rblundon/homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Updated cluster creation playbook

Browse Source
This commit is contained in:
Ryan Blundon
2025-07-26 01:06:44 -05:00
parent 0f4d2dcb7c
commit 5612932691
30 changed files with 533 additions and 237 deletions
Download Patch File Download Diff File Expand all files Collapse all files

134
README.md
View File

@@ -1,9 +1,141 @@
# A Homelab based on Red Hat Technologies
This repository is the configuration of my homelab. In addition to providing services, the purpose of my homelab is to learn advanced concepts primarily based on Red Hat OpenShift.
A comprehensive homelab for learning advanced concepts primarily based on Red Hat OpenShift. In addition to providing services, it is an area to incorporate container technologies, and enterprise integration scenarios.
This implementation is built on easily accessible consumer based hardware and will focus heavily on GitOps practices and automation will be used wherever possible.
## 🎯 Project Goals
- **Multi-cluster OpenShift management** with ACM
- **Hybrid cloud scenarios** (bare metal + virtualized + containerized)
- **Enterprise integration testing** (AD, SQL Server, SIEM)
- **GitOps and automation workflows**
- **Red Hat certification preparation**
## 📋 Documentation (Priority Order)
### Phase 1: Foundation
1. **[Overview & Hardware Allocation](./docs/01-overview.md)** - Complete architecture overview
2. **[Networking Plan](./docs/02-networking.md)** - VLAN strategy and network design
3. **[Core Services Setup](./docs/03-core-services.md)** *(TBD)* - k0s cluster, DNS, monitoring
4. **[Storage Configuration](./docs/04-storage.md)** *(TBD)* - Synology, democratic-csi
### Phase 2: Container Platform
5. **[Container Registry Setup](./docs/05-container-registry.md)** *(TBD)* - Harbor deployment
6. **[Git Repository Setup](./docs/06-git-repository.md)** *(TBD)* - Gitea/GitLab on Synology
7. **[Artifact Repository](./docs/07-artifact-repository.md)** *(TBD)* - Nexus/Artifactory
### Phase 3: OpenShift Clusters
8. **[OpenShift Compact Cluster](./docs/08-openshift-compact.md)** *(TBD)* - 3-node production-like
9. **[OpenShift SNO + Worker](./docs/09-openshift-sno.md)** *(TBD)* - Edge computing setup
10. **[ACM Configuration](./docs/10-acm-setup.md)** *(TBD)* - Multi-cluster management
### Phase 4: vSphere Platform
11. **[vSphere Installation](./docs/11-vsphere-setup.md)** *(TBD)* - Dell T640 virtualization
12. **[Windows Infrastructure](./docs/12-windows-infrastructure.md)** *(TBD)* - AD, SQL Server
13. **[VM Templates & Automation](./docs/13-vm-automation.md)** *(TBD)* - Template creation
### Phase 5: Advanced Services
14. **[Monitoring & Observability](./docs/14-monitoring.md)** *(TBD)* - Prometheus, Grafana, Splunk
15. **[Security & Compliance](./docs/15-security.md)** *(TBD)* - ACS, certificates, auditing
16. **[Backup & DR](./docs/16-backup-dr.md)** *(TBD)* - Backup strategies
## 🚀 Quick Start Deployment
### Prerequisites
- Ubiquiti UDM SE configured
- Hardware powered and networked
- Initial VLAN setup (see [networking plan](./docs/02-networking.md))
Ansible Collections
- ansible-galaxy collection install freeipa.ansible_freeipa
### Deployment Scripts
```bash
source ~/venv-ansible/bin/activate
# Phase 1: Foundation
./scripts/01-network-setup.sh
./scripts/02-core-services-deploy.sh
# Phase 2: Container Platform
./deployment/synology/docker-compose.yml # Git repo, Harbor, Nexus
./scripts/03-storage-setup.sh
# Phase 3: OpenShift
./deployment/openshift/compact-cluster/
./deployment/openshift/sno-cluster/
# Phase 4: vSphere
./deployment/vsphere/
```
## 📁 Repository Structure
```
homelab-plan/
├── README.md # This file
├── docs/ # Documentation (numbered by priority)
│ ├── 01-overview.md
│ ├── 02-networking.md
│ └── ...
├── deployment/ # Deployment configurations
│ ├── synology/ # Docker Compose files for Synology
│ ├── k0s/ # k0s cluster manifests
│ ├── openshift/ # OpenShift installation configs
│ └── vsphere/ # vSphere automation
├── scripts/ # Automation scripts
└── .gitignore # Excludes sensitive data
```
## 🔧 Technology Stack
### Infrastructure
- **Networking**: Ubiquiti UDM SE
- **Storage**: Synology DS1621+, Ubiquiti UNAS Pro
- **Compute**: 3x Beelink S12 Pro, 5x Lenovo M710q, Dell T640
### Container Platforms
- **OpenShift 4.14+**: Two clusters (compact + SNO)
- **k0s**: Core services cluster
- **vSphere**: VM workloads
### Core Services
- **Container Registry**: Harbor
- **Git Repository**: Gitea/GitLab CE
- **Artifact Repository**: Nexus/Artifactory
- **Monitoring**: Prometheus + Grafana
- **Logging**: Splunk Enterprise
- **DNS**: CoreDNS
- **Load Balancing**: MetalLB + HAProxy
## 🔐 Security Notes
- **No sensitive data** is stored in this repository
- **Secrets management** via external-secrets-operator
- **Certificate management** via cert-manager
- **Network segmentation** via VLANs and firewall rules
## 🤝 Contributing
This is a personal homelab project, but feel free to:
- Submit issues for questions or suggestions
- Fork for your own homelab adaptations
- Share improvements via pull requests
## 📞 Next Steps
1. **Create GitHub repository** for version control
2. **Start with Phase 1** foundation setup
3. **Build deployment automation** as we go
4. **Document lessons learned** for future reference
---
**Status**: 🚧 Planning & Initial Development
**Last Updated**: June 2025
This repo is a mono-repo that is broken up into three sections:
- infra-config

13
infra-config/10-internal-cluster/01-dhcp/host-reservations.yml
View File

@@ -1,13 +0,0 @@
---
- name: Dnsmasq
hosts: localhost
become: yes
vars:
- additional_dhcp_hosts:
ethernet_switch:
desc: "SNO Hub Cluster"
mac: 98:b7:85:1e:c6:f1
ip: 10.1.71.10
roles:
- role: ricsanfre.dnsmasq

24
infra-config/10-internal-cluster/01-dns/.terraform.lock.hcl generated
View File

@@ -1,24 +0,0 @@
# This file is maintained automatically by "terraform init".
# Manual edits may be lost in future updates.
provider "registry.terraform.io/rework-space-com/freeipa" {
version = "5.0.0"
constraints = "5.0.0"
hashes = [
"h1:6EquDv6GgQO2HjZUUoRIUVzYa951n+wb4Uk7ggD6XD0=",
"zh:098607e559c3b696401034ff494ba8068962b45059ee067a54b58334b6ee0f2c",
"zh:18b806a14bb9d9382213c6929af35f5a65f16c17ff526d475f1eab33d1470290",
"zh:2c8c74668844d256b7fdc503cd736a20b7e58db5b31880d1ad8090c1af04e24c",
"zh:3bba458b9a6df99c21da58750dd6586b93bdcc557e4a2d695e801ada39e8de1e",
"zh:58f728d9e98cc7aae3841c07318be64b6dcb2f51c041f04bba977e61104a2333",
"zh:597dfbefbfe111a31e9ff3c4fc14fc8e12c1e255454087d3eebd2ec6c7aa9bf3",
"zh:6093d6db13d834c23f5482efae80c8e1ae046028fccf24242f0f1c1935e6aa70",
"zh:87271fa234a57ce05d4166e444002bd66976f971b434f7add45c874c9587129d",
"zh:89f7f6be64b6bf9e708fbafd22f410cf3f50b1fcd4cd6c61e9ffffd6180ea839",
"zh:9bdd7a984f845ff6f4bc4df5cc41a9de019639fceca62e60fc7c0f098ad2695c",
"zh:a0551311c96b86050d15854b4fca2beaa06b2e1964f97945824567d0b90db580",
"zh:c3daa12021725883bd32d7d852a2de845bb7a5f18009a45be7c2c2d891631713",
"zh:d7871eb99683934a30b9d47508379e6d16978f3dcd73601af2204652668592aa",
"zh:e8f72fd7750e6c1f0f97d039fea66cb85f457cf22908b7c3f14c7d2cf990ee84",
]
}

3
infra-config/10-internal-cluster/01-dns/README.md
View File

@@ -1,3 +0,0 @@
# DNS Provider Configuration
This directory contains the configuration to updateFreeIPA DNS for the Hub Cluster.

39
infra-config/10-internal-cluster/01-dns/dns.tf
View File

@@ -1,39 +0,0 @@
resource "freeipa_dns_record" "ocp-hub" {
zone_name = "int.mk-labs.cloud."
name = "ocp-hub"
type = "A"
records = [
"10.1.71.10",
]
ttl = 60
}
resource "freeipa_dns_record" "api" {
zone_name = "int.mk-labs.cloud."
name = "api.hub"
type = "A"
records = [
"10.1.71.10",
]
ttl = 60
}
resource "freeipa_dns_record" "api-int" {
zone_name = "int.mk-labs.cloud."
name = "api-int.hub"
type = "A"
records = [
"10.1.71.10",
]
ttl = 60
}
resource "freeipa_dns_record" "wildcard-apps" {
zone_name = "int.mk-labs.cloud."
name = "*.apps.hub"
type = "A"
records = [
"10.1.71.10",
]
ttl = 60
}

22
infra-config/10-internal-cluster/01-dns/provider.tf
View File

@@ -1,22 +0,0 @@
# Configure the DNS Provider
provider "freeipa" {
host = "infra01.int.mk-labs.cloud"
username = "admin"
password = var.freeipa_password
insecure = true
}
variable "freeipa_password" {
description = "The password for the FreeIPA provider"
type = string
sensitive = true
}
terraform {
required_providers {
freeipa = {
source = "rework-space-com/freeipa"
version = "5.0.0"
}
}
}

1
infra-config/10-internal-cluster/02-dhcp/README.md
View File

@@ -1 +0,0 @@
# Add/modify entry in DNSmasq

28
infra-config/10-internal-cluster/02-dhcp/ip-reservations.yml
View File

@@ -1,28 +0,0 @@
---
- name: Ensure dnsmasq is installed
ansible.builtin.apt:
name: dnsmasq
state: present
become: true
when: ansible_os_family == "Debian"
- name: Ensure dnsmasq is installed
ansible.builtin.dnf:
name: dnsmasq
state: present
become: true
when: ansible_os_family == "RedHat"
- name: Add host reservation to dnsmasq
ansible.builtin.lineinfile:
path: /etc/dnsmasq.d/hosts.conf
regexp: "^dhcp-host={{ hostvars['ocp-hub'].mac_address }}"
line: "dhcp-host={{ hostvars['ocp-hub'].mac_address }},{{ hostvars['ocp-hub'].ip_address }} #{{ hostvars['ocp-hub'].hostname }}"
state: present
become: true
- name: Restart dnsmasq service
ansible.builtin.service:
name: dnsmasq
state: restarted
become: true

8
infra-config/10-internal-cluster/04-matchbox/templates/groups.tf.j2
View File

@@ -1,8 +0,0 @@
// Matcher group for OCP Internal machines
resource "matchbox_group" "{{ hostvars[groups['hub_cluster'][0]].cluster_name }}" {
name = "{{ hostvars['ocp-hub'].hostname }}" # Physical Server
profile = matchbox_profile.openshift-agent-install.name
selector = {
mac = "{{ hostvars['ocp-hub'].mac_address }}" # PXE boots and installs to 10GbE NIC
}
}

16
infra-config/10-internal-cluster/04-matchbox/templates/profiles.tf.j2
View File

@@ -1,16 +0,0 @@
// Fedora CoreOS profile
resource "matchbox_profile" "openshift-agent-install" {
name = "{{ hostvars[groups['hub_cluster'][0]].cluster_name }}"
kernel = "/assets/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}/agent.x86_64-vmlinuz"
initrd = [
"--name initrd /assets/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}/agent.x86_64-initrd.img"
]
args = [
"initrd=initrd",
"coreos.live.rootfs_url={{ hostvars[groups['matchbox'][0]].http_endpoint }}/assets/{{ hostvars[groups['hub_cluster'][0]].cluster_name }}/agent.x86_64-rootfs.img",
"rw",
"ignition.firstboot",
"ignition.platform.id=metal",
]
}

92
infra-config/10-internal-cluster/install.yml
View File

@@ -5,58 +5,58 @@
gather_facts: true
tasks:
- name: Deploy DNS entries for cluster via Terraform
community.general.terraform:
project_path: 01-dns/
variables:
freeipa_password: "{{ vault_freeipa_password }}"
state: present
force_init: true
# - name: Deploy DNS entries for cluster via Terraform
# community.general.terraform:
# project_path: 01-dns/
# variables:
# freeipa_password: "{{ vault_freeipa_password }}"
# state: present
# force_init: true
- name: Deploy DHCP entries for cluster via Terraform
ansible.builtin.include_tasks:
file: 02-dhcp/ip-reservations.yml
# - name: Deploy DHCP entries for cluster via Terraform
# ansible.builtin.include_tasks:
# file: 02-dhcp/ip-reservations.yml
- name: OpenShift Installer install-config.yaml
ansible.builtin.template:
src: 03-openshift-image/templates/install-config.yaml.j2
dest: 03-openshift-image/install-config.yaml
mode: '0644'
# - name: OpenShift Installer install-config.yaml
# ansible.builtin.template:
# src: 03-openshift-image/templates/install-config.yaml.j2
# dest: 03-openshift-image/install-config.yaml
# mode: '0644'
- name: OpenShift Installer agent-config.yaml
ansible.builtin.template:
src: 03-openshift-image/templates/agent-config.yaml.j2
dest: 03-openshift-image/agent-config.yaml
mode: '0644'
# - name: OpenShift Installer agent-config.yaml
# ansible.builtin.template:
# src: 03-openshift-image/templates/agent-config.yaml.j2
# dest: 03-openshift-image/agent-config.yaml
# mode: '0644'
- name: Create OpenShift image
ansible.builtin.include_tasks:
file: 03-openshift-image/create-openshift-image.yml
# - name: Create OpenShift image
# ansible.builtin.include_tasks:
# file: 03-openshift-image/create-openshift-image.yml
- name: Move PXE assets to matchbox
ansible.builtin.include_tasks:
file: 03-openshift-image/move-pxe-assets.yml
# - name: Move PXE assets to matchbox
# ansible.builtin.include_tasks:
# file: 03-openshift-image/move-pxe-assets.yml
- name: Terraform matchbox groups file
ansible.builtin.template:
src: 04-matchbox/templates/groups.tf.j2
dest: 04-matchbox/groups.tf
mode: '0644'
# - name: Terraform matchbox groups file
# ansible.builtin.template:
# src: 04-matchbox/templates/groups.tf.j2
# dest: 04-matchbox/groups.tf
# mode: '0644'
- name: Terraform matchbox profiles file
ansible.builtin.template:
src: 04-matchbox/templates/profiles.tf.j2
dest: 04-matchbox/profiles.tf
mode: '0644'
# - name: Terraform matchbox profiles file
# ansible.builtin.template:
# src: 04-matchbox/templates/profiles.tf.j2
# dest: 04-matchbox/profiles.tf
# mode: '0644'
- name: Terraform matchbox provider file
ansible.builtin.template:
src: 04-matchbox/templates/provider.tf.j2
dest: 04-matchbox/provider.tf
mode: '0644'
# - name: Terraform matchbox provider file
# ansible.builtin.template:
# src: 04-matchbox/templates/provider.tf.j2
# dest: 04-matchbox/provider.tf
# mode: '0644'
- name: Configure Matchbox via Terraform
community.general.terraform:
project_path: 04-matchbox/
state: present
force_init: true
# - name: Configure Matchbox via Terraform
# community.general.terraform:
# project_path: 04-matchbox/
# state: present
# force_init: true

4
infra-config/group_vars/all/vars
View File

@@ -7,9 +7,11 @@ proxmox_password: "{{ vault_proxmox_root_password }}"
proxmox_host: "pve01"
# DNS variables
dns_server: "infra01.int.mk-labs.cloud"
dns_server: "infra01" # .int.mk-labs.cloud"
dns_admin: "admin"
base_domain: "int.mk-labs.cloud"
# DHCP server
dhcp_server: "matchbox"
# Terraform variables
terraform_server: "infra01"

10
infra-config/group_vars/internal_cluster/vars
View File

@@ -1,10 +1,14 @@
cluster_name: "openshift"
cluster_version: "4.17.20"
#base_domain: "int.mk-labs.cloud"
cluster_version: "4.18.21"
openshift_installer_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/openshift-install-linux.tar.gz"
openshift_client_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/openshift-client-linux.tar.gz"
# cluster_group: "internal_cluster"
worker_node_count: 1
master_node_count: 3
cluster_network: "10.128.0.0/14"
cluster_network_host_prefix: 23
machine_network: "10.1.71.0/24"
service_network: "172.30.0.0/16"
platform_type: "none"
platform_type: "baremetal"
api_address: "10.1.71.69"
app_address: "10.1.71.60"

0
infra-config/group_vars/matchbox/vars → infra-config/group_vars/matchbox_server/vars
View File

7
infra-config/host_vars/int-master01/vars
View File

@@ -1,9 +1,12 @@
---
# file: host_vars/int-master01/vars
# OpenShift node
# Networking
# primary_interface: "enp1s0f0"
mac_address: "54:bf:64:60:52:2d"
primary_interface: "enp1s0f0"
boot_mac_address: "54:bf:64:60:52:2d"
install_mac_address: "00:0a:f7:5d:f3:53"
ip_address: 10.1.71.61
node_role: "master"
hostname: "{{ inventory_hostname }}.{{ base_domain }}"

9
infra-config/host_vars/int-master02/vars
View File

@@ -1,9 +1,12 @@
---
# file: host_vars/int-master01/vars
# file: host_vars/int-master02/vars
# OpenShift node
# Networking
# primary_interface: "enp1s0f0"
mac_address: "54:bf:64:5f:a2:80"
primary_interface: "enp1s0f0"
boot_mac_address: "54:bf:64:5f:a2:80"
install_mac_address: "98:b7:85:20:47:3b"
ip_address: 10.1.71.62
node_role: "master"
hostname: "{{ inventory_hostname }}.{{ base_domain }}"

9
infra-config/host_vars/int-master03/vars
View File

@@ -1,9 +1,12 @@
---
# file: host_vars/int-master01/vars
# file: host_vars/int-master03/vars
# OpenShift node
# Networking
# primary_interface: "enp1s0f0"
mac_address: "d8:9e:f3:4c:02:a9"
primary_interface: "enp1s0f0"
boot_mac_address: "d8:9e:f3:4c:02:a9"
install_mac_address: "98:b7:85:20:47:23"
ip_address: 10.1.71.63
node_role: "master"
hostname: "{{ inventory_hostname }}.{{ base_domain }}"

9
infra-config/host_vars/int-worker01/vars
View File

@@ -1,9 +0,0 @@
---
# file: host_vars/int-master01/vars
# Networking
# primary_interface: "enp1s0f0"
mac_address: "54:bf:64:60:52:2d"
ip_address: 10.1.71.64
hostname: "{{ inventory_hostname }}.{{ base_domain }}"

12
infra-config/host_vars/int-worker02/vars Normal file
View File

@@ -0,0 +1,12 @@
---
# file: host_vars/int-worker02/vars
# OpenShift node
# Networking
primary_interface: "enp2s0f0"
boot_mac_address: "58:47:ca:76:13:49"
install_mac_address: "58:47:ca:76:13:47"
ip_address: 10.1.71.65
node_role: "worker"
hostname: "{{ inventory_hostname }}.{{ base_domain }}"

8
infra-config/inventory.yml
View File

@@ -40,9 +40,9 @@ ipaserver:
hosts:
infra01.int.mk-labs.cloud:
# matchbox:
# hosts:
# infra01:
matchbox_server:
hosts:
matchbox:
hub_cluster:
hosts:
@@ -53,7 +53,7 @@ internal_cluster:
int-master01:
int-master02:
int-master03:
int-worker01:
int-worker02:
sql_servers:
hosts:

0
infra-config/playbooks/alertmanager.yml
View File

196
infra-config/playbooks/configure_openshift_internal.yml Normal file
View File

@@ -0,0 +1,196 @@
---
- name: Configure DNS entries for cluster nodes
hosts: internal_cluster
gather_facts: false
become: true
tasks:
- name: Create DNS entry for each cluster node
ansible.builtin.include_tasks: tasks/create_dns_record.yml
vars:
host_ip_address: "{{ ip_address }}"
- name: Configure DNS entries for OpenShift cluster services
hosts: internal_cluster[0]
gather_facts: false
become: true
tasks:
- name: Create DNS entries for OpenShift cluster services
ansible.builtin.include_tasks: tasks/create_dns_record.yml
vars:
dns_name: "{{ item.name }}"
dns_address: "{{ item.address }}"
loop:
- name: "api.{{ cluster_name }}"
address: "{{ api_address }}"
- name: "api-int.{{ cluster_name }}"
address: "{{ api_address }}"
- name: "*.apps.{{ cluster_name }}"
address: "{{ app_address }}"
loop_control:
label: "{{ item.name }}"
- name: Configure DHCP entries for cluster nodes
hosts: internal_cluster
gather_facts: false
become: true
tasks:
- name: Configure DHCP entry for node
ansible.builtin.include_tasks: tasks/configure_dhcp_entry.yml
vars:
host_mac_address: "{{ install_mac_address }}"
host_ip_address: "{{ ip_address }}"
handlers:
- name: Restart dnsmasq
delegate_to: "{{ dhcp_server }}"
become: true
ansible.builtin.service:
name: dnsmasq
state: restarted
- name: Create OpenShift installer files
hosts: matchbox
gather_facts: true
vars:
cluster_group: "internal_cluster"
tasks:
- name: Create directory
ansible.builtin.file:
path: ~/homelab/terraform/{{ cluster_group }}
state: directory
mode: '0755'
- name: OpenShift Installer install-config.yaml
ansible.builtin.template:
src: templates/install-config.yaml.j2
dest: ~/homelab/terraform/{{ cluster_group }}/install-config.yaml
mode: '0644'
- name: OpenShift Installer agent-config.yaml
ansible.builtin.template:
src: templates/agent-config.yaml.j2
dest: ~/homelab/terraform/{{ cluster_group }}/agent-config.yaml
mode: '0644'
- name: Create directory for OpenShift Installer files
become: true
ansible.builtin.file:
path: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
state: directory
mode: '0755'
owner: root
group: root
- name: Download OpenShift Installer file
become: true
ansible.builtin.get_url:
url: "{{ hostvars[groups[cluster_group][0]].openshift_installer_download_url }}"
dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
mode: '0644'
- name: Download OpenShift Client file
become: true
ansible.builtin.get_url:
url: "{{ hostvars[groups[cluster_group][0]].openshift_client_download_url }}"
dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
mode: '0644'
- name: Unarchive installer file
become: true
ansible.builtin.unarchive:
src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install-linux.tar.gz
dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
remote_src: true
- name: Unarchive client file
become: true
ansible.builtin.unarchive:
src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-client-linux.tar.gz
dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
remote_src: true
- name: Copy install binary
become: true
ansible.builtin.copy:
src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install
dest: /usr/local/bin
remote_src: true
owner: wed
group: wed
mode: '0755'
- name: Copy client binary
become: true
ansible.builtin.copy:
src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/oc
dest: /usr/local/bin
remote_src: true
owner: wed
group: wed
mode: '0755'
- name: Check if OpenShift image exists
ansible.builtin.stat:
path: ~/homelab/terraform/{{ cluster_group }}/boot-artifacts/agent.x86_64-initrd.img
register: openshift_image_exists
- name: OpenShift image creation
ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
args:
chdir: ~/homelab/terraform/{{ cluster_group }}
when: not openshift_image_exists.stat.exists
changed_when: true
- name: Create a directory if it does not exist
become: true
ansible.builtin.file:
path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
state: directory
owner: matchbox
group: matchbox
mode: '0755'
- name: Copy file with owner and permissions
become: true
ansible.builtin.copy:
src: "{{ ansible_env['HOME'] }}/homelab/terraform/{{ cluster_group }}/boot-artifacts/"
dest: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}/"
remote_src: true
owner: matchbox
group: matchbox
mode: '0644'
- name: Verify directory permissions
become: true
ansible.builtin.file:
path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
state: directory
owner: matchbox
group: matchbox
mode: '0755'
- name: Create Terraform matchbox groups file from template
ansible.builtin.template:
src: templates/groups.tf.j2
dest: ~/homelab/terraform/{{ cluster_group }}/groups.tf
mode: '0644'
- name: Create Terraform matchbox profiles file from template
ansible.builtin.template:
src: templates/profiles.tf.j2
dest: ~/homelab/terraform/{{ cluster_group }}/profiles.tf
mode: '0644'
- name: Create Terraform matchbox provider file from template
ansible.builtin.template:
src: templates/provider.tf.j2
dest: ~/homelab/terraform/{{ cluster_group }}/provider.tf
mode: '0644'
- name: Configure Matchbox via Terraform
community.general.terraform:
project_path: ~/homelab/terraform/{{ cluster_group }}
state: present
force_init: true

10
infra-config/playbooks/configure_unbound copy.yml
View File

@@ -1,10 +0,0 @@
---
- name: Master playbook to configure openshift cluster (internal)
hosts: internal_cluster
become: true
tasks:
- name: Install unbound via role
ansible.builtin.import_role:
name: Anthony25.unbound

10
infra-config/playbooks/tasks/configure_dhcp_entry.yml Normal file
View File

@@ -0,0 +1,10 @@
---
- name: Add DHCP entry for {{ inventory_hostname }}
delegate_to: "{{ dhcp_server }}"
become: true
ansible.builtin.lineinfile:
path: /etc/dnsmasq.d/hosts.conf
regexp: "# {{ inventory_hostname }}$"
line: "dhcp-host={{ host_mac_address | lower }},{{ host_ip_address }} # {{ inventory_hostname }}"
state: present
notify: Restart dnsmasq

11
infra-config/playbooks/tasks/create_dns_record.yml Normal file
View File

@@ -0,0 +1,11 @@
---
- name: "Create DNS record for {{ dns_name | default(inventory_hostname) }}"
delegate_to: "{{ dns_server }}"
freeipa.ansible_freeipa.ipadnsrecord:
ipaapi_context: "server"
ipaadmin_password: "{{ vault_freeipa_password }}"
name: "{{ dns_name | default(inventory_hostname) }}"
zone_name: "{{ base_domain }}"
record_type: "A"
record_value: "{{ dns_address | default(host_ip_address) }}"
record_ttl: 60

35
infra-config/playbooks/templates/agent-config.yaml.j2 Normal file
View File

@@ -0,0 +1,35 @@
apiVersion: v1alpha1
kind: AgentConfig
metadata:
name: {{ hostvars[groups[cluster_group][0]].cluster_name }}
rendezvousIP: {{ hostvars[groups[cluster_group][0]].ip_address }}
bootArtifactsBaseURL: {{ hostvars[groups['matchbox_server'][0]].http_endpoint }}/assets/hub/
hosts:
{% for host in groups[cluster_group] %}
- hostname: {{ host }}
role: {{ hostvars[host].node_role | default('master') }}
interfaces:
- name: {{ hostvars[host].primary_interface }}
macAddress: {{ hostvars[host].install_mac_address }}
networkConfig:
interfaces:
- name: {{ hostvars[host].primary_interface }}
type: ethernet
state: up
identifier: mac-address
mac-address: {{ hostvars[host].install_mac_address }}
ipv4:
enabled: true
dhcp: true
dns-resolver:
config:
server:
- 10.1.71.251
- 10.1.71.252
routes:
config:
- destination: 0.0.0.0/0
next-hop-address: 10.1.71.1
next-hop-interface: {{ hostvars[host].primary_interface }}
table-id: 254
{% endfor %}

14
infra-config/playbooks/templates/groups.tf.j2 Normal file
View File

@@ -0,0 +1,14 @@
// Matcher group for OCP Internal machines
{% for host in groups[cluster_group] %}
resource "matchbox_group" "{{ host }}" {
name = "{{ host }}" # Physical Server
profile = matchbox_profile.openshift-agent-install.name
selector = {
{% if hostvars[host].boot_mac_address == hostvars[host].install_mac_address %}
mac = "{{ hostvars[host].boot_mac_address }}" # PXE boots and installs to same NIC
{% else %}
mac = "{{ hostvars[host].boot_mac_address }}" # PXE boots to 1GbE NIC, installs to 10GbE NIC
{% endif %}
}
}
{% endfor %}

28
infra-config/playbooks/templates/install-config.yaml.j2 Normal file
View File

@@ -0,0 +1,28 @@
apiVersion: v1
baseDomain: {{ hostvars[groups[cluster_group][0]].base_domain }}
compute:
- name: worker
hyperthreading: Enabled
replicas: {{ hostvars[groups[cluster_group][0]].worker_node_count }}
controlPlane:
hyperthreading: Enabled
name: master
replicas: {{ hostvars[groups[cluster_group][0]].master_node_count }}
metadata:
name: {{ hostvars[groups[cluster_group][0]].cluster_name }}
networking:
clusterNetwork:
- cidr: {{ hostvars[groups[cluster_group][0]].cluster_network }}
hostPrefix: {{ hostvars[groups[cluster_group][0]].cluster_network_host_prefix }}
machineNetwork:
- cidr: {{ hostvars[groups[cluster_group][0]].machine_network }}
networkType: OVNKubernetes
serviceNetwork:
- {{ hostvars[groups[cluster_group][0]].service_network }}
platform:
{{ hostvars[groups[cluster_group][0]].platform_type }}:
apiVIP: {{ hostvars[groups[cluster_group][0]].api_address }}
ingressVIP: {{ hostvars[groups[cluster_group][0]].app_address }}
fips: false
pullSecret: '{{ vault_pull_secret }}'
sshKey: '{{ vault_ssh_key }}'

16
infra-config/playbooks/templates/profiles.tf.j2 Normal file
View File

@@ -0,0 +1,16 @@
// Fedora CoreOS profile
resource "matchbox_profile" "openshift-agent-install" {
name = "{{ hostvars[groups[cluster_group][0]].cluster_name }}"
kernel = "/assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-vmlinuz"
initrd = [
"--name initrd /assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-initrd.img"
]
args = [
"initrd=initrd",
"coreos.live.rootfs_url={{ hostvars[groups['matchbox_server'][0]].http_endpoint }}/assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-rootfs.img",
"rw",
"ignition.firstboot",
"ignition.platform.id=metal",
]
}

2
infra-config/10-internal-cluster/04-matchbox/templates/provider.tf.j2 → infra-config/playbooks/templates/provider.tf.j2
View File

@@ -1,6 +1,6 @@
// Configure the matchbox provider
provider "matchbox" {
endpoint = "{{ hostvars[groups['matchbox'][0]].rpc_endpoint }}"
endpoint = "{{ hostvars[groups['matchbox_server'][0]].rpc_endpoint }}"
client_cert = file("/etc/matchbox/client.crt")
client_key = file("/etc/matchbox/client.key")
ca = file("/etc/matchbox/ca.crt")