From 5612932691bee0645dd6e608e69afab47a6f2dd1 Mon Sep 17 00:00:00 2001 From: rblundon Date: Sat, 26 Jul 2025 01:06:44 -0500 Subject: [PATCH] Updated cluster creation playbook --- README.md | 134 +++++++++++- .../01-dhcp/host-reservations.yml | 13 -- .../01-dns/.terraform.lock.hcl | 24 --- .../10-internal-cluster/01-dns/README.md | 3 - .../10-internal-cluster/01-dns/dns.tf | 39 ---- .../10-internal-cluster/01-dns/provider.tf | 22 -- .../10-internal-cluster/02-dhcp/README.md | 1 - .../02-dhcp/ip-reservations.yml | 28 --- .../04-matchbox/templates/groups.tf.j2 | 8 - .../04-matchbox/templates/profiles.tf.j2 | 16 -- infra-config/10-internal-cluster/install.yml | 92 ++++---- infra-config/group_vars/all/vars | 4 +- infra-config/group_vars/internal_cluster/vars | 10 +- .../{matchbox => matchbox_server}/vars | 0 infra-config/host_vars/int-master01/vars | 7 +- infra-config/host_vars/int-master02/vars | 9 +- infra-config/host_vars/int-master03/vars | 9 +- infra-config/host_vars/int-worker01/vars | 9 - infra-config/host_vars/int-worker02/vars | 12 ++ infra-config/inventory.yml | 8 +- infra-config/playbooks/alertmanager.yml | 0 .../configure_openshift_internal.yml | 196 ++++++++++++++++++ .../playbooks/configure_unbound copy.yml | 10 - .../playbooks/tasks/configure_dhcp_entry.yml | 10 + .../playbooks/tasks/create_dns_record.yml | 11 + .../playbooks/templates/agent-config.yaml.j2 | 35 ++++ infra-config/playbooks/templates/groups.tf.j2 | 14 ++ .../templates/install-config.yaml.j2 | 28 +++ .../playbooks/templates/profiles.tf.j2 | 16 ++ .../templates/provider.tf.j2 | 2 +- 30 files changed, 533 insertions(+), 237 deletions(-) delete mode 100644 infra-config/10-internal-cluster/01-dhcp/host-reservations.yml delete mode 100644 infra-config/10-internal-cluster/01-dns/.terraform.lock.hcl delete mode 100644 infra-config/10-internal-cluster/01-dns/README.md delete mode 100644 infra-config/10-internal-cluster/01-dns/dns.tf delete mode 100644 infra-config/10-internal-cluster/01-dns/provider.tf delete mode 100644 infra-config/10-internal-cluster/02-dhcp/README.md delete mode 100644 infra-config/10-internal-cluster/02-dhcp/ip-reservations.yml delete mode 100644 infra-config/10-internal-cluster/04-matchbox/templates/groups.tf.j2 delete mode 100644 infra-config/10-internal-cluster/04-matchbox/templates/profiles.tf.j2 rename infra-config/group_vars/{matchbox => matchbox_server}/vars (100%) delete mode 100644 infra-config/host_vars/int-worker01/vars create mode 100644 infra-config/host_vars/int-worker02/vars delete mode 100644 infra-config/playbooks/alertmanager.yml create mode 100644 infra-config/playbooks/configure_openshift_internal.yml delete mode 100644 infra-config/playbooks/configure_unbound copy.yml create mode 100644 infra-config/playbooks/tasks/configure_dhcp_entry.yml create mode 100644 infra-config/playbooks/tasks/create_dns_record.yml create mode 100644 infra-config/playbooks/templates/agent-config.yaml.j2 create mode 100644 infra-config/playbooks/templates/groups.tf.j2 create mode 100644 infra-config/playbooks/templates/install-config.yaml.j2 create mode 100644 infra-config/playbooks/templates/profiles.tf.j2 rename infra-config/{10-internal-cluster/04-matchbox => playbooks}/templates/provider.tf.j2 (84%) diff --git a/README.md b/README.md index ab65486..cf86223 100644 --- a/README.md +++ b/README.md @@ -1,9 +1,141 @@ # A Homelab based on Red Hat Technologies -This repository is the configuration of my homelab. In addition to providing services, the purpose of my homelab is to learn advanced concepts primarily based on Red Hat OpenShift. +A comprehensive homelab for learning advanced concepts primarily based on Red Hat OpenShift. In addition to providing services, it is an area to incorporate container technologies, and enterprise integration scenarios. This implementation is built on easily accessible consumer based hardware and will focus heavily on GitOps practices and automation will be used wherever possible. +## 🎯 Project Goals + +- **Multi-cluster OpenShift management** with ACM +- **Hybrid cloud scenarios** (bare metal + virtualized + containerized) +- **Enterprise integration testing** (AD, SQL Server, SIEM) +- **GitOps and automation workflows** +- **Red Hat certification preparation** + +## 📋 Documentation (Priority Order) + +### Phase 1: Foundation +1. **[Overview & Hardware Allocation](./docs/01-overview.md)** - Complete architecture overview +2. **[Networking Plan](./docs/02-networking.md)** - VLAN strategy and network design +3. **[Core Services Setup](./docs/03-core-services.md)** *(TBD)* - k0s cluster, DNS, monitoring +4. **[Storage Configuration](./docs/04-storage.md)** *(TBD)* - Synology, democratic-csi + +### Phase 2: Container Platform +5. **[Container Registry Setup](./docs/05-container-registry.md)** *(TBD)* - Harbor deployment +6. **[Git Repository Setup](./docs/06-git-repository.md)** *(TBD)* - Gitea/GitLab on Synology +7. **[Artifact Repository](./docs/07-artifact-repository.md)** *(TBD)* - Nexus/Artifactory + +### Phase 3: OpenShift Clusters +8. **[OpenShift Compact Cluster](./docs/08-openshift-compact.md)** *(TBD)* - 3-node production-like +9. **[OpenShift SNO + Worker](./docs/09-openshift-sno.md)** *(TBD)* - Edge computing setup +10. **[ACM Configuration](./docs/10-acm-setup.md)** *(TBD)* - Multi-cluster management + +### Phase 4: vSphere Platform +11. **[vSphere Installation](./docs/11-vsphere-setup.md)** *(TBD)* - Dell T640 virtualization +12. **[Windows Infrastructure](./docs/12-windows-infrastructure.md)** *(TBD)* - AD, SQL Server +13. **[VM Templates & Automation](./docs/13-vm-automation.md)** *(TBD)* - Template creation + +### Phase 5: Advanced Services +14. **[Monitoring & Observability](./docs/14-monitoring.md)** *(TBD)* - Prometheus, Grafana, Splunk +15. **[Security & Compliance](./docs/15-security.md)** *(TBD)* - ACS, certificates, auditing +16. **[Backup & DR](./docs/16-backup-dr.md)** *(TBD)* - Backup strategies + +## 🚀 Quick Start Deployment + +### Prerequisites +- Ubiquiti UDM SE configured +- Hardware powered and networked +- Initial VLAN setup (see [networking plan](./docs/02-networking.md)) + +Ansible Collections +- ansible-galaxy collection install freeipa.ansible_freeipa + +### Deployment Scripts + +```bash +source ~/venv-ansible/bin/activate +# Phase 1: Foundation +./scripts/01-network-setup.sh +./scripts/02-core-services-deploy.sh + +# Phase 2: Container Platform +./deployment/synology/docker-compose.yml # Git repo, Harbor, Nexus +./scripts/03-storage-setup.sh + +# Phase 3: OpenShift +./deployment/openshift/compact-cluster/ +./deployment/openshift/sno-cluster/ + +# Phase 4: vSphere +./deployment/vsphere/ +``` + +## 📁 Repository Structure + +``` +homelab-plan/ +├── README.md # This file +├── docs/ # Documentation (numbered by priority) +│ ├── 01-overview.md +│ ├── 02-networking.md +│ └── ... +├── deployment/ # Deployment configurations +│ ├── synology/ # Docker Compose files for Synology +│ ├── k0s/ # k0s cluster manifests +│ ├── openshift/ # OpenShift installation configs +│ └── vsphere/ # vSphere automation +├── scripts/ # Automation scripts +└── .gitignore # Excludes sensitive data +``` + +## 🔧 Technology Stack + +### Infrastructure +- **Networking**: Ubiquiti UDM SE +- **Storage**: Synology DS1621+, Ubiquiti UNAS Pro +- **Compute**: 3x Beelink S12 Pro, 5x Lenovo M710q, Dell T640 + +### Container Platforms +- **OpenShift 4.14+**: Two clusters (compact + SNO) +- **k0s**: Core services cluster +- **vSphere**: VM workloads + +### Core Services +- **Container Registry**: Harbor +- **Git Repository**: Gitea/GitLab CE +- **Artifact Repository**: Nexus/Artifactory +- **Monitoring**: Prometheus + Grafana +- **Logging**: Splunk Enterprise +- **DNS**: CoreDNS +- **Load Balancing**: MetalLB + HAProxy + +## 🔐 Security Notes + +- **No sensitive data** is stored in this repository +- **Secrets management** via external-secrets-operator +- **Certificate management** via cert-manager +- **Network segmentation** via VLANs and firewall rules + +## 🤝 Contributing + +This is a personal homelab project, but feel free to: +- Submit issues for questions or suggestions +- Fork for your own homelab adaptations +- Share improvements via pull requests + +## 📞 Next Steps + +1. **Create GitHub repository** for version control +2. **Start with Phase 1** foundation setup +3. **Build deployment automation** as we go +4. **Document lessons learned** for future reference + +--- + +**Status**: 🚧 Planning & Initial Development + +**Last Updated**: June 2025 + This repo is a mono-repo that is broken up into three sections: - infra-config diff --git a/infra-config/10-internal-cluster/01-dhcp/host-reservations.yml b/infra-config/10-internal-cluster/01-dhcp/host-reservations.yml deleted file mode 100644 index 838c2b7..0000000 --- a/infra-config/10-internal-cluster/01-dhcp/host-reservations.yml +++ /dev/null @@ -1,13 +0,0 @@ ---- -- name: Dnsmasq - hosts: localhost - become: yes - vars: - - additional_dhcp_hosts: - ethernet_switch: - desc: "SNO Hub Cluster" - mac: 98:b7:85:1e:c6:f1 - ip: 10.1.71.10 - - roles: - - role: ricsanfre.dnsmasq \ No newline at end of file diff --git a/infra-config/10-internal-cluster/01-dns/.terraform.lock.hcl b/infra-config/10-internal-cluster/01-dns/.terraform.lock.hcl deleted file mode 100644 index eaa91ba..0000000 --- a/infra-config/10-internal-cluster/01-dns/.terraform.lock.hcl +++ /dev/null @@ -1,24 +0,0 @@ -# This file is maintained automatically by "terraform init". -# Manual edits may be lost in future updates. - -provider "registry.terraform.io/rework-space-com/freeipa" { - version = "5.0.0" - constraints = "5.0.0" - hashes = [ - "h1:6EquDv6GgQO2HjZUUoRIUVzYa951n+wb4Uk7ggD6XD0=", - "zh:098607e559c3b696401034ff494ba8068962b45059ee067a54b58334b6ee0f2c", - "zh:18b806a14bb9d9382213c6929af35f5a65f16c17ff526d475f1eab33d1470290", - "zh:2c8c74668844d256b7fdc503cd736a20b7e58db5b31880d1ad8090c1af04e24c", - "zh:3bba458b9a6df99c21da58750dd6586b93bdcc557e4a2d695e801ada39e8de1e", - "zh:58f728d9e98cc7aae3841c07318be64b6dcb2f51c041f04bba977e61104a2333", - "zh:597dfbefbfe111a31e9ff3c4fc14fc8e12c1e255454087d3eebd2ec6c7aa9bf3", - "zh:6093d6db13d834c23f5482efae80c8e1ae046028fccf24242f0f1c1935e6aa70", - "zh:87271fa234a57ce05d4166e444002bd66976f971b434f7add45c874c9587129d", - "zh:89f7f6be64b6bf9e708fbafd22f410cf3f50b1fcd4cd6c61e9ffffd6180ea839", - "zh:9bdd7a984f845ff6f4bc4df5cc41a9de019639fceca62e60fc7c0f098ad2695c", - "zh:a0551311c96b86050d15854b4fca2beaa06b2e1964f97945824567d0b90db580", - "zh:c3daa12021725883bd32d7d852a2de845bb7a5f18009a45be7c2c2d891631713", - "zh:d7871eb99683934a30b9d47508379e6d16978f3dcd73601af2204652668592aa", - "zh:e8f72fd7750e6c1f0f97d039fea66cb85f457cf22908b7c3f14c7d2cf990ee84", - ] -} diff --git a/infra-config/10-internal-cluster/01-dns/README.md b/infra-config/10-internal-cluster/01-dns/README.md deleted file mode 100644 index 90b034d..0000000 --- a/infra-config/10-internal-cluster/01-dns/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# DNS Provider Configuration - -This directory contains the configuration to updateFreeIPA DNS for the Hub Cluster. diff --git a/infra-config/10-internal-cluster/01-dns/dns.tf b/infra-config/10-internal-cluster/01-dns/dns.tf deleted file mode 100644 index 83fb427..0000000 --- a/infra-config/10-internal-cluster/01-dns/dns.tf +++ /dev/null @@ -1,39 +0,0 @@ -resource "freeipa_dns_record" "ocp-hub" { - zone_name = "int.mk-labs.cloud." - name = "ocp-hub" - type = "A" - records = [ - "10.1.71.10", - ] - ttl = 60 -} - -resource "freeipa_dns_record" "api" { - zone_name = "int.mk-labs.cloud." - name = "api.hub" - type = "A" - records = [ - "10.1.71.10", - ] - ttl = 60 -} - -resource "freeipa_dns_record" "api-int" { - zone_name = "int.mk-labs.cloud." - name = "api-int.hub" - type = "A" - records = [ - "10.1.71.10", - ] - ttl = 60 -} - -resource "freeipa_dns_record" "wildcard-apps" { - zone_name = "int.mk-labs.cloud." - name = "*.apps.hub" - type = "A" - records = [ - "10.1.71.10", - ] - ttl = 60 -} diff --git a/infra-config/10-internal-cluster/01-dns/provider.tf b/infra-config/10-internal-cluster/01-dns/provider.tf deleted file mode 100644 index 4d1c4f8..0000000 --- a/infra-config/10-internal-cluster/01-dns/provider.tf +++ /dev/null @@ -1,22 +0,0 @@ -# Configure the DNS Provider -provider "freeipa" { - host = "infra01.int.mk-labs.cloud" - username = "admin" - password = var.freeipa_password - insecure = true -} - -variable "freeipa_password" { - description = "The password for the FreeIPA provider" - type = string - sensitive = true -} - -terraform { - required_providers { - freeipa = { - source = "rework-space-com/freeipa" - version = "5.0.0" - } - } -} diff --git a/infra-config/10-internal-cluster/02-dhcp/README.md b/infra-config/10-internal-cluster/02-dhcp/README.md deleted file mode 100644 index 4fad815..0000000 --- a/infra-config/10-internal-cluster/02-dhcp/README.md +++ /dev/null @@ -1 +0,0 @@ -# Add/modify entry in DNSmasq diff --git a/infra-config/10-internal-cluster/02-dhcp/ip-reservations.yml b/infra-config/10-internal-cluster/02-dhcp/ip-reservations.yml deleted file mode 100644 index 0993f40..0000000 --- a/infra-config/10-internal-cluster/02-dhcp/ip-reservations.yml +++ /dev/null @@ -1,28 +0,0 @@ ---- -- name: Ensure dnsmasq is installed - ansible.builtin.apt: - name: dnsmasq - state: present - become: true - when: ansible_os_family == "Debian" - -- name: Ensure dnsmasq is installed - ansible.builtin.dnf: - name: dnsmasq - state: present - become: true - when: ansible_os_family == "RedHat" - -- name: Add host reservation to dnsmasq - ansible.builtin.lineinfile: - path: /etc/dnsmasq.d/hosts.conf - regexp: "^dhcp-host={{ hostvars['ocp-hub'].mac_address }}" - line: "dhcp-host={{ hostvars['ocp-hub'].mac_address }},{{ hostvars['ocp-hub'].ip_address }} #{{ hostvars['ocp-hub'].hostname }}" - state: present - become: true - -- name: Restart dnsmasq service - ansible.builtin.service: - name: dnsmasq - state: restarted - become: true diff --git a/infra-config/10-internal-cluster/04-matchbox/templates/groups.tf.j2 b/infra-config/10-internal-cluster/04-matchbox/templates/groups.tf.j2 deleted file mode 100644 index ae7ef1b..0000000 --- a/infra-config/10-internal-cluster/04-matchbox/templates/groups.tf.j2 +++ /dev/null @@ -1,8 +0,0 @@ -// Matcher group for OCP Internal machines -resource "matchbox_group" "{{ hostvars[groups['hub_cluster'][0]].cluster_name }}" { - name = "{{ hostvars['ocp-hub'].hostname }}" # Physical Server - profile = matchbox_profile.openshift-agent-install.name - selector = { - mac = "{{ hostvars['ocp-hub'].mac_address }}" # PXE boots and installs to 10GbE NIC - } -} diff --git a/infra-config/10-internal-cluster/04-matchbox/templates/profiles.tf.j2 b/infra-config/10-internal-cluster/04-matchbox/templates/profiles.tf.j2 deleted file mode 100644 index 5e54f8e..0000000 --- a/infra-config/10-internal-cluster/04-matchbox/templates/profiles.tf.j2 +++ /dev/null @@ -1,16 +0,0 @@ -// Fedora CoreOS profile -resource "matchbox_profile" "openshift-agent-install" { - name = "{{ hostvars[groups['hub_cluster'][0]].cluster_name }}" - kernel = "/assets/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}/agent.x86_64-vmlinuz" - initrd = [ - "--name initrd /assets/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}/agent.x86_64-initrd.img" - ] - - args = [ - "initrd=initrd", - "coreos.live.rootfs_url={{ hostvars[groups['matchbox'][0]].http_endpoint }}/assets/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}/agent.x86_64-rootfs.img", - "rw", - "ignition.firstboot", - "ignition.platform.id=metal", - ] -} diff --git a/infra-config/10-internal-cluster/install.yml b/infra-config/10-internal-cluster/install.yml index bacdafe..1c1a107 100644 --- a/infra-config/10-internal-cluster/install.yml +++ b/infra-config/10-internal-cluster/install.yml @@ -5,58 +5,58 @@ gather_facts: true tasks: - - name: Deploy DNS entries for cluster via Terraform - community.general.terraform: - project_path: 01-dns/ - variables: - freeipa_password: "{{ vault_freeipa_password }}" - state: present - force_init: true + # - name: Deploy DNS entries for cluster via Terraform + # community.general.terraform: + # project_path: 01-dns/ + # variables: + # freeipa_password: "{{ vault_freeipa_password }}" + # state: present + # force_init: true - - name: Deploy DHCP entries for cluster via Terraform - ansible.builtin.include_tasks: - file: 02-dhcp/ip-reservations.yml + # - name: Deploy DHCP entries for cluster via Terraform + # ansible.builtin.include_tasks: + # file: 02-dhcp/ip-reservations.yml - - name: OpenShift Installer install-config.yaml - ansible.builtin.template: - src: 03-openshift-image/templates/install-config.yaml.j2 - dest: 03-openshift-image/install-config.yaml - mode: '0644' + # - name: OpenShift Installer install-config.yaml + # ansible.builtin.template: + # src: 03-openshift-image/templates/install-config.yaml.j2 + # dest: 03-openshift-image/install-config.yaml + # mode: '0644' - - name: OpenShift Installer agent-config.yaml - ansible.builtin.template: - src: 03-openshift-image/templates/agent-config.yaml.j2 - dest: 03-openshift-image/agent-config.yaml - mode: '0644' + # - name: OpenShift Installer agent-config.yaml + # ansible.builtin.template: + # src: 03-openshift-image/templates/agent-config.yaml.j2 + # dest: 03-openshift-image/agent-config.yaml + # mode: '0644' - - name: Create OpenShift image - ansible.builtin.include_tasks: - file: 03-openshift-image/create-openshift-image.yml + # - name: Create OpenShift image + # ansible.builtin.include_tasks: + # file: 03-openshift-image/create-openshift-image.yml - - name: Move PXE assets to matchbox - ansible.builtin.include_tasks: - file: 03-openshift-image/move-pxe-assets.yml + # - name: Move PXE assets to matchbox + # ansible.builtin.include_tasks: + # file: 03-openshift-image/move-pxe-assets.yml - - name: Terraform matchbox groups file - ansible.builtin.template: - src: 04-matchbox/templates/groups.tf.j2 - dest: 04-matchbox/groups.tf - mode: '0644' + # - name: Terraform matchbox groups file + # ansible.builtin.template: + # src: 04-matchbox/templates/groups.tf.j2 + # dest: 04-matchbox/groups.tf + # mode: '0644' - - name: Terraform matchbox profiles file - ansible.builtin.template: - src: 04-matchbox/templates/profiles.tf.j2 - dest: 04-matchbox/profiles.tf - mode: '0644' + # - name: Terraform matchbox profiles file + # ansible.builtin.template: + # src: 04-matchbox/templates/profiles.tf.j2 + # dest: 04-matchbox/profiles.tf + # mode: '0644' - - name: Terraform matchbox provider file - ansible.builtin.template: - src: 04-matchbox/templates/provider.tf.j2 - dest: 04-matchbox/provider.tf - mode: '0644' + # - name: Terraform matchbox provider file + # ansible.builtin.template: + # src: 04-matchbox/templates/provider.tf.j2 + # dest: 04-matchbox/provider.tf + # mode: '0644' - - name: Configure Matchbox via Terraform - community.general.terraform: - project_path: 04-matchbox/ - state: present - force_init: true + # - name: Configure Matchbox via Terraform + # community.general.terraform: + # project_path: 04-matchbox/ + # state: present + # force_init: true diff --git a/infra-config/group_vars/all/vars b/infra-config/group_vars/all/vars index 20d81a7..06b1854 100644 --- a/infra-config/group_vars/all/vars +++ b/infra-config/group_vars/all/vars @@ -7,9 +7,11 @@ proxmox_password: "{{ vault_proxmox_root_password }}" proxmox_host: "pve01" # DNS variables -dns_server: "infra01.int.mk-labs.cloud" +dns_server: "infra01" # .int.mk-labs.cloud" dns_admin: "admin" base_domain: "int.mk-labs.cloud" +# DHCP server +dhcp_server: "matchbox" # Terraform variables terraform_server: "infra01" diff --git a/infra-config/group_vars/internal_cluster/vars b/infra-config/group_vars/internal_cluster/vars index 429665b..14efe12 100644 --- a/infra-config/group_vars/internal_cluster/vars +++ b/infra-config/group_vars/internal_cluster/vars @@ -1,10 +1,14 @@ cluster_name: "openshift" -cluster_version: "4.17.20" -#base_domain: "int.mk-labs.cloud" +cluster_version: "4.18.21" +openshift_installer_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/openshift-install-linux.tar.gz" +openshift_client_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/openshift-client-linux.tar.gz" +# cluster_group: "internal_cluster" worker_node_count: 1 master_node_count: 3 cluster_network: "10.128.0.0/14" cluster_network_host_prefix: 23 machine_network: "10.1.71.0/24" service_network: "172.30.0.0/16" -platform_type: "none" +platform_type: "baremetal" +api_address: "10.1.71.69" +app_address: "10.1.71.60" \ No newline at end of file diff --git a/infra-config/group_vars/matchbox/vars b/infra-config/group_vars/matchbox_server/vars similarity index 100% rename from infra-config/group_vars/matchbox/vars rename to infra-config/group_vars/matchbox_server/vars diff --git a/infra-config/host_vars/int-master01/vars b/infra-config/host_vars/int-master01/vars index c559848..b2a8f8b 100644 --- a/infra-config/host_vars/int-master01/vars +++ b/infra-config/host_vars/int-master01/vars @@ -1,9 +1,12 @@ --- # file: host_vars/int-master01/vars +# OpenShift node # Networking -# primary_interface: "enp1s0f0" -mac_address: "54:bf:64:60:52:2d" +primary_interface: "enp1s0f0" +boot_mac_address: "54:bf:64:60:52:2d" +install_mac_address: "00:0a:f7:5d:f3:53" ip_address: 10.1.71.61 +node_role: "master" hostname: "{{ inventory_hostname }}.{{ base_domain }}" diff --git a/infra-config/host_vars/int-master02/vars b/infra-config/host_vars/int-master02/vars index 77aa4f8..ec39c5a 100644 --- a/infra-config/host_vars/int-master02/vars +++ b/infra-config/host_vars/int-master02/vars @@ -1,9 +1,12 @@ --- -# file: host_vars/int-master01/vars +# file: host_vars/int-master02/vars +# OpenShift node # Networking -# primary_interface: "enp1s0f0" -mac_address: "54:bf:64:5f:a2:80" +primary_interface: "enp1s0f0" +boot_mac_address: "54:bf:64:5f:a2:80" +install_mac_address: "98:b7:85:20:47:3b" ip_address: 10.1.71.62 +node_role: "master" hostname: "{{ inventory_hostname }}.{{ base_domain }}" diff --git a/infra-config/host_vars/int-master03/vars b/infra-config/host_vars/int-master03/vars index def32e2..984cce7 100644 --- a/infra-config/host_vars/int-master03/vars +++ b/infra-config/host_vars/int-master03/vars @@ -1,9 +1,12 @@ --- -# file: host_vars/int-master01/vars +# file: host_vars/int-master03/vars +# OpenShift node # Networking -# primary_interface: "enp1s0f0" -mac_address: "d8:9e:f3:4c:02:a9" +primary_interface: "enp1s0f0" +boot_mac_address: "d8:9e:f3:4c:02:a9" +install_mac_address: "98:b7:85:20:47:23" ip_address: 10.1.71.63 +node_role: "master" hostname: "{{ inventory_hostname }}.{{ base_domain }}" diff --git a/infra-config/host_vars/int-worker01/vars b/infra-config/host_vars/int-worker01/vars deleted file mode 100644 index 883ee92..0000000 --- a/infra-config/host_vars/int-worker01/vars +++ /dev/null @@ -1,9 +0,0 @@ ---- -# file: host_vars/int-master01/vars - -# Networking -# primary_interface: "enp1s0f0" -mac_address: "54:bf:64:60:52:2d" -ip_address: 10.1.71.64 - -hostname: "{{ inventory_hostname }}.{{ base_domain }}" diff --git a/infra-config/host_vars/int-worker02/vars b/infra-config/host_vars/int-worker02/vars new file mode 100644 index 0000000..8ccd7d3 --- /dev/null +++ b/infra-config/host_vars/int-worker02/vars @@ -0,0 +1,12 @@ +--- +# file: host_vars/int-worker02/vars +# OpenShift node + +# Networking +primary_interface: "enp2s0f0" +boot_mac_address: "58:47:ca:76:13:49" +install_mac_address: "58:47:ca:76:13:47" +ip_address: 10.1.71.65 +node_role: "worker" + +hostname: "{{ inventory_hostname }}.{{ base_domain }}" diff --git a/infra-config/inventory.yml b/infra-config/inventory.yml index 49de0f0..f55c9c6 100644 --- a/infra-config/inventory.yml +++ b/infra-config/inventory.yml @@ -40,9 +40,9 @@ ipaserver: hosts: infra01.int.mk-labs.cloud: -# matchbox: -# hosts: -# infra01: +matchbox_server: + hosts: + matchbox: hub_cluster: hosts: @@ -53,7 +53,7 @@ internal_cluster: int-master01: int-master02: int-master03: - int-worker01: + int-worker02: sql_servers: hosts: diff --git a/infra-config/playbooks/alertmanager.yml b/infra-config/playbooks/alertmanager.yml deleted file mode 100644 index e69de29..0000000 diff --git a/infra-config/playbooks/configure_openshift_internal.yml b/infra-config/playbooks/configure_openshift_internal.yml new file mode 100644 index 0000000..951a3d7 --- /dev/null +++ b/infra-config/playbooks/configure_openshift_internal.yml @@ -0,0 +1,196 @@ +--- +- name: Configure DNS entries for cluster nodes + hosts: internal_cluster + gather_facts: false + become: true + tasks: + - name: Create DNS entry for each cluster node + ansible.builtin.include_tasks: tasks/create_dns_record.yml + vars: + host_ip_address: "{{ ip_address }}" + +- name: Configure DNS entries for OpenShift cluster services + hosts: internal_cluster[0] + gather_facts: false + become: true + tasks: + - name: Create DNS entries for OpenShift cluster services + ansible.builtin.include_tasks: tasks/create_dns_record.yml + vars: + dns_name: "{{ item.name }}" + dns_address: "{{ item.address }}" + loop: + - name: "api.{{ cluster_name }}" + address: "{{ api_address }}" + - name: "api-int.{{ cluster_name }}" + address: "{{ api_address }}" + - name: "*.apps.{{ cluster_name }}" + address: "{{ app_address }}" + loop_control: + label: "{{ item.name }}" + +- name: Configure DHCP entries for cluster nodes + hosts: internal_cluster + gather_facts: false + become: true + tasks: + - name: Configure DHCP entry for node + ansible.builtin.include_tasks: tasks/configure_dhcp_entry.yml + vars: + host_mac_address: "{{ install_mac_address }}" + host_ip_address: "{{ ip_address }}" + + handlers: + - name: Restart dnsmasq + delegate_to: "{{ dhcp_server }}" + become: true + ansible.builtin.service: + name: dnsmasq + state: restarted + +- name: Create OpenShift installer files + hosts: matchbox + gather_facts: true + + vars: + cluster_group: "internal_cluster" + + tasks: + - name: Create directory + ansible.builtin.file: + path: ~/homelab/terraform/{{ cluster_group }} + state: directory + mode: '0755' + + - name: OpenShift Installer install-config.yaml + ansible.builtin.template: + src: templates/install-config.yaml.j2 + dest: ~/homelab/terraform/{{ cluster_group }}/install-config.yaml + mode: '0644' + + - name: OpenShift Installer agent-config.yaml + ansible.builtin.template: + src: templates/agent-config.yaml.j2 + dest: ~/homelab/terraform/{{ cluster_group }}/agent-config.yaml + mode: '0644' + + - name: Create directory for OpenShift Installer files + become: true + ansible.builtin.file: + path: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }} + state: directory + mode: '0755' + owner: root + group: root + + - name: Download OpenShift Installer file + become: true + ansible.builtin.get_url: + url: "{{ hostvars[groups[cluster_group][0]].openshift_installer_download_url }}" + dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }} + mode: '0644' + + - name: Download OpenShift Client file + become: true + ansible.builtin.get_url: + url: "{{ hostvars[groups[cluster_group][0]].openshift_client_download_url }}" + dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }} + mode: '0644' + + - name: Unarchive installer file + become: true + ansible.builtin.unarchive: + src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install-linux.tar.gz + dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }} + remote_src: true + + - name: Unarchive client file + become: true + ansible.builtin.unarchive: + src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-client-linux.tar.gz + dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }} + remote_src: true + + - name: Copy install binary + become: true + ansible.builtin.copy: + src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install + dest: /usr/local/bin + remote_src: true + owner: wed + group: wed + mode: '0755' + + - name: Copy client binary + become: true + ansible.builtin.copy: + src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/oc + dest: /usr/local/bin + remote_src: true + owner: wed + group: wed + mode: '0755' + + - name: Check if OpenShift image exists + ansible.builtin.stat: + path: ~/homelab/terraform/{{ cluster_group }}/boot-artifacts/agent.x86_64-initrd.img + register: openshift_image_exists + + - name: OpenShift image creation + ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files + args: + chdir: ~/homelab/terraform/{{ cluster_group }} + when: not openshift_image_exists.stat.exists + changed_when: true + + - name: Create a directory if it does not exist + become: true + ansible.builtin.file: + path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}" + state: directory + owner: matchbox + group: matchbox + mode: '0755' + + - name: Copy file with owner and permissions + become: true + ansible.builtin.copy: + src: "{{ ansible_env['HOME'] }}/homelab/terraform/{{ cluster_group }}/boot-artifacts/" + dest: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}/" + remote_src: true + owner: matchbox + group: matchbox + mode: '0644' + + - name: Verify directory permissions + become: true + ansible.builtin.file: + path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}" + state: directory + owner: matchbox + group: matchbox + mode: '0755' + + - name: Create Terraform matchbox groups file from template + ansible.builtin.template: + src: templates/groups.tf.j2 + dest: ~/homelab/terraform/{{ cluster_group }}/groups.tf + mode: '0644' + + - name: Create Terraform matchbox profiles file from template + ansible.builtin.template: + src: templates/profiles.tf.j2 + dest: ~/homelab/terraform/{{ cluster_group }}/profiles.tf + mode: '0644' + + - name: Create Terraform matchbox provider file from template + ansible.builtin.template: + src: templates/provider.tf.j2 + dest: ~/homelab/terraform/{{ cluster_group }}/provider.tf + mode: '0644' + + - name: Configure Matchbox via Terraform + community.general.terraform: + project_path: ~/homelab/terraform/{{ cluster_group }} + state: present + force_init: true diff --git a/infra-config/playbooks/configure_unbound copy.yml b/infra-config/playbooks/configure_unbound copy.yml deleted file mode 100644 index 674340a..0000000 --- a/infra-config/playbooks/configure_unbound copy.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -- name: Master playbook to configure openshift cluster (internal) - hosts: internal_cluster - become: true - - tasks: - - - name: Install unbound via role - ansible.builtin.import_role: - name: Anthony25.unbound diff --git a/infra-config/playbooks/tasks/configure_dhcp_entry.yml b/infra-config/playbooks/tasks/configure_dhcp_entry.yml new file mode 100644 index 0000000..d403cf7 --- /dev/null +++ b/infra-config/playbooks/tasks/configure_dhcp_entry.yml @@ -0,0 +1,10 @@ +--- +- name: Add DHCP entry for {{ inventory_hostname }} + delegate_to: "{{ dhcp_server }}" + become: true + ansible.builtin.lineinfile: + path: /etc/dnsmasq.d/hosts.conf + regexp: "# {{ inventory_hostname }}$" + line: "dhcp-host={{ host_mac_address | lower }},{{ host_ip_address }} # {{ inventory_hostname }}" + state: present + notify: Restart dnsmasq diff --git a/infra-config/playbooks/tasks/create_dns_record.yml b/infra-config/playbooks/tasks/create_dns_record.yml new file mode 100644 index 0000000..9878f4b --- /dev/null +++ b/infra-config/playbooks/tasks/create_dns_record.yml @@ -0,0 +1,11 @@ +--- +- name: "Create DNS record for {{ dns_name | default(inventory_hostname) }}" + delegate_to: "{{ dns_server }}" + freeipa.ansible_freeipa.ipadnsrecord: + ipaapi_context: "server" + ipaadmin_password: "{{ vault_freeipa_password }}" + name: "{{ dns_name | default(inventory_hostname) }}" + zone_name: "{{ base_domain }}" + record_type: "A" + record_value: "{{ dns_address | default(host_ip_address) }}" + record_ttl: 60 diff --git a/infra-config/playbooks/templates/agent-config.yaml.j2 b/infra-config/playbooks/templates/agent-config.yaml.j2 new file mode 100644 index 0000000..e883030 --- /dev/null +++ b/infra-config/playbooks/templates/agent-config.yaml.j2 @@ -0,0 +1,35 @@ +apiVersion: v1alpha1 +kind: AgentConfig +metadata: + name: {{ hostvars[groups[cluster_group][0]].cluster_name }} +rendezvousIP: {{ hostvars[groups[cluster_group][0]].ip_address }} +bootArtifactsBaseURL: {{ hostvars[groups['matchbox_server'][0]].http_endpoint }}/assets/hub/ +hosts: +{% for host in groups[cluster_group] %} + - hostname: {{ host }} + role: {{ hostvars[host].node_role | default('master') }} + interfaces: + - name: {{ hostvars[host].primary_interface }} + macAddress: {{ hostvars[host].install_mac_address }} + networkConfig: + interfaces: + - name: {{ hostvars[host].primary_interface }} + type: ethernet + state: up + identifier: mac-address + mac-address: {{ hostvars[host].install_mac_address }} + ipv4: + enabled: true + dhcp: true + dns-resolver: + config: + server: + - 10.1.71.251 + - 10.1.71.252 + routes: + config: + - destination: 0.0.0.0/0 + next-hop-address: 10.1.71.1 + next-hop-interface: {{ hostvars[host].primary_interface }} + table-id: 254 +{% endfor %} \ No newline at end of file diff --git a/infra-config/playbooks/templates/groups.tf.j2 b/infra-config/playbooks/templates/groups.tf.j2 new file mode 100644 index 0000000..906429c --- /dev/null +++ b/infra-config/playbooks/templates/groups.tf.j2 @@ -0,0 +1,14 @@ +// Matcher group for OCP Internal machines +{% for host in groups[cluster_group] %} +resource "matchbox_group" "{{ host }}" { + name = "{{ host }}" # Physical Server + profile = matchbox_profile.openshift-agent-install.name + selector = { +{% if hostvars[host].boot_mac_address == hostvars[host].install_mac_address %} + mac = "{{ hostvars[host].boot_mac_address }}" # PXE boots and installs to same NIC +{% else %} + mac = "{{ hostvars[host].boot_mac_address }}" # PXE boots to 1GbE NIC, installs to 10GbE NIC +{% endif %} + } +} +{% endfor %} \ No newline at end of file diff --git a/infra-config/playbooks/templates/install-config.yaml.j2 b/infra-config/playbooks/templates/install-config.yaml.j2 new file mode 100644 index 0000000..6328bd8 --- /dev/null +++ b/infra-config/playbooks/templates/install-config.yaml.j2 @@ -0,0 +1,28 @@ +apiVersion: v1 +baseDomain: {{ hostvars[groups[cluster_group][0]].base_domain }} +compute: +- name: worker + hyperthreading: Enabled + replicas: {{ hostvars[groups[cluster_group][0]].worker_node_count }} +controlPlane: + hyperthreading: Enabled + name: master + replicas: {{ hostvars[groups[cluster_group][0]].master_node_count }} +metadata: + name: {{ hostvars[groups[cluster_group][0]].cluster_name }} +networking: + clusterNetwork: + - cidr: {{ hostvars[groups[cluster_group][0]].cluster_network }} + hostPrefix: {{ hostvars[groups[cluster_group][0]].cluster_network_host_prefix }} + machineNetwork: + - cidr: {{ hostvars[groups[cluster_group][0]].machine_network }} + networkType: OVNKubernetes + serviceNetwork: + - {{ hostvars[groups[cluster_group][0]].service_network }} +platform: + {{ hostvars[groups[cluster_group][0]].platform_type }}: + apiVIP: {{ hostvars[groups[cluster_group][0]].api_address }} + ingressVIP: {{ hostvars[groups[cluster_group][0]].app_address }} +fips: false +pullSecret: '{{ vault_pull_secret }}' +sshKey: '{{ vault_ssh_key }}' diff --git a/infra-config/playbooks/templates/profiles.tf.j2 b/infra-config/playbooks/templates/profiles.tf.j2 new file mode 100644 index 0000000..8bd0193 --- /dev/null +++ b/infra-config/playbooks/templates/profiles.tf.j2 @@ -0,0 +1,16 @@ +// Fedora CoreOS profile +resource "matchbox_profile" "openshift-agent-install" { + name = "{{ hostvars[groups[cluster_group][0]].cluster_name }}" + kernel = "/assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-vmlinuz" + initrd = [ + "--name initrd /assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-initrd.img" + ] + + args = [ + "initrd=initrd", + "coreos.live.rootfs_url={{ hostvars[groups['matchbox_server'][0]].http_endpoint }}/assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-rootfs.img", + "rw", + "ignition.firstboot", + "ignition.platform.id=metal", + ] +} diff --git a/infra-config/10-internal-cluster/04-matchbox/templates/provider.tf.j2 b/infra-config/playbooks/templates/provider.tf.j2 similarity index 84% rename from infra-config/10-internal-cluster/04-matchbox/templates/provider.tf.j2 rename to infra-config/playbooks/templates/provider.tf.j2 index 2c6c8b8..0424b97 100644 --- a/infra-config/10-internal-cluster/04-matchbox/templates/provider.tf.j2 +++ b/infra-config/playbooks/templates/provider.tf.j2 @@ -1,6 +1,6 @@ // Configure the matchbox provider provider "matchbox" { - endpoint = "{{ hostvars[groups['matchbox'][0]].rpc_endpoint }}" + endpoint = "{{ hostvars[groups['matchbox_server'][0]].rpc_endpoint }}" client_cert = file("/etc/matchbox/client.crt") client_key = file("/etc/matchbox/client.key") ca = file("/etc/matchbox/ca.crt")