From 6f5bc65171b5bd6b7796db728772390bf9d41d9a Mon Sep 17 00:00:00 2001 From: rblundon Date: Sat, 27 Sep 2025 16:05:33 -0500 Subject: [PATCH] ansible scripts done to install kubewrnetes prequesites --- ansible/group_vars/fastpass/vars | 2 +- .../roles/containerd}/README.md | 0 .../roles/containerd/defaults/main.yml | 3 + .../roles/containerd/handlers/main.yml | 3 + .../roles/containerd}/meta/main.yml | 0 .../playbooks/roles/containerd/tasks/main.yml | 74 +++++ .../roles/containerd}/tests/inventory | 0 .../playbooks/roles/containerd/tests/test.yml | 6 + .../roles/containerd/vars}/main.yml | 2 +- .../defaults/main.yml | 31 +- .../kubernetes-prerequisites/tasks/main.yml | 189 +++--------- .../kubernetes-firewall-service.xml.j2 | 9 - ansible/playbooks/roles/kubernetes/README.md | 38 +++ .../roles/kubernetes/defaults/main.yml | 3 + .../roles/kubernetes/handlers/main.yml | 3 + .../playbooks/roles/kubernetes/meta/main.yml | 35 +++ .../playbooks/roles/kubernetes/tasks/main.yml | 289 ++++-------------- .../kubernetes-firewalld-service.xml.j2 | 49 +++ .../templates/kubernetes-ufw-service.xml.j2 | 34 +++ .../roles/kubernetes/tests/inventory | 3 + .../playbooks/roles/kubernetes/tests/test.yml | 6 + .../playbooks/roles/kubernetes/vars/main.yml | 3 + ansible/playbooks/roles/n8n/tasks/main.yml | 5 - ansible/playbooks/roles/time-sync/README.md | 38 +++ .../roles/time-sync/defaults/main.yml | 0 .../roles/time-sync/handlers/main.yml | 0 .../playbooks/roles/time-sync/meta/main.yml | 35 +++ .../playbooks/roles/time-sync/tasks/main.yml | 41 +++ .../playbooks/roles/time-sync/tests/inventory | 3 + .../roles/time-sync/tests/test.yml | 0 .../roles/time-sync/vars/main.yml | 0 31 files changed, 498 insertions(+), 406 deletions(-) rename ansible/{roles/time-sync => playbooks/roles/containerd}/README.md (100%) create mode 100644 ansible/playbooks/roles/containerd/defaults/main.yml create mode 100644 ansible/playbooks/roles/containerd/handlers/main.yml rename ansible/{roles/time-sync => playbooks/roles/containerd}/meta/main.yml (100%) create mode 100644 ansible/playbooks/roles/containerd/tasks/main.yml rename ansible/{roles/time-sync => playbooks/roles/containerd}/tests/inventory (100%) create mode 100644 ansible/playbooks/roles/containerd/tests/test.yml rename ansible/{roles/time-sync/tasks => playbooks/roles/containerd/vars}/main.yml (57%) delete mode 100644 ansible/playbooks/roles/kubernetes-prerequisites/templates/kubernetes-firewall-service.xml.j2 create mode 100644 ansible/playbooks/roles/kubernetes/README.md create mode 100644 ansible/playbooks/roles/kubernetes/defaults/main.yml create mode 100644 ansible/playbooks/roles/kubernetes/handlers/main.yml create mode 100644 ansible/playbooks/roles/kubernetes/meta/main.yml create mode 100644 ansible/playbooks/roles/kubernetes/templates/kubernetes-firewalld-service.xml.j2 create mode 100644 ansible/playbooks/roles/kubernetes/templates/kubernetes-ufw-service.xml.j2 create mode 100644 ansible/playbooks/roles/kubernetes/tests/inventory create mode 100644 ansible/playbooks/roles/kubernetes/tests/test.yml create mode 100644 ansible/playbooks/roles/kubernetes/vars/main.yml create mode 100644 ansible/playbooks/roles/time-sync/README.md rename ansible/{ => playbooks}/roles/time-sync/defaults/main.yml (100%) rename ansible/{ => playbooks}/roles/time-sync/handlers/main.yml (100%) create mode 100644 ansible/playbooks/roles/time-sync/meta/main.yml create mode 100644 ansible/playbooks/roles/time-sync/tasks/main.yml create mode 100644 ansible/playbooks/roles/time-sync/tests/inventory rename ansible/{ => playbooks}/roles/time-sync/tests/test.yml (100%) rename ansible/{ => playbooks}/roles/time-sync/vars/main.yml (100%) diff --git a/ansible/group_vars/fastpass/vars b/ansible/group_vars/fastpass/vars index 1e4e334..2c7a3b7 100644 --- a/ansible/group_vars/fastpass/vars +++ b/ansible/group_vars/fastpass/vars @@ -3,7 +3,7 @@ # Cluster Configuration cluster_name: "fastpass" -kubernetes_version: "1.33.4" +kubernetes_version: "1.33" pod_network_cidr: "10.244.0.0/16" service_cidr: "10.96.0.0/12" diff --git a/ansible/roles/time-sync/README.md b/ansible/playbooks/roles/containerd/README.md similarity index 100% rename from ansible/roles/time-sync/README.md rename to ansible/playbooks/roles/containerd/README.md diff --git a/ansible/playbooks/roles/containerd/defaults/main.yml b/ansible/playbooks/roles/containerd/defaults/main.yml new file mode 100644 index 0000000..a43b99b --- /dev/null +++ b/ansible/playbooks/roles/containerd/defaults/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# defaults file for containerd diff --git a/ansible/playbooks/roles/containerd/handlers/main.yml b/ansible/playbooks/roles/containerd/handlers/main.yml new file mode 100644 index 0000000..ae43855 --- /dev/null +++ b/ansible/playbooks/roles/containerd/handlers/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# handlers file for containerd diff --git a/ansible/roles/time-sync/meta/main.yml b/ansible/playbooks/roles/containerd/meta/main.yml similarity index 100% rename from ansible/roles/time-sync/meta/main.yml rename to ansible/playbooks/roles/containerd/meta/main.yml diff --git a/ansible/playbooks/roles/containerd/tasks/main.yml b/ansible/playbooks/roles/containerd/tasks/main.yml new file mode 100644 index 0000000..596c0e6 --- /dev/null +++ b/ansible/playbooks/roles/containerd/tasks/main.yml @@ -0,0 +1,74 @@ +--- +# tasks file for containerd +- name: Install containerd dependencies + become: true + ansible.builtin.package: + name: "{{ item }}" + state: present + loop: + "{{ containerd_dependencies }}" + +- name: Install via apt + become: true + when: ansible_os_family == "Debian" + block: + - name: Add repo using key from URL (apt) + ansible.builtin.deb822_repository: + name: docker + types: deb + uris: https://download.docker.com/linux/ubuntu + suites: "{{ ansible_distribution_release }}" + components: stable + architectures: amd64 + signed_by: https://download.docker.com/linux/ubuntu/gpg + + - name: Update apt cache + ansible.builtin.apt: + update_cache: true + +- name: Install via dnf + become: true + when: ansible_os_family == "RedHat" + block: + - name: Add repo using key from URL (dnf) + ansible.builtin.yum_repository: + name: docker + description: "Docker repository" + baseurl: https://download.docker.com/linux/ubuntu + gpgcheck: true + gpgkey: https://download.docker.com/linux/ubuntu/gpg + + - name: Update dnf cache + ansible.builtin.dnf: + update_cache: true + +- name: Install containerd + become: true + ansible.builtin.package: + name: containerd.io + state: present + +- name: Create containerd config directory + ansible.builtin.file: + path: /etc/containerd + state: directory + owner: root + group: root + mode: '0755' + +- name: Check if containerd config file exists + ansible.builtin.stat: + path: /etc/containerd/config.toml + register: containerd_config_file + +- name: Generate default containerd config and enable SystemdCgroup + when: containerd_config_file.stat.exists == false + ansible.builtin.shell: | + containerd config default > /etc/containerd/config.toml + sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml + +- name: Restart and enable containerd service + ansible.builtin.systemd: + name: containerd + state: restarted + enabled: true diff --git a/ansible/roles/time-sync/tests/inventory b/ansible/playbooks/roles/containerd/tests/inventory similarity index 100% rename from ansible/roles/time-sync/tests/inventory rename to ansible/playbooks/roles/containerd/tests/inventory diff --git a/ansible/playbooks/roles/containerd/tests/test.yml b/ansible/playbooks/roles/containerd/tests/test.yml new file mode 100644 index 0000000..3ab8eba --- /dev/null +++ b/ansible/playbooks/roles/containerd/tests/test.yml @@ -0,0 +1,6 @@ +#SPDX-License-Identifier: MIT-0 +--- +- hosts: localhost + remote_user: root + roles: + - containerd diff --git a/ansible/roles/time-sync/tasks/main.yml b/ansible/playbooks/roles/containerd/vars/main.yml similarity index 57% rename from ansible/roles/time-sync/tasks/main.yml rename to ansible/playbooks/roles/containerd/vars/main.yml index e982617..2a95a87 100644 --- a/ansible/roles/time-sync/tasks/main.yml +++ b/ansible/playbooks/roles/containerd/vars/main.yml @@ -1,3 +1,3 @@ #SPDX-License-Identifier: MIT-0 --- -# tasks file for time-sync +# vars file for containerd diff --git a/ansible/playbooks/roles/kubernetes-prerequisites/defaults/main.yml b/ansible/playbooks/roles/kubernetes-prerequisites/defaults/main.yml index 64b1074..96174b8 100644 --- a/ansible/playbooks/roles/kubernetes-prerequisites/defaults/main.yml +++ b/ansible/playbooks/roles/kubernetes-prerequisites/defaults/main.yml @@ -2,17 +2,11 @@ # Kubernetes Prerequisites Role Defaults # Kubernetes version to install (should be overridden in group_vars) -kubernetes_version: "v1.30" - -# Container runtime (containerd is default) -container_runtime: "containerd" +kubernetes_version: "v1.33" # CNI plugin to install cni_plugin: "calico" -# Firewall configuration -configure_firewall: true - # SELinux configuration selinux_state: "permissive" @@ -27,15 +21,14 @@ k8s_sysctl_params: - "net.bridge.bridge-nf-call-ip6tables: 1" - "net.ipv4.ip_forward: 1" -# Kubernetes firewall ports -k8s_firewall_ports: - - { protocol: "tcp", port: "6443" } # API server - - { protocol: "tcp", port: "2379" } # etcd client - - { protocol: "tcp", port: "2380" } # etcd peer - - { protocol: "tcp", port: "10250" } # kubelet - - { protocol: "tcp", port: "10251" } # kube-scheduler - - { protocol: "tcp", port: "10252" } # kube-controller-manager - - { protocol: "tcp", port: "10255" } # kubelet read-only - - { protocol: "tcp", port: "30000-32767" } # NodePort services - - { protocol: "udp", port: "4789" } # VXLAN (Flannel) - - { protocol: "tcp", port: "179" } # BGP (Calico) +containerd_dependencies: + - curl + - gnupg2 + - software-properties-common + - apt-transport-https + - ca-certificates + +kubernetes_packages: + - kubelet + - kubeadm + - kubectl diff --git a/ansible/playbooks/roles/kubernetes-prerequisites/tasks/main.yml b/ansible/playbooks/roles/kubernetes-prerequisites/tasks/main.yml index e87e6e5..a229dd7 100644 --- a/ansible/playbooks/roles/kubernetes-prerequisites/tasks/main.yml +++ b/ansible/playbooks/roles/kubernetes-prerequisites/tasks/main.yml @@ -9,176 +9,71 @@ ansible.builtin.include_role: name: no-swap -- name: 3.1 Load required kernel modules - become: true - ansible.builtin.modprobe: - name: "{{ item }}" - loop: "{{ required_kernel_modules }}" - -- name: 3.2 Persist kernel modules on boot - become: true - ansible.builtin.copy: - dest: /etc/modules-load.d/k8s.conf - content: "{{ required_kernel_modules | join('\n') }}" - owner: root - group: root - mode: '0644' - -- name: 3.3 Configure required sysctl params for Kubernetes - become: true - ansible.builtin.copy: - dest: /etc/sysctl.d/kubernetes.conf - content: "{{ k8s_sysctl_params | join('\n') }}" - owner: root - group: root - mode: '0644' - -- name: 3.4 Apply sysctl params without reboot - become: true - ansible.builtin.shell: sysctl --system - -- name: 3.5 Manage SELinux +- name: 3. Manage SELinux become: true when: ansible_os_family == "RedHat" block: - - name: 3.5.1 Install python3-libselinux for managing selinux + - name: 3.1 Install python3-libselinux for managing selinux ansible.builtin.dnf: name: python3-libselinux state: present - - name: 3.5.2 Set SELinux to permissive mode + - name: 3.2 Set SELinux to permissive mode ansible.posix.selinux: policy: targeted state: "{{ selinux_state }}" - name: 4 Manage Time Synchronization + ansible.builtin.include_role: + name: time-sync + +- name: 5.1 Manage firewall (ufw) become: true + when: ansible_os_family == "Debian" block: - - name: Check if ntp is installed - ansible.builtin.package: rpm -q ntp - register: ntp_installed - changed_when: false - - - name: 4.1 Remove the ntp package + - name: 5.1.1 Install ufw ansible.builtin.package: - name: ntp - state: absent - - - name: 4.2 Install the chrony package - ansible.builtin.package: - name: chrony + name: ufw state: present + - name: 5.1.2 Open firewall ports OpenSSH + community.general.ufw: + rule: allow + name: OpenSSH -# - name: Start and enable chronyd -# ansible.builtin.systemd: -# name: chronyd -# state: started -# enabled: true -# when: configure_ntp | default(true) + - name: 5.1.3 Enable ufw + community.general.ufw: + state: enabled -# - name: Force time synchronization -# ansible.builtin.shell: chronyc makestep -# ignore_errors: true -# when: configure_ntp | default(true) +- name: 5.2 Manage firewall (firewalld) + become: true + when: ansible_os_family == "RedHat" + block: + - name: 5.2.1 Install firewalld + ansible.builtin.package: + name: firewalld + state: present -# - name: Install firewalld -# ansible.builtin.dnf: -# name: firewalld -# state: present -# when: configure_firewall | default(true) + - name: 5.2.2 Add SSH service to default zone (ensure SSH access) + ansible.posix.firewalld: + service: ssh + permanent: true + immediate: true + state: enabled -# - name: Start and enable firewalld -# ansible.builtin.systemd: -# name: firewalld -# state: started -# enabled: true -# when: configure_firewall | default(true) + - name: 5.2.3 Start and enable firewalld + ansible.builtin.systemd: + name: firewalld + state: started + enabled: true -# - name: Create Kubernetes service definition -# ansible.builtin.template: -# dest: /etc/firewalld/services/kubernetes.xml -# owner: root -# group: root -# mode: '0644' -# src: kubernetes-firewall-service.xml.j2 -# when: configure_firewall | default(true) +- name: 6 Install kubernetes + ansible.builtin.include_role: + name: kubernetes -# - name: Reload firewalld to load new service -# ansible.builtin.shell: firewall-cmd --reload -# when: configure_firewall | default(true) - -# - name: Add Kubernetes service to default zone -# ansible.builtin.shell: firewall-cmd --permanent --add-service=kubernetes -# when: configure_firewall | default(true) - -# - name: Add SSH service to default zone (ensure SSH access) -# ansible.builtin.shell: firewall-cmd --permanent --add-service=ssh -# when: configure_firewall | default(true) - -# - name: Reload firewalld to apply changes -# ansible.builtin.shell: firewall-cmd --reload -# when: configure_firewall | default(true) - -# - name: Verify Kubernetes service is active -# ansible.builtin.shell: firewall-cmd --list-services -# register: active_services -# when: configure_firewall | default(true) - -# - name: Display active firewall services -# ansible.builtin.debug: -# msg: "Active firewall services: {{ active_services.stdout }}" -# when: configure_firewall | default(true) - -# - name: Install DNF plugins core for managing repositories -# ansible.builtin.dnf: -# name: dnf-plugins-core -# state: present - -# - name: Add Docker CE repository -# ansible.builtin.shell: | -# curl -fsSL https://download.docker.com/linux/fedora/docker-ce.repo -o /etc/yum.repos.d/docker-ce.repo - -# - name: Install containerd -# ansible.builtin.dnf: -# name: containerd -# state: present - -# - name: Create containerd config directory -# ansible.builtin.file: -# path: /etc/containerd -# state: directory -# owner: root -# group: root -# mode: '0755' - -# - name: Generate default containerd config and enable SystemdCgroup -# ansible.builtin.shell: | -# containerd config default > /etc/containerd/config.toml -# sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml - -# - name: Restart and enable containerd service -# ansible.builtin.systemd: -# name: containerd -# state: restarted -# enabled: true - -# - name: Add Kubernetes repository -# ansible.builtin.template: -# dest: /etc/yum.repos.d/kubernetes.repo -# owner: root -# group: root -# mode: '0644' -# src: kubernetes.repo.j2 - -# - name: Install Kubernetes packages -# ansible.builtin.dnf: -# name: -# - kubelet -# - kubeadm -# - kubectl -# - kubernetes-cni -# state: present +- name: 7 Install containerd + ansible.builtin.include_role: + name: containerd # - name: Create kubelet config directory # ansible.builtin.file: diff --git a/ansible/playbooks/roles/kubernetes-prerequisites/templates/kubernetes-firewall-service.xml.j2 b/ansible/playbooks/roles/kubernetes-prerequisites/templates/kubernetes-firewall-service.xml.j2 deleted file mode 100644 index ad1ce85..0000000 --- a/ansible/playbooks/roles/kubernetes-prerequisites/templates/kubernetes-firewall-service.xml.j2 +++ /dev/null @@ -1,9 +0,0 @@ - - - Kubernetes - Kubernetes cluster communication ports -{% for port in k8s_firewall_ports %} - -{% endfor %} - - diff --git a/ansible/playbooks/roles/kubernetes/README.md b/ansible/playbooks/roles/kubernetes/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/ansible/playbooks/roles/kubernetes/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/ansible/playbooks/roles/kubernetes/defaults/main.yml b/ansible/playbooks/roles/kubernetes/defaults/main.yml new file mode 100644 index 0000000..5655d4a --- /dev/null +++ b/ansible/playbooks/roles/kubernetes/defaults/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# defaults file for kubernetes diff --git a/ansible/playbooks/roles/kubernetes/handlers/main.yml b/ansible/playbooks/roles/kubernetes/handlers/main.yml new file mode 100644 index 0000000..0bd8963 --- /dev/null +++ b/ansible/playbooks/roles/kubernetes/handlers/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# handlers file for kubernetes diff --git a/ansible/playbooks/roles/kubernetes/meta/main.yml b/ansible/playbooks/roles/kubernetes/meta/main.yml new file mode 100644 index 0000000..36b9858 --- /dev/null +++ b/ansible/playbooks/roles/kubernetes/meta/main.yml @@ -0,0 +1,35 @@ +#SPDX-License-Identifier: MIT-0 +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.1 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/ansible/playbooks/roles/kubernetes/tasks/main.yml b/ansible/playbooks/roles/kubernetes/tasks/main.yml index de51e3a..ac5bef8 100644 --- a/ansible/playbooks/roles/kubernetes/tasks/main.yml +++ b/ansible/playbooks/roles/kubernetes/tasks/main.yml @@ -1,256 +1,97 @@ -# ------------------------------------------------------------------------------ -# FILE: roles/common/tasks/main.yml -# ------------------------------------------------------------------------------ -- name: Set Kubernetes-compatible hostname - become: true - ansible.builtin.hostname: - name: "{{ kubernetes_hostnames[inventory_hostname] | default(inventory_hostname) }}" - when: kubernetes_hostnames is defined - -- name: Remove zram-generator-defaults - become: true - ansible.builtin.dnf: - name: zram-generator-defaults - state: absent - -- name: Disable swap - ansible.builtin.command: swapoff -a - become: true - changed_when: false - -- name: Persist swap off by commenting out swap in fstab - become: true - ansible.builtin.replace: - path: /etc/fstab - regexp: '^(\s*)([^#\n]+\s+swap\s+.*)$' - replace: '#\2' - backup: true - +--- +# tasks file for kubernetes - name: Load required kernel modules become: true community.general.modprobe: name: "{{ item }}" - state: present - loop: - - overlay - - br_netfilter + loop: "{{ required_kernel_modules }}" - name: Persist kernel modules on boot become: true ansible.builtin.copy: dest: /etc/modules-load.d/k8s.conf + content: "{{ required_kernel_modules | join('\n') }}" + owner: root + group: root mode: '0644' - content: | - overlay - br_netfilter - name: Configure required sysctl params for Kubernetes become: true ansible.builtin.copy: - dest: /etc/sysctl.d/k8s.conf + dest: /etc/sysctl.d/kubernetes.conf + content: "{{ k8s_sysctl_params | join('\n') }}" + owner: root + group: root mode: '0644' - content: | - net.bridge.bridge-nf-call-iptables = 1 - net.bridge.bridge-nf-call-ip6tables = 1 - net.ipv4.ip_forward = 1 - name: Apply sysctl params without reboot become: true ansible.builtin.command: sysctl --system - changed_when: false -- name: Install python3-libselinux for managing selinux +- name: Manage firewall (ufw) become: true - ansible.builtin.dnf: - name: python3-libselinux - state: present + when: ansible_os_family == "Debian" + block: + - name: Create Kubernetes service definition (ufw) + ansible.builtin.template: + dest: /etc/ufw/applications.d/kubernetes + owner: root + group: root + mode: '0644' + src: kubernetes-ufw-service.xml.j2 -- name: Set SELinux to permissive mode +- name: Manage firewall (firewalld) become: true - ansible.posix.selinux: - policy: targeted - state: permissive + when: ansible_os_family == "RedHat" + block: + - name: Create Kubernetes service definition (firewalld) + ansible.builtin.template: + dest: /etc/firewalld/services/kubernetes.xml + owner: root + group: root + mode: '0644' + src: kubernetes-firewalld-service.xml.j2 -- name: Create Kubernetes service definition +- name: Install via apt become: true - ansible.builtin.copy: - dest: /etc/firewalld/services/kubernetes.xml - owner: root - group: root - mode: '0644' - content: | - - - Kubernetes - Kubernetes cluster communication ports - - - - - - - - - - - + when: ansible_os_family == "Debian" + block: + - name: Add Kubernetes apt key + ansible.builtin.apt_key: + url: "https://pkgs.k8s.io/core:/stable:/v{{ kubernetes_version }}/deb/Release.key" + state: present -- name: Reload firewalld to load new service + - name: Add Kubernetes repository + ansible.builtin.apt_repository: + repo: "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.28/deb/ /" + state: present + filename: kubernetes + + - name: Update apt cache + ansible.builtin.apt: + update_cache: true + +- name: Install via dnf (may not work) become: true - ansible.builtin.command: firewall-cmd --reload + when: ansible_os_family == "RedHat" + block: + - name: Add repo using key from URL (dnf) + ansible.builtin.yum_repository: + name: kubernetes + description: "Kubernetes repository" + baseurl: https://pkgs.k8s.io/core:/stable:/{{ kubernetes_version }}/rpm/ + gpgcheck: true + gpgkey: https://pkgs.k8s.io/core:/stable:/{{ kubernetes_version }}/rpm/repodata/repomd.xml.key -- name: Add Kubernetes service to default zone - become: true - ansible.builtin.command: firewall-cmd --permanent --add-service=kubernetes - -- name: Add SSH service to default zone (ensure SSH access) - become: true - ansible.builtin.command: firewall-cmd --permanent --add-service=ssh - -- name: Reload firewalld to apply changes - become: true - ansible.builtin.command: firewall-cmd --reload - -- name: Verify Kubernetes service is active - become: true - ansible.builtin.command: firewall-cmd --list-services - register: firewall_services - changed_when: false - -- name: Display active firewall services - ansible.builtin.debug: - msg: "Active firewall services: {{ firewall_services.stdout }}" - -- name: Install DNF plugins core for managing repositories - become: true - ansible.builtin.dnf: - name: dnf-plugins-core - state: present - -- name: Add Docker CE repository - become: true - ansible.builtin.yum_repository: - name: docker-ce - baseurl: https://download.docker.com/linux/fedora/docker-ce.repo - gpgcheck: false - enabled: true - description: "Docker repository" - -- name: Install containerd - become: true - ansible.builtin.dnf: - name: containerd - state: present - -- name: Create containerd config directory - become: true - ansible.builtin.file: - path: /etc/containerd - mode: '0755' - state: directory - -- name: Generate default containerd config and enable SystemdCgroup - become: true - ansible.builtin.shell: | - containerd config default > /etc/containerd/config.toml - sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml - args: - creates: /etc/containerd/config.toml - -- name: Restart and enable containerd service - become: true - ansible.builtin.systemd: - name: containerd - state: restarted - enabled: true - daemon_reload: true - -- name: Add Kubernetes repository - become: true - ansible.builtin.yum_repository: - name: kubernetes - description: Kubernetes - baseurl: https://pkgs.k8s.io/core:/stable:/v1.33/rpm/ - gpgkey: https://pkgs.k8s.io/core:/stable:/v1.33/rpm/repodata/repomd.xml.key - gpgcheck: true + - name: Update dnf cache + ansible.builtin.dnf: + update_cache: true - name: Install Kubernetes packages become: true - ansible.builtin.dnf: - name: - - kubelet - - kubeadm - - kubectl + ansible.builtin.package: + name: "{{ item }}" + update_cache: true state: present - disable_excludes: kubernetes - -- name: Create kubelet config directory - become: true - ansible.builtin.file: - path: /var/lib/kubelet - state: directory - owner: root - group: root - mode: '0755' - -- name: Create initial kubelet config file - become: true - ansible.builtin.copy: - dest: /var/lib/kubelet/config.yaml - owner: root - group: root - mode: '0644' - content: | - apiVersion: kubelet.config.k8s.io/v1beta1 - kind: KubeletConfiguration - authentication: - anonymous: - enabled: false - webhook: - enabled: true - x509: - clientCAFile: /etc/kubernetes/pki/ca.crt - authorization: - mode: Webhook - clusterDomain: cluster.local - clusterDNS: - - 10.96.0.10 - cpuManagerPolicy: none - evictionHard: - imagefs.available: 15% - memory.available: 100Mi - nodefs.available: 10% - nodefs.inodesFree: 5% - maxPods: 110 - podCIDR: {{ pod_network_cidr | default('10.244.0.0/16') }} - resolvConf: /etc/resolv.conf - runtimeRequestTimeout: 2m - staticPodPath: /etc/kubernetes/manifests - streamingConnectionIdleTimeout: 4h0m0s - syncFrequency: 1m0s - volumeStatsAggPeriod: 1m0s - -- name: Install CNI plugins via dnf - become: true - ansible.builtin.dnf: - name: containernetworking-plugins - state: present - -- name: Verify CNI plugins installation - become: true - ansible.builtin.command: ls -la /usr/libexec/cni/ - register: cni_plugins_list - changed_when: false - - - -- name: Display installed CNI plugins - ansible.builtin.debug: - msg: "Installed CNI plugins: {{ cni_plugins_list.stdout_lines }}" - -- name: Enable and start the kubelet service - become: true - ansible.builtin.systemd: - name: kubelet - enabled: true - state: started + loop: + "{{ kubernetes_packages }}" diff --git a/ansible/playbooks/roles/kubernetes/templates/kubernetes-firewalld-service.xml.j2 b/ansible/playbooks/roles/kubernetes/templates/kubernetes-firewalld-service.xml.j2 new file mode 100644 index 0000000..b203a1d --- /dev/null +++ b/ansible/playbooks/roles/kubernetes/templates/kubernetes-firewalld-service.xml.j2 @@ -0,0 +1,49 @@ + + + + kubernetes_API + Kubernetes API + + + + + etcd + Kubernetes etcd + + + + + kubelet + Kubernetes Kubelet + + + + + kube-scheduler + Kubernetes kube-scheduler + + + + + kube-controller-manager + Kubernetes kube-controller-manager + + + + + kube-proxy + Kubernetes kube-proxy + + + + + NodePort + NodePort + + + + + NodePort + NodePort + + diff --git a/ansible/playbooks/roles/kubernetes/templates/kubernetes-ufw-service.xml.j2 b/ansible/playbooks/roles/kubernetes/templates/kubernetes-ufw-service.xml.j2 new file mode 100644 index 0000000..d18ea05 --- /dev/null +++ b/ansible/playbooks/roles/kubernetes/templates/kubernetes-ufw-service.xml.j2 @@ -0,0 +1,34 @@ +[kubernetes_API] +title=Kubernetes API +description=KKubernetes API +ports=6443/tcp + +[etcd] +title=Kubernetes etcd +description=Kubernetes etcd +ports=2379:2380/tcp + +[kubelet] +title=Kubernetes Kubelet +description=Kubernetes Kubelet +ports=10250/tcp + +[kube-scheduler] +title=Kubernetes kube-scheduler +description=Kubernetes kube-scheduler +ports=10259/tcp + +[kube-controller-manager] +title=Kubernetes kube-controller-manager +description=Kubernetes kube-controller-manager +ports=10257/tcp + +[kube-proxy] +title=Kubernetes kube-proxy +description=Kubernetes kube-proxy +ports=10256/tcp + +[NodePort] +title=NodePort +description=NodePort +ports=30000:32767/tcp|30000:32767/udp \ No newline at end of file diff --git a/ansible/playbooks/roles/kubernetes/tests/inventory b/ansible/playbooks/roles/kubernetes/tests/inventory new file mode 100644 index 0000000..03ca42f --- /dev/null +++ b/ansible/playbooks/roles/kubernetes/tests/inventory @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +localhost + diff --git a/ansible/playbooks/roles/kubernetes/tests/test.yml b/ansible/playbooks/roles/kubernetes/tests/test.yml new file mode 100644 index 0000000..4825bd8 --- /dev/null +++ b/ansible/playbooks/roles/kubernetes/tests/test.yml @@ -0,0 +1,6 @@ +#SPDX-License-Identifier: MIT-0 +--- +- hosts: localhost + remote_user: root + roles: + - kubernetes diff --git a/ansible/playbooks/roles/kubernetes/vars/main.yml b/ansible/playbooks/roles/kubernetes/vars/main.yml new file mode 100644 index 0000000..20aab4c --- /dev/null +++ b/ansible/playbooks/roles/kubernetes/vars/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# vars file for kubernetes diff --git a/ansible/playbooks/roles/n8n/tasks/main.yml b/ansible/playbooks/roles/n8n/tasks/main.yml index 5244991..43c19a6 100644 --- a/ansible/playbooks/roles/n8n/tasks/main.yml +++ b/ansible/playbooks/roles/n8n/tasks/main.yml @@ -21,11 +21,6 @@ - ca-certificates - software-properties-common -# firewall -# sudo ufw enable -# sudo ufw allow ssh -# sudo ufw allow 5678/tcp - - name: 3. Enable UFW become: true community.general.ufw: diff --git a/ansible/playbooks/roles/time-sync/README.md b/ansible/playbooks/roles/time-sync/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/ansible/playbooks/roles/time-sync/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/ansible/roles/time-sync/defaults/main.yml b/ansible/playbooks/roles/time-sync/defaults/main.yml similarity index 100% rename from ansible/roles/time-sync/defaults/main.yml rename to ansible/playbooks/roles/time-sync/defaults/main.yml diff --git a/ansible/roles/time-sync/handlers/main.yml b/ansible/playbooks/roles/time-sync/handlers/main.yml similarity index 100% rename from ansible/roles/time-sync/handlers/main.yml rename to ansible/playbooks/roles/time-sync/handlers/main.yml diff --git a/ansible/playbooks/roles/time-sync/meta/main.yml b/ansible/playbooks/roles/time-sync/meta/main.yml new file mode 100644 index 0000000..36b9858 --- /dev/null +++ b/ansible/playbooks/roles/time-sync/meta/main.yml @@ -0,0 +1,35 @@ +#SPDX-License-Identifier: MIT-0 +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.1 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/ansible/playbooks/roles/time-sync/tasks/main.yml b/ansible/playbooks/roles/time-sync/tasks/main.yml new file mode 100644 index 0000000..5fba5ab --- /dev/null +++ b/ansible/playbooks/roles/time-sync/tasks/main.yml @@ -0,0 +1,41 @@ +--- +# tasks file for time-sync +- name: Manage Time Synchronization + become: true + block: + - name: Remove the ntp package + ansible.builtin.package: + name: ntp + state: absent + + - name: Install the chrony package + ansible.builtin.package: + name: chrony + state: present + + - name: Remove pool entries from Chrony config file + ansible.builtin.lineinfile: + path: /etc/chrony/chrony.conf + regexp: '^pool\s*' + state: absent + + - name: Add local NTP servers to Chrony config file + ansible.builtin.lineinfile: + path: /etc/chrony/chrony.conf + line: "server 10.1.71.21 iburst" + state: present + + - name: Start and enable chronyd + ansible.builtin.systemd: + name: chronyd + state: started + enabled: true + + - name: Force time synchronization + become: true + ansible.builtin.command: chronyc makestep + register: chronyc_status + + - name: Display chronyc status + ansible.builtin.debug: + var: chronyc_status.stdout diff --git a/ansible/playbooks/roles/time-sync/tests/inventory b/ansible/playbooks/roles/time-sync/tests/inventory new file mode 100644 index 0000000..03ca42f --- /dev/null +++ b/ansible/playbooks/roles/time-sync/tests/inventory @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +localhost + diff --git a/ansible/roles/time-sync/tests/test.yml b/ansible/playbooks/roles/time-sync/tests/test.yml similarity index 100% rename from ansible/roles/time-sync/tests/test.yml rename to ansible/playbooks/roles/time-sync/tests/test.yml diff --git a/ansible/roles/time-sync/vars/main.yml b/ansible/playbooks/roles/time-sync/vars/main.yml similarity index 100% rename from ansible/roles/time-sync/vars/main.yml rename to ansible/playbooks/roles/time-sync/vars/main.yml