|
||||
name: US/Central
|
||||
|
||||
28
ansible/playbooks/templates/kubeadm-config.yaml.j2
Normal file
28
ansible/playbooks/templates/kubeadm-config.yaml.j2
Normal file
@@ -0,0 +1,28 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: kubeadm-config
|
||||
namespace: kube-system
|
||||
data:
|
||||
ClusterConfiguration: |
|
||||
apiServer: {}
|
||||
apiVersion: kubeadm.k8s.io/v1beta4
|
||||
caCertificateValidityPeriod: 87600h0m0s
|
||||
certificateValidityPeriod: 8760h0m0s
|
||||
certificatesDir: /etc/kubernetes/pki
|
||||
clusterName: kubernetes
|
||||
controllerManager: {}
|
||||
dns: {}
|
||||
encryptionAlgorithm: RSA-2048
|
||||
etcd:
|
||||
local:
|
||||
dataDir: /var/lib/etcd
|
||||
imageRepository: registry.k8s.io
|
||||
kind: ClusterConfiguration
|
||||
kubernetesVersion: {{ kubernetes_version | default('v1.33.4') }}
|
||||
networking:
|
||||
dnsDomain: cluster.local
|
||||
serviceSubnet: {{ service_cidr | default('10.96.0.0/12') }}
|
||||
proxy: {}
|
||||
scheduler: {}
|
||||
controlPlaneEndpoint: {{ control_plane_endpoint | default('fastpass.local.mk-labs.cloud') }}:{{ control_plane_port | default('6443') }}
|
||||
8
ansible/playbooks/test-control-plane.yml
Normal file
8
ansible/playbooks/test-control-plane.yml
Normal file
@@ -0,0 +1,8 @@
|
||||
---
|
||||
- name: Test Control Plane Initialization on Single Node
|
||||
hosts: space-mountain
|
||||
become: true
|
||||
gather_facts: false
|
||||
roles:
|
||||
- role: fastpass-control-plane
|
||||
|
||||
8
ansible/playbooks/test-kubernetes-role.yml
Normal file
8
ansible/playbooks/test-kubernetes-role.yml
Normal file
@@ -0,0 +1,8 @@
|
||||
---
|
||||
- name: Test Kubernetes Role on Single Node
|
||||
hosts: space-mountain
|
||||
become: true
|
||||
gather_facts: true
|
||||
roles:
|
||||
- role: kubernetes
|
||||
|
||||
8
ansible/playbooks/test-prerequisites.yml
Normal file
8
ansible/playbooks/test-prerequisites.yml
Normal file
@@ -0,0 +1,8 @@
|
||||
---
|
||||
- name: Test Kubernetes Prerequisites Role
|
||||
hosts: space-mountain
|
||||
become: true
|
||||
gather_facts: true
|
||||
roles:
|
||||
- role: kubernetes-prerequisites
|
||||
|
||||
@@ -1,27 +1,25 @@
|
||||
---
|
||||
- name: Interactively configure an OpenShift cluster
|
||||
# Run this play on the controller to orchestrate the changes
|
||||
hosts: localhost
|
||||
gather_facts: false
|
||||
|
||||
vars_prompt:
|
||||
- name: cluster_group
|
||||
prompt: "What is the name of the Cluster Group?"
|
||||
private: false
|
||||
- name: Test Ansible Playbook
|
||||
hosts: all
|
||||
gather_facts: yes
|
||||
become: false
|
||||
|
||||
tasks:
|
||||
- name: Create DNS entry for each cluster node
|
||||
# Loop over every hostname in the user-provided group
|
||||
loop: "{{ groups[cluster_group] }}"
|
||||
loop_control:
|
||||
# Use a descriptive name for the loop variable instead of 'item'
|
||||
loop_var: node_hostname
|
||||
- name: Ping all hosts
|
||||
ansible.builtin.ping:
|
||||
|
||||
- name: Display hostname
|
||||
ansible.builtin.debug:
|
||||
msg: "Using {{ item, dns_address }}"
|
||||
msg: "The hostname of this system is {{ inventory_hostname }}"
|
||||
|
||||
# ansible.builtin.include_tasks: tasks/create_dns_record.yml
|
||||
vars:
|
||||
# Access the 'ip_address' variable of the specific host in the loop
|
||||
dns_address: "{{ hostvars[node_hostname]['ip_address'] }}"
|
||||
dns_name: "{{ hostvars[node_hostname] }}"
|
||||
- name: Show OS distribution
|
||||
ansible.builtin.debug:
|
||||
msg: "This host is running {{ ansible_distribution }} {{ ansible_distribution_version }}"
|
||||
|
||||
- name: Run uptime command
|
||||
ansible.builtin.command: uptime
|
||||
register: uptime_result
|
||||
|
||||
- name: Display uptime result
|
||||
ansible.builtin.debug:
|
||||
var: uptime_result.stdout
|
||||
Reference in New Issue
Block a user