Updated cluster creation playbook

README.md

@@ -1,9 +1,141 @@
 # A Homelab based on Red Hat Technologies
 
-This repository is the configuration of my homelab. In addition to providing services, the purpose of my homelab is to learn advanced concepts primarily based on Red Hat OpenShift.
+A comprehensive homelab for learning advanced concepts primarily based on Red Hat OpenShift.  In addition to providing services, it is an area to incorporate container technologies, and enterprise integration scenarios.
 
 This implementation is built on easily accessible consumer based hardware and will focus heavily on GitOps practices and automation will be used wherever possible.
 
+## 🎯 Project Goals
+
+- **Multi-cluster OpenShift management** with ACM
+- **Hybrid cloud scenarios** (bare metal + virtualized + containerized)
+- **Enterprise integration testing** (AD, SQL Server, SIEM)
+- **GitOps and automation workflows**
+- **Red Hat certification preparation**
+
+## 📋 Documentation (Priority Order)
+
+### Phase 1: Foundation
+1. **[Overview & Hardware Allocation](./docs/01-overview.md)** - Complete architecture overview
+2. **[Networking Plan](./docs/02-networking.md)** - VLAN strategy and network design
+3. **[Core Services Setup](./docs/03-core-services.md)** *(TBD)* - k0s cluster, DNS, monitoring
+4. **[Storage Configuration](./docs/04-storage.md)** *(TBD)* - Synology, democratic-csi
+
+### Phase 2: Container Platform
+5. **[Container Registry Setup](./docs/05-container-registry.md)** *(TBD)* - Harbor deployment
+6. **[Git Repository Setup](./docs/06-git-repository.md)** *(TBD)* - Gitea/GitLab on Synology
+7. **[Artifact Repository](./docs/07-artifact-repository.md)** *(TBD)* - Nexus/Artifactory
+
+### Phase 3: OpenShift Clusters
+8. **[OpenShift Compact Cluster](./docs/08-openshift-compact.md)** *(TBD)* - 3-node production-like
+9. **[OpenShift SNO + Worker](./docs/09-openshift-sno.md)** *(TBD)* - Edge computing setup
+10. **[ACM Configuration](./docs/10-acm-setup.md)** *(TBD)* - Multi-cluster management
+
+### Phase 4: vSphere Platform
+11. **[vSphere Installation](./docs/11-vsphere-setup.md)** *(TBD)* - Dell T640 virtualization
+12. **[Windows Infrastructure](./docs/12-windows-infrastructure.md)** *(TBD)* - AD, SQL Server
+13. **[VM Templates & Automation](./docs/13-vm-automation.md)** *(TBD)* - Template creation
+
+### Phase 5: Advanced Services
+14. **[Monitoring & Observability](./docs/14-monitoring.md)** *(TBD)* - Prometheus, Grafana, Splunk
+15. **[Security & Compliance](./docs/15-security.md)** *(TBD)* - ACS, certificates, auditing
+16. **[Backup & DR](./docs/16-backup-dr.md)** *(TBD)* - Backup strategies
+
+## 🚀 Quick Start Deployment
+
+### Prerequisites
+- Ubiquiti UDM SE configured
+- Hardware powered and networked
+- Initial VLAN setup (see [networking plan](./docs/02-networking.md))
+
+Ansible Collections
+- ansible-galaxy collection install freeipa.ansible_freeipa
+
+### Deployment Scripts
+
+```bash
+source ~/venv-ansible/bin/activate
+# Phase 1: Foundation
+./scripts/01-network-setup.sh
+./scripts/02-core-services-deploy.sh
+
+# Phase 2: Container Platform  
+./deployment/synology/docker-compose.yml  # Git repo, Harbor, Nexus
+./scripts/03-storage-setup.sh
+
+# Phase 3: OpenShift
+./deployment/openshift/compact-cluster/
+./deployment/openshift/sno-cluster/
+
+# Phase 4: vSphere
+./deployment/vsphere/
+```
+
+## 📁 Repository Structure
+
+```
+homelab-plan/
+├── README.md                    # This file
+├── docs/                        # Documentation (numbered by priority)
+│   ├── 01-overview.md
+│   ├── 02-networking.md
+│   └── ...
+├── deployment/                  # Deployment configurations
+│   ├── synology/               # Docker Compose files for Synology
+│   ├── k0s/                    # k0s cluster manifests
+│   ├── openshift/              # OpenShift installation configs
+│   └── vsphere/                # vSphere automation
+├── scripts/                     # Automation scripts
+└── .gitignore                   # Excludes sensitive data
+```
+
+## 🔧 Technology Stack
+
+### Infrastructure
+- **Networking**: Ubiquiti UDM SE
+- **Storage**: Synology DS1621+, Ubiquiti UNAS Pro
+- **Compute**: 3x Beelink S12 Pro, 5x Lenovo M710q, Dell T640
+
+### Container Platforms
+- **OpenShift 4.14+**: Two clusters (compact + SNO)
+- **k0s**: Core services cluster
+- **vSphere**: VM workloads
+
+### Core Services
+- **Container Registry**: Harbor
+- **Git Repository**: Gitea/GitLab CE
+- **Artifact Repository**: Nexus/Artifactory
+- **Monitoring**: Prometheus + Grafana
+- **Logging**: Splunk Enterprise
+- **DNS**: CoreDNS
+- **Load Balancing**: MetalLB + HAProxy
+
+## 🔐 Security Notes
+
+- **No sensitive data** is stored in this repository
+- **Secrets management** via external-secrets-operator
+- **Certificate management** via cert-manager
+- **Network segmentation** via VLANs and firewall rules
+
+## 🤝 Contributing
+
+This is a personal homelab project, but feel free to:
+- Submit issues for questions or suggestions
+- Fork for your own homelab adaptations
+- Share improvements via pull requests
+
+## 📞 Next Steps
+
+1. **Create GitHub repository** for version control
+2. **Start with Phase 1** foundation setup
+3. **Build deployment automation** as we go
+4. **Document lessons learned** for future reference
+
+---
+
+**Status**: 🚧 Planning & Initial Development
+
+**Last Updated**: June 2025
+
 This repo is a mono-repo that is broken up into three sections:
 
 - infra-config

infra-config/10-internal-cluster/01-dhcp/host-reservations.yml

@@ -1,13 +0,0 @@
----
-- name: Dnsmasq
-  hosts: localhost
-  become: yes
-  vars:
-    - additional_dhcp_hosts:
-        ethernet_switch:
-          desc: "SNO Hub Cluster"
-          mac: 98:b7:85:1e:c6:f1
-          ip: 10.1.71.10
-
-  roles:
-    - role: ricsanfre.dnsmasq

infra-config/10-internal-cluster/01-dns/.terraform.lock.hcl

@@ -1,24 +0,0 @@
-# This file is maintained automatically by "terraform init".
-# Manual edits may be lost in future updates.
-
-provider "registry.terraform.io/rework-space-com/freeipa" {
-  version     = "5.0.0"
-  constraints = "5.0.0"
-  hashes = [
-    "h1:6EquDv6GgQO2HjZUUoRIUVzYa951n+wb4Uk7ggD6XD0=",
-    "zh:098607e559c3b696401034ff494ba8068962b45059ee067a54b58334b6ee0f2c",
-    "zh:18b806a14bb9d9382213c6929af35f5a65f16c17ff526d475f1eab33d1470290",
-    "zh:2c8c74668844d256b7fdc503cd736a20b7e58db5b31880d1ad8090c1af04e24c",
-    "zh:3bba458b9a6df99c21da58750dd6586b93bdcc557e4a2d695e801ada39e8de1e",
-    "zh:58f728d9e98cc7aae3841c07318be64b6dcb2f51c041f04bba977e61104a2333",
-    "zh:597dfbefbfe111a31e9ff3c4fc14fc8e12c1e255454087d3eebd2ec6c7aa9bf3",
-    "zh:6093d6db13d834c23f5482efae80c8e1ae046028fccf24242f0f1c1935e6aa70",
-    "zh:87271fa234a57ce05d4166e444002bd66976f971b434f7add45c874c9587129d",
-    "zh:89f7f6be64b6bf9e708fbafd22f410cf3f50b1fcd4cd6c61e9ffffd6180ea839",
-    "zh:9bdd7a984f845ff6f4bc4df5cc41a9de019639fceca62e60fc7c0f098ad2695c",
-    "zh:a0551311c96b86050d15854b4fca2beaa06b2e1964f97945824567d0b90db580",
-    "zh:c3daa12021725883bd32d7d852a2de845bb7a5f18009a45be7c2c2d891631713",
-    "zh:d7871eb99683934a30b9d47508379e6d16978f3dcd73601af2204652668592aa",
-    "zh:e8f72fd7750e6c1f0f97d039fea66cb85f457cf22908b7c3f14c7d2cf990ee84",
-  ]
-}

infra-config/10-internal-cluster/01-dns/README.md

@@ -1,3 +0,0 @@
-# DNS Provider Configuration
-
-This directory contains the configuration to updateFreeIPA DNS for the Hub Cluster.

infra-config/10-internal-cluster/01-dns/dns.tf

@@ -1,39 +0,0 @@
-resource "freeipa_dns_record" "ocp-hub" {
-  zone_name = "int.mk-labs.cloud."
-  name = "ocp-hub"
-  type = "A"
-  records = [
-    "10.1.71.10",
-  ]
-  ttl = 60
-}
-
-resource "freeipa_dns_record" "api" {
-  zone_name = "int.mk-labs.cloud."
-  name = "api.hub"
-  type = "A"
-  records = [
-    "10.1.71.10",
-  ]
-  ttl = 60
-}
-
-resource "freeipa_dns_record" "api-int" {
-  zone_name = "int.mk-labs.cloud."
-  name = "api-int.hub"
-  type = "A"
-  records = [
-    "10.1.71.10",
-  ]
-  ttl = 60
-}
-
-resource "freeipa_dns_record" "wildcard-apps" {
-  zone_name = "int.mk-labs.cloud."
-  name = "*.apps.hub"
-  type = "A"
-  records = [
-    "10.1.71.10",
-  ]
-  ttl = 60
-}

infra-config/10-internal-cluster/01-dns/provider.tf

@@ -1,22 +0,0 @@
-# Configure the DNS Provider
-provider "freeipa" {
-  host        = "infra01.int.mk-labs.cloud"
-  username    = "admin"
-  password    = var.freeipa_password
-  insecure    = true
-}
-
-variable "freeipa_password" {
-  description = "The password for the FreeIPA provider"
-  type        = string
-  sensitive   = true
-}
-
-terraform {
-  required_providers {
-    freeipa = {
-      source = "rework-space-com/freeipa"
-      version = "5.0.0"
-    }
-  }
-}

infra-config/10-internal-cluster/02-dhcp/README.md

@@ -1 +0,0 @@
-# Add/modify entry in DNSmasq

infra-config/10-internal-cluster/02-dhcp/ip-reservations.yml

@@ -1,28 +0,0 @@
----
-- name: Ensure dnsmasq is installed
-  ansible.builtin.apt:
-    name: dnsmasq
-    state: present
-  become: true
-  when: ansible_os_family == "Debian"
-
-- name: Ensure dnsmasq is installed
-  ansible.builtin.dnf:
-    name: dnsmasq
-    state: present
-  become: true
-  when: ansible_os_family == "RedHat"
-
-- name: Add host reservation to dnsmasq
-  ansible.builtin.lineinfile:
-    path: /etc/dnsmasq.d/hosts.conf
-    regexp: "^dhcp-host={{ hostvars['ocp-hub'].mac_address }}"
-    line: "dhcp-host={{ hostvars['ocp-hub'].mac_address }},{{ hostvars['ocp-hub'].ip_address }} #{{ hostvars['ocp-hub'].hostname }}"
-    state: present
-  become: true
-
-- name: Restart dnsmasq service
-  ansible.builtin.service:
-    name: dnsmasq
-    state: restarted
-  become: true

infra-config/10-internal-cluster/04-matchbox/templates/groups.tf.j2

@@ -1,8 +0,0 @@
-// Matcher group for OCP Internal machines
-resource "matchbox_group" "{{ hostvars[groups['hub_cluster'][0]].cluster_name }}" {
-  name = "{{ hostvars['ocp-hub'].hostname }}" # Physical Server
-  profile = matchbox_profile.openshift-agent-install.name
-  selector = {
-    mac = "{{ hostvars['ocp-hub'].mac_address }}" # PXE boots and installs to 10GbE NIC
-  }
-}

infra-config/10-internal-cluster/04-matchbox/templates/profiles.tf.j2

@@ -1,16 +0,0 @@
-// Fedora CoreOS profile
-resource "matchbox_profile" "openshift-agent-install" {
-  name   = "{{ hostvars[groups['hub_cluster'][0]].cluster_name }}"
-  kernel = "/assets/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}/agent.x86_64-vmlinuz"
-  initrd = [
-    "--name initrd /assets/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}/agent.x86_64-initrd.img"
-  ]
-
-  args = [
-    "initrd=initrd",
-    "coreos.live.rootfs_url={{ hostvars[groups['matchbox'][0]].http_endpoint }}/assets/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}/agent.x86_64-rootfs.img",
-    "rw",
-    "ignition.firstboot",
-    "ignition.platform.id=metal",
-  ]
-}

infra-config/10-internal-cluster/install.yml

@@ -5,58 +5,58 @@
   gather_facts: true
 
   tasks:
-    - name: Deploy DNS entries for cluster via Terraform
+    # - name: Deploy DNS entries for cluster via Terraform
-      community.general.terraform:
+    #   community.general.terraform:
-        project_path: 01-dns/
+    #     project_path: 01-dns/
-        variables:
+    #     variables:
-          freeipa_password: "{{ vault_freeipa_password }}"
+    #       freeipa_password: "{{ vault_freeipa_password }}"
-        state: present
+    #     state: present
-        force_init: true
+    #     force_init: true
 
-    - name: Deploy DHCP entries for cluster via Terraform
+    # - name: Deploy DHCP entries for cluster via Terraform
-      ansible.builtin.include_tasks:
+    #   ansible.builtin.include_tasks:
-        file: 02-dhcp/ip-reservations.yml
+    #     file: 02-dhcp/ip-reservations.yml
 
-    - name: OpenShift Installer install-config.yaml
+    # - name: OpenShift Installer install-config.yaml
-      ansible.builtin.template:
+    #   ansible.builtin.template:
-        src: 03-openshift-image/templates/install-config.yaml.j2
+    #     src: 03-openshift-image/templates/install-config.yaml.j2
-        dest: 03-openshift-image/install-config.yaml
+    #     dest: 03-openshift-image/install-config.yaml
-        mode: '0644'
+    #     mode: '0644'
 
-    - name: OpenShift Installer agent-config.yaml
+    # - name: OpenShift Installer agent-config.yaml
-      ansible.builtin.template:
+    #   ansible.builtin.template:
-        src: 03-openshift-image/templates/agent-config.yaml.j2
+    #     src: 03-openshift-image/templates/agent-config.yaml.j2
-        dest: 03-openshift-image/agent-config.yaml
+    #     dest: 03-openshift-image/agent-config.yaml
-        mode: '0644'
+    #     mode: '0644'
 
-    - name: Create OpenShift image
+    # - name: Create OpenShift image
-      ansible.builtin.include_tasks:
+    #   ansible.builtin.include_tasks:
-        file: 03-openshift-image/create-openshift-image.yml
+    #     file: 03-openshift-image/create-openshift-image.yml
 
-    - name: Move PXE assets to matchbox
+    # - name: Move PXE assets to matchbox
-      ansible.builtin.include_tasks:
+    #   ansible.builtin.include_tasks:
-        file: 03-openshift-image/move-pxe-assets.yml
+    #     file: 03-openshift-image/move-pxe-assets.yml
 
-    - name: Terraform matchbox groups file
+    # - name: Terraform matchbox groups file
-      ansible.builtin.template:
+    #   ansible.builtin.template:
-        src: 04-matchbox/templates/groups.tf.j2
+    #     src: 04-matchbox/templates/groups.tf.j2
-        dest: 04-matchbox/groups.tf
+    #     dest: 04-matchbox/groups.tf
-        mode: '0644'
+    #     mode: '0644'
 
-    - name: Terraform matchbox profiles file
+    # - name: Terraform matchbox profiles file
-      ansible.builtin.template:
+    #   ansible.builtin.template:
-        src: 04-matchbox/templates/profiles.tf.j2
+    #     src: 04-matchbox/templates/profiles.tf.j2
-        dest: 04-matchbox/profiles.tf
+    #     dest: 04-matchbox/profiles.tf
-        mode: '0644'
+    #     mode: '0644'
 
-    - name: Terraform matchbox provider file
+    # - name: Terraform matchbox provider file
-      ansible.builtin.template:
+    #   ansible.builtin.template:
-        src: 04-matchbox/templates/provider.tf.j2
+    #     src: 04-matchbox/templates/provider.tf.j2
-        dest: 04-matchbox/provider.tf
+    #     dest: 04-matchbox/provider.tf
-        mode: '0644'
+    #     mode: '0644'
 
-    - name: Configure Matchbox via Terraform
+    # - name: Configure Matchbox via Terraform
-      community.general.terraform:
+    #   community.general.terraform:
-        project_path: 04-matchbox/
+    #     project_path: 04-matchbox/
-        state: present
+    #     state: present
-        force_init: true
+    #     force_init: true

infra-config/group_vars/all/vars

@@ -7,9 +7,11 @@ proxmox_password: "{{ vault_proxmox_root_password }}"
 proxmox_host: "pve01"
 
 # DNS variables
-dns_server: "infra01.int.mk-labs.cloud"
+dns_server: "infra01" # .int.mk-labs.cloud"
 dns_admin: "admin"
 base_domain: "int.mk-labs.cloud"
+# DHCP server
+dhcp_server: "matchbox"
 
 # Terraform variables
 terraform_server: "infra01"

infra-config/group_vars/internal_cluster/vars

@@ -1,10 +1,14 @@
 cluster_name: "openshift"
-cluster_version: "4.17.20"
+cluster_version: "4.18.21"
-#base_domain: "int.mk-labs.cloud"
+openshift_installer_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/openshift-install-linux.tar.gz"
+openshift_client_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/openshift-client-linux.tar.gz"
+# cluster_group: "internal_cluster"
 worker_node_count: 1
 master_node_count: 3
 cluster_network: "10.128.0.0/14"
 cluster_network_host_prefix: 23
 machine_network: "10.1.71.0/24"
 service_network: "172.30.0.0/16"
-platform_type: "none"
+platform_type: "baremetal"
+api_address: "10.1.71.69"
+app_address: "10.1.71.60"

infra-config/host_vars/int-master01/vars

@@ -1,9 +1,12 @@
 ---
 # file: host_vars/int-master01/vars
+# OpenShift node
 
 # Networking
-# primary_interface: "enp1s0f0"
+primary_interface: "enp1s0f0"
-mac_address: "54:bf:64:60:52:2d"
+boot_mac_address: "54:bf:64:60:52:2d"
+install_mac_address: "00:0a:f7:5d:f3:53"
 ip_address: 10.1.71.61
+node_role: "master"
 
 hostname: "{{ inventory_hostname }}.{{ base_domain }}"

infra-config/host_vars/int-master02/vars

@@ -1,9 +1,12 @@
 ---
-# file: host_vars/int-master01/vars
+# file: host_vars/int-master02/vars
+# OpenShift node
 
 # Networking
-# primary_interface: "enp1s0f0"
+primary_interface: "enp1s0f0"
-mac_address: "54:bf:64:5f:a2:80"
+boot_mac_address: "54:bf:64:5f:a2:80"
+install_mac_address: "98:b7:85:20:47:3b"
 ip_address: 10.1.71.62
+node_role: "master"
 
 hostname: "{{ inventory_hostname }}.{{ base_domain }}"

infra-config/host_vars/int-master03/vars

@@ -1,9 +1,12 @@
 ---
-# file: host_vars/int-master01/vars
+# file: host_vars/int-master03/vars
+# OpenShift node
 
 # Networking
-# primary_interface: "enp1s0f0"
+primary_interface: "enp1s0f0"
-mac_address: "d8:9e:f3:4c:02:a9"
+boot_mac_address: "d8:9e:f3:4c:02:a9"
+install_mac_address: "98:b7:85:20:47:23"
 ip_address: 10.1.71.63
+node_role: "master"
 
 hostname: "{{ inventory_hostname }}.{{ base_domain }}"

infra-config/host_vars/int-worker01/vars

@@ -1,9 +0,0 @@
----
-# file: host_vars/int-master01/vars
-
-# Networking
-# primary_interface: "enp1s0f0"
-mac_address: "54:bf:64:60:52:2d"
-ip_address: 10.1.71.64
-
-hostname: "{{ inventory_hostname }}.{{ base_domain }}"

infra-config/host_vars/int-worker02/vars

@@ -0,0 +1,12 @@
+---
+# file: host_vars/int-worker02/vars
+# OpenShift node
+
+# Networking
+primary_interface: "enp2s0f0"
+boot_mac_address: "58:47:ca:76:13:49"
+install_mac_address: "58:47:ca:76:13:47"
+ip_address: 10.1.71.65
+node_role: "worker"
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"

infra-config/inventory.yml

@@ -40,9 +40,9 @@ ipaserver:
   hosts:
     infra01.int.mk-labs.cloud:
 
-# matchbox:
+matchbox_server:
-#   hosts:
+  hosts:
-#     infra01:
+    matchbox:
 
 hub_cluster:
   hosts:
@@ -53,7 +53,7 @@ internal_cluster:
     int-master01:
     int-master02:
     int-master03:
-    int-worker01:
+    int-worker02:
 
 sql_servers:
   hosts:

infra-config/playbooks/configure_openshift_internal.yml

@@ -0,0 +1,196 @@
+---
+- name: Configure DNS entries for cluster nodes
+  hosts: internal_cluster
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Create DNS entry for each cluster node
+      ansible.builtin.include_tasks: tasks/create_dns_record.yml
+      vars:
+        host_ip_address: "{{ ip_address }}"
+
+- name: Configure DNS entries for OpenShift cluster services
+  hosts: internal_cluster[0]
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Create DNS entries for OpenShift cluster services
+      ansible.builtin.include_tasks: tasks/create_dns_record.yml
+      vars:
+        dns_name: "{{ item.name }}"
+        dns_address: "{{ item.address }}"
+      loop:
+        - name: "api.{{ cluster_name }}"
+          address: "{{ api_address }}"
+        - name: "api-int.{{ cluster_name }}"
+          address: "{{ api_address }}"
+        - name: "*.apps.{{ cluster_name }}"
+          address: "{{ app_address }}"
+      loop_control:
+        label: "{{ item.name }}"
+
+- name: Configure DHCP entries for cluster nodes
+  hosts: internal_cluster
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Configure DHCP entry for node
+      ansible.builtin.include_tasks: tasks/configure_dhcp_entry.yml
+      vars:
+        host_mac_address: "{{ install_mac_address }}"
+        host_ip_address: "{{ ip_address }}"
+
+  handlers:
+    - name: Restart dnsmasq
+      delegate_to: "{{ dhcp_server }}"
+      become: true
+      ansible.builtin.service:
+        name: dnsmasq
+        state: restarted
+
+- name: Create OpenShift installer files
+  hosts: matchbox
+  gather_facts: true
+
+  vars:
+    cluster_group: "internal_cluster"
+
+  tasks:
+    - name: Create directory
+      ansible.builtin.file:
+        path: ~/homelab/terraform/{{ cluster_group }}
+        state: directory
+        mode: '0755'
+
+    - name: OpenShift Installer install-config.yaml
+      ansible.builtin.template:
+        src: templates/install-config.yaml.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/install-config.yaml
+        mode: '0644'
+
+    - name: OpenShift Installer agent-config.yaml
+      ansible.builtin.template:
+        src: templates/agent-config.yaml.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/agent-config.yaml
+        mode: '0644'
+
+    - name: Create directory for OpenShift Installer files
+      become: true
+      ansible.builtin.file:
+        path: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+
+    - name: Download OpenShift Installer file
+      become: true
+      ansible.builtin.get_url:
+        url: "{{ hostvars[groups[cluster_group][0]].openshift_installer_download_url }}"
+        dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+        mode: '0644'
+
+    - name: Download OpenShift Client file
+      become: true
+      ansible.builtin.get_url:
+        url: "{{ hostvars[groups[cluster_group][0]].openshift_client_download_url }}"
+        dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+        mode: '0644'
+
+    - name: Unarchive installer file
+      become: true
+      ansible.builtin.unarchive:
+        src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install-linux.tar.gz
+        dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+        remote_src: true
+
+    - name: Unarchive client file
+      become: true
+      ansible.builtin.unarchive:
+        src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-client-linux.tar.gz
+        dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+        remote_src: true
+
+    - name: Copy install binary
+      become: true
+      ansible.builtin.copy:
+        src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install
+        dest: /usr/local/bin
+        remote_src: true
+        owner: wed
+        group: wed
+        mode: '0755'
+
+    - name: Copy client binary
+      become: true
+      ansible.builtin.copy:
+        src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/oc
+        dest: /usr/local/bin
+        remote_src: true
+        owner: wed
+        group: wed
+        mode: '0755'
+
+    - name: Check if OpenShift image exists
+      ansible.builtin.stat:
+        path: ~/homelab/terraform/{{ cluster_group }}/boot-artifacts/agent.x86_64-initrd.img
+      register: openshift_image_exists
+
+    - name: OpenShift image creation
+      ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
+      args:
+        chdir: ~/homelab/terraform/{{ cluster_group }}
+      when: not openshift_image_exists.stat.exists
+      changed_when: true
+
+    - name: Create a directory if it does not exist
+      become: true
+      ansible.builtin.file:
+        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+        state: directory
+        owner: matchbox
+        group: matchbox
+        mode: '0755'
+
+    - name: Copy file with owner and permissions
+      become: true
+      ansible.builtin.copy:
+        src: "{{ ansible_env['HOME'] }}/homelab/terraform/{{ cluster_group }}/boot-artifacts/"
+        dest: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}/"
+        remote_src: true
+        owner: matchbox
+        group: matchbox
+        mode: '0644'
+
+    - name: Verify directory permissions
+      become: true
+      ansible.builtin.file:
+        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+        state: directory
+        owner: matchbox
+        group: matchbox
+        mode: '0755'
+
+    - name: Create Terraform matchbox groups file from template
+      ansible.builtin.template:
+        src: templates/groups.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/groups.tf
+        mode: '0644'
+
+    - name: Create Terraform matchbox profiles file from template
+      ansible.builtin.template:
+        src: templates/profiles.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/profiles.tf
+        mode: '0644'
+
+    - name: Create Terraform matchbox provider file from template
+      ansible.builtin.template:
+        src: templates/provider.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/provider.tf
+        mode: '0644'
+
+    - name: Configure Matchbox via Terraform
+      community.general.terraform:
+        project_path: ~/homelab/terraform/{{ cluster_group }}
+        state: present
+        force_init: true

infra-config/playbooks/configure_unbound copy.yml

@@ -1,10 +0,0 @@
----
-- name: Master playbook to configure openshift cluster (internal)
-  hosts: internal_cluster
-  become: true
-
-  tasks:
-
-    - name: Install unbound via role
-      ansible.builtin.import_role:
-        name: Anthony25.unbound

infra-config/playbooks/tasks/configure_dhcp_entry.yml

@@ -0,0 +1,10 @@
+---
+- name: Add DHCP entry for {{ inventory_hostname }}
+  delegate_to: "{{ dhcp_server }}"
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/dnsmasq.d/hosts.conf
+    regexp: "# {{ inventory_hostname }}$"
+    line: "dhcp-host={{ host_mac_address | lower }},{{ host_ip_address }} # {{ inventory_hostname }}"
+    state: present
+  notify: Restart dnsmasq

infra-config/playbooks/tasks/create_dns_record.yml

@@ -0,0 +1,11 @@
+---
+- name: "Create DNS record for {{ dns_name | default(inventory_hostname) }}"
+  delegate_to: "{{ dns_server }}"
+  freeipa.ansible_freeipa.ipadnsrecord:
+    ipaapi_context: "server"
+    ipaadmin_password: "{{ vault_freeipa_password }}"
+    name: "{{ dns_name | default(inventory_hostname) }}"
+    zone_name: "{{ base_domain }}"
+    record_type: "A"
+    record_value: "{{ dns_address | default(host_ip_address) }}"
+    record_ttl: 60

infra-config/playbooks/templates/agent-config.yaml.j2

@@ -0,0 +1,35 @@
+apiVersion: v1alpha1
+kind: AgentConfig
+metadata:
+  name: {{ hostvars[groups[cluster_group][0]].cluster_name }}
+rendezvousIP: {{ hostvars[groups[cluster_group][0]].ip_address }}
+bootArtifactsBaseURL: {{ hostvars[groups['matchbox_server'][0]].http_endpoint }}/assets/hub/
+hosts:
+{% for host in groups[cluster_group] %}
+  - hostname: {{ host }}
+    role: {{ hostvars[host].node_role | default('master') }}
+    interfaces:
+      - name: {{ hostvars[host].primary_interface }}
+        macAddress: {{ hostvars[host].install_mac_address }}
+    networkConfig:
+      interfaces:
+        - name: {{ hostvars[host].primary_interface }}
+          type: ethernet
+          state: up
+          identifier: mac-address
+          mac-address: {{ hostvars[host].install_mac_address }}
+          ipv4:
+            enabled: true
+            dhcp: true
+      dns-resolver:
+        config:
+          server:
+            - 10.1.71.251
+            - 10.1.71.252
+      routes:
+        config:
+          - destination: 0.0.0.0/0
+            next-hop-address: 10.1.71.1
+            next-hop-interface: {{ hostvars[host].primary_interface }}
+            table-id: 254
+{% endfor %}

infra-config/playbooks/templates/groups.tf.j2

@@ -0,0 +1,14 @@
+// Matcher group for OCP Internal machines
+{% for host in groups[cluster_group] %}
+resource "matchbox_group" "{{ host }}" {
+  name = "{{ host }}" # Physical Server
+  profile = matchbox_profile.openshift-agent-install.name
+  selector = {
+{% if hostvars[host].boot_mac_address == hostvars[host].install_mac_address %}
+    mac = "{{ hostvars[host].boot_mac_address }}" # PXE boots and installs to same NIC
+{% else %}
+    mac = "{{ hostvars[host].boot_mac_address }}" # PXE boots to 1GbE NIC, installs to 10GbE NIC
+{% endif %}
+  }
+}
+{% endfor %}

infra-config/playbooks/templates/install-config.yaml.j2

@@ -0,0 +1,28 @@
+apiVersion: v1
+baseDomain: {{ hostvars[groups[cluster_group][0]].base_domain }}
+compute:
+- name: worker
+  hyperthreading: Enabled
+  replicas: {{ hostvars[groups[cluster_group][0]].worker_node_count }}
+controlPlane:
+  hyperthreading: Enabled
+  name: master
+  replicas: {{ hostvars[groups[cluster_group][0]].master_node_count }}
+metadata:
+  name: {{ hostvars[groups[cluster_group][0]].cluster_name }}
+networking:
+  clusterNetwork:
+  - cidr: {{ hostvars[groups[cluster_group][0]].cluster_network }}
+    hostPrefix: {{ hostvars[groups[cluster_group][0]].cluster_network_host_prefix }}
+  machineNetwork:
+  - cidr: {{ hostvars[groups[cluster_group][0]].machine_network }}
+  networkType: OVNKubernetes
+  serviceNetwork:
+  - {{ hostvars[groups[cluster_group][0]].service_network }}
+platform:
+  {{ hostvars[groups[cluster_group][0]].platform_type }}:
+    apiVIP: {{ hostvars[groups[cluster_group][0]].api_address }}
+    ingressVIP: {{ hostvars[groups[cluster_group][0]].app_address }}
+fips: false
+pullSecret: '{{ vault_pull_secret }}'
+sshKey: '{{ vault_ssh_key }}'

infra-config/playbooks/templates/profiles.tf.j2

@@ -0,0 +1,16 @@
+// Fedora CoreOS profile
+resource "matchbox_profile" "openshift-agent-install" {
+  name   = "{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+  kernel = "/assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-vmlinuz"
+  initrd = [
+    "--name initrd /assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-initrd.img"
+  ]
+
+  args = [
+    "initrd=initrd",
+    "coreos.live.rootfs_url={{ hostvars[groups['matchbox_server'][0]].http_endpoint }}/assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-rootfs.img",
+    "rw",
+    "ignition.firstboot",
+    "ignition.platform.id=metal",
+  ]
+}

infra-config/playbooks/templates/provider.tf.j2

@@ -1,6 +1,6 @@
 // Configure the matchbox provider
 provider "matchbox" {
-  endpoint    = "{{ hostvars[groups['matchbox'][0]].rpc_endpoint }}"
+  endpoint    = "{{ hostvars[groups['matchbox_server'][0]].rpc_endpoint }}"
   client_cert = file("/etc/matchbox/client.crt")
   client_key  = file("/etc/matchbox/client.key")
   ca          = file("/etc/matchbox/ca.crt")