Updated cluster creation playbook

infra-config/playbooks/configure_openshift_internal.yml

@@ -0,0 +1,196 @@
+---
+- name: Configure DNS entries for cluster nodes
+  hosts: internal_cluster
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Create DNS entry for each cluster node
+      ansible.builtin.include_tasks: tasks/create_dns_record.yml
+      vars:
+        host_ip_address: "{{ ip_address }}"
+
+- name: Configure DNS entries for OpenShift cluster services
+  hosts: internal_cluster[0]
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Create DNS entries for OpenShift cluster services
+      ansible.builtin.include_tasks: tasks/create_dns_record.yml
+      vars:
+        dns_name: "{{ item.name }}"
+        dns_address: "{{ item.address }}"
+      loop:
+        - name: "api.{{ cluster_name }}"
+          address: "{{ api_address }}"
+        - name: "api-int.{{ cluster_name }}"
+          address: "{{ api_address }}"
+        - name: "*.apps.{{ cluster_name }}"
+          address: "{{ app_address }}"
+      loop_control:
+        label: "{{ item.name }}"
+
+- name: Configure DHCP entries for cluster nodes
+  hosts: internal_cluster
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Configure DHCP entry for node
+      ansible.builtin.include_tasks: tasks/configure_dhcp_entry.yml
+      vars:
+        host_mac_address: "{{ install_mac_address }}"
+        host_ip_address: "{{ ip_address }}"
+
+  handlers:
+    - name: Restart dnsmasq
+      delegate_to: "{{ dhcp_server }}"
+      become: true
+      ansible.builtin.service:
+        name: dnsmasq
+        state: restarted
+
+- name: Create OpenShift installer files
+  hosts: matchbox
+  gather_facts: true
+
+  vars:
+    cluster_group: "internal_cluster"
+
+  tasks:
+    - name: Create directory
+      ansible.builtin.file:
+        path: ~/homelab/terraform/{{ cluster_group }}
+        state: directory
+        mode: '0755'
+
+    - name: OpenShift Installer install-config.yaml
+      ansible.builtin.template:
+        src: templates/install-config.yaml.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/install-config.yaml
+        mode: '0644'
+
+    - name: OpenShift Installer agent-config.yaml
+      ansible.builtin.template:
+        src: templates/agent-config.yaml.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/agent-config.yaml
+        mode: '0644'
+
+    - name: Create directory for OpenShift Installer files
+      become: true
+      ansible.builtin.file:
+        path: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+
+    - name: Download OpenShift Installer file
+      become: true
+      ansible.builtin.get_url:
+        url: "{{ hostvars[groups[cluster_group][0]].openshift_installer_download_url }}"
+        dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+        mode: '0644'
+
+    - name: Download OpenShift Client file
+      become: true
+      ansible.builtin.get_url:
+        url: "{{ hostvars[groups[cluster_group][0]].openshift_client_download_url }}"
+        dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+        mode: '0644'
+
+    - name: Unarchive installer file
+      become: true
+      ansible.builtin.unarchive:
+        src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install-linux.tar.gz
+        dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+        remote_src: true
+
+    - name: Unarchive client file
+      become: true
+      ansible.builtin.unarchive:
+        src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-client-linux.tar.gz
+        dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+        remote_src: true
+
+    - name: Copy install binary
+      become: true
+      ansible.builtin.copy:
+        src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install
+        dest: /usr/local/bin
+        remote_src: true
+        owner: wed
+        group: wed
+        mode: '0755'
+
+    - name: Copy client binary
+      become: true
+      ansible.builtin.copy:
+        src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/oc
+        dest: /usr/local/bin
+        remote_src: true
+        owner: wed
+        group: wed
+        mode: '0755'
+
+    - name: Check if OpenShift image exists
+      ansible.builtin.stat:
+        path: ~/homelab/terraform/{{ cluster_group }}/boot-artifacts/agent.x86_64-initrd.img
+      register: openshift_image_exists
+
+    - name: OpenShift image creation
+      ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
+      args:
+        chdir: ~/homelab/terraform/{{ cluster_group }}
+      when: not openshift_image_exists.stat.exists
+      changed_when: true
+
+    - name: Create a directory if it does not exist
+      become: true
+      ansible.builtin.file:
+        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+        state: directory
+        owner: matchbox
+        group: matchbox
+        mode: '0755'
+
+    - name: Copy file with owner and permissions
+      become: true
+      ansible.builtin.copy:
+        src: "{{ ansible_env['HOME'] }}/homelab/terraform/{{ cluster_group }}/boot-artifacts/"
+        dest: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}/"
+        remote_src: true
+        owner: matchbox
+        group: matchbox
+        mode: '0644'
+
+    - name: Verify directory permissions
+      become: true
+      ansible.builtin.file:
+        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+        state: directory
+        owner: matchbox
+        group: matchbox
+        mode: '0755'
+
+    - name: Create Terraform matchbox groups file from template
+      ansible.builtin.template:
+        src: templates/groups.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/groups.tf
+        mode: '0644'
+
+    - name: Create Terraform matchbox profiles file from template
+      ansible.builtin.template:
+        src: templates/profiles.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/profiles.tf
+        mode: '0644'
+
+    - name: Create Terraform matchbox provider file from template
+      ansible.builtin.template:
+        src: templates/provider.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/provider.tf
+        mode: '0644'
+
+    - name: Configure Matchbox via Terraform
+      community.general.terraform:
+        project_path: ~/homelab/terraform/{{ cluster_group }}
+        state: present
+        force_init: true

infra-config/playbooks/configure_unbound copy.yml

@@ -1,10 +0,0 @@
----
-- name: Master playbook to configure openshift cluster (internal)
-  hosts: internal_cluster
-  become: true
-
-  tasks:
-
-    - name: Install unbound via role
-      ansible.builtin.import_role:
-        name: Anthony25.unbound

infra-config/playbooks/tasks/configure_dhcp_entry.yml

@@ -0,0 +1,10 @@
+---
+- name: Add DHCP entry for {{ inventory_hostname }}
+  delegate_to: "{{ dhcp_server }}"
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/dnsmasq.d/hosts.conf
+    regexp: "# {{ inventory_hostname }}$"
+    line: "dhcp-host={{ host_mac_address | lower }},{{ host_ip_address }} # {{ inventory_hostname }}"
+    state: present
+  notify: Restart dnsmasq

infra-config/playbooks/tasks/create_dns_record.yml

@@ -0,0 +1,11 @@
+---
+- name: "Create DNS record for {{ dns_name | default(inventory_hostname) }}"
+  delegate_to: "{{ dns_server }}"
+  freeipa.ansible_freeipa.ipadnsrecord:
+    ipaapi_context: "server"
+    ipaadmin_password: "{{ vault_freeipa_password }}"
+    name: "{{ dns_name | default(inventory_hostname) }}"
+    zone_name: "{{ base_domain }}"
+    record_type: "A"
+    record_value: "{{ dns_address | default(host_ip_address) }}"
+    record_ttl: 60

infra-config/playbooks/templates/agent-config.yaml.j2

@@ -0,0 +1,35 @@
+apiVersion: v1alpha1
+kind: AgentConfig
+metadata:
+  name: {{ hostvars[groups[cluster_group][0]].cluster_name }}
+rendezvousIP: {{ hostvars[groups[cluster_group][0]].ip_address }}
+bootArtifactsBaseURL: {{ hostvars[groups['matchbox_server'][0]].http_endpoint }}/assets/hub/
+hosts:
+{% for host in groups[cluster_group] %}
+  - hostname: {{ host }}
+    role: {{ hostvars[host].node_role | default('master') }}
+    interfaces:
+      - name: {{ hostvars[host].primary_interface }}
+        macAddress: {{ hostvars[host].install_mac_address }}
+    networkConfig:
+      interfaces:
+        - name: {{ hostvars[host].primary_interface }}
+          type: ethernet
+          state: up
+          identifier: mac-address
+          mac-address: {{ hostvars[host].install_mac_address }}
+          ipv4:
+            enabled: true
+            dhcp: true
+      dns-resolver:
+        config:
+          server:
+            - 10.1.71.251
+            - 10.1.71.252
+      routes:
+        config:
+          - destination: 0.0.0.0/0
+            next-hop-address: 10.1.71.1
+            next-hop-interface: {{ hostvars[host].primary_interface }}
+            table-id: 254
+{% endfor %}

infra-config/playbooks/templates/groups.tf.j2

@@ -0,0 +1,14 @@
+// Matcher group for OCP Internal machines
+{% for host in groups[cluster_group] %}
+resource "matchbox_group" "{{ host }}" {
+  name = "{{ host }}" # Physical Server
+  profile = matchbox_profile.openshift-agent-install.name
+  selector = {
+{% if hostvars[host].boot_mac_address == hostvars[host].install_mac_address %}
+    mac = "{{ hostvars[host].boot_mac_address }}" # PXE boots and installs to same NIC
+{% else %}
+    mac = "{{ hostvars[host].boot_mac_address }}" # PXE boots to 1GbE NIC, installs to 10GbE NIC
+{% endif %}
+  }
+}
+{% endfor %}

infra-config/playbooks/templates/install-config.yaml.j2

@@ -0,0 +1,28 @@
+apiVersion: v1
+baseDomain: {{ hostvars[groups[cluster_group][0]].base_domain }}
+compute:
+- name: worker
+  hyperthreading: Enabled
+  replicas: {{ hostvars[groups[cluster_group][0]].worker_node_count }}
+controlPlane:
+  hyperthreading: Enabled
+  name: master
+  replicas: {{ hostvars[groups[cluster_group][0]].master_node_count }}
+metadata:
+  name: {{ hostvars[groups[cluster_group][0]].cluster_name }}
+networking:
+  clusterNetwork:
+  - cidr: {{ hostvars[groups[cluster_group][0]].cluster_network }}
+    hostPrefix: {{ hostvars[groups[cluster_group][0]].cluster_network_host_prefix }}
+  machineNetwork:
+  - cidr: {{ hostvars[groups[cluster_group][0]].machine_network }}
+  networkType: OVNKubernetes
+  serviceNetwork:
+  - {{ hostvars[groups[cluster_group][0]].service_network }}
+platform:
+  {{ hostvars[groups[cluster_group][0]].platform_type }}:
+    apiVIP: {{ hostvars[groups[cluster_group][0]].api_address }}
+    ingressVIP: {{ hostvars[groups[cluster_group][0]].app_address }}
+fips: false
+pullSecret: '{{ vault_pull_secret }}'
+sshKey: '{{ vault_ssh_key }}'

infra-config/playbooks/templates/profiles.tf.j2

@@ -0,0 +1,16 @@
+// Fedora CoreOS profile
+resource "matchbox_profile" "openshift-agent-install" {
+  name   = "{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+  kernel = "/assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-vmlinuz"
+  initrd = [
+    "--name initrd /assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-initrd.img"
+  ]
+
+  args = [
+    "initrd=initrd",
+    "coreos.live.rootfs_url={{ hostvars[groups['matchbox_server'][0]].http_endpoint }}/assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-rootfs.img",
+    "rw",
+    "ignition.firstboot",
+    "ignition.platform.id=metal",
+  ]
+}

infra-config/playbooks/templates/provider.tf.j2

@@ -0,0 +1,20 @@
+// Configure the matchbox provider
+provider "matchbox" {
+  endpoint    = "{{ hostvars[groups['matchbox_server'][0]].rpc_endpoint }}"
+  client_cert = file("/etc/matchbox/client.crt")
+  client_key  = file("/etc/matchbox/client.key")
+  ca          = file("/etc/matchbox/ca.crt")
+}
+
+terraform {
+  required_providers {
+    ct = {
+      source  = "poseidon/ct"
+      version = "0.13.0"
+    }
+    matchbox = {
+      source  = "poseidon/matchbox"
+      version = "0.5.4"
+    }
+  }
+}