rblundon/homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #1 from rblundon/deploy-hub-cluster

Browse Source 
Configure hub cluster
This commit is contained in:
Ryan Blundon
2025-03-25 10:32:52 -05:00
committed by GitHub
parent e1c72629a8 8ae36cdce2
commit 6ab1d11d79
74 changed files with 2155 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

0
.ansible/.lock Normal file
View File

712
.ansible/ansible.cfg Normal file
View File

@@ -0,0 +1,712 @@
[defaults]
# (boolean) By default, Ansible will issue a warning when received from a task action (module or action plugin).
# These warnings can be silenced by adjusting this setting to False.
;action_warnings=True
# (list) Accept a list of cowsay templates that are 'safe' to use, set to an empty list if you want to enable all installed templates.
;cowsay_enabled_stencils=bud-frogs, bunny, cheese, daemon, default, dragon, elephant-in-snake, elephant, eyes, hellokitty, kitty, luke-koala, meow, milk, moofasa, moose, ren, sheep, small, stegosaurus, stimpy, supermilker, three-eyes, turkey, turtle, tux, udder, vader-koala, vader, www
# (string) Specify a custom cowsay path or swap in your cowsay implementation of choice.
;cowpath=
# (string) This allows you to choose a specific cowsay stencil for the banners or use 'random' to cycle through them.
;cow_selection=default
# (boolean) This option forces color mode even when running without a TTY or the "nocolor" setting is True.
;force_color=False
# (path) The default root path for Ansible config files on the controller.
;home=~/.ansible
# (boolean) This setting allows suppressing colorizing output, which is used to give a better indication of failure and status information.
;nocolor=False
# (boolean) If you have cowsay installed but want to avoid the 'cows' (why????), use this.
;nocows=False
# (boolean) Sets the default value for the any_errors_fatal keyword, if True, Task failures will be considered fatal errors.
;any_errors_fatal=False
# (path) The password file to use for the become plugin. ``--become-password-file``.
# If executable, it will be run and the resulting stdout will be used as the password.
;become_password_file=
# (pathspec) Colon-separated paths in which Ansible will search for Become Plugins.
;become_plugins=/Users/rblundon/.ansible/plugins/become:/usr/share/ansible/plugins/become
# (string) Chooses which cache plugin to use, the default 'memory' is ephemeral.
;fact_caching=memory
# (string) Defines connection or path information for the cache plugin.
;fact_caching_connection=
# (string) Prefix to use for cache plugin files/tables.
;fact_caching_prefix=ansible_facts
# (integer) Expiration timeout for the cache plugin data.
;fact_caching_timeout=86400
# (list) List of enabled callbacks, not all callbacks need enabling, but many of those shipped with Ansible do as we don't want them activated by default.
;callbacks_enabled=
# (string) When a collection is loaded that does not support the running Ansible version (with the collection metadata key `requires_ansible`).
;collections_on_ansible_version_mismatch=warning
# (pathspec) Colon-separated paths in which Ansible will search for collections content. Collections must be in nested *subdirectories*, not directly in these directories. For example, if ``COLLECTIONS_PATHS`` includes ``'{{ ANSIBLE_HOME ~ "/collections" }}'``, and you want to add ``my.collection`` to that directory, it must be saved as ``'{{ ANSIBLE_HOME} ~ "/collections/ansible_collections/my/collection" }}'``.
;collections_path=/Users/rblundon/.ansible/collections:/usr/share/ansible/collections
# (boolean) A boolean to enable or disable scanning the sys.path for installed collections.
;collections_scan_sys_path=True
# (path) The password file to use for the connection plugin. ``--connection-password-file``.
;connection_password_file=
# (pathspec) Colon-separated paths in which Ansible will search for Action Plugins.
;action_plugins=/Users/rblundon/.ansible/plugins/action:/usr/share/ansible/plugins/action
# (boolean) When enabled, this option allows lookup plugins (whether used in variables as ``{{lookup('foo')}}`` or as a loop as with_foo) to return data that is not marked 'unsafe'.
# By default, such data is marked as unsafe to prevent the templating engine from evaluating any jinja2 templating language, as this could represent a security risk. This option is provided to allow for backward compatibility, however, users should first consider adding allow_unsafe=True to any lookups that may be expected to contain data that may be run through the templating engine late.
;allow_unsafe_lookups=False
# (boolean) This controls whether an Ansible playbook should prompt for a login password. If using SSH keys for authentication, you probably do not need to change this setting.
;ask_pass=False
# (boolean) This controls whether an Ansible playbook should prompt for a vault password.
;ask_vault_pass=False
# (pathspec) Colon-separated paths in which Ansible will search for Cache Plugins.
;cache_plugins=/Users/rblundon/.ansible/plugins/cache:/usr/share/ansible/plugins/cache
# (pathspec) Colon-separated paths in which Ansible will search for Callback Plugins.
;callback_plugins=/Users/rblundon/.ansible/plugins/callback:/usr/share/ansible/plugins/callback
# (pathspec) Colon-separated paths in which Ansible will search for Cliconf Plugins.
;cliconf_plugins=/Users/rblundon/.ansible/plugins/cliconf:/usr/share/ansible/plugins/cliconf
# (pathspec) Colon-separated paths in which Ansible will search for Connection Plugins.
;connection_plugins=/Users/rblundon/.ansible/plugins/connection:/usr/share/ansible/plugins/connection
# (boolean) Toggles debug output in Ansible. This is *very* verbose and can hinder multiprocessing. Debug output can also include secret information despite no_log settings being enabled, which means debug mode should not be used in production.
;debug=False
# (string) This indicates the command to use to spawn a shell under, which is required for Ansible's execution needs on a target. Users may need to change this in rare instances when shell usage is constrained, but in most cases, it may be left as is.
;executable=/bin/sh
# (pathspec) Colon-separated paths in which Ansible will search for Jinja2 Filter Plugins.
;filter_plugins=/Users/rblundon/.ansible/plugins/filter:/usr/share/ansible/plugins/filter
# (boolean) This option controls if notified handlers run on a host even if a failure occurs on that host.
# When false, the handlers will not run if a failure has occurred on a host.
# This can also be set per play or on the command line. See Handlers and Failure for more details.
;force_handlers=False
# (integer) Maximum number of forks Ansible will use to execute tasks on target hosts.
;forks=5
# (string) This setting controls the default policy of fact gathering (facts discovered about remote systems).
# This option can be useful for those wishing to save fact gathering time. Both 'smart' and 'explicit' will use the cache plugin.
;gathering=implicit
# (string) This setting controls how duplicate definitions of dictionary variables (aka hash, map, associative array) are handled in Ansible.
# This does not affect variables whose values are scalars (integers, strings) or arrays.
# **WARNING**, changing this setting is not recommended as this is fragile and makes your content (plays, roles, collections) nonportable, leading to continual confusion and misuse. Don't change this setting unless you think you have an absolute need for it.
# We recommend avoiding reusing variable names and relying on the ``combine`` filter and ``vars`` and ``varnames`` lookups to create merged versions of the individual variables. In our experience, this is rarely needed and is a sign that too much complexity has been introduced into the data structures and plays.
# For some uses you can also look into custom vars_plugins to merge on input, even substituting the default ``host_group_vars`` that is in charge of parsing the ``host_vars/`` and ``group_vars/`` directories. Most users of this setting are only interested in inventory scope, but the setting itself affects all sources and makes debugging even harder.
# All playbooks and roles in the official examples repos assume the default for this setting.
# Changing the setting to ``merge`` applies across variable sources, but many sources will internally still overwrite the variables. For example ``include_vars`` will dedupe variables internally before updating Ansible, with 'last defined' overwriting previous definitions in same file.
# The Ansible project recommends you **avoid ``merge`` for new projects.**
# It is the intention of the Ansible developers to eventually deprecate and remove this setting, but it is being kept as some users do heavily rely on it. New projects should **avoid 'merge'**.
;hash_behaviour=replace
# (pathlist) Comma-separated list of Ansible inventory sources
;inventory=/etc/ansible/hosts
# (pathspec) Colon-separated paths in which Ansible will search for HttpApi Plugins.
;httpapi_plugins=/Users/rblundon/.ansible/plugins/httpapi:/usr/share/ansible/plugins/httpapi
# (float) This sets the interval (in seconds) of Ansible internal processes polling each other. Lower values improve performance with large playbooks at the expense of extra CPU load. Higher values are more suitable for Ansible usage in automation scenarios when UI responsiveness is not required but CPU usage might be a concern.
# The default corresponds to the value hardcoded in Ansible <= 2.1
;internal_poll_interval=0.001
# (pathspec) Colon-separated paths in which Ansible will search for Inventory Plugins.
;inventory_plugins=/Users/rblundon/.ansible/plugins/inventory:/usr/share/ansible/plugins/inventory
# (string) This is a developer-specific feature that allows enabling additional Jinja2 extensions.
# See the Jinja2 documentation for details. If you do not know what these do, you probably don't need to change this setting :)
;jinja2_extensions=[]
# (boolean) This option preserves variable types during template operations.
;jinja2_native=False
# (boolean) Enables/disables the cleaning up of the temporary files Ansible used to execute the tasks on the remote.
# If this option is enabled it will disable ``ANSIBLE_PIPELINING``.
;keep_remote_files=False
# (boolean) Controls whether callback plugins are loaded when running /usr/bin/ansible. This may be used to log activity from the command line, send notifications, and so on. Callback plugins are always loaded for ``ansible-playbook``.
;bin_ansible_callbacks=False
# (tmppath) Temporary directory for Ansible to use on the controller.
;local_tmp=/Users/rblundon/.ansible/tmp
# (list) List of logger names to filter out of the log file.
;log_filter=
# (path) File to which Ansible will log on the controller.
# When not set the logging is disabled.
;log_path=
# (pathspec) Colon-separated paths in which Ansible will search for Lookup Plugins.
;lookup_plugins=/Users/rblundon/.ansible/plugins/lookup:/usr/share/ansible/plugins/lookup
# (string) Sets the macro for the 'ansible_managed' variable available for :ref:`ansible_collections.ansible.builtin.template_module` and :ref:`ansible_collections.ansible.windows.win_template_module`. This is only relevant to those two modules.
;ansible_managed=Ansible managed
# (string) This sets the default arguments to pass to the ``ansible`` adhoc binary if no ``-a`` is specified.
;module_args=
# (string) Compression scheme to use when transferring Python modules to the target.
;module_compression=ZIP_DEFLATED
# (string) Module to use with the ``ansible`` AdHoc command, if none is specified via ``-m``.
;module_name=command
# (pathspec) Colon-separated paths in which Ansible will search for Modules.
;library=/Users/rblundon/.ansible/plugins/modules:/usr/share/ansible/plugins/modules
# (pathspec) Colon-separated paths in which Ansible will search for Module utils files, which are shared by modules.
;module_utils=/Users/rblundon/.ansible/plugins/module_utils:/usr/share/ansible/plugins/module_utils
# (pathspec) Colon-separated paths in which Ansible will search for Netconf Plugins.
;netconf_plugins=/Users/rblundon/.ansible/plugins/netconf:/usr/share/ansible/plugins/netconf
# (boolean) Toggle Ansible's display and logging of task details, mainly used to avoid security disclosures.
;no_log=False
# (boolean) Toggle Ansible logging to syslog on the target when it executes tasks. On Windows hosts, this will disable a newer style PowerShell modules from writing to the event log.
;no_target_syslog=False
# (raw) What templating should return as a 'null' value. When not set it will let Jinja2 decide.
;null_representation=
# (integer) For asynchronous tasks in Ansible (covered in Asynchronous Actions and Polling), this is how often to check back on the status of those tasks when an explicit poll interval is not supplied. The default is a reasonably moderate 15 seconds which is a tradeoff between checking in frequently and providing a quick turnaround when something may have completed.
;poll_interval=15
# (path) Option for connections using a certificate or key file to authenticate, rather than an agent or passwords, you can set the default value here to avoid re-specifying ``--private-key`` with every invocation.
private_key_file=~/.ssh/ansible
# (boolean) By default, imported roles publish their variables to the play and other roles, this setting can avoid that.
# This was introduced as a way to reset role variables to default values if a role is used more than once in a playbook.
# Starting in version '2.17' M(ansible.builtin.include_roles) and M(ansible.builtin.import_roles) can individually override this via the C(public) parameter.
# Included roles only make their variables public at execution, unlike imported roles which happen at playbook compile time.
;private_role_vars=False
# (integer) Port to use in remote connections, when blank it will use the connection plugin default.
;remote_port=
# (string) Sets the login user for the target machines
# When blank it uses the connection plugin's default, normally the user currently executing Ansible.
remote_user=wed
# (pathspec) Colon-separated paths in which Ansible will search for Roles.
;roles_path=/Users/rblundon/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles
# (string) Set the main callback used to display Ansible output. You can only have one at a time.
# You can have many other callbacks, but just one can be in charge of stdout.
# See :ref:`callback_plugins` for a list of available options.
;stdout_callback=default
# (string) Set the default strategy used for plays.
;strategy=linear
# (pathspec) Colon-separated paths in which Ansible will search for Strategy Plugins.
;strategy_plugins=/Users/rblundon/.ansible/plugins/strategy:/usr/share/ansible/plugins/strategy
# (boolean) Toggle the use of "su" for tasks.
;su=False
# (string) Syslog facility to use when Ansible logs to the remote target.
;syslog_facility=LOG_USER
# (pathspec) Colon-separated paths in which Ansible will search for Terminal Plugins.
;terminal_plugins=/Users/rblundon/.ansible/plugins/terminal:/usr/share/ansible/plugins/terminal
# (pathspec) Colon-separated paths in which Ansible will search for Jinja2 Test Plugins.
;test_plugins=/Users/rblundon/.ansible/plugins/test:/usr/share/ansible/plugins/test
# (integer) This is the default timeout for connection plugins to use.
;timeout=10
# (string) Can be any connection plugin available to your ansible installation.
# There is also a (DEPRECATED) special 'smart' option, that will toggle between 'ssh' and 'paramiko' depending on controller OS and ssh versions.
;transport=ssh
# (boolean) When True, this causes ansible templating to fail steps that reference variable names that are likely typoed.
# Otherwise, any '{{ template_expression }}' that contains undefined variables will be rendered in a template or ansible action line exactly as written.
;error_on_undefined_vars=True
# (pathspec) Colon-separated paths in which Ansible will search for Vars Plugins.
;vars_plugins=/Users/rblundon/.ansible/plugins/vars:/usr/share/ansible/plugins/vars
# (string) The vault_id to use for encrypting by default. If multiple vault_ids are provided, this specifies which to use for encryption. The ``--encrypt-vault-id`` CLI option overrides the configured value.
;vault_encrypt_identity=
# (string) The label to use for the default vault id label in cases where a vault id label is not provided.
;vault_identity=default
# (list) A list of vault-ids to use by default. Equivalent to multiple ``--vault-id`` args. Vault-ids are tried in order.
;vault_identity_list=
# (string) If true, decrypting vaults with a vault id will only try the password from the matching vault-id.
;vault_id_match=False
# (path) The vault password file to use. Equivalent to ``--vault-password-file`` or ``--vault-id``.
# If executable, it will be run and the resulting stdout will be used as the password.
;vault_password_file=
# (integer) Sets the default verbosity, equivalent to the number of ``-v`` passed in the command line.
;verbosity=0
# (boolean) Toggle to control the showing of deprecation warnings
;deprecation_warnings=True
# (boolean) Toggle to control showing warnings related to running devel.
;devel_warning=True
# (boolean) Normally ``ansible-playbook`` will print a header for each task that is run. These headers will contain the name: field from the task if you specified one. If you didn't then ``ansible-playbook`` uses the task's action to help you tell which task is presently running. Sometimes you run many of the same action and so you want more information about the task to differentiate it from others of the same action. If you set this variable to True in the config then ``ansible-playbook`` will also include the task's arguments in the header.
# This setting defaults to False because there is a chance that you have sensitive values in your parameters and you do not want those to be printed.
# If you set this to True you should be sure that you have secured your environment's stdout (no one can shoulder surf your screen and you aren't saving stdout to an insecure file) or made sure that all of your playbooks explicitly added the ``no_log: True`` parameter to tasks that have sensitive values :ref:`keep_secret_data` for more information.
;display_args_to_stdout=False
# (boolean) Toggle to control displaying skipped task/host entries in a task in the default callback.
;display_skipped_hosts=True
# (string) Root docsite URL used to generate docs URLs in warning/error text; must be an absolute URL with a valid scheme and trailing slash.
;docsite_root_url=https://docs.ansible.com/ansible-core/
# (pathspec) Colon-separated paths in which Ansible will search for Documentation Fragments Plugins.
;doc_fragment_plugins=/Users/rblundon/.ansible/plugins/doc_fragments:/usr/share/ansible/plugins/doc_fragments
# (string) By default, Ansible will issue a warning when a duplicate dict key is encountered in YAML.
# These warnings can be silenced by adjusting this setting to False.
;duplicate_dict_key=warn
# (string) for the cases in which Ansible needs to return a file within an editor, this chooses the application to use.
;editor=vi
# (boolean) Whether or not to enable the task debugger, this previously was done as a strategy plugin.
# Now all strategy plugins can inherit this behavior. The debugger defaults to activating when
# a task is failed on unreachable. Use the debugger keyword for more flexibility.
;enable_task_debugger=False
# (boolean) Toggle to allow missing handlers to become a warning instead of an error when notifying.
;error_on_missing_handler=True
# (list) Which modules to run during a play's fact gathering stage, using the default of 'smart' will try to figure it out based on connection type.
# If adding your own modules but you still want to use the default Ansible facts, you will want to include 'setup' or corresponding network module to the list (if you add 'smart', Ansible will also figure it out).
# This does not affect explicit calls to the 'setup' module, but does always affect the 'gather_facts' action (implicit or explicit).
;facts_modules=smart
# (boolean) Set this to "False" if you want to avoid host key checking by the underlying connection plugin Ansible uses to connect to the host.
# Please read the documentation of the specific connection plugin used for details.
;host_key_checking=True
# (boolean) Facts are available inside the `ansible_facts` variable, this setting also pushes them as their own vars in the main namespace.
# Unlike inside the `ansible_facts` dictionary where the prefix `ansible_` is removed from fact names, these will have the exact names that are returned by the module.
;inject_facts_as_vars=True
# (string) Path to the Python interpreter to be used for module execution on remote targets, or an automatic discovery mode. Supported discovery modes are ``auto`` (the default), ``auto_silent``, ``auto_legacy``, and ``auto_legacy_silent``. All discovery modes employ a lookup table to use the included system Python (on distributions known to include one), falling back to a fixed ordered list of well-known Python interpreter locations if a platform-specific default is not available. The fallback behavior will issue a warning that the interpreter should be set explicitly (since interpreters installed later may change which one is used). This warning behavior can be disabled by setting ``auto_silent`` or ``auto_legacy_silent``. The value of ``auto_legacy`` provides all the same behavior, but for backward-compatibility with older Ansible releases that always defaulted to ``/usr/bin/python``, will use that interpreter if present.
;interpreter_python=auto
# (boolean) If 'false', invalid attributes for a task will result in warnings instead of errors.
;invalid_task_attribute_failed=True
# (boolean) By default, Ansible will issue a warning when there are no hosts in the inventory.
# These warnings can be silenced by adjusting this setting to False.
;localhost_warning=True
# (int) This will set log verbosity if higher than the normal display verbosity, otherwise it will match that.
;log_verbosity=
# (int) Maximum size of files to be considered for diff display.
;max_diff_size=104448
# (list) List of extensions to ignore when looking for modules to load.
# This is for rejecting script and binary module fallback extensions.
;module_ignore_exts=.pyc, .pyo, .swp, .bak, ~, .rpm, .md, .txt, .rst, .yaml, .yml, .ini
# (bool) Enables whether module responses are evaluated for containing non-UTF-8 data.
# Disabling this may result in unexpected behavior.
# Only ansible-core should evaluate this configuration.
;module_strict_utf8_response=True
# (list) TODO: write it
;network_group_modules=eos, nxos, ios, iosxr, junos, enos, ce, vyos, sros, dellos9, dellos10, dellos6, asa, aruba, aireos, bigip, ironware, onyx, netconf, exos, voss, slxos
# (boolean) Previously Ansible would only clear some of the plugin loading caches when loading new roles, this led to some behaviors in which a plugin loaded in previous plays would be unexpectedly 'sticky'. This setting allows the user to return to that behavior.
;old_plugin_cache_clear=False
# (string) for the cases in which Ansible needs to return output in a pageable fashion, this chooses the application to use.
;pager=less
# (path) A number of non-playbook CLIs have a ``--playbook-dir`` argument; this sets the default value for it.
;playbook_dir=
# (string) This sets which playbook dirs will be used as a root to process vars plugins, which includes finding host_vars/group_vars.
;playbook_vars_root=top
# (path) A path to configuration for filtering which plugins installed on the system are allowed to be used.
# See :ref:`plugin_filtering_config` for details of the filter file's format.
# The default is /etc/ansible/plugin_filters.yml
;plugin_filters_cfg=
# (string) Attempts to set RLIMIT_NOFILE soft limit to the specified value when executing Python modules (can speed up subprocess usage on Python 2.x. See https://bugs.python.org/issue11284). The value will be limited by the existing hard limit. Default value of 0 does not attempt to adjust existing system-defined limits.
;python_module_rlimit_nofile=0
# (bool) This controls whether a failed Ansible playbook should create a .retry file.
;retry_files_enabled=False
# (path) This sets the path in which Ansible will save .retry files when a playbook fails and retry files are enabled.
# This file will be overwritten after each run with the list of failed hosts from all plays.
;retry_files_save_path=
# (str) This setting can be used to optimize vars_plugin usage depending on the user's inventory size and play selection.
;run_vars_plugins=demand
# (bool) This adds the custom stats set via the set_stats plugin to the default output.
;show_custom_stats=False
# (string) Action to take when a module parameter value is converted to a string (this does not affect variables). For string parameters, values such as '1.00', "['a', 'b',]", and 'yes', 'y', etc. will be converted by the YAML parser unless fully quoted.
# Valid options are 'error', 'warn', and 'ignore'.
# Since 2.8, this option defaults to 'warn' but will change to 'error' in 2.12.
;string_conversion_action=warn
# (boolean) Allows disabling of warnings related to potential issues on the system running Ansible itself (not on the managed hosts).
# These may include warnings about third-party packages or other conditions that should be resolved if possible.
;system_warnings=True
# (string) A string to insert into target logging for tracking purposes
;target_log_info=
# (boolean) This option defines whether the task debugger will be invoked on a failed task when ignore_errors=True is specified.
# True specifies that the debugger will honor ignore_errors, and False will not honor ignore_errors.
;task_debugger_ignore_errors=True
# (integer) Set the maximum time (in seconds) for a task action to execute in.
# Timeout runs independently from templating or looping. It applies per each attempt of executing the task's action and remains unchanged by the total time spent on a task.
# When the action execution exceeds the timeout, Ansible interrupts the process. This is registered as a failure due to outside circumstances, not a task failure, to receive appropriate response and recovery process.
# If set to 0 (the default) there is no timeout.
;task_timeout=0
# (string) Make ansible transform invalid characters in group names supplied by inventory sources.
;force_valid_group_names=never
# (boolean) Toggles the use of persistence for connections.
;use_persistent_connections=False
# (bool) A toggle to disable validating a collection's 'metadata' entry for a module_defaults action group. Metadata containing unexpected fields or value types will produce a warning when this is True.
;validate_action_group_metadata=True
# (list) Accept list for variable plugins that require it.
;vars_plugins_enabled=host_group_vars
# (list) Allows to change the group variable precedence merge order.
;precedence=all_inventory, groups_inventory, all_plugins_inventory, all_plugins_play, groups_plugins_inventory, groups_plugins_play
# (string) The salt to use for the vault encryption. If it is not provided, a random salt will be used.
;vault_encrypt_salt=
# (bool) Force 'verbose' option to use stderr instead of stdout
;verbose_to_stderr=False
# (integer) For asynchronous tasks in Ansible (covered in Asynchronous Actions and Polling), this is how long, in seconds, to wait for the task spawned by Ansible to connect back to the named pipe used on Windows systems. The default is 5 seconds. This can be too low on slower systems, or systems under heavy load.
# This is not the total time an async command can run for, but is a separate timeout to wait for an async command to start. The task will only start to be timed against its async_timeout once it has connected to the pipe, so the overall maximum duration the task can take will be extended by the amount specified here.
;win_async_startup_timeout=5
# (list) Check all of these extensions when looking for 'variable' files which should be YAML or JSON or vaulted versions of these.
# This affects vars_files, include_vars, inventory and vars plugins among others.
;yaml_valid_extensions=.yml, .yaml, .json
[privilege_escalation]
# (boolean) Display an agnostic become prompt instead of displaying a prompt containing the command line supplied become method.
;agnostic_become_prompt=True
# (boolean) When ``False``(default), Ansible will skip using become if the remote user is the same as the become user, as this is normally a redundant operation. In other words root sudo to root.
# If ``True``, this forces Ansible to use the become plugin anyways as there are cases in which this is needed.
;become_allow_same_user=False
# (boolean) Toggles the use of privilege escalation, allowing you to 'become' another user after login.
;become=False
# (boolean) Toggle to prompt for privilege escalation password.
;become_ask_pass=False
# (string) executable to use for privilege escalation, otherwise Ansible will depend on PATH.
;become_exe=
# (string) Flags to pass to the privilege escalation executable.
;become_flags=
# (string) Privilege escalation method to use when `become` is enabled.
;become_method=sudo
# (string) The user your login/remote user 'becomes' when using privilege escalation, most systems will use 'root' when no user is specified.
;become_user=root
[persistent_connection]
# (path) Specify where to look for the ansible-connection script. This location will be checked before searching $PATH.
# If null, ansible will start with the same directory as the ansible script.
;ansible_connection_path=
# (int) This controls the amount of time to wait for a response from a remote device before timing out a persistent connection.
;command_timeout=30
# (integer) This controls the retry timeout for persistent connection to connect to the local domain socket.
;connect_retry_timeout=15
# (integer) This controls how long the persistent connection will remain idle before it is destroyed.
;connect_timeout=30
# (path) Path to the socket to be used by the connection persistence system.
;control_path_dir=/Users/rblundon/.ansible/pc
[connection]
# (boolean) This is a global option, each connection plugin can override either by having more specific options or not supporting pipelining at all.
# Pipelining, if supported by the connection plugin, reduces the number of network operations required to execute a module on the remote server, by executing many Ansible modules without actual file transfer.
# It can result in a very significant performance improvement when enabled.
# However this conflicts with privilege escalation (become). For example, when using 'sudo:' operations you must first disable 'requiretty' in /etc/sudoers on all managed hosts, which is why it is disabled by default.
# This setting will be disabled if ``ANSIBLE_KEEP_REMOTE_FILES`` is enabled.
;pipelining=False
[colors]
# (string) Defines the color to use on 'Changed' task status.
;changed=yellow
# (string) Defines the default color to use for ansible-console.
;console_prompt=white
# (string) Defines the color to use when emitting debug messages.
;debug=dark gray
# (string) Defines the color to use when emitting deprecation messages.
;deprecate=purple
# (string) Defines the color to use when showing added lines in diffs.
;diff_add=green
# (string) Defines the color to use when showing diffs.
;diff_lines=cyan
# (string) Defines the color to use when showing removed lines in diffs.
;diff_remove=red
# (string) Defines the color to use when emitting a constant in the ansible-doc output.
;doc_constant=dark gray
# (string) Defines the color to use when emitting a deprecated value in the ansible-doc output.
;doc_deprecated=magenta
# (string) Defines the color to use when emitting a link in the ansible-doc output.
;doc_link=cyan
# (string) Defines the color to use when emitting a module name in the ansible-doc output.
;doc_module=yellow
# (string) Defines the color to use when emitting a plugin name in the ansible-doc output.
;doc_plugin=yellow
# (string) Defines the color to use when emitting cross-reference in the ansible-doc output.
;doc_reference=magenta
# (string) Defines the color to use when emitting error messages.
;error=red
# (string) Defines the color to use for highlighting.
;highlight=white
# (string) Defines the color to use when showing 'Included' task status.
;included=cyan
# (string) Defines the color to use when showing 'OK' task status.
;ok=green
# (string) Defines the color to use when showing 'Skipped' task status.
;skip=cyan
# (string) Defines the color to use on 'Unreachable' status.
;unreachable=bright red
# (string) Defines the color to use when emitting verbose messages. In other words, those that show with '-v's.
;verbose=blue
# (string) Defines the color to use when emitting warning messages.
;warn=bright purple
[selinux]
# (boolean) This setting causes libvirt to connect to LXC containers by passing ``--noseclabel`` parameter to ``virsh`` command. This is necessary when running on systems which do not have SELinux.
;libvirt_lxc_noseclabel=False
# (list) Some filesystems do not support safe operations and/or return inconsistent errors, this setting makes Ansible 'tolerate' those in the list without causing fatal errors.
# Data corruption may occur and writes are not always verified when a filesystem is in the list.
;special_context_filesystems=fuse, nfs, vboxsf, ramfs, 9p, vfat
[diff]
# (bool) Configuration toggle to tell modules to show differences when in 'changed' status, equivalent to ``--diff``.
;always=False
# (integer) Number of lines of context to show when displaying the differences between files.
;context=3
[galaxy]
# (path) The directory that stores cached responses from a Galaxy server.
# This is only used by the ``ansible-galaxy collection install`` and ``download`` commands.
# Cache files inside this dir will be ignored if they are world writable.
;cache_dir=/Users/rblundon/.ansible/galaxy_cache
# (bool) whether ``ansible-galaxy collection install`` should warn about ``--collections-path`` missing from configured :ref:`collections_paths`.
;collections_path_warning=True
# (path) Collection skeleton directory to use as a template for the ``init`` action in ``ansible-galaxy collection``, same as ``--collection-skeleton``.
;collection_skeleton=
# (list) patterns of files to ignore inside a Galaxy collection skeleton directory.
;collection_skeleton_ignore=^.git$, ^.*/.git_keep$
# (bool) Disable GPG signature verification during collection installation.
;disable_gpg_verify=False
# (bool) Some steps in ``ansible-galaxy`` display a progress wheel which can cause issues on certain displays or when outputting the stdout to a file.
# This config option controls whether the display wheel is shown or not.
# The default is to show the display wheel if stdout has a tty.
;display_progress=
# (path) Configure the keyring used for GPG signature verification during collection installation and verification.
;gpg_keyring=
# (boolean) If set to yes, ansible-galaxy will not validate TLS certificates. This can be useful for testing against a server with a self-signed certificate.
;ignore_certs=
# (list) A list of GPG status codes to ignore during GPG signature verification. See L(https://github.com/gpg/gnupg/blob/master/doc/DETAILS#general-status-codes) for status code descriptions.
# If fewer signatures successfully verify the collection than `GALAXY_REQUIRED_VALID_SIGNATURE_COUNT`, signature verification will fail even if all error codes are ignored.
;ignore_signature_status_codes=
# (str) The number of signatures that must be successful during GPG signature verification while installing or verifying collections.
# This should be a positive integer or all to indicate all signatures must successfully validate the collection.
# Prepend + to the value to fail if no valid signatures are found for the collection.
;required_valid_signature_count=1
# (path) Role skeleton directory to use as a template for the ``init`` action in ``ansible-galaxy``/``ansible-galaxy role``, same as ``--role-skeleton``.
;role_skeleton=
# (list) patterns of files to ignore inside a Galaxy role or collection skeleton directory.
;role_skeleton_ignore=^.git$, ^.*/.git_keep$
# (string) URL to prepend when roles don't specify the full URI, assume they are referencing this server as the source.
;server=https://galaxy.ansible.com
# (list) A list of Galaxy servers to use when installing a collection.
# The value corresponds to the config ini header ``[galaxy_server.{{item}}]`` which defines the server details.
# See :ref:`galaxy_server_config` for more details on how to define a Galaxy server.
# The order of servers in this list is used as the order in which a collection is resolved.
# Setting this config option will ignore the :ref:`galaxy_server` config option.
;server_list=
# (int) The default timeout for Galaxy API calls. Galaxy servers that don't configure a specific timeout will fall back to this value.
;server_timeout=60
# (path) Local path to galaxy access token file
;token_path=/Users/rblundon/.ansible/galaxy_token
[inventory]
# (string) This setting changes the behaviour of mismatched host patterns, it allows you to force a fatal error, a warning or just ignore it.
;host_pattern_mismatch=warning
# (boolean) If 'true', it is a fatal error when any given inventory source cannot be successfully parsed by any available inventory plugin; otherwise, this situation only attracts a warning.
;any_unparsed_is_failed=False
# (bool) Toggle to turn on inventory caching.
# This setting has been moved to the individual inventory plugins as a plugin option :ref:`inventory_plugins`.
# The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory configuration.
# This message will be removed in 2.16.
;cache=False
# (string) The plugin for caching inventory.
# This setting has been moved to the individual inventory plugins as a plugin option :ref:`inventory_plugins`.
# The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory and fact cache configuration.
# This message will be removed in 2.16.
;cache_plugin=
# (string) The inventory cache connection.
# This setting has been moved to the individual inventory plugins as a plugin option :ref:`inventory_plugins`.
# The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory and fact cache configuration.
# This message will be removed in 2.16.
;cache_connection=
# (string) The table prefix for the cache plugin.
# This setting has been moved to the individual inventory plugins as a plugin option :ref:`inventory_plugins`.
# The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory and fact cache configuration.
# This message will be removed in 2.16.
;cache_prefix=ansible_inventory_
# (string) Expiration timeout for the inventory cache plugin data.
# This setting has been moved to the individual inventory plugins as a plugin option :ref:`inventory_plugins`.
# The existing configuration settings are still accepted with the inventory plugin adding additional options from inventory and fact cache configuration.
# This message will be removed in 2.16.
;cache_timeout=3600
# (list) List of enabled inventory plugins, it also determines the order in which they are used.
;enable_plugins=host_list, script, auto, yaml, ini, toml
# (bool) Controls if ansible-inventory will accurately reflect Ansible's view into inventory or its optimized for exporting.
;export=False
# (list) List of extensions to ignore when using a directory as an inventory source.
;ignore_extensions=.pyc, .pyo, .swp, .bak, ~, .rpm, .md, .txt, .rst, .orig, .ini, .cfg, .retry
# (list) List of patterns to ignore when using a directory as an inventory source.
;ignore_patterns=
# (bool) If 'true' it is a fatal error if every single potential inventory source fails to parse, otherwise, this situation will only attract a warning.
;unparsed_is_failed=False
# (boolean) By default, Ansible will issue a warning when no inventory was loaded and notes that it will use an implicit localhost-only inventory.
# These warnings can be silenced by adjusting this setting to False.
;inventory_unparsed_warning=True
[netconf_connection]
# (string) This variable is used to enable bastion/jump host with netconf connection. If set to True the bastion/jump host ssh settings should be present in ~/.ssh/config file, alternatively it can be set to custom ssh configuration file path to read the bastion/jump host settings.
;ssh_config=
[paramiko_connection]
# (boolean) TODO: write it
;host_key_auto_add=False
# (boolean) TODO: write it
;look_for_keys=True
[jinja2]
# (list) This list of filters avoids 'type conversion' when templating variables.
# Useful when you want to avoid conversion into lists or dictionaries for JSON strings, for example.
;dont_type_filters=string, to_json, to_nice_json, to_yaml, to_nice_yaml, ppretty, json
[tags]
# (list) default list of tags to run in your plays, Skip Tags has precedence.
;run=
# (list) default list of tags to skip in your plays, has precedence over Run Tags
;skip=

18
.gitignore vendored
View File

@@ -29,4 +29,20 @@ Temporary Items
.vscode/
# macOS metadata
*.icloud
*.icloud
# Terraform
.terraform/
*.tfstate
*.tfstate.backup
# Crash log files
crash.log
# Ignore override files as they are usually used to override resources locally
*.override.tf
*.override.tf.json
# Ignore CLI configuration files
.terraformrc
.terraformrc.json

43
00-core-infra/ansible/README.md Normal file
View File

@@ -0,0 +1,43 @@
# README
inventory # inventory file for all servers
group_vars/
group1.yml # here we assign variables to particular groups
group2.yml
host_vars/
hostname1.yml # here we assign variables to particular systems
hostname2.yml
library/ # if any custom modules, put them here (optional)
module_utils/ # if any custom module_utils to support modules, put them here (optional)
filter_plugins/ # if any custom filter plugins, put them here (optional)
site.yml # master playbook
webservers.yml # playbook for webserver tier
dbservers.yml # playbook for dbserver tier
roles/
common/ # this hierarchy represents a "role"
tasks/ #
main.yml # <-- tasks file can include smaller files if warranted
handlers/ #
main.yml # <-- handlers file
templates/ # <-- files for use with the template resource
ntp.conf.j2 # <------- templates end in .j2
files/ #
bar.txt # <-- files for use with the copy resource
foo.sh # <-- script files for use with the script resource
vars/ #
main.yml # <-- variables associated with this role
defaults/ #
main.yml # <-- default lower priority variables for this role
meta/ #
main.yml # <-- role dependencies
library/ # roles can also include custom modules
module_utils/ # roles can also include custom module_utils
lookup_plugins/ # or other types of plugins, like lookup in this case
webtier/ # same kind of structure as "common" was above, done for the webtier role
monitoring/ # ""
fooapp/ # ""

13
00-core-infra/ansible/ansible-ssh-key.yml Normal file
View File

@@ -0,0 +1,13 @@
- name: "Add SSH key to servers for Ansible"
hosts: ipaserver
vars_files:
- ansible-vault.yml
roles:
- role: rywillia.ssh-copy-id
vars:
hostname: "{{ ansible_hostname }}"
username: "{{ vault_ansible_user }}"
password: "{{ vault_ansible_password }}"
ssh_public_key: "/Users/rblundon/git/MK-Labs/ansible/files/ansible"

8
00-core-infra/ansible/ansible-vault.yml Normal file
View File

@@ -0,0 +1,8 @@
$ANSIBLE_VAULT;1.1;AES256
37663530616632333938363737366639623261366264616231396533366432303034376365643633
3632383464666637343765366439333964646637643936380a326335353639326362366263373466
63646562353737636333653333373765363331323065386137626161633333643034323962316630
6263373464613033360a376633663236333464393866373733643839336165363761373931623761
37646139633036646435323361326366326134656630656366366434363335353165356431613731
39653364653465613066323164663261363461316662623433663637333330306663633864303862
643261393832643433326332366166383239

19
00-core-infra/ansible/ansible.cfg Normal file
View File

@@ -0,0 +1,19 @@
[defaults]
# Chick-Fil-A would like a word...
nocows = True
# Installs collections into [current dir]/ansible_collections/namespace/collection_name
collections_paths = ./collections:~/.ansible/collections
# Installs roles into [current dir]/roles/namespace.rolename
roles_path = ./roles
inventory = ./inventory
# default user to use for playbooks if user is not specified
# (/usr/bin/ansible will use current user as default)
remote_user = wed
private_key_file = ~/.ssh/ansible
allow_world_readable_tmpfiles = True

5
00-core-infra/ansible/collections/requirements.yml Normal file
View File

@@ -0,0 +1,5 @@
---
roles: []
collections: []
# - name: community.docker

23
00-core-infra/ansible/debub.yml Normal file
View File

@@ -0,0 +1,23 @@
- name: "Playbook to test the inventory_hostname and ansible_hostname"
hosts: ipaserver
# gather_facts: true
tasks:
- name: "What is my inventory_hostname"
ansible.builtin.debug:
var: inventory_hostname
- name: "What is my hostname"
ansible.builtin.debug:
var: hostname
- name: "What is my ansible_hostname"
ansible.builtin.debug:
var: ansible_hostname
- name: "What is my ansible_host"
ansible.builtin.debug:
var: ansible_host
# - name: "Ansible | List all known variables and facts"
# ansible.builtin.debug:
# var: hostvars[inventory_hostname]

14
00-core-infra/ansible/group_vars/ipaserver/main.yml Normal file
View File

@@ -0,0 +1,14 @@
---
ipaadmin_password: "{{ vault_ipaadmin_password }}"
ipadm_password: "{{ vault_ipadm_password }}"
ipaserver_domain: int.mk-labs.cloud
ipaserver_realm: INT.MK-LABS.CLOUD
ipaserver_setup_firewalld: true
ipaserver_setup_dns: true
ipaserver_forwarders: 1.1.1.1,1.0.0.1
ipaserver_random_serial_numbers: true
#dns_ip_addresses: "{{ ansible_hostname }}"
#dns_reverse_zones:
#domain: int.mk-labs.cloud
forwarders: 1.1.1.1,1.0.0.1
#hostname: "{{ hostname }}"

5
00-core-infra/ansible/group_vars/unbound_servers/main.yml Normal file
View File

@@ -0,0 +1,5 @@
---
unbound_do_ip6: "no"
#unbound_forward_zones:
unbound_chroot: "/etc/unbound"
#unbound_pidfile: "/etc/unbound/unbound.pid"

2
00-core-infra/ansible/host_vars/infra01/vars/main.yml Normal file
View File

@@ -0,0 +1,2 @@
---
hostname: infra01.int.mk-labs.cloud

6
00-core-infra/ansible/host_vars/infra01/vault/main.yml Normal file
View File

@@ -0,0 +1,6 @@
$ANSIBLE_VAULT;1.1;AES256
36383531343863313331636462653666393131633533346433343237653433633938343737363531
3330616336336635313037356130373231643531613237340a613663303764333837333438343433
38373264316533613763373634343735323764316364376138613934323339653735303562636631
6166393933356663660a393036653937386239396331653037376564663232666561306631306331
6362

9
00-core-infra/ansible/host_vars/infra01/vault/vault.yml Normal file
View File

@@ -0,0 +1,9 @@
$ANSIBLE_VAULT;1.1;AES256
36393261393537313432333136623438383339303162636464353239386433316134613537336263
6462326336363562613431653435353032383064303166340a333761633530643265336465663634
65633864653830653738333563326162326430666237303362336537306238356231393761376539
3335336333316231620a633562633731396464393366323762323365383664326430323038646566
34643339303863303734623038393336313264636439636663616462613465303232643337653539
39386231373231306639343561613665626634383932393836616239643662376237353965316162
64623934616533386664333732343230626130343630393235303863366536363033323335323337
61356536323131383438

2
00-core-infra/ansible/host_vars/unbound/vars/main.yml Normal file
View File

@@ -0,0 +1,2 @@
---
hostname: unbound.int.mk-labs.cloud

2
00-core-infra/ansible/host_vars/unbound01.yml Normal file
View File

@@ -0,0 +1,2 @@
---
hostname: unbound01.int.mk-labs.cloud

2
00-core-infra/ansible/host_vars/unbound02.yml Normal file
View File

@@ -0,0 +1,2 @@
---
hostname: unbound02.int.mk-labs.cloud

10
00-core-infra/ansible/idm-servers.yml Normal file
View File

@@ -0,0 +1,10 @@
---
- name: Playbook to configure IPA server
hosts: ipaserver
become: true
vars_files:
- idm-vault.yml
roles:
- role: freeipa.ansible_freeipa.ipaserver
state: present

9
00-core-infra/ansible/idm-vault.yml Normal file
View File

@@ -0,0 +1,9 @@
$ANSIBLE_VAULT;1.1;AES256
62613936343461366134333738386435646236386662663434373563663433393437383961336634
6234303634383134623162396130623562353332313463620a373364393561633038383662643561
37636232366532623364306638373064623433626364383639353137653139353764343466386463
3237373565653262630a383633353438303934643064623464313639623963386661393562333738
39316136633733386166663433633434653636333239323236306161653864353666653137653935
34636236353635336631313432386362616462383763346162363466323432333064633336646439
38656362306337393065366362653864363438313934333235616338653934626535363266633039
38626466343338313239

32
00-core-infra/ansible/inventory Normal file
View File

@@ -0,0 +1,32 @@
---
proxmox:
hosts:
pve01:
ansible_host: 10.10.21.51
pve02:
ansible_host: 10.10.21.52
pve03:
ansible_host: 10.10.21.53
unbound_servers:
hosts:
unbound:
ansible_host: 10.1.71.254
unbound01:
ansible_host: 10.1.71.254
unbound02:
ansible_host: 10.1.71.253
ipaserver:
hosts:
infra01:
ansible_host: 10.1.71.5
ipareplicas:
hosts:
# infra02.int.mk-labs.cloud:
# ansible_host: 10.1.71.6
#infra:
# hosts:
# awx.int.mk-labs.cloud:

0
00-core-infra/ansible/lightspeed.yml Normal file
View File

1
00-core-infra/ansible/roles/common/files/ansible.pub Normal file
View File

@@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnSM/9fO8rz/amqkyoGUzUKNNzzmtSXPwOCr1O9zKNO ansible

4
00-core-infra/ansible/roles/unbound/files/resolved_unbound.conf Normal file
View File

@@ -0,0 +1,4 @@
[Resolve]
DNS=127.0.0.1
DNSSEC=yes
DNSStubListener=no

236
00-core-infra/ansible/roles/unbound/files/unbound.conf Normal file
View File

@@ -0,0 +1,236 @@
## Authoritative, validating, recursive caching DNS
## unbound.conf -- https://calomel.org
#
server:
# log verbosity
verbosity: 1
chroot: ""
# specify the interfaces to answer queries from by ip-address. The default
# is to listen to localhost (127.0.0.1 and ::1). specify 0.0.0.0 and ::0 to
# bind to all available interfaces. specify every interface[@port] on a new
# 'interface:' labeled line. The listen interfaces are not changed on
# reload, only on restart.
interface: 0.0.0.0
# port to answer queries from
port: 53
# Enable IPv4, "yes" or "no".
do-ip4: yes
# Enable IPv6, "yes" or "no".
do-ip6: no
# Enable UDP, "yes" or "no".
do-udp: yes
# Enable TCP, "yes" or "no". If TCP is not needed, Unbound is actually
# quicker to resolve as the functions related to TCP checks are not done.i
# NOTE: you may need tcp enabled to get the DNSSEC results from *.edu domains
# due to their size.
do-tcp: yes
# control which client ips are allowed to make (recursive) queries to this
# server. Specify classless netblocks with /size and action. By default
# everything is refused, except for localhost. Choose deny (drop message),
# refuse (polite error reply), allow (recursive ok), allow_snoop (recursive
# and nonrecursive ok)
access-control: 192.168.1.0/24 allow
access-control: 192.168.3.0/24 allow
access-control: 192.168.10.0/24 allow
access-control: 10.1.71.0/24 allow
# Read the root hints from this file. Default is nothing, using built in
# hints for the IN class. The file has the format of zone files, with root
# nameserver names and addresses only. The default may become outdated,
# when servers change, therefore it is good practice to use a root-hints
# file. get one from https://www.internic.net/domain/named.root
root-hints: "/etc/unbound/root.hints"
# enable to not answer id.server and hostname.bind queries.
hide-identity: yes
# enable to not answer version.server and version.bind queries.
hide-version: yes
# Will trust glue only if it is within the servers authority.
# Harden against out of zone rrsets, to avoid spoofing attempts.
# Hardening queries multiple name servers for the same data to make
# spoofing significantly harder and does not mandate dnssec.
harden-glue: yes
# Require DNSSEC data for trust-anchored zones, if such data is absent, the
# zone becomes bogus. Harden against receiving dnssec-stripped data. If you
# turn it off, failing to validate dnskey data for a trustanchor will trigger
# insecure mode for that zone (like without a trustanchor). Default on,
# which insists on dnssec data for trust-anchored zones.
harden-dnssec-stripped: yes
# Use 0x20-encoded random bits in the query to foil spoof attempts.
# http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00
# While upper and lower case letters are allowed in domain names, no significance
# is attached to the case. That is, two names with the same spelling but
# different case are to be treated as if identical. This means calomel.org is the
# same as CaLoMeL.Org which is the same as CALOMEL.ORG.
use-caps-for-id: yes
# the time to live (TTL) value lower bound, in seconds. Default 0.
# If more than an hour could easily give trouble due to stale data.
cache-min-ttl: 3600
# the time to live (TTL) value cap for RRsets and messages in the
# cache. Items are not cached for longer. In seconds.
cache-max-ttl: 86400
# perform prefetching of close to expired message cache entries. If a client
# requests the dns lookup and the TTL of the cached hostname is going to
# expire in less than 10% of its TTL, unbound will (1st) return the ip of the
# host to the client and (2nd) pre-fetch the dns request from the remote dns
# server. This method has been shown to increase the amount of cached hits by
# local clients by 10% on average.
prefetch: yes
# number of threads to create. 1 disables threading. This should equal the number
# of CPU cores in the machine. Our example machine has 4 CPU cores.
num-threads: 2
## Unbound Optimization and Speed Tweaks ###
# the number of slabs to use for cache and must be a power of 2 times the
# number of num-threads set above. more slabs reduce lock contention, but
# fragment memory usage.
msg-cache-slabs: 8
rrset-cache-slabs: 8
infra-cache-slabs: 8
key-cache-slabs: 8
# Increase the memory size of the cache. Use roughly twice as much rrset cache
# memory as you use msg cache memory. Due to malloc overhead, the total memory
# usage is likely to rise to double (or 2.5x) the total cache memory. The test
# box has 4gig of ram so 256meg for rrset allows a lot of room for cacheed objects.
rrset-cache-size: 256m
msg-cache-size: 128m
# buffer size for UDP port 53 incoming (SO_RCVBUF socket option). This sets
# the kernel buffer larger so that no messages are lost in spikes in the traffic.
so-rcvbuf: 1m
## Unbound Optimization and Speed Tweaks ###
# Enforce privacy of these addresses. Strips them away from answers. It may
# cause DNSSEC validation to additionally mark it as bogus. Protects against
# 'DNS Rebinding' (uses browser as network proxy). Only 'private-domain' and
# 'local-data' names are allowed to have these private addresses. No default.
private-address: 192.168.1.0/24
private-address: 192.168.3.0/24
private-address: 192.168.10.0/24
private-address: 10.1.71.0/24
# Allow the domain (and its subdomains) to contain private addresses.
# local-data statements are allowed to contain private addresses too.
private-domain: "mk-labs.cloud"
# If nonzero, unwanted replies are not only reported in statistics, but also
# a running total is kept per thread. If it reaches the threshold, a warning
# is printed and a defensive action is taken, the cache is cleared to flush
# potential poison out of it. A suggested value is 10000000, the default is
# 0 (turned off). We think 10K is a good value.
unwanted-reply-threshold: 10000
# IMPORTANT FOR TESTING: If you are testing and setup NSD or BIND on
# localhost you will want to allow the resolver to send queries to localhost.
# Make sure to set do-not-query-localhost: yes . If yes, the above default
# do-not-query-address entries are present. if no, localhost can be queried
# (for testing and debugging).
do-not-query-localhost: no
# File with trusted keys, kept up to date using RFC5011 probes, initial file
# like trust-anchor-file, then it stores metadata. Use several entries, one
# per domain name, to track multiple zones. If you use forward-zone below to
# query the Google DNS servers you MUST comment out this option or all DNS
# queries will fail.
#auto-trust-anchor-file: "/etc/unbound/root.key"
# Should additional section of secure message also be kept clean of unsecure
# data. Useful to shield the users of this validator from potential bogus
# data in the additional section. All unsigned data in the additional section
# is removed from secure messages.
val-clean-additional: yes
# Blocking Ad Server domains. Google's AdSense, DoubleClick and Yahoo
# account for a 70 percent share of all advertising traffic. Block them.
# local-zone: "doubleclick.net" redirect
# local-data: "doubleclick.net A 127.0.0.1"
# local-zone: "googlesyndication.com" redirect
# local-data: "googlesyndication.com A 127.0.0.1"
# local-zone: "googleadservices.com" redirect
# local-data: "googleadservices.com A 127.0.0.1"
# local-zone: "google-analytics.com" redirect
# local-data: "google-analytics.com A 127.0.0.1"
# local-zone: "ads.youtube.com" redirect
# local-data: "ads.youtube.com A 127.0.0.1"
# local-zone: "adserver.yahoo.com" redirect
# local-data: "adserver.yahoo.com A 127.0.0.1"
# local-zone: "ask.com" redirect
# local-data: "ask.com A 127.0.0.1"
# Unbound will not load if you specify the same local-zone and local-data
# servers in the main configuration as well as in this "include:" file. We
# suggest commenting out any of the local-zone and local-data lines above if
# you suspect they could be included in the unbound_ad_servers servers file.
#include: "/etc/unbound/unbound_ad_servers"
# locally served zones can be configured for the machines on the LAN.
# local-zone: "home.lan." static
# local-data: "firewall.home.lan. IN A 10.0.0.1"
# local-data-ptr: "10.0.0.1 firewall.home.lan"
# Unbound can query your NSD or BIND server for private domain queries too.
# On our NSD page we have NSD configured to serve the private domain,
# "home.lan". Here we can tell Unbound to connect to the NSD server when it
# needs to resolve a *.home.lan hostname or IP.
#
# private-domain: "home.lan"
# local-zone: "0.0.10.in-addr.arpa." nodefault
# stub-zone:
# name: "home.lan"
# stub-addr: 10.0.0.111@53
# If you have an internal or private DNS names the external DNS servers can
# not resolve, then you can assign domain name strings to be redirected to a
# seperate dns server. For example, our comapny has the domain
# organization.com and the domain name internal.organization.com can not be
# resolved by Google's public DNS, but can be resolved by our private DNS
# server located at 1.1.1.1. The following tells Unbound that any
# organization.com domain, i.e. *.organization.com be dns resolved by 1.1.1.1
# instead of the public dns servers.
#
forward-zone:
name: "int.mk-labs.cloud"
forward-addr: 10.1.71.5 # Internal or private DNS
# Use the following forward-zone to forward all queries to Google DNS,
# OpenDNS.com or your local ISP's dns servers for example. To test resolution
# speeds use "drill calomel.org @8.8.8.8" and look for the "Query time:" in
# milliseconds.
#
forward-zone:
name: "."
forward-addr: 1.0.0.1@53#one.one.one.one
forward-addr: 1.1.1.1@53#one.one.one.one
# forward-addr: 8.8.8.8@53#dns.google
# forward-addr: 9.9.9.9@53#dns.quad9.net
# forward-addr: 1.0.0.1@53#one.one.one.one
# forward-addr: 8.8.4.4@53#dns.google
# forward-addr: 149.112.112.112@53#dns.quad9.net
#
#
## Authoritative, validating, recursive caching DNS
## unbound.conf -- https://calomel.org

15
00-core-infra/ansible/set_hostname.yml Normal file
View File

@@ -0,0 +1,15 @@
---
- name: Set hostname
hosts: ipa_server
become: true
gather_facts: true
tasks:
- name: Set hostname
ansible.builtin.hostname:
name: "{{ hostname }}"
register: result
- name: Print result
ansible.builtin.debug:
var: result

14
00-core-infra/ansible/set_sudoers.yml Normal file
View File

@@ -0,0 +1,14 @@
---
- name: Update sudoers for passwordless
hosts: unbound_servers
become: true
gather_facts: true
tasks:
- name: Update sudoers for passwordless
ansible.builtin.lineinfile:
path: /etc/sudoers
state: present
regexp: '^%wheel'
line: '%wheel ALL=(ALL) NOPASSWD:ALL'
validate: 'visudo -cf %s'

4
00-core-infra/ansible/site.yml Normal file
View File

@@ -0,0 +1,4 @@
---
# file: site.yml
#- import_playbook: webservers.yml
#- import_playbook: dbservers.yml

8
00-core-infra/ansible/uninstall-ipa.yml Normal file
View File

@@ -0,0 +1,8 @@
---
- name: Playbook to unconfigure IPA servers
hosts: ipaserver
become: true
roles:
- role: freeipa.ansible_freeipa.ipaserver
state: absent

10
00-core-infra/ansible/vault/mk-labs.vault Normal file
View File

@@ -0,0 +1,10 @@
$ANSIBLE_VAULT;1.1;AES256
66323366323966373436343163303131323239343134323434373762383539663539363464393234
3762666265303430373832333865613538316261386162640a653562666130323138313533616334
37623336653332353830306534633165626634376636396166356235353937323965616161323437
3536643537623931380a633730366330396538373836326439306566666663633932393230323563
30643032646366393530663138376638386538336466633532303563636163303637303933646465
37316239393136383638636436646230643338616438646564396238376136653639393865363666
39346337356133313938303938643866346636663737323238333762386234373563633761333166
36373063643438303930313366653436363731656163376666323330633763373361393663633631
39353232346634633836623134383861656337663062393232373932353431323730

0
docs/networks.md → 00-network/README.md
View File

0
01-storage/README.md Normal file
View File

10
docs/proxmox.md → 02-proxmox/README.md
View File

@@ -6,11 +6,11 @@ The proxmox cluster will be installed via ISO Image and manually configured. (Fu
## Primary Networking
| Hostname | VLAN | IP Address | NIC | Notes |
|-------------|------|------------------|-----------------|--------------------------|
| pve01 | 71 | 10.1.71.51 | On-board 1 GbE | VLAN set on switch port |
| pve02 | 71 | 10.1.71.52 | On-board 1 GbE | VLAN set on switch port |
| pve03 | 71 | 10.1.71.53 | On-board 1 GbE | VLAN set on switch port |
| Hostname | VLAN | IP Address | NIC | Notes |
|-------------|------|------------------|-----------------|----------------------------|
| pve01 | | 10.1.71.51 | On-board 1 GbE | VLAN 71 set on switch port |
| pve02 | | 10.1.71.52 | On-board 1 GbE | VLAN 71 set on switch port |
| pve03 | | 10.1.71.53 | On-board 1 GbE | VLAN 71 set on switch port |
## Additional Networking

0
03-infra01-server/03-unbound-dns/README.md Normal file
View File

0
03-infra01-server/04-free-ipa/README.md Normal file
View File

0
03-infra01-server/05-templates/README.md Normal file
View File

0
03-infra01-server/06-matchbox/README.md Normal file
View File

30
03-infra01-server/install.yml Normal file
View File

@@ -0,0 +1,30 @@
---
- name: Install all software on infra01
hosts: infra01
gather_facts: true
collections:
- somaz94.ansible_k8s_iac_tool
tasks:
# - Update all packages
# - Install ansible-core
# - Copy .vault_pass.txt from laptop and set env variable
# - Clone git repo
# - Install ansible required packages
- name: Install ansible-core
ansible.builtin.package:
name: ansible-core
state: present
become: true
# - name: Clone Git repository
# ansible.builtin.git:
# repo: "https://github.com/rblundon/homelab.git"
# dest: ~
# version: deploy-hub-cluster #main
# become: true
roles:
- install_kustomize

13
10-sno-hub-cluster/01-dhcp/host-reservations.yml Normal file
View File

@@ -0,0 +1,13 @@
---
- name: Dnsmasq
hosts: localhost
become: yes
vars:
- additional_dhcp_hosts:
ethernet_switch:
desc: "SNO Hub Cluster"
mac: 98:b7:85:1e:c6:f1
ip: 10.1.71.10
roles:
- role: ricsanfre.dnsmasq

24
10-sno-hub-cluster/01-dns/.terraform.lock.hcl generated Normal file
View File

@@ -0,0 +1,24 @@
# This file is maintained automatically by "terraform init".
# Manual edits may be lost in future updates.
provider "registry.terraform.io/rework-space-com/freeipa" {
version = "5.0.0"
constraints = "5.0.0"
hashes = [
"h1:6EquDv6GgQO2HjZUUoRIUVzYa951n+wb4Uk7ggD6XD0=",
"zh:098607e559c3b696401034ff494ba8068962b45059ee067a54b58334b6ee0f2c",
"zh:18b806a14bb9d9382213c6929af35f5a65f16c17ff526d475f1eab33d1470290",
"zh:2c8c74668844d256b7fdc503cd736a20b7e58db5b31880d1ad8090c1af04e24c",
"zh:3bba458b9a6df99c21da58750dd6586b93bdcc557e4a2d695e801ada39e8de1e",
"zh:58f728d9e98cc7aae3841c07318be64b6dcb2f51c041f04bba977e61104a2333",
"zh:597dfbefbfe111a31e9ff3c4fc14fc8e12c1e255454087d3eebd2ec6c7aa9bf3",
"zh:6093d6db13d834c23f5482efae80c8e1ae046028fccf24242f0f1c1935e6aa70",
"zh:87271fa234a57ce05d4166e444002bd66976f971b434f7add45c874c9587129d",
"zh:89f7f6be64b6bf9e708fbafd22f410cf3f50b1fcd4cd6c61e9ffffd6180ea839",
"zh:9bdd7a984f845ff6f4bc4df5cc41a9de019639fceca62e60fc7c0f098ad2695c",
"zh:a0551311c96b86050d15854b4fca2beaa06b2e1964f97945824567d0b90db580",
"zh:c3daa12021725883bd32d7d852a2de845bb7a5f18009a45be7c2c2d891631713",
"zh:d7871eb99683934a30b9d47508379e6d16978f3dcd73601af2204652668592aa",
"zh:e8f72fd7750e6c1f0f97d039fea66cb85f457cf22908b7c3f14c7d2cf990ee84",
]
}

3
10-sno-hub-cluster/01-dns/README.md Normal file
View File

@@ -0,0 +1,3 @@
# DNS Provider Configuration
This directory contains the configuration to updateFreeIPA DNS for the Hub Cluster.

39
10-sno-hub-cluster/01-dns/dns.tf Normal file
View File

@@ -0,0 +1,39 @@
resource "freeipa_dns_record" "ocp-hub" {
zone_name = "int.mk-labs.cloud."
name = "ocp-hub"
type = "A"
records = [
"10.1.71.10",
]
ttl = 60
}
resource "freeipa_dns_record" "api" {
zone_name = "int.mk-labs.cloud."
name = "api.hub"
type = "A"
records = [
"10.1.71.10",
]
ttl = 60
}
resource "freeipa_dns_record" "api-int" {
zone_name = "int.mk-labs.cloud."
name = "api-int.hub"
type = "A"
records = [
"10.1.71.10",
]
ttl = 60
}
resource "freeipa_dns_record" "wildcard-apps" {
zone_name = "int.mk-labs.cloud."
name = "*.apps.hub"
type = "A"
records = [
"10.1.71.10",
]
ttl = 60
}

22
10-sno-hub-cluster/01-dns/provider.tf Normal file
View File

@@ -0,0 +1,22 @@
# Configure the DNS Provider
provider "freeipa" {
host = "infra01.int.mk-labs.cloud"
username = "admin"
password = var.freeipa_password
insecure = true
}
variable "freeipa_password" {
description = "The password for the FreeIPA provider"
type = string
sensitive = true
}
terraform {
required_providers {
freeipa = {
source = "rework-space-com/freeipa"
version = "5.0.0"
}
}
}

1
10-sno-hub-cluster/02-dhcp/README.md Normal file
View File

@@ -0,0 +1 @@
# Add/modify entry in DNSmasq

28
10-sno-hub-cluster/02-dhcp/ip-reservations.yml Normal file
View File

@@ -0,0 +1,28 @@
---
- name: Ensure dnsmasq is installed
ansible.builtin.apt:
name: dnsmasq
state: present
become: true
when: ansible_os_family == "Debian"
- name: Ensure dnsmasq is installed
ansible.builtin.dnf:
name: dnsmasq
state: present
become: true
when: ansible_os_family == "RedHat"
- name: Add host reservation to dnsmasq
ansible.builtin.lineinfile:
path: /etc/dnsmasq.d/hosts.conf
regexp: "^dhcp-host={{ hostvars['ocp-hub'].mac_address }}"
line: "dhcp-host={{ hostvars['ocp-hub'].mac_address }},{{ hostvars['ocp-hub'].ip_address }} #{{ hostvars['ocp-hub'].hostname }}"
state: present
become: true
- name: Restart dnsmasq service
ansible.builtin.service:
name: dnsmasq
state: restarted
become: true

7
10-sno-hub-cluster/03-openshift-image/README.md Normal file
View File

@@ -0,0 +1,7 @@
# Configure the OpenShift Agent Installer and Matchbox
## Reference Document
<https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/epub/installing_an_on-premise_cluster_with_the_agent-based_installer/prepare-pxe-assets-agent#prepare-pxe-assets-agent>
Recap of image creation is in 10-sno-hub-cluster/02-matchbox/.openshift_install.log

5
10-sno-hub-cluster/03-openshift-image/create-openshift-image.yml Normal file
View File

@@ -0,0 +1,5 @@
---
- name: OpenShift image creation
ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
args:
chdir: 03-openshift-image

16
10-sno-hub-cluster/03-openshift-image/move-pxe-assets.yml Normal file
View File

@@ -0,0 +1,16 @@
---
- name: Create a directory if it does not exist
ansible.builtin.file:
path: "{{ hostvars[groups['matchbox'][0]].assets }}/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}"
state: directory
mode: '0755'
become: true
- name: Copy file with owner and permissions
ansible.builtin.copy:
src: 03-openshift-image/boot-artifacts/
dest: "{{ hostvars[groups['matchbox'][0]].assets }}/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}/"
owner: matchbox
group: matchbox
mode: '0644'
become: true

33
10-sno-hub-cluster/03-openshift-image/templates/agent-config.yaml.j2 Normal file
View File

@@ -0,0 +1,33 @@
apiVersion: v1alpha1
kind: AgentConfig
metadata:
name: {{ hostvars[groups['hub-cluster'][0]].cluster_name }}
rendezvousIP: {{ hostvars['ocp-hub'].ip_address }}
bootArtifactsBaseURL: {{ hostvars[groups['matchbox'][0]].http_endpoint }}/assets/hub/
hosts:
- hostname: {{ hostvars['ocp-hub'].hostname }}
role: master
interfaces:
- name: {{ hostvars['ocp-hub'].primary_interface }}
macAddress: {{ hostvars['ocp-hub'].mac_address }}
networkConfig:
interfaces:
- name: {{ hostvars['ocp-hub'].primary_interface }}
type: ethernet
state: up
identifier: mac-address
mac-address: {{ hostvars['ocp-hub'].mac_address }}
ipv4:
enabled: true
dhcp: true
dns-resolver:
config:
server:
- 10.1.71.254
- 10.1.71.253
routes:
config:
- destination: 0.0.0.0/0
next-hop-address: 10.1.71.1
next-hop-interface: {{ hostvars['ocp-hub'].primary_interface }}
table-id: 254

25
10-sno-hub-cluster/03-openshift-image/templates/install-config.yaml.j2 Normal file
View File

@@ -0,0 +1,25 @@
apiVersion: v1
baseDomain: {{ hostvars[groups['hub-cluster'][0]].base_domain }}
compute:
- name: worker
replicas: {{ hostvars[groups['hub-cluster'][0]].worker_node_count }}
controlPlane:
hyperthreading: Enabled
name: master
replicas: {{ hostvars[groups['hub-cluster'][0]].master_node_count }}
metadata:
name: {{ hostvars[groups['hub-cluster'][0]].cluster_name }}
networking:
clusterNetwork:
- cidr: {{ hostvars[groups['hub-cluster'][0]].cluster_network }}
hostPrefix: {{ hostvars[groups['hub-cluster'][0]].cluster_network_host_prefix }}
machineNetwork:
- cidr: {{ hostvars[groups['hub-cluster'][0]].machine_network }}
networkType: OVNKubernetes
serviceNetwork:
- {{ hostvars[groups['hub-cluster'][0]].service_network }}
platform:
{{ hostvars[groups['hub-cluster'][0]].platform_type }}: {}
fips: false
pullSecret: '{{ vault_pull_secret }}'
sshKey: '{{ vault_ssh_key }}'

8
10-sno-hub-cluster/04-matchbox/templates/groups.tf.j2 Normal file
View File

@@ -0,0 +1,8 @@
// Matcher group for OCP Internal machines
resource "matchbox_group" "{{ hostvars[groups['hub-cluster'][0]].cluster_name }}" {
name = "{{ hostvars['ocp-hub'].hostname }}" # Physical Server
profile = matchbox_profile.openshift-agent-install.name
selector = {
mac = "{{ hostvars['ocp-hub'].mac_address }}" # PXE boots and installs to 10GbE NIC
}
}

16
10-sno-hub-cluster/04-matchbox/templates/profiles.tf.j2 Normal file
View File

@@ -0,0 +1,16 @@
// Fedora CoreOS profile
resource "matchbox_profile" "openshift-agent-install" {
name = "{{ hostvars[groups['hub-cluster'][0]].cluster_name }}"
kernel = "/assets/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}/agent.x86_64-vmlinuz"
initrd = [
"--name initrd /assets/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}/agent.x86_64-initrd.img"
]
args = [
"initrd=initrd",
"coreos.live.rootfs_url={{ hostvars[groups['matchbox'][0]].http_endpoint }}/assets/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}/agent.x86_64-rootfs.img",
"rw",
"ignition.firstboot",
"ignition.platform.id=metal",
]
}

20
10-sno-hub-cluster/04-matchbox/templates/provider.tf.j2 Normal file
View File

@@ -0,0 +1,20 @@
// Configure the matchbox provider
provider "matchbox" {
endpoint = "{{ hostvars[groups['matchbox'][0]].rpc_endpoint }}"
client_cert = file("/etc/matchbox/client.crt")
client_key = file("/etc/matchbox/client.key")
ca = file("/etc/matchbox/ca.crt")
}
terraform {
required_providers {
ct = {
source = "poseidon/ct"
version = "0.13.0"
}
matchbox = {
source = "poseidon/matchbox"
version = "0.5.4"
}
}
}

0
10-sno-hub-cluster/05-bootstrap-acm/README.md Normal file
View File

13
10-sno-hub-cluster/05-bootstrap-acm/install2.yml Normal file
View File

@@ -0,0 +1,13 @@
---
- name: Run all tasks necessary to configure matchbox to install the cluster
hosts: matchbox
connection: local
gather_facts: true
tasks:
- name: Clone Git repository
ansible.builtin.git:
repo: "https://github.com/redhatryan/acm-hub-bootstrap.git"
dest: 05-bootstrap-acm
version: main
become: true

1
10-sno-hub-cluster/README.md Normal file
View File

@@ -0,0 +1 @@
# Moved to other documentation

62
10-sno-hub-cluster/install.yml Normal file
View File

@@ -0,0 +1,62 @@
---
- name: Run all tasks necessary to configure matchbox to install the cluster
hosts: matchbox
connection: local
gather_facts: true
tasks:
- name: Deploy DNS entries for cluster via Terraform
community.general.terraform:
project_path: 01-dns/
variables:
freeipa_password: "{{ vault_freeipa_password }}"
state: present
force_init: true
- name: Deploy DHCP entries for cluster via Terraform
ansible.builtin.include_tasks:
file: 02-dhcp/ip-reservations.yml
- name: OpenShift Installer install-config.yaml
ansible.builtin.template:
src: 03-openshift-image/templates/install-config.yaml.j2
dest: 03-openshift-image/install-config.yaml
mode: '0644'
- name: OpenShift Installer agent-config.yaml
ansible.builtin.template:
src: 03-openshift-image/templates/agent-config.yaml.j2
dest: 03-openshift-image/agent-config.yaml
mode: '0644'
- name: Create OpenShift image
ansible.builtin.include_tasks:
file: 03-openshift-image/create-openshift-image.yml
- name: Move PXE assets to matchbox
ansible.builtin.include_tasks:
file: 03-openshift-image/move-pxe-assets.yml
- name: Terraform matchbox groups file
ansible.builtin.template:
src: 04-matchbox/templates/groups.tf.j2
dest: 04-matchbox/groups.tf
mode: '0644'
- name: Terraform matchbox profiles file
ansible.builtin.template:
src: 04-matchbox/templates/profiles.tf.j2
dest: 04-matchbox/profiles.tf
mode: '0644'
- name: Terraform matchbox provider file
ansible.builtin.template:
src: 04-matchbox/templates/provider.tf.j2
dest: 04-matchbox/provider.tf
mode: '0644'
- name: Configure Matchbox via Terraform
community.general.terraform:
project_path: 04-matchbox/
state: present
force_init: true

9
README.md
View File

@@ -40,6 +40,8 @@ For the sake of this documentation we'll assume the following:
## Getting Started
[Step-by-Step Walkthrough](step-by-step.md)
### Hub Cluster
You'll need an OpenShift "Hub Cluster" with access to persistant storage.
@@ -75,7 +77,7 @@ With everything in its right place, you can now start to declaratively create cl
### Internal Cluster
Two additional bare metal nodes, to be added to Advanced Cluster Management (ACM) running on the SNO Hub. These will be used to create another two HCP clusters.
Two additional bare metal nodes, to be added to Advanced Cluster Management (ACM) running on the SNO Hub. These will be used to create another HCP cluster.
These servers have a BMC interface with Redfish - if not, then you'll need to manually manage the boot and installation of those servers.
This makes it to where you just need 3 bare metal nodes. You could run one HCP Bare Metal cluster with both of the other nodes, but then you have a shared storage requirement that can't be satisfied by ODF since that needs at least 3 nodes.
@@ -84,5 +86,8 @@ This makes it to where you just need 3 bare metal nodes. You could run one HCP B
You'll also either need you just need at least 2 bare metal nodes.
---
## Credits
Credit to Ken Moini as I used his [repo](https://github.com/kenmoini/ztp-for-you-and-me) as the baseline for this project.
- Ken Moini - As I used his [repo](https://github.com/kenmoini/ztp-for-you-and-me) as the baseline for this project.
- Ryan Etten
- Andrew Potozniak

1
group_vars/all/vars Normal file
View File

@@ -0,0 +1 @@
---

153
group_vars/all/vault Normal file
View File

@@ -0,0 +1,153 @@
$ANSIBLE_VAULT;1.1;AES256
64343766343632623130366435613934363465653264663165616466303364306632633930326333
6336663534313662373938666530363636313561343738340a366131323836633061316338313766
32303032626135373264396638643031326264383637343162343432373731303530333565653761
3735303536396366630a666136373437353038333664306665333938666262646566396430623664
32343163643863326566303635653032346266656538653034383266663566343064313261396561
66313062333630656564653339353065666462626330653738353333623038623836653462633538
61323235303339363836306434643033346234626238626136366534636463303163633130663533
64646562346566386365336466346434656138306665623833313933383939323438393935623937
33636131386430383861663363386532396664383239643133663738363635353736303262326462
65613038353731363337633935623662666361646364653534643561306561623535663232366134
33353466666561376262623062613563363662363461306434656361666233303763313732353466
66616532613262313531363361343963343062396463396130356436666331323036383135663638
36303364323436653730386365656332346164656139383436653836613066353334383335633661
30393761363738626438393761623435326139343034306632653039666336633566653863653264
35653734646466316564343036646237346534333139643735306636626664646361633035623362
63376439656664323564363765386630613662393735633162316135653735636231633730346132
61653930343238393262623439326635636630626234326338333163353139303833336339333361
39376165343064383032313533636165613261623735646432313131363035626539653038616436
39643737363238353536386236316434363066626164633837333264386163393831646439343631
31363365333736353965393132363535613363663138643432386633653764383738346431626133
63633864613533366536633130316662333761366330313535333363653038623763316561353264
65663033636134343833656336633762353364306537303837343939373066616430376565393137
62383030323563363236343765383235626139393137626663353537613037663539316565663662
37373165636630633664303362386331633662303136653132356234383435376665636430303937
38396639653363643839376166653436636435326464613939353439316463613462343631663565
66346466376332366135323932656265353234393735346132333932306537353862356436346133
65663637396662623665653334313464353339303362396139366639383866353061383062303337
63633863366432383435363866613939323433613164323132376436323236353335353337646663
64303338323830386337636463663738376566616630633663383165313332643438323137326565
34333035616533393961653531323466303032383765303065323464373130663839343661633063
39353761396430313035376365653031396232316464343662323734386538326431653065646331
63336465386261326338646632363565623132663264623832303565346261663531393463396239
36326236383231363530383566393937616636666335626364623239396463346566643066343736
62396632383839346463613735613730373762383435343065306562356462383630383962653139
63323739306437313065663139303037363365656365343038633466346339353437393439393166
37333033623531313333666363353230323339666232393936663331666433386238383532343634
61613531646438363466626565373033356365343931636265303633666539306639303237373130
38656239343065643830623739343236343062356162663165656537636238653265643039643834
63353039656362373365646466626135353438663865643861313238633539336666323535343637
61666533356533626563346664333338373832396162363534393130613561663335323134653030
62333038616235383637313736353264346233303437303632393933376463343133396638613366
34366165336339313932633866623663353736373965303666653334383239326362633836636437
30313564353835343564356334353862373761643861336536326338623334656539663934323865
61303430316265663464316330643032313732353763393165636133616232386635363333346164
65393864623939343430343435386638333735363838646530633036396530666233303231653366
31316333343530323962383430616336323638623735616431323366303132613533373937376135
63326431653832356137656535393763646134666239376164346330633637613631303236333632
35616266616431383333656530663838346238616331363635326532396566386461353362353035
63633138666561653063333566373637623433643666346534313938666361376431396234666265
33323563323139326333396633383537623564333636626461633333623264626363303161346139
32616432663737303764353366323766333665326561343463373339346331366338326432613230
33653165343835393564373334306631363334646462656665643631303539303065346638653031
64343862373665363231353464373639356139373338373639656161646135393665373738303866
65353262623536366636316137336633383434306463656336643233363837376238386166663438
38393762353962353365366333623336336631353133636238313238616234333564313530383036
66343964353564303434316137653261613635313430656335316534633339373964383765623865
34333930343033373234326561333432336165306533313237343866363330393334616130366336
34316330336165393034336135633465313566346265616238656362363762356664643564313132
39326434303163656166373965373338383439616132303065333762326465376136653562663339
32373063313837643339323062323361643766376366386563386431353563363736323933356333
33633737336239316164653533626231393037343664616536393039356332363338303765653833
65363134646238356534653037383631303866633234313331383066666233336262303062383064
30366362663736353632393032363030653537666162356230343261623463353439623538613863
35623564353465313335373763373538333537333938363536646231396132646364383135343534
34323635346663383361616664306530353038653436376638656464386334626238356239363231
32393365376462323035366432326165366138646163343734646136623033376134643737666635
35663962653662353039623737353466306662323664643430373835313832666363346133366261
32386435633366613337333933326564623230663631373964663832633662616239373262366264
62663164636263646538653037646136353433383937393434313362656262356532613331383232
36646361326332666634383435373632613231316165326637333439633638323265373437336461
64313163326364306236613162653036646163383164646237623938333934343366643930666530
36633763663730386432653461613833376462336162343334346435323537633537633161363464
62313136346362323433623137323935366235393334336139363731336332303362643664373038
66366437353332313464656131396434663132656531363762663432373632306332653163633765
36663165656562383063333538393261323062336662346539623335643463336437636334396661
62656163356530333534313539356436323733393663313265656431613130613137306530643538
32393362623237393764313930646661636565363331643431303533323838323030366562376231
62636536363733623536346339356634303236656531393737333834396231386637353638666638
62323964666530313361333666326238626439323834393434633831316466623938653431396434
37326136396134326162383331656563346339623032646565336262636632636433313439383264
34336432393761613938623839396138376533326663656161393331383461353234626637343633
65633765363064663636363031653636313034636563326565353931656633626236333037633261
30666633306133386536343133383538636336353261376531626566383134613966343766386232
30386464343731626634626234386633343462366434303763383733386263396361353132343339
62636130346262336637643934643838333762623931323230333137366363333062343763393762
35616630333138383034386232626532636532623962636534353130323732613937323231313637
39323837396133366363366261326232656464356338336362336163333362313661303433356562
64353431333761376237343062333266343664386439663964333538653134663237396538333031
61323031376235363137623364393735383337383661333762343561373433376137373234613938
64633531656230333465303666643034346236373532306139323466383134636361613262636162
31336135636237393565313334666230646630376462393937393565333531643735616432306665
66313361313835363333373562333764353236653331666431363838653565613562343437353432
34653933363131323932363333336466346631303036613134323063376364363763313730646465
37663637613866623432316165616463613739336632646332386532313438363766656566373430
64383930373333396135663662646230656565613161616238306338376332653362353430646637
61666636363332343733613263343030613164393237616238363562373938383865643031343032
37613238353935366638363564643461326330383339343431396434643430643434383365383162
66643535353565333838636265386365666261656637633133633164616566323061363837323364
65653037386133393039353062313630353065653436666333613637376534653665633261623239
66616134613766353264353864323464396364653838363363393036343132633630393132343631
35656434643631323630343230323537653334663135393439356263666237333662373631323538
31653839336436636130653035373061323038623339623336313935373530646331346131663838
32313835376566366464656634633261353562323566383330386336396335653731636636343062
66623533663539326461393739663063343666636239633839643330356537346231653034353934
63396662363133386635666232333535373038333632656336633736393733643566393462663631
64353137653032653263366266623531323633346661343561306161643334633237633532353434
36373532383532373936383532633936616436623135653263613338393232623739363132666166
37343337333561346331313336396331346666653138666262356434646536313731613938616634
34626466333630653765343665653465643933306533626634333635336565646236613633366532
36313539373736383834373833373836316137313639336231386662663836303861353465306639
32303035303832666564653032636339663830333930313630316536333966366536653133656338
32666432663064376436653865366138353337393665616562356434663031626138386334633661
62393565303164343965313166646361356262353063623134333936313963316139636432383738
34663736306663373666623538633732663630646136333135663433356336666635306132343032
64333565396635346337303663383865323262636365356537376465656631613462326264643835
37333933363339323836346338623562323737356535323762356235363964383265333836343761
65666465306539666437386436666262663163393639663662393363306237356630616630363863
39363338366365366430333730323133396633366136353039306437383162313131656563623664
39343639663037323535363437623936336235353237356164316161343364383736373630626335
37333539633064323232373330366239636631306264353661343861333530366439366131643936
32643132616537643339653730303835623235636561316261396238353463643133313263383463
63323332393939303564656436326238386266366464373038376263633135303164383261376235
61323830386537323762393134666163663064613330636235383837623436353339336561633732
38363130633338666334383864383935326131376566313133313166333639653338653037393139
31626138643339643137613864633662303162343166643039623062663338346561633430643065
62316535373631353665323938646464623863323632346463336430663031393435333463303930
36363434306135313332623839313138353132323266636163333661383634306434306164363735
32333632343265313831323235363764343061363537323963646430333031363534353065303063
63303265383234303335383638343438323636323235663230313762313566663833333866383134
62663061383464616565626635313732343335356536633932323639306661663430336230353064
36393066633330633438353431373761653761373439353463346163646232653865366533396462
39306462383862646436353339313734333463336530326433326634336264313034343431353037
65393461616361666462366234666563393234633862616532323966346662643533393832626133
34313435626264376334313066333638376562666633356231613037303536343431623666643937
63326330303830356436393131376331393732636161306633643630663836306266343766306332
63656331353438643636623763323866376435616161633734613532636663653939333434356333
66613162616664373561666232313036323733353535343238393665636433326234653163663834
31616336653664316337393762626463353065643837303737313336656264613230663430636466
31326537306662373062303761623261363766643665393835613733646161623361356132353265
30366336616463386334643966633633643261333833636130353362643233666339303235356366
34626564633062363336383431376631343836366561653634396638326262323062303237336566
64643365636232633338643035353030326130643164303231363537646465353562363938626265
64393464333330333635313338666565366138643866663966643362633237366634643465353366
31646262623865366664646662613931343963343364323234613935373362316539633430353535
30386531343932373537376137373335313965313763623333303935643965633338373530626661
34353439626664383639623665336135623234336435653261316635646364366233383034346533
66633736613636396336323665666431346135346336656538623361336236653262653063386562
64373634643065663765313331353438313139386333313263643639633861663431313833653263
61363930386632663937663863333561363533363434346132396366626234306136646161653935
61336362313439336439356663666264343935313137653264336539386262666536333930356235
39323263623461373336336364666466336631643738333731366230616232323737353164356361
61346530373561383864

3
group_vars/freeipa/vars Normal file
View File

@@ -0,0 +1,3 @@
---
freeipa_user: "admin"
#freeipa_password: "{{ vault_freeipa_password }}"

10
group_vars/hub-cluster/vars Normal file
View File

@@ -0,0 +1,10 @@
cluster_name: "hub"
cluster_version: "4.17.20"
base_domain: "int.mk-labs.cloud"
worker_node_count: 0
master_node_count: 1
cluster_network: "10.128.0.0/14"
cluster_network_host_prefix: 23
machine_network: "10.1.71.0/24"
service_network: "172.30.0.0/16"
platform_type: "none"

9
group_vars/matchbox/vars Normal file
View File

@@ -0,0 +1,9 @@
---
# Variables for Matchbox
assets: "/var/lib/matchbox/assets"
http_endpoint: "http://matchbox.int.mk-labs.cloud:8080"
rpc_endpoint: "matchbox.int.mk-labs.cloud:8081"
# Variables for OpenShift Installer
#openshift_installer_pull_secret: "{{ vault_pull_secret }}"
#openshift_installer_ssh_key: "{{ vault_ssh_key }}"

5
host_vars/ocp-hub/vars Normal file
View File

@@ -0,0 +1,5 @@
---
mac_address: "98:b7:85:1e:c6:f1"
ip_address: "10.1.71.10"
hostname: "ocp-hub"
primary_interface: "enp1s0f0"

17
inventory.yml Normal file
View File

@@ -0,0 +1,17 @@
proxmox:
hosts:
pve01:
pve02:
pve03:
freeipa:
hosts:
infra01:
matchbox:
hosts:
infra01:
hub-cluster:
hosts:
ocp-hub:

122
playbooks/update-linux-os.yml Normal file
View File

@@ -0,0 +1,122 @@
---
- name: Linux OS Upgrade
hosts: all
gather_facts: true
become: true
tasks:
- name: Update all packages
ansible.builtin.package:
name: '*'
state: latest
update_cache: true
- name: Upgrade Debian and Ubuntu systems with apt
when: ansible_os_family == "Debian"
block:
- name: Dist-upgrade
ansible.builtin.apt:
upgrade: dist
update_cache: true
register: upgrade_result
- name: Debain check if reboot is required
ansible.builtin.shell: "[ -f /var/run/reboot-required ]"
failed_when: false
register: debian_reboot_required
changed_when: debian_reboot_required.rc == 0
notify:
- Reboot server
- name: Debian remove unneeded dependencies
ansible.builtin.apt:
autoremove: true
register: autoremove_result
- name: Debian print errors if upgrade failed
ansible.builtin.debug:
msg: |
Upgrade Result: {{ upgrade_result }}
Autoremove Result: {{ autoremove_result }}
- name: Upgrade RHEL systems with DNF
when: ansible_os_family == "RedHat" and not (ansible_distribution_major_version == "7")
block:
- name: Get packages that can be upgraded with DNF
ansible.builtin.dnf:
list: upgrades
state: latest
update_cache: true
register: reg_dnf_output_all
- name: List packages that can be upgraded with DNF
ansible.builtin.debug:
msg: "{{ reg_dnf_output_all.results | map(attribute='name') | list }}"
- name: Upgrade packages with DNF
become: true
ansible.builtin.dnf:
name: '*'
state: latest
update_cache: true
update_only: false
register: reg_upgrade_ok
- name: Print DNF errors if upgrade failed
ansible.builtin.debug:
msg: "Packages upgrade failed"
when: reg_upgrade_ok is not defined
- name: Install dnf-utils
when: reg_dnf_output_all is defined
become: true
ansible.builtin.dnf:
name: 'dnf-utils'
state: latest
update_cache: true
- name: Upgrade legacy RHEL systems with YUM
when: ansible_os_family == "RedHat" and ansible_distribution_major_version == "7"
block:
- name: Get packages that can be upgraded with YUM
ansible.builtin.yum:
list: upgrades
state: latest
update_cache: true
register: reg_yum_output_all
- name: List packages that can be upgraded with YUM
ansible.builtin.debug:
msg: "{{ reg_yum_output_all.results | map(attribute='name') | list }}"
- name: Upgrade packages with YUM
become: true
ansible.builtin.yum:
name: '*'
state: latest
update_cache: true
update_only: false
register: reg_yum_upgrade_ok
- name: Print YUM errors if upgrade failed
ansible.builtin.debug:
msg: "Packages upgrade failed"
when: reg_yum_upgrade_ok is not defined
- name: Check legacy RHEL system if a reboot is required
become: true
ansible.builtin.command: needs-restarting -r
register: reg_reboot_required
ignore_errors: true
failed_when: false
changed_when: reg_reboot_required.rc != 0
notify:
- Reboot server
handlers:
- name: Reboot server
ansible.builtin.reboot:
msg: "Reboot initiated by Ansible after OS update"
reboot_timeout: 3600
test_command: uptime

10
requirements.yml Normal file
View File

@@ -0,0 +1,10 @@
# requirements.yml
collections:
- name: community.general
version: 10.4.0
- name: nccurry.openshift
version: 1.4.0
- name: somaz94.ansible_k8s_iac_tool
version: 1.1.6

119
step-by-step.md Normal file
View File

@@ -0,0 +1,119 @@
# Almost automated step by step walkthrough of full lab deployment
This ~~is~~ *will be* the complete walkthrough of the deployment of my homelab.
- On a PC/laptop, clone this git repo
- Create your vault file for secrets (and store somewhere safe)
```bash
echo 'master-ansible-password' > ~/.vault_pass.txt
chmod 644 ~/.vault_pass.txt
```
- Add "export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass.txt" to your shell profile.
- Create vault file
```bash
cd homelab/group_vars/all
ansible-vault create vault
```
- Modify ansible variables for your environment
## [Network](00-network/README.md) *Manual*
<https://registry.terraform.io/providers/ubiquiti-community/unifi/latest/docs/resources/network>
## [Storage](01-storage/README.md) *Manual*
## [Proxmox](02-proxmox/README.md) *Manual*
<https://registry.terraform.io/providers/bpg/proxmox/latest>
## [Unbound DNS](03-unbound-dns/README.md) *Manual*
---
## Build infra01
- From laptop run ansible playbook to:
```bash
cd homelab
ansible-playbook -i inventory.yml 03-infra01-server/install.yml
```
- Install ansible-core
- Copy .vault_pass.txt from laptop and set env variable
- Clone git repo
- Install ansible required packages
```bash
scp ~/.vault_pass.txt infra01:.
ssh infra01
cd homelab
ansible-galaxy collection install -r requirements.yml
ansible-playbook -i inventory.yml 10-sno-hub-cluster/install.yml
```
Other needed software:
- ~~kustomize~~
- git
- oc
- ansible
- terraform
## [FreeIPA](04-free-ipa/README.md) *Manual*
## [Templates](05-templates/README.md) *Manual*
## [Matchbox](06-matchbox/README.md) *Manual*
- Downloading the Agent-based Installer
---
## [Hub Cluster](10-sno-hub-cluster/README.md) *In Progress*
- Prepare matchbox to install hub cluster
Running this playbook will configure Matchbox to wait for the sno-cluster to boot via iPXE and will install Single Node OpenShift. All configuration files are built from templates driven from Ansible variables.
```bash
cd homelab
ansible-playbook -i inventory.yml 10-sno-hub-cluster/install.yml
```
- PXE boot the SNO host
Boot host to boot options menu:
- \<F12\> for Dell 7050
Select NIC with matching MAC to boot from
- Monitor installation process
```bash
openshift-install --dir homelab/10-sno-hub-cluster/03-openshift-image agent wait-for bootstrap-complete --log-level=debug
```
- Admin password and kubeconfig are in the homelab/10-sno-hub-cluster/03-openshift-image/auth directory
- Bootstrap ACM
Running this playbook will configure Matchbox to wait for the sno-cluster to boot via iPXE and will install Single Node OpenShift. All configuration files are built from templates driven from Ansible variables.
```bash
ansible-playbook -i inventory.yml 10-sno-hub-cluster/install2.yml
```
10-sno-hub-cluster/05-bootstrap-acm/bootstrap.sh
## Internal Cluster *TBD*
(Deployed in conjunction with ACM)
## External Cluster *TBD*
(Deployed in conjunction with ACM)

22
test.yml Normal file
View File

@@ -0,0 +1,22 @@
---
- name: Run all tasks necessary to configure matchbox to install the cluster
hosts: matchbox
connection: local
gather_facts: true
tasks:
- name: Print vars for debugging
ansible.builtin.debug:
msg: System {{ hostvars['infra01'].matchbox_assets }} / {{ hostvars['ocp-hub'].cluster_name }}
- name: Print vars for debugging 2
ansible.builtin.debug:
msg: System {{ groups }}
- name: Print vars for debugging 3
ansible.builtin.debug:
msg: System {{ groups['hub-cluster'][0] }}
- name: Print vars for debugging 4
ansible.builtin.debug:
msg: System {{ hostvars[groups['hub-cluster'][0]].cluster_name }}

8
tmp/groups.tf Normal file
View File

@@ -0,0 +1,8 @@
// Matcher group for OCP Internal machinesmachines
resource "matchbox_group" "ocp-hub" {
name = "ocp-hub" # Physical Server
profile = matchbox_profile.openshift-agent-install.name
selector = {
mac = "98:b7:85:1e:c6:f1" # PXE boots and installs to 10GbE NIC
}
}

25
tmp/install-config.yaml Normal file
View File

@@ -0,0 +1,25 @@
apiVersion: v1
baseDomain: int.mk-labs.cloud
compute:
- name: worker
replicas: 0
controlPlane:
hyperthreading: Enabled
name: master
replicas: 1
metadata:
name: hub
networking:
clusterNetwork:
- cidr: 10.128.0.0/14 #<== Internal node network. Not available externally.
hostPrefix: 23
machineNetwork:
- cidr: 10.1.71.0/24 #<== Real world host network.
networkType: OVNKubernetes
serviceNetwork:
- 172.30.0.0/16 #<== Internal cluster overlay. Not available externally.
platform:
none: {}
fips: false
pullSecret: '{"auths":{"cloud.openshift.com":{"auth":"b3BlbnNoaWZ0LXJlbGVhc2UtZGV2K29jbV9hY2Nlc3NfY2ZlYjYxMjE5ZmFiNDA1OWIwZWZmZDJlZTUxZTNlOTc6UjhaUEs2UEQyTjlBNURERUxHUjE0UDdLQ1pWR1ZPME1KUDYzUTUzQ0hBMTlIVjE4STJETzBHMkdGNzg2QjQxOA==","email":"rblundon@redhat.com"},"quay.io":{"auth":"b3BlbnNoaWZ0LXJlbGVhc2UtZGV2K29jbV9hY2Nlc3NfY2ZlYjYxMjE5ZmFiNDA1OWIwZWZmZDJlZTUxZTNlOTc6UjhaUEs2UEQyTjlBNURERUxHUjE0UDdLQ1pWR1ZPME1KUDYzUTUzQ0hBMTlIVjE4STJETzBHMkdGNzg2QjQxOA==","email":"rblundon@redhat.com"},"registry.connect.redhat.com":{"auth":"fHVoYy1wb29sLTk0ZGM3NWFiLTEyYzAtNGRhMC1hMjI5LTBmOTZiY2Y2NGZhMDpleUpoYkdjaU9pSlNVelV4TWlKOS5leUp6ZFdJaU9pSmhabVppWWpRMFpqWXlPVEkwTVRKaFlqWTBaVFl3T1RSaFpqRmpabUk0WlNKOS5tS3RLNnYxa1ZEZjZOcXJweTBXTjRubEQ1bDFhTG9sbWtvV3YzYzcwdTJJb29iODBsZGEtanJHYV85LWVVUU1IM1dsU3BvdEQzQzFBdi1wUE5pT0tKM2paSGJGOEoxTlNtSmdsb0hSR214NDZXb2FGYlh5c2JuUVhwamNBU0l4MnpZQ1hFSWlaNkZrRzFwUUMzWHlISTdsMVh6dEZ1TG5yWFBGUUhUdHFJcm5KNDA5R2c2Uk5jNXhnOEpMWEY4UmFWM2x1SGZqdWY2RHJRaGdzc3Vla1BOcDc0Q0g1Y0k4T3pYVWVLMy1xelZkQ3FaSDhZYXp5dHVJRDFmQkxyUDV4Nnh5a3U3NFd6dEJXaE9rMFRBdnVldkNHSVlLOV91MGlFSVl0bll5TTJndnpWSTl4YXBUckkwMW9DcF9NXzh2YU1YVzJjb2ZUNEE5b2VrZDM0ZmdkUGs4MFU0UzBBN0RabWpiMFZCT211Y0xuX1F6U2FQMkZjMmtGNDExenBfb2I5ZHl1MEZhSXN5bF9YTG5kZDF3S21JU2N6N04tZDBpM244QkpvYnh6YUJwZzJxUEdhV2VvTXJNWmYwRGdzVEo4VmhBSWlBNTVwUDYwSGVpRzdzMUhUQ1Rudl9kTlpaMWY0TzMwUTBNVnRTQWl6Q3Q0azdnbHd5VzZVamU4czd2WVZPekFvUEFvTEZKQVZVcUcwWUNUYXJodnBsZ204MWlzWHhwWk5nMEQwUkZISmRIYXFmRXQtVE5wVHplZzlBOEZ6QkVQaG5ZTU1ZMEhzUVpONHFNbE1kTHBHOHJrZU04azRoWGIyQ08wcFZvMUluY1d2aFQ5cDgxV1M0QlNfMHR6bG1EckdTbXJYN3JNTnN1V2RZbmlpNm16WFJuRUlIV25FelNUc2hhLUtRcw==","email":"rblundon@redhat.com"},"registry.redhat.io":{"auth":"fHVoYy1wb29sLTk0ZGM3NWFiLTEyYzAtNGRhMC1hMjI5LTBmOTZiY2Y2NGZhMDpleUpoYkdjaU9pSlNVelV4TWlKOS5leUp6ZFdJaU9pSmhabVppWWpRMFpqWXlPVEkwTVRKaFlqWTBaVFl3T1RSaFpqRmpabUk0WlNKOS5tS3RLNnYxa1ZEZjZOcXJweTBXTjRubEQ1bDFhTG9sbWtvV3YzYzcwdTJJb29iODBsZGEtanJHYV85LWVVUU1IM1dsU3BvdEQzQzFBdi1wUE5pT0tKM2paSGJGOEoxTlNtSmdsb0hSR214NDZXb2FGYlh5c2JuUVhwamNBU0l4MnpZQ1hFSWlaNkZrRzFwUUMzWHlISTdsMVh6dEZ1TG5yWFBGUUhUdHFJcm5KNDA5R2c2Uk5jNXhnOEpMWEY4UmFWM2x1SGZqdWY2RHJRaGdzc3Vla1BOcDc0Q0g1Y0k4T3pYVWVLMy1xelZkQ3FaSDhZYXp5dHVJRDFmQkxyUDV4Nnh5a3U3NFd6dEJXaE9rMFRBdnVldkNHSVlLOV91MGlFSVl0bll5TTJndnpWSTl4YXBUckkwMW9DcF9NXzh2YU1YVzJjb2ZUNEE5b2VrZDM0ZmdkUGs4MFU0UzBBN0RabWpiMFZCT211Y0xuX1F6U2FQMkZjMmtGNDExenBfb2I5ZHl1MEZhSXN5bF9YTG5kZDF3S21JU2N6N04tZDBpM244QkpvYnh6YUJwZzJxUEdhV2VvTXJNWmYwRGdzVEo4VmhBSWlBNTVwUDYwSGVpRzdzMUhUQ1Rudl9kTlpaMWY0TzMwUTBNVnRTQWl6Q3Q0azdnbHd5VzZVamU4czd2WVZPekFvUEFvTEZKQVZVcUcwWUNUYXJodnBsZ204MWlzWHhwWk5nMEQwUkZISmRIYXFmRXQtVE5wVHplZzlBOEZ6QkVQaG5ZTU1ZMEhzUVpONHFNbE1kTHBHOHJrZU04azRoWGIyQ08wcFZvMUluY1d2aFQ5cDgxV1M0QlNfMHR6bG1EckdTbXJYN3JNTnN1V2RZbmlpNm16WFJuRUlIV25FelNUc2hhLUtRcw==","email":"rblundon@redhat.com"}}}'
sshKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICB/UfNTK2JX8Lq0H75yHrWgr32vhLFBcE7r+cEC6hvd rblundon@rblundon-mac'

16
tmp/profiles.tf Normal file
View File

@@ -0,0 +1,16 @@
// Fedora CoreOS profile
resource "matchbox_profile" "openshift-agent-install" {
name = "hub"
kernel = "/assets/hub/agent.x86_64-vmlinuz"
initrd = [
"--name initrd /assets/hub/agent.x86_64-initrd.img"
]
args = [
"initrd=initrd",
"coreos.live.rootfs_url=${var.matchbox_http_endpoint}/assets/hub/agent.x86_64-rootfs.img",
"rw",
"ignition.firstboot",
"ignition.platform.id=metal",
]
}

20
tmp/provider.tf Normal file
View File

@@ -0,0 +1,20 @@
// Configure the matchbox provider
provider "matchbox" {
endpoint = var.matchbox_rpc_endpoint
client_cert = file("/etc/matchbox/client.crt")
client_key = file("/etc/matchbox/client.key")
ca = file("/etc/matchbox/ca.crt")
}
terraform {
required_providers {
ct = {
source = "poseidon/ct"
version = "0.13.0"
}
matchbox = {
source = "poseidon/matchbox"
version = "0.5.4"
}
}
}

2
tmp/terraform.tfvars Normal file
View File

@@ -0,0 +1,2 @@
matchbox_http_endpoint = "http://matchbox.int.mk-labs.cloud:8080"
matchbox_rpc_endpoint = "matchbox.int.mk-labs.cloud:8081"

10
tmp/variables.tf Normal file
View File

@@ -0,0 +1,10 @@
variable "matchbox_http_endpoint" {
type = string
description = "Matchbox HTTP read-only endpoint (e.g. http://matchbox.example.com:8080)"
}
variable "matchbox_rpc_endpoint" {
type = string
description = "Matchbox gRPC API endpoint, without the protocol (e.g. matchbox.example.com:8081)"
}