rblundon/homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ansible scripts done to install kubewrnetes prequesites

Browse Source
This commit is contained in:
Ryan Blundon
2025-09-27 16:05:33 -05:00
parent 6107e474c1
commit 6f5bc65171
31 changed files with 498 additions and 406 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
ansible/playbooks/roles/kubernetes/README.md Normal file
View File

@@ -0,0 +1,38 @@
Role Name
=========
A brief description of the role goes here.
Requirements
------------
Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
Role Variables
--------------
A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
Dependencies
------------
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- hosts: servers
roles:
- { role: username.rolename, x: 42 }
License
-------
BSD
Author Information
------------------
An optional section for the role authors to include contact information, or a website (HTML is not allowed).

3
ansible/playbooks/roles/kubernetes/defaults/main.yml Normal file
View File

@@ -0,0 +1,3 @@
#SPDX-License-Identifier: MIT-0
---
# defaults file for kubernetes

3
ansible/playbooks/roles/kubernetes/handlers/main.yml Normal file
View File

@@ -0,0 +1,3 @@
#SPDX-License-Identifier: MIT-0
---
# handlers file for kubernetes

35
ansible/playbooks/roles/kubernetes/meta/main.yml Normal file
View File

@@ -0,0 +1,35 @@
#SPDX-License-Identifier: MIT-0
galaxy_info:
author: your name
description: your role description
company: your company (optional)
# If the issue tracker for your role is not on github, uncomment the
# next line and provide a value
# issue_tracker_url: http://example.com/issue/tracker
# Choose a valid license ID from https://spdx.org - some suggested licenses:
# - BSD-3-Clause (default)
# - MIT
# - GPL-2.0-or-later
# - GPL-3.0-only
# - Apache-2.0
# - CC-BY-4.0
license: license (GPL-2.0-or-later, MIT, etc)
min_ansible_version: 2.1
# If this a Container Enabled role, provide the minimum Ansible Container version.
# min_ansible_container_version:
galaxy_tags: []
# List tags for your role here, one per line. A tag is a keyword that describes
# and categorizes the role. Users find roles by searching for tags. Be sure to
# remove the '[]' above, if you add tags to this list.
#
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
# Maximum 20 tags per role.
dependencies: []
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
# if you add dependencies to this list.

289
ansible/playbooks/roles/kubernetes/tasks/main.yml
View File

@@ -1,256 +1,97 @@
# ------------------------------------------------------------------------------
# FILE: roles/common/tasks/main.yml
# ------------------------------------------------------------------------------
- name: Set Kubernetes-compatible hostname
become: true
ansible.builtin.hostname:
name: "{{ kubernetes_hostnames[inventory_hostname] | default(inventory_hostname) }}"
when: kubernetes_hostnames is defined
- name: Remove zram-generator-defaults
become: true
ansible.builtin.dnf:
name: zram-generator-defaults
state: absent
- name: Disable swap
ansible.builtin.command: swapoff -a
become: true
changed_when: false
- name: Persist swap off by commenting out swap in fstab
become: true
ansible.builtin.replace:
path: /etc/fstab
regexp: '^(\s*)([^#\n]+\s+swap\s+.*)$'
replace: '#\2'
backup: true
---
# tasks file for kubernetes
- name: Load required kernel modules
become: true
community.general.modprobe:
name: "{{ item }}"
state: present
loop:
- overlay
- br_netfilter
loop: "{{ required_kernel_modules }}"
- name: Persist kernel modules on boot
become: true
ansible.builtin.copy:
dest: /etc/modules-load.d/k8s.conf
content: "{{ required_kernel_modules | join('\n') }}"
owner: root
group: root
mode: '0644'
content: |
overlay
br_netfilter
- name: Configure required sysctl params for Kubernetes
become: true
ansible.builtin.copy:
dest: /etc/sysctl.d/k8s.conf
dest: /etc/sysctl.d/kubernetes.conf
content: "{{ k8s_sysctl_params | join('\n') }}"
owner: root
group: root
mode: '0644'
content: |
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
- name: Apply sysctl params without reboot
become: true
ansible.builtin.command: sysctl --system
changed_when: false
- name: Install python3-libselinux for managing selinux
- name: Manage firewall (ufw)
become: true
ansible.builtin.dnf:
name: python3-libselinux
state: present
when: ansible_os_family == "Debian"
block:
- name: Create Kubernetes service definition (ufw)
ansible.builtin.template:
dest: /etc/ufw/applications.d/kubernetes
owner: root
group: root
mode: '0644'
src: kubernetes-ufw-service.xml.j2
- name: Set SELinux to permissive mode
- name: Manage firewall (firewalld)
become: true
ansible.posix.selinux:
policy: targeted
state: permissive
when: ansible_os_family == "RedHat"
block:
- name: Create Kubernetes service definition (firewalld)
ansible.builtin.template:
dest: /etc/firewalld/services/kubernetes.xml
owner: root
group: root
mode: '0644'
src: kubernetes-firewalld-service.xml.j2
- name: Create Kubernetes service definition
- name: Install via apt
become: true
ansible.builtin.copy:
dest: /etc/firewalld/services/kubernetes.xml
owner: root
group: root
mode: '0644'
content: |
<?xml version="1.0" encoding="utf-8"?>
<service>
<short>Kubernetes</short>
<description>Kubernetes cluster communication ports</description>
<port protocol="tcp" port="6443"/>
<port protocol="tcp" port="2379"/>
<port protocol="tcp" port="2380"/>
<port protocol="tcp" port="10250"/>
<port protocol="tcp" port="10251"/>
<port protocol="tcp" port="10252"/>
<port protocol="tcp" port="10255"/>
<port protocol="tcp" port="30000-32767"/>
<port protocol="udp" port="4789"/>
<port protocol="tcp" port="179"/>
</service>
when: ansible_os_family == "Debian"
block:
- name: Add Kubernetes apt key
ansible.builtin.apt_key:
url: "https://pkgs.k8s.io/core:/stable:/v{{ kubernetes_version }}/deb/Release.key"
state: present
- name: Reload firewalld to load new service
- name: Add Kubernetes repository
ansible.builtin.apt_repository:
repo: "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.28/deb/ /"
state: present
filename: kubernetes
- name: Update apt cache
ansible.builtin.apt:
update_cache: true
- name: Install via dnf (may not work)
become: true
ansible.builtin.command: firewall-cmd --reload
when: ansible_os_family == "RedHat"
block:
- name: Add repo using key from URL (dnf)
ansible.builtin.yum_repository:
name: kubernetes
description: "Kubernetes repository"
baseurl: https://pkgs.k8s.io/core:/stable:/{{ kubernetes_version }}/rpm/
gpgcheck: true
gpgkey: https://pkgs.k8s.io/core:/stable:/{{ kubernetes_version }}/rpm/repodata/repomd.xml.key
- name: Add Kubernetes service to default zone
become: true
ansible.builtin.command: firewall-cmd --permanent --add-service=kubernetes
- name: Add SSH service to default zone (ensure SSH access)
become: true
ansible.builtin.command: firewall-cmd --permanent --add-service=ssh
- name: Reload firewalld to apply changes
become: true
ansible.builtin.command: firewall-cmd --reload
- name: Verify Kubernetes service is active
become: true
ansible.builtin.command: firewall-cmd --list-services
register: firewall_services
changed_when: false
- name: Display active firewall services
ansible.builtin.debug:
msg: "Active firewall services: {{ firewall_services.stdout }}"
- name: Install DNF plugins core for managing repositories
become: true
ansible.builtin.dnf:
name: dnf-plugins-core
state: present
- name: Add Docker CE repository
become: true
ansible.builtin.yum_repository:
name: docker-ce
baseurl: https://download.docker.com/linux/fedora/docker-ce.repo
gpgcheck: false
enabled: true
description: "Docker repository"
- name: Install containerd
become: true
ansible.builtin.dnf:
name: containerd
state: present
- name: Create containerd config directory
become: true
ansible.builtin.file:
path: /etc/containerd
mode: '0755'
state: directory
- name: Generate default containerd config and enable SystemdCgroup
become: true
ansible.builtin.shell: |
containerd config default > /etc/containerd/config.toml
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
args:
creates: /etc/containerd/config.toml
- name: Restart and enable containerd service
become: true
ansible.builtin.systemd:
name: containerd
state: restarted
enabled: true
daemon_reload: true
- name: Add Kubernetes repository
become: true
ansible.builtin.yum_repository:
name: kubernetes
description: Kubernetes
baseurl: https://pkgs.k8s.io/core:/stable:/v1.33/rpm/
gpgkey: https://pkgs.k8s.io/core:/stable:/v1.33/rpm/repodata/repomd.xml.key
gpgcheck: true
- name: Update dnf cache
ansible.builtin.dnf:
update_cache: true
- name: Install Kubernetes packages
become: true
ansible.builtin.dnf:
name:
- kubelet
- kubeadm
- kubectl
ansible.builtin.package:
name: "{{ item }}"
update_cache: true
state: present
disable_excludes: kubernetes
- name: Create kubelet config directory
become: true
ansible.builtin.file:
path: /var/lib/kubelet
state: directory
owner: root
group: root
mode: '0755'
- name: Create initial kubelet config file
become: true
ansible.builtin.copy:
dest: /var/lib/kubelet/config.yaml
owner: root
group: root
mode: '0644'
content: |
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
authentication:
anonymous:
enabled: false
webhook:
enabled: true
x509:
clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
mode: Webhook
clusterDomain: cluster.local
clusterDNS:
- 10.96.0.10
cpuManagerPolicy: none
evictionHard:
imagefs.available: 15%
memory.available: 100Mi
nodefs.available: 10%
nodefs.inodesFree: 5%
maxPods: 110
podCIDR: {{ pod_network_cidr | default('10.244.0.0/16') }}
resolvConf: /etc/resolv.conf
runtimeRequestTimeout: 2m
staticPodPath: /etc/kubernetes/manifests
streamingConnectionIdleTimeout: 4h0m0s
syncFrequency: 1m0s
volumeStatsAggPeriod: 1m0s
- name: Install CNI plugins via dnf
become: true
ansible.builtin.dnf:
name: containernetworking-plugins
state: present
- name: Verify CNI plugins installation
become: true
ansible.builtin.command: ls -la /usr/libexec/cni/
register: cni_plugins_list
changed_when: false
- name: Display installed CNI plugins
ansible.builtin.debug:
msg: "Installed CNI plugins: {{ cni_plugins_list.stdout_lines }}"
- name: Enable and start the kubelet service
become: true
ansible.builtin.systemd:
name: kubelet
enabled: true
state: started
loop:
"{{ kubernetes_packages }}"

49
ansible/playbooks/roles/kubernetes/templates/kubernetes-firewalld-service.xml.j2 Normal file
View File

@@ -0,0 +1,49 @@
<?xml version="1.0" encoding="utf-8"?>
<service>
<short>kubernetes_API</short>
<description>Kubernetes API</description>
<port protocol="tcp" port="6443"/>
</service>
<service>
<short>etcd</short>
<description>Kubernetes etcd</description>
<port protocol="tcp" port="2379-2380"/>
</service>
<service>
<short>kubelet</short>
<description>Kubernetes Kubelet</description>
<port protocol="tcp" port="10250"/>
</service>
<service>
<short>kube-scheduler</short>
<description>Kubernetes kube-scheduler</description>
<port protocol="tcp" port="10259"/>
</service>
<service>
<short>kube-controller-manager</short>
<description>Kubernetes kube-controller-manager</description>
<port protocol="tcp" port="10257"/>
</service>
<service>
<short>kube-proxy</short>
<description>Kubernetes kube-proxy</description>
<port protocol="tcp" port="10256"/>
</service>
<service>
<short>NodePort</short>
<description>NodePort</description>
<port protocol="tcp" port="30000-32767"/>
</service>
<service>
<short>NodePort</short>
<description>NodePort</description>
<port protocol="udp" port="30000-32767"/>
</service>

34
ansible/playbooks/roles/kubernetes/templates/kubernetes-ufw-service.xml.j2 Normal file
View File

@@ -0,0 +1,34 @@
[kubernetes_API]
title=Kubernetes API
description=KKubernetes API
ports=6443/tcp
[etcd]
title=Kubernetes etcd
description=Kubernetes etcd
ports=2379:2380/tcp
[kubelet]
title=Kubernetes Kubelet
description=Kubernetes Kubelet
ports=10250/tcp
[kube-scheduler]
title=Kubernetes kube-scheduler
description=Kubernetes kube-scheduler
ports=10259/tcp
[kube-controller-manager]
title=Kubernetes kube-controller-manager
description=Kubernetes kube-controller-manager
ports=10257/tcp
[kube-proxy]
title=Kubernetes kube-proxy
description=Kubernetes kube-proxy
ports=10256/tcp
[NodePort]
title=NodePort
description=NodePort
ports=30000:32767/tcp|30000:32767/udp

3
ansible/playbooks/roles/kubernetes/tests/inventory Normal file
View File

@@ -0,0 +1,3 @@
#SPDX-License-Identifier: MIT-0
localhost

6
ansible/playbooks/roles/kubernetes/tests/test.yml Normal file
View File

@@ -0,0 +1,6 @@
#SPDX-License-Identifier: MIT-0
---
- hosts: localhost
remote_user: root
roles:
- kubernetes

3
ansible/playbooks/roles/kubernetes/vars/main.yml Normal file
View File

@@ -0,0 +1,3 @@
#SPDX-License-Identifier: MIT-0
---
# vars file for kubernetes