rblundon/homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: archive deprecated Ansible content (OpenShift, Fastpass, FreeIPA, k8s)

Browse Source
This commit is contained in:
Ryan Blundon
2026-02-25 20:44:49 -06:00
parent 286d20f8c1
commit 8c8835d1d5
85 changed files with 0 additions and 4235 deletions
Download Patch File Download Diff File Expand all files Collapse all files

309
ansible/FASTPASS_DEPLOYMENT_GUIDE.md
View File

@@ -1,309 +0,0 @@
# FastPass Kubernetes Cluster - Complete Deployment Guide
## Overview
This guide provides step-by-step instructions for deploying a complete Kubernetes cluster on Fedora using Ansible automation. The FastPass cluster is designed for high availability with multiple control plane nodes and worker nodes.
## Prerequisites
### System Requirements
- **OS**: Fedora 38+ (64-bit)
- **Memory**: Minimum 2GB RAM per node
- **CPU**: Minimum 2 cores per node
- **Storage**: Minimum 10GB free space
- **Network**: All nodes must be able to communicate
### Software Requirements
- Ansible 2.15+
- Python 3.8+
- SSH access to all nodes with sudo privileges
## Quick Start
### 1. Validate Your Setup
Before deploying, run the validation script:
```bash
cd ansible
./scripts/test-fastpass-deployment.sh
```
This will check:
- ✅ Ansible installation
- ✅ Inventory configuration
- ✅ Playbook files
- ✅ Role files
- ✅ Group variables
- ✅ Playbook syntax
- ✅ Common issues
### 2. Deploy the Cluster
```bash
# Deploy the complete cluster
ansible-playbook -i inventory.yml playbooks/deploy-fastpass-cluster.yml
```
## Deployment Process
The deployment follows this sequence:
### Phase 1: System Preparation
- **Hosts**: All FastPass nodes
- **Tasks**:
- Preflight checks (OS, memory, CPU, disk space)
- Disable swap and configure kernel modules
- Install and configure containerd
- Install Kubernetes packages
### Phase 2: Control Plane Initialization
- **Hosts**: First control plane node (`space-mountain`)
- **Tasks**:
- Initialize the Kubernetes cluster
- Configure API server and etcd
- Install Flannel CNI
- Generate join commands
### Phase 3: Additional Control Plane Nodes
- **Hosts**: Remaining control plane nodes (`big-thunder-mountain`, `splash-mountain`)
- **Tasks**:
- Join additional control plane nodes
- Configure high availability
### Phase 4: Worker Nodes
- **Hosts**: Worker nodes (`haunted-mansion`, `peter-pans-flight`)
- **Tasks**:
- Join worker nodes to the cluster
- Apply node labels and taints
### Phase 5: Validation
- **Hosts**: First control plane node
- **Tasks**:
- Verify all nodes are ready
- Check all pods are running
- Display final cluster status
## Configuration
### Inventory Structure
Ensure your `inventory.yml` has the correct structure:
```yaml
fastpass_control_plane:
hosts:
space-mountain:
big-thunder-mountain:
splash-mountain:
fastpass_workers:
hosts:
haunted-mansion:
peter-pans-flight:
fastpass:
children:
fastpass_control_plane:
fastpass_workers:
```
### Group Variables
Key variables in `group_vars/fastpass/vars`:
```yaml
# Cluster Configuration
cluster_name: "fastpass"
kubernetes_version: "1.33"
pod_network_cidr: "10.244.0.0/16"
service_cidr: "10.96.0.0/12"
# Control Plane Configuration
control_plane_endpoint: "fastpass.local.mk-labs.cloud"
control_plane_port: "6443"
# CNI Configuration
cni_plugin: "flannel"
# Node Labels
node_labels:
zone:
# Control Plane nodes (masters) - no zone labels needed
# space-mountain: (control plane - no zone label)
# big-thunder-mountain: (control plane - no zone label)
# splash-mountain: (control plane - no zone label)
# Worker nodes
haunted-mansion: "backstage" # Internal/backstage workloads
peter-pans-flight: "backstage" # Internal/backstage workloads
# Future node: "on-stage" # External/on-stage workloads (future)
```
## Troubleshooting
### Common Issues
#### 1. Swap Enabled
**Problem**: `running with swap on is not supported`
**Solution**: The playbook automatically disables swap, but if it persists:
```bash
# On the problematic node
sudo swapoff -a
sudo systemctl restart kubelet
```
#### 2. CNI Not Ready
**Problem**: `Network plugin returns error: cni plugin not initialized`
**Solution**: The playbook installs Flannel automatically. If issues persist:
```bash
kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml
```
#### 3. Control Plane Endpoint Issues
**Problem**: `unable to add a new control plane instance to a cluster that doesn't have a stable controlPlaneEndpoint`
**Solution**: The playbook uses the first control plane node as the endpoint. For production, consider using a load balancer.
#### 4. Permission Issues
**Problem**: `User "kubernetes-admin" cannot create resource "secrets"`
**Solution**: The playbook uses super-admin.conf for proper permissions.
### Debug Commands
```bash
# Check node status
kubectl get nodes -o wide
# Check pod status
kubectl get pods --all-namespaces
# Check kubelet logs
journalctl -u kubelet -f
# Check API server logs
kubectl logs -n kube-system kube-apiserver-space-mountain
# Check CNI status
kubectl get pods -n kube-flannel
```
## Post-Deployment
### 1. Verify Cluster Health
```bash
# Check all nodes are ready
kubectl get nodes -o wide
# Check all pods are running
kubectl get pods --all-namespaces
# Test cluster connectivity
kubectl cluster-info
```
### 2. Manage Kubeconfig
Use the provided script to manage different cluster configurations:
```bash
# Switch to FastPass cluster
./scripts/manage-kubeconfigs.sh fastpass
# Check status
./scripts/manage-kubeconfigs.sh status
# Test connectivity
./scripts/manage-kubeconfigs.sh test
```
### 3. Deploy Applications
Your cluster is now ready for workloads:
```bash
# Deploy a test application
kubectl run nginx --image=nginx --port=80
# Create a service
kubectl expose pod nginx --port=80 --type=NodePort
# Check the service
kubectl get svc nginx
```
## Maintenance
### Adding New Nodes
1. Add the new node to the inventory
2. Run the preparation role:
```bash
ansible-playbook -i inventory.yml playbooks/deploy_k8s.yml --limit=new-node
```
3. Join the node to the cluster manually or extend the playbook
### Upgrading Kubernetes
1. Update the `kubernetes_version` variable
2. Run the preparation role on all nodes
3. Upgrade control plane nodes first
4. Upgrade worker nodes
### Backup and Recovery
- Backup `/etc/kubernetes/` directory on control plane nodes
- Backup etcd data: `etcdctl snapshot save backup.db`
- Document cluster configuration
## Architecture
```
FastPass Cluster Architecture:
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ Control Plane │ │ Control Plane │ │ Control Plane │
│ space-mountain │ │big-thunder-mtn │ │ splash-mountain │
│ (Masters) │ │ (Masters) │ │ (Masters) │
│ No Zone Label │ │ No Zone Label │ │ No Zone Label │
└─────────────────┘ └─────────────────┘ └─────────────────┘
│ │ │
└───────────────────────┼───────────────────────┘
│
┌───────────────────────┼───────────────────────┐
│ │ │
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ Worker Node │ │ Worker Node │ │ Worker Node │
│ haunted-mansion │ │peter-pans-flight│ │ (Future) │
│ (Backstage) │ │ (Backstage) │ │ (On-Stage) │
│ zone=backstage │ │ zone=backstage │ │ zone=on-stage │
└─────────────────┘ └─────────────────┘ └─────────────────┘
```
## Support
For issues specific to this deployment:
1. Check the troubleshooting section
2. Review Ansible logs with `-vvv` verbosity
3. Check system logs on affected nodes
4. Verify network connectivity between nodes
## Files Structure
```
ansible/
├── group_vars/
│ └── fastpass/
│ └── vars # Cluster configuration
├── playbooks/
│ ├── deploy-fastpass-cluster.yml # Main deployment playbook
│ ├── deploy_k8s.yml # Legacy deployment playbook
│ └── roles/
│ ├── kubernetes/ # System preparation
│ ├── fastpass-control-plane/ # Control plane setup
│ ├── fastpass-control-plane-join/ # Additional control plane nodes
│ └── fastpass-workers/ # Worker node setup
├── scripts/
│ ├── test-fastpass-deployment.sh # Validation script
│ └── manage-kubeconfigs.sh # Kubeconfig management
└── inventory.yml # Host inventory
```

228
ansible/FASTPASS_README.md
View File

@@ -1,228 +0,0 @@
# FastPass Kubernetes Cluster - Fedora Deployment Guide
## Overview
This guide covers the deployment of a Kubernetes cluster on Fedora using Ansible automation. The FastPass cluster is designed for high availability with multiple control plane nodes and worker nodes.
## Architecture
```
FastPass Cluster Architecture:
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ Control Plane │ │ Control Plane │ │ Control Plane │
│ space-mountain │ │big-thunder-mtn │ │ splash-mountain │
│ (Leader) │ │ │ │ │
└─────────────────┘ └─────────────────┘ └─────────────────┘
│ │ │
└───────────────────────┼───────────────────────┘
│
┌───────────────────────┼───────────────────────┐
│ │ │
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ Worker Node │ │ Worker Node │ │ Worker Node │
│ haunted-mansion │ │peter-pans-flight│ │ (Future) │
│ (backstage) │ │ (backstage) │ │ │
└─────────────────┘ └─────────────────┘ └─────────────────┘
```
## Prerequisites
### System Requirements
- **OS**: Fedora 38+ (64-bit)
- **Memory**: Minimum 2GB RAM per node
- **CPU**: Minimum 2 cores per node
- **Storage**: Minimum 10GB free space
- **Network**: All nodes must be able to communicate
### Software Requirements
- Ansible 2.15+
- Python 3.8+
- SSH access to all nodes with sudo privileges
## Quick Start
### 1. Prepare Inventory
Ensure your `inventory.yml` has the correct host groups:
```yaml
fastpass_control_plane:
hosts:
space-mountain:
big-thunder-mountain:
splash-mountain:
fastpass_workers:
hosts:
haunted-mansion:
peter-pans-flight:
fastpass:
children:
fastpass_control_plane:
fastpass_workers:
```
### 2. Configure Variables
Edit `group_vars/fastpass/vars` to customize your deployment:
```yaml
# Cluster Configuration
cluster_name: "fastpass"
kubernetes_version: "1.33"
pod_network_cidr: "10.244.0.0/16"
service_cidr: "10.96.0.0/12"
# Node Labels
node_labels:
zone:
space-mountain: "external"
big-thunder-mountain: "external"
splash-mountain: "external"
haunted-mansion: "internal"
peter-pans-flight: "internal"
```
### 3. Deploy the Cluster
```bash
# Deploy the complete cluster
ansible-playbook -i inventory.yml playbooks/deploy-fastpass-cluster.yml
# Or deploy step by step
ansible-playbook -i inventory.yml playbooks/deploy_k8s.yml
```
## Deployment Process
### Phase 1: System Preparation
- Preflight checks (OS, memory, CPU, disk space)
- Disable swap and configure kernel modules
- Install and configure containerd
- Install Kubernetes packages
### Phase 2: Control Plane Setup
- Initialize the first control plane node
- Configure API server and etcd
- Install Calico CNI
- Join additional control plane nodes
### Phase 3: Worker Node Setup
- Join worker nodes to the cluster
- Apply node labels and taints
- Verify cluster health
## Troubleshooting
### Common Issues
#### 1. Repository Errors
**Problem**: Docker CE repository not found
**Solution**: Update the repository URL in `container-runtime.yml`:
```yaml
baseurl: "https://download.docker.com/linux/fedora/{{ ansible_distribution_major_version }}/x86_64/stable"
```
#### 2. kubeadm Init Failures
**Problem**: kubeadm init fails with preflight errors
**Solution**: The playbook includes `--ignore-preflight-errors=all` flag
#### 3. Node Not Ready
**Problem**: Worker nodes stuck in NotReady state
**Solution**: Check CNI installation and network connectivity
### Debug Commands
```bash
# Check node status
kubectl get nodes -o wide
# Check pod status
kubectl get pods --all-namespaces
# Check kubelet logs
journalctl -u kubelet -f
# Check containerd status
systemctl status containerd
```
## Customization
### Network Configuration
Modify the pod and service CIDRs in `group_vars/fastpass/vars`:
```yaml
pod_network_cidr: "10.244.0.0/16"
service_cidr: "10.96.0.0/12"
```
### CNI Selection
The default CNI is Calico. To change, modify the control plane role:
```yaml
cni_plugin: "flannel" # or "weave", "cilium"
```
### Node Labels and Taints
Configure node labels in `group_vars/fastpass/vars`:
```yaml
node_labels:
zone:
space-mountain: "external"
haunted-mansion: "internal"
environment: "production"
cluster: "fastpass"
```
## Maintenance
### Adding New Nodes
1. Add the new node to the inventory
2. Run the preparation role: `ansible-playbook -i inventory.yml playbooks/deploy_k8s.yml --limit=new-node`
3. Join the node to the cluster
### Upgrading Kubernetes
1. Update the `kubernetes_version` variable
2. Run the preparation role on all nodes
3. Upgrade control plane nodes first
4. Upgrade worker nodes
### Backup and Recovery
- Backup `/etc/kubernetes/` directory on control plane nodes
- Backup etcd data: `etcdctl snapshot save backup.db`
- Document cluster configuration
## Security Considerations
- SELinux is set to permissive mode for compatibility
- Firewalld is disabled (configure as needed for your environment)
- Consider enabling RBAC and network policies
- Regularly update Kubernetes and system packages
## Support
For issues specific to this deployment:
1. Check the troubleshooting section
2. Review Ansible logs with `-vvv` verbosity
3. Check system logs on affected nodes
4. Verify network connectivity between nodes
## Files Structure
```
ansible/
├── group_vars/
│ └── fastpass/
│ └── vars # Cluster configuration
├── playbooks/
│ ├── deploy-fastpass-cluster.yml # Main deployment playbook
│ ├── deploy_k8s.yml # Legacy deployment playbook
│ └── roles/
│ ├── kubernetes/ # System preparation
│ ├── fastpass-control-plane/ # Control plane setup
│ └── fastpass-workers/ # Worker node setup
└── inventory.yml # Host inventory
```

233
ansible/KUBECONFIG_MANAGEMENT.md
View File

@@ -1,233 +0,0 @@
# Kubeconfig Management - Modular & Repeatable
This document explains the modular kubeconfig management system for your homelab's multiple Kubernetes clusters.
## Overview
The kubeconfig management has been refactored into reusable, modular components that can handle multiple clusters seamlessly:
- **FastPass** (Vanilla Kubernetes)
- **Hub Cluster** (OpenShift SNO)
- **Internal Cluster** (OpenShift)
- **Future clusters** (easily extensible)
## Architecture
```
ansible/playbooks/roles/
├── kubeconfig-manager/ # Core reusable role
│ ├── tasks/main.yml # Main entry point
│ ├── tasks/merge-kubeconfig.yml # Merging logic
│ ├── defaults/main.yml # Default variables
│ └── README.md # Role documentation
├── cluster-kubeconfig/ # Generic wrapper role
└── fastpass-first-control-plane/ # Uses kubeconfig-manager
```
## Quick Usage
### 1. Using the Script (Easiest)
```bash
cd ansible
# Setup FastPass cluster kubeconfig
./scripts/setup-kubeconfig.sh fastpass fastpass_control_plane[0]
# Setup Hub cluster kubeconfig
./scripts/setup-kubeconfig.sh hub hub_cluster
# Setup Internal cluster kubeconfig
./scripts/setup-kubeconfig.sh internal internal_cluster[0]
```
### 2. Direct Ansible Usage
```bash
# Single cluster
ansible-playbook -i inventory.yml \
playbooks/examples/multi-cluster-kubeconfig.yml \
--limit fastpass_control_plane[0] \
-e target_cluster_name=fastpass
# Multiple clusters at once
ansible-playbook -i inventory.yml \
playbooks/examples/multi-cluster-kubeconfig.yml
```
### 3. In Your Own Playbooks
```yaml
- name: Setup kubeconfig for any cluster
hosts: my_cluster_nodes[0]
roles:
- role: kubeconfig-manager
vars:
cluster_name: "my-cluster"
kubeconfig_source_path: "/etc/kubernetes/admin.conf"
```
## Features
### ✅ **Modular & Reusable**
- Single role works with any Kubernetes cluster
- Easy to extend for new clusters
- Consistent behavior across all clusters
### ✅ **Safe Operations**
- Automatic backups before merging
- Non-destructive merging
- Preserves existing contexts
### ✅ **Multi-Cluster Ready**
- Unique naming: `cluster-name-admin`
- No conflicts between clusters
- Easy context switching
### ✅ **Homelab Optimized**
- Works with vanilla Kubernetes
- Works with OpenShift
- Handles different kubeconfig paths
## Generated Structure
After running the kubeconfig management:
```bash
~/.kube/
├── config # Merged config with all clusters
├── config-fastpass # Individual cluster configs
├── config-hub
├── config-internal
└── config.backup.1697123456 # Timestamped backups
```
## Context Management
```bash
# List all available contexts
kubectl config get-contexts
# Switch between clusters
kubectl config use-context fastpass-admin
kubectl config use-context hub-admin
kubectl config use-context internal-admin
# Check current context
kubectl config current-context
# Test connectivity
kubectl cluster-info
kubectl get nodes
```
## Integration with Existing Roles
### Before (Monolithic)
```yaml
# fastpass-first-control-plane/tasks/main.yml
- name: 50+ lines of kubeconfig logic
# Lots of repetitive code
```
### After (Modular)
```yaml
# fastpass-first-control-plane/tasks/main.yml
- name: Setup kubeconfig for FastPass cluster
ansible.builtin.include_role:
name: kubeconfig-manager
vars:
cluster_name: "{{ cluster_name }}"
```
## Adding New Clusters
To add a new cluster (e.g., "edge-cluster"):
1. **Add to inventory:**
```yaml
edge_cluster:
hosts:
edge-node-01:
```
2. **Use the script:**
```bash
./scripts/setup-kubeconfig.sh edge edge_cluster[0]
```
3. **Or add to playbook:**
```yaml
- name: Setup kubeconfig for Edge cluster
hosts: edge_cluster[0]
roles:
- role: kubeconfig-manager
vars:
cluster_name: "edge"
```
## Customization
### Different Kubeconfig Paths
```yaml
- role: kubeconfig-manager
vars:
cluster_name: "openshift-cluster"
kubeconfig_source_path: "/etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/localhost.kubeconfig"
```
### Custom Context Names
```yaml
- role: kubeconfig-manager
vars:
cluster_name: "prod"
context_suffix: "system:admin" # Results in "prod-system:admin"
```
## Troubleshooting
### Common Issues
1. **Permission Denied**
```bash
# Fix ownership
sudo chown -R $USER:$USER ~/.kube/
```
2. **Context Not Found**
```bash
# List available contexts
kubectl config get-contexts
# Check if cluster was added
kubectl config view
```
3. **Backup Recovery**
```bash
# Restore from backup
cp ~/.kube/config.backup.1697123456 ~/.kube/config
```
### Debug Mode
```bash
# Run with verbose output
ansible-playbook -vvv playbooks/examples/multi-cluster-kubeconfig.yml
```
## Benefits for Your Homelab
1. **Consistency**: Same process for all clusters
2. **Maintainability**: Single role to update/fix
3. **Scalability**: Easy to add new clusters
4. **Safety**: Automatic backups and safe merging
5. **Flexibility**: Works with different Kubernetes distributions
## Next Steps
1. **Test the modular approach** with your FastPass cluster
2. **Extend to Hub and Internal clusters** using the same pattern
3. **Create cluster-specific variables** in group_vars if needed
4. **Add monitoring/validation** tasks to verify kubeconfig health
This modular approach makes your homelab's multi-cluster management much more maintainable and repeatable!

66
ansible/group_vars/fastpass/vars
View File

@@ -1,66 +0,0 @@
---
# FastPass Kubernetes Cluster Variables
# Cluster Configuration
cluster_name: "fastpass"
kubernetes_version: "1.33"
pod_network_cidr: "10.244.0.0/16"
service_cidr: "10.96.0.0/12"
# Control Plane Configuration
control_plane_endpoint: "{{ cluster_name}}.{{ base_domain}}"
control_plane_port: "6443"
# CNI Configuration
cni_plugin: "calico"
calico_version: "v3.30.3"
# Node Labels and Taints
node_labels:
zone:
# Control Plane nodes (masters) - no zone labels needed
# space-mountain: (control plane - no zone label)
# big-thunder-mountain: (control plane - no zone label)
# splash-mountain: (control plane - no zone label)
# Worker nodes
haunted-mansion: "backstage" # Internal/backstage workloads
peter-pans-flight: "backstage" # Internal/backstage workloads
# Future node: "on-stage" # External/on-stage workloads (future)
environment: "production"
cluster: "fastpass"
# System Configuration
selinux_mode: "permissive"
firewall_enabled: false
# Container Runtime
container_runtime: "containerd"
containerd_version: "latest"
# Repository Configuration
kubernetes_repo_url: "https://pkgs.k8s.io/core:/stable:/v1.33/rpm/"
containerd_repo_url: "https://download.docker.com/linux/fedora/docker-ce.repo"
# Validation
preflight_checks: true
validate_cluster: true
# Kubeconfig Configuration
kubeconfig_path: "{{ lookup('env', 'HOME') }}/.kube/config"
# Hostname Configuration for Kubernetes
# Override hostnames to remove dots for Kubernetes compatibility
kubernetes_hostnames:
space-mountain: "space-mountain"
big-thunder-mountain: "big-thunder-mountain"
splash-mountain: "splash-mountain"
haunted-mansion: "haunted-mansion"
peter-pans-flight: "peter-pans-flight"
# Generic Kubernetes Prerequisites Configuration
configure_firewall: true
configure_ntp: true
selinux_state: "permissive"
disable_swap: true

3
ansible/group_vars/freeipa/vars
View File

@@ -1,3 +0,0 @@
---
#freeipa_user: "admin"
#freeipa_password: "{{ vault_freeipa_password }}"

51
ansible/group_vars/hub_cluster/vars
View File

@@ -1,51 +0,0 @@
# file: group_vars/hub_cluster/vars
# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
# Cluster deployed via Agent Installer and Matchbox (iPXE):
# Name of the OpenShift Cluster
cluster_name: "hub"
# Version of OpenShift to install. All available versions can be found at: https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/
cluster_version: "4.18.21"
# Type of cluster.
# - none (Single Node Cluster)
# - baremetal (Traditional and Compact Cluster)
platform_type: "none"
# Number of nodes to deploy
# - Master: 1; Worker 0 (Single Node Cluster)
# - Master: 3; Worker 0 (Compact Cluster)
# - Master: 3; Worker 1-3 (Traditional Cluster)
master_node_count: 1
worker_node_count: 0
# Subnet that cluster nodes will reside on.
machine_network: "10.1.71.0/24"
# OpenShift API IP Address (Reference host IP address for Single Node Cluster)
api_address: "{{ ip_address }}" # "10.1.71.10"
# OpenShift Apps Wildcard IP Address (Reference host IP address for Single Node Cluster)
app_address: "{{ ip_address }}" # "10.1.71.10"
# These are internal networks to the cluster and should not need to be changed.
cluster_network: "10.128.0.0/14"
cluster_network_host_prefix: 23
service_network: "172.30.0.0/16"
# Static Variables
openshift_installer_file: "openshift-install-linux.tar.gz"
openshift_client_file: "openshift-client-linux.tar.gz"
openshift_installer_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_installer_file }}"
openshift_client_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_client_file }}"

51
ansible/group_vars/internal_cluster/vars
View File

@@ -1,51 +0,0 @@
# file: group_vars/internal_cluster/vars
# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
# Cluster deployed via Agent Installer and Matchbox (iPXE):
# Name of the OpenShift Cluster
cluster_name: "openshift"
# Version of OpenShift to install. All available versions can be found at: https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/
cluster_version: "4.18.21"
# Type of cluster.
# - none (Single Node Cluster)
# - baremetal (Traditional and Compact Cluster)
platform_type: "baremetal"
# Number of nodes to deploy
# - Master: 1; Worker 0 (Single Node Cluster)
# - Master: 3; Worker 0 (Compact Cluster)
# - Master: 3; Worker 1-3 (Traditional Cluster)
master_node_count: 3
worker_node_count: 1
# Subnet that cluster nodes will reside on.
machine_network: "10.1.71.0/24"
# OpenShift API IP Address
api_address: "10.1.71.69"
# OpenShift Apps Wildcard IP Address (These will be the same in a Single Node Cluster)
app_address: "10.1.71.60"
# These are internal networks to the cluster and should not need to be changed.
cluster_network: "10.128.0.0/14"
cluster_network_host_prefix: 23
service_network: "172.30.0.0/16"
# Static Variables
openshift_installer_file: "openshift-install-linux.tar.gz"
openshift_client_file: "openshift-client-linux.tar.gz"
openshift_installer_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_installer_file }}"
openshift_client_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_client_file }}"

14
ansible/group_vars/ipaserver/main.yml
View File

@@ -1,14 +0,0 @@
---
ipaadmin_password: "{{ vault_ipaadmin_password }}"
ipadm_password: "{{ vault_ipadm_password }}"
ipaserver_domain: int.mk-labs.cloud
ipaserver_realm: INT.MK-LABS.CLOUD
ipaserver_setup_firewalld: true
ipaserver_setup_dns: true
ipaserver_forwarders: 1.1.1.1,1.0.0.1
ipaserver_random_serial_numbers: true
#dns_ip_addresses: "{{ ansible_hostname }}"
#dns_reverse_zones:
#domain: int.mk-labs.cloud
forwarders: 1.1.1.1,1.0.0.1
#hostname: "{{ hostname }}"

4
ansible/group_vars/ipaserver/vars
View File

@@ -1,4 +0,0 @@
---
#freeipa_user: "admin"
ipaadmin_password: "{{ vault_freeipa_password }}"
ipaserver_domain: "int.mk-labs.cloud"

9
ansible/group_vars/matchbox_server/vars
View File

@@ -1,9 +0,0 @@
---
# Variables for Matchbox
assets: "/var/lib/matchbox/assets"
http_endpoint: "http://matchbox.int.mk-labs.cloud:8080"
rpc_endpoint: "matchbox.int.mk-labs.cloud:8081"
# Variables for OpenShift Installer
#openshift_installer_pull_secret: "{{ vault_pull_secret }}"
#openshift_installer_ssh_key: "{{ vault_ssh_key }}"

54
ansible/group_vars/openshift_cluster_template/vars
View File

@@ -1,54 +0,0 @@
# file: group_vars/openshift_cluster_template/vars
# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
# Cluster deployed via Agent Installer and Matchbox (iPXE):
# Role of this node in the cluster.
# - master
# - worker
# Name of the OpenShift Cluster
cluster_name: "openshift"
# Version of OpenShift to install. All available versions can be found at: https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/
cluster_version: "4.18.21"
# Type of cluster.
# - none (Single Node Cluster)
# - baremetal (Traditional and Compact Cluster)
platform_type: "baremetal"
# Number of nodes to deploy
# - Master: 1; Worker 0 (Single Node Cluster)
# - Master: 3; Worker 0 (Compact Cluster)
# - Master: 3; Worker 1-3 (Traditional Cluster)
master_node_count: 3
worker_node_count: 1
# Subnet that cluster nodes will reside on.
machine_network: "10.1.71.0/24"
# OpenShift API IP Address (Comment out for Single Node Cluster)
api_address: "10.1.71.69"
# OpenShift Apps Wildcard IP Address (Comment out for Single Node Cluster)
app_address: "10.1.71.60"
# These are internal networks to the cluster and should not need to be changed.
cluster_network: "10.128.0.0/14"
cluster_network_host_prefix: 23
service_network: "172.30.0.0/16"
# Static Variables
openshift_installer_file: "openshift-install-linux.tar.gz"
openshift_client_file: "openshift-client-linux.tar.gz"
openshift_installer_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_installer_file }}"
openshift_client_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_client_file }}"

29
ansible/host_vars/int-master01/vars
View File

@@ -1,29 +0,0 @@
---
# file: host_vars/int-master01/vars
# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
# Cluster deployed via Agent Installer and Matchbox (iPXE):
# Role of this node in the cluster.
# - master
# - worker
node_role: "master"
# IP address assigned to this node on the Primary Interface
ip_address: 10.1.71.61
# Ansible Playbook supports booting node via one interface, but installing on a
# different interface. (Disabling the boot interface on install) All these fields
# are necessary. In the case of a single NIC node, interfaces and MAC addresses
# should be the same.
boot_interface: "enp0s31f6"
boot_mac_address: "54:bf:64:60:52:2d"
primary_interface: "enp1s0f0"
install_mac_address: "98:b7:85:20:47:22"
# Static Variables
hostname: "{{ inventory_hostname }}.{{ base_domain }}"

29
ansible/host_vars/int-master02/vars
View File

@@ -1,29 +0,0 @@
---
# file: host_vars/int-master02/vars
# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
# Cluster deployed via Agent Installer and Matchbox (iPXE):
# Role of this node in the cluster.
# - master
# - worker
node_role: "master"
# IP address assigned to this node on the Primary Interface
ip_address: 10.1.71.62
# Ansible Playbook supports booting node via one interface, but installing on a
# different interface. (Disabling the boot interface on install) All these fields
# are necessary. In the case of a single NIC node, interfaces and MAC addresses
# should be the same.
boot_interface: "enp0s31f6"
boot_mac_address: "54:bf:64:5f:a2:80"
primary_interface: "enp1s0f0"
install_mac_address: "98:b7:85:20:47:3a"
# ---
hostname: "{{ inventory_hostname }}.{{ base_domain }}"

29
ansible/host_vars/int-master03/vars
View File

@@ -1,29 +0,0 @@
---
# file: host_vars/int-master03/vars
# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
# Cluster deployed via Agent Installer and Matchbox (iPXE):
# Role of this node in the cluster.
# - master
# - worker
node_role: "master"
# IP address assigned to this node on the Primary Interface
ip_address: 10.1.71.63
# Ansible Playbook supports booting node via one interface, but installing on a
# different interface. (Disabling the boot interface on install) All these fields
# are necessary. In the case of a single NIC node, interfaces and MAC addresses
# should be the same.
boot_interface: "enp0s31f6"
boot_mac_address: "d8:9e:f3:4c:02:a9"
primary_interface: "enp1s0f0"
install_mac_address: "98:b7:85:1f:89:cf"
# ---
hostname: "{{ inventory_hostname }}.{{ base_domain }}"

29
ansible/host_vars/int-worker01/vars
View File

@@ -1,29 +0,0 @@
---
# file: host_vars/int-worker02/vars
# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
# Cluster deployed via Agent Installer and Matchbox (iPXE):
# Role of this node in the cluster.
# - master
# - worker
node_role: "worker"
# IP address assigned to this node on the Primary Interface
ip_address: 10.1.71.164
# Ansible Playbook supports booting node via one interface, but installing on a
# different interface. (Disabling the boot interface on install) All these fields
# are necessary. In the case of a single NIC node, interfaces and MAC addresses
# should be the same.
boot_interface: "enp87s0"
boot_mac_address: "36:47:ca:76:13:49"
primary_interface: "enp2s0f0"
install_mac_address: "36:47:ca:76:13:47"
# ---
hostname: "{{ inventory_hostname }}.{{ base_domain }}"

29
ansible/host_vars/int-worker02/vars
View File

@@ -1,29 +0,0 @@
---
# file: host_vars/int-worker02/vars
# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
# Cluster deployed via Agent Installer and Matchbox (iPXE):
# Role of this node in the cluster.
# - master
# - worker
node_role: "worker"
# IP address assigned to this node on the Primary Interface
ip_address: 10.1.71.65
# Ansible Playbook supports booting node via one interface, but installing on a
# different interface. (Disabling the boot interface on install) All these fields
# are necessary. In the case of a single NIC node, interfaces and MAC addresses
# should be the same.
boot_interface: "enp87s0"
boot_mac_address: "58:47:ca:76:13:49"
primary_interface: "enp2s0f0"
install_mac_address: "58:47:ca:76:13:47"
# ---
hostname: "{{ inventory_hostname }}.{{ base_domain }}"

31
ansible/host_vars/ocp-hub/vars
View File

@@ -1,31 +0,0 @@
---
# file: host_vars/ocp-hub/vars
# file: host_vars/int-master01/vars
# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
# Cluster deployed via Agent Installer and Matchbox (iPXE):
# Role of this node in the cluster.
# - master
# - worker
node_role: "master"
# IP address assigned to this node on the Primary Interface
ip_address: 10.1.71.10
# Ansible Playbook supports booting node via one interface, but installing on a
# different interface. (Disabling the boot interface on install) All these fields
# are necessary. In the case of a single NIC node, interfaces and MAC addresses
# should be the same.
boot_interface: "enp0s31f6"
boot_mac_address: "50:9A:4C:52:A8:5D"
primary_interface: "enp1s0f0"
install_mac_address: "98:b7:85:1e:c6:f1"
# Static Variables
hostname: "{{ inventory_hostname }}.{{ base_domain }}"

29
ansible/host_vars/openshift_node_template/vars
View File

@@ -1,29 +0,0 @@
---
# file: host_vars/openshift_node_template/vars
# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
# Cluster deployed via Agent Installer and Matchbox (iPXE):
# Role of this node in the cluster.
# - master
# - worker
node_role: "master"
# IP address assigned to this node on the Primary Interface
ip_address: 10.1.71.61
# Ansible Playbook supports booting node via one interface, but installing on a
# different interface. (Disabling the boot interface on install) All these fields
# are necessary. In the case of a single NIC node, interfaces and MAC addresses
# should be the same.
boot_interface: "enp0s31f6"
boot_mac_address: "54:bf:64:60:52:2d"
primary_interface: "enp1s0f0"
install_mac_address: "98:b7:85:20:47:22"
# Static Variables
hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

218
ansible/playbooks/configure_openshift_cluster.yml
View File

@@ -1,218 +0,0 @@
---
- name: Configure DNS entries for cluster nodes
hosts: internal_cluster
gather_facts: false
become: true
tasks:
- name: Create DNS entry for each cluster node
ansible.builtin.include_tasks: tasks/create_dns_record.yml
vars:
host_ip_address: "{{ ip_address }}"
- name: Configure DNS entries for OpenShift cluster services
hosts: internal_cluster[0]
gather_facts: false
become: true
tasks:
- name: Create DNS entries for OpenShift cluster services
ansible.builtin.include_tasks: tasks/create_dns_record.yml
vars:
dns_name: "{{ item.name }}"
dns_address: "{{ item.address }}"
loop:
- name: "api.{{ cluster_name }}"
address: "{{ api_address }}"
- name: "api-int.{{ cluster_name }}"
address: "{{ api_address }}"
- name: "*.apps.{{ cluster_name }}"
address: "{{ app_address }}"
loop_control:
label: "{{ item.name }}"
- name: Configure DHCP entries for cluster nodes
hosts: internal_cluster
gather_facts: false
become: true
tasks:
- name: Configure DHCP entry for node
ansible.builtin.include_tasks: tasks/configure_dhcp_entry.yml
vars:
host_mac_address: "{{ install_mac_address }}"
host_ip_address: "{{ ip_address }}"
handlers:
- name: Restart dnsmasq
delegate_to: "{{ dhcp_server }}"
become: true
ansible.builtin.service:
name: dnsmasq
state: restarted
- name: Create OpenShift installer files
hosts: matchbox
gather_facts: true
vars:
cluster_group: "internal_cluster"
download_dir: "/var/cache/openshift-install"
tasks:
- name: Remove previous directory
ansible.builtin.file:
path: ~/homelab/terraform/{{ cluster_group }}
state: absent
- name: Create directory
ansible.builtin.file:
path: ~/homelab/terraform/{{ cluster_group }}
state: directory
mode: '0755'
- name: OpenShift Installer install-config.yaml
ansible.builtin.template:
src: templates/install-config.yaml.j2
dest: ~/homelab/terraform/{{ cluster_group }}/install-config.yaml
mode: '0644'
- name: OpenShift Installer agent-config.yaml
ansible.builtin.template:
src: templates/agent-config.yaml.j2
dest: ~/homelab/terraform/{{ cluster_group }}/agent-config.yaml
mode: '0644'
- name: Create directory for OpenShift Installer files
become: true
ansible.builtin.file:
path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}"
state: directory
mode: '0755'
owner: root
group: root
- name: Check if OpenShift installer file exists
ansible.builtin.stat:
path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_installer_file }}"
register: openshift_installer_file
- name: Download and install OpenShift installer package
when: not openshift_installer_file.stat.exists
block:
- name: Download OpenShift Installer file
become: true
ansible.builtin.get_url:
url: "{{ hostvars[groups[cluster_group][0]].openshift_installer_download_url }}"
dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
mode: '0644'
- name: Unarchive installer file
become: true
ansible.builtin.unarchive:
src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install-linux.tar.gz
dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
remote_src: true
- name: Copy install binary
become: true
ansible.builtin.copy:
src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install
dest: /usr/local/bin
remote_src: true
owner: wed
group: wed
mode: '0755'
- name: Check if OpenShift client file exists
ansible.builtin.stat:
path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_client_file }}"
register: openshift_client_file
- name: Download and install OpenShift client package
when: not openshift_client_file.stat.exists
block:
- name: Download OpenShift Client file
become: true
ansible.builtin.get_url:
url: "{{ hostvars[groups[cluster_group][0]].openshift_client_download_url }}"
dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
mode: '0644'
- name: Unarchive client file
become: true
ansible.builtin.unarchive:
src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-client-linux.tar.gz
dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
remote_src: true
- name: Copy client binary
become: true
ansible.builtin.copy:
src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/oc
dest: /usr/local/bin
remote_src: true
owner: wed
group: wed
mode: '0755'
- name: Check if OpenShift image exists
ansible.builtin.stat:
path: ~/homelab/terraform/{{ cluster_group }}/boot-artifacts/agent.x86_64-initrd.img
register: openshift_image_exists
- name: OpenShift image creation
ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
args:
chdir: ~/homelab/terraform/{{ cluster_group }}
when: not openshift_image_exists.stat.exists
changed_when: true
- name: Create a directory if it does not exist
become: true
ansible.builtin.file:
path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
state: directory
owner: matchbox
group: matchbox
mode: '0755'
- name: Copy file with owner and permissions
become: true
ansible.builtin.copy:
src: "{{ ansible_env['HOME'] }}/homelab/terraform/{{ cluster_group }}/boot-artifacts/"
dest: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}/"
remote_src: true
owner: matchbox
group: matchbox
mode: '0644'
- name: Verify directory permissions
become: true
ansible.builtin.file:
path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
state: directory
owner: matchbox
group: matchbox
mode: '0755'
- name: Create Terraform matchbox groups file from template
ansible.builtin.template:
src: templates/groups.tf.j2
dest: ~/homelab/terraform/{{ cluster_group }}/groups.tf
mode: '0644'
- name: Create Terraform matchbox profiles file from template
ansible.builtin.template:
src: templates/profiles.tf.j2
dest: ~/homelab/terraform/{{ cluster_group }}/profiles.tf
mode: '0644'
- name: Create Terraform matchbox provider file from template
ansible.builtin.template:
src: templates/provider.tf.j2
dest: ~/homelab/terraform/{{ cluster_group }}/provider.tf
mode: '0644'
- name: Configure Matchbox via Terraform
community.general.terraform:
project_path: ~/homelab/terraform/{{ cluster_group }}
state: present
force_init: true

221
ansible/playbooks/configure_openshift_hub.yml
View File

@@ -1,221 +0,0 @@
---
- name: Configure DNS entries for cluster nodes
hosts: hub_cluster
gather_facts: false
become: true
tasks:
- name: Create DNS entry for each cluster node
ansible.builtin.include_tasks: tasks/create_dns_record.yml
vars:
host_ip_address: "{{ ip_address }}"
- name: Configure DNS entries for OpenShift cluster services
hosts: hub_cluster[0]
gather_facts: false
become: true
tasks:
- name: Create DNS entries for OpenShift cluster services
ansible.builtin.include_tasks: tasks/create_dns_record.yml
vars:
dns_name: "{{ item.name }}"
dns_address: "{{ item.address }}"
loop:
- name: "api.{{ cluster_name }}"
address: "{{ api_address }}"
- name: "api-int.{{ cluster_name }}"
address: "{{ api_address }}"
- name: "*.apps.{{ cluster_name }}"
address: "{{ app_address }}"
loop_control:
label: "{{ item.name }}"
- name: Configure DHCP entries for cluster nodes
hosts: hub_cluster
gather_facts: false
become: true
tasks:
- name: Configure DHCP entry for node
ansible.builtin.include_tasks: tasks/configure_dhcp_entry.yml
vars:
host_mac_address: "{{ install_mac_address }}"
host_ip_address: "{{ ip_address }}"
handlers:
- name: Restart dnsmasq
delegate_to: "{{ dhcp_server }}"
become: true
ansible.builtin.service:
name: dnsmasq
state: restarted
- name: Create OpenShift installer files
hosts: matchbox
gather_facts: true
vars:
cluster_group: "hub_cluster"
download_dir: "/var/cache/openshift-install"
tasks:
- name: Remove previous directory
ansible.builtin.file:
path: ~/homelab/terraform/{{ cluster_group }}
state: absent
- name: Create directory
ansible.builtin.file:
path: ~/homelab/terraform/{{ cluster_group }}
state: directory
mode: '0755'
- name: OpenShift Installer install-config.yaml
ansible.builtin.template:
src: templates/install-config.yaml.j2
dest: ~/homelab/terraform/{{ cluster_group }}/install-config.yaml
mode: '0644'
- name: OpenShift Installer agent-config.yaml
ansible.builtin.template:
src: templates/agent-config.yaml.j2
dest: ~/homelab/terraform/{{ cluster_group }}/agent-config.yaml
mode: '0644'
# - name: Quit
# ansible.builtin.meta: end_play
- name: Create directory for OpenShift Installer files
become: true
ansible.builtin.file:
path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}"
state: directory
mode: '0755'
owner: root
group: root
- name: Check if OpenShift installer file exists
ansible.builtin.stat:
path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_installer_file }}"
register: openshift_installer_file
- name: Download and install OpenShift installer package
when: not openshift_installer_file.stat.exists
block:
- name: Download OpenShift Installer file
become: true
ansible.builtin.get_url:
url: "{{ hostvars[groups[cluster_group][0]].openshift_installer_download_url }}"
dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
mode: '0644'
- name: Unarchive installer file
become: true
ansible.builtin.unarchive:
src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install-linux.tar.gz
dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
remote_src: true
- name: Copy install binary
become: true
ansible.builtin.copy:
src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install
dest: /usr/local/bin
remote_src: true
owner: wed
group: wed
mode: '0755'
- name: Check if OpenShift client file exists
ansible.builtin.stat:
path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_client_file }}"
register: openshift_client_file
- name: Download and install OpenShift client package
when: not openshift_client_file.stat.exists
block:
- name: Download OpenShift Client file
become: true
ansible.builtin.get_url:
url: "{{ hostvars[groups[cluster_group][0]].openshift_client_download_url }}"
dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
mode: '0644'
- name: Unarchive client file
become: true
ansible.builtin.unarchive:
src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-client-linux.tar.gz
dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
remote_src: true
- name: Copy client binary
become: true
ansible.builtin.copy:
src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/oc
dest: /usr/local/bin
remote_src: true
owner: wed
group: wed
mode: '0755'
- name: Check if OpenShift image exists
ansible.builtin.stat:
path: ~/homelab/terraform/{{ cluster_group }}/boot-artifacts/agent.x86_64-initrd.img
register: openshift_image_exists
- name: OpenShift image creation
ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
args:
chdir: ~/homelab/terraform/{{ cluster_group }}
when: not openshift_image_exists.stat.exists
changed_when: true
- name: Create a directory if it does not exist
become: true
ansible.builtin.file:
path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
state: directory
owner: matchbox
group: matchbox
mode: '0755'
- name: Copy file with owner and permissions
become: true
ansible.builtin.copy:
src: "{{ ansible_env['HOME'] }}/homelab/terraform/{{ cluster_group }}/boot-artifacts/"
dest: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}/"
remote_src: true
owner: matchbox
group: matchbox
mode: '0644'
- name: Verify directory permissions
become: true
ansible.builtin.file:
path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
state: directory
owner: matchbox
group: matchbox
mode: '0755'
- name: Create Terraform matchbox groups file from template
ansible.builtin.template:
src: templates/groups.tf.j2
dest: ~/homelab/terraform/{{ cluster_group }}/groups.tf
mode: '0644'
- name: Create Terraform matchbox profiles file from template
ansible.builtin.template:
src: templates/profiles.tf.j2
dest: ~/homelab/terraform/{{ cluster_group }}/profiles.tf
mode: '0644'
- name: Create Terraform matchbox provider file from template
ansible.builtin.template:
src: templates/provider.tf.j2
dest: ~/homelab/terraform/{{ cluster_group }}/provider.tf
mode: '0644'
- name: Configure Matchbox via Terraform
community.general.terraform:
project_path: ~/homelab/terraform/{{ cluster_group }}
state: present
force_init: true

218
ansible/playbooks/configure_openshift_internal.yml
View File

@@ -1,218 +0,0 @@
---
- name: Configure DNS entries for cluster nodes
hosts: internal_cluster
gather_facts: false
become: true
tasks:
- name: Create DNS entry for each cluster node
ansible.builtin.include_tasks: tasks/create_dns_record.yml
vars:
host_ip_address: "{{ ip_address }}"
- name: Configure DNS entries for OpenShift cluster services
hosts: internal_cluster[0]
gather_facts: false
become: true
tasks:
- name: Create DNS entries for OpenShift cluster services
ansible.builtin.include_tasks: tasks/create_dns_record.yml
vars:
dns_name: "{{ item.name }}"
dns_address: "{{ item.address }}"
loop:
- name: "api.{{ cluster_name }}"
address: "{{ api_address }}"
- name: "api-int.{{ cluster_name }}"
address: "{{ api_address }}"
- name: "*.apps.{{ cluster_name }}"
address: "{{ app_address }}"
loop_control:
label: "{{ item.name }}"
- name: Configure DHCP entries for cluster nodes
hosts: internal_cluster
gather_facts: false
become: true
tasks:
- name: Configure DHCP entry for node
ansible.builtin.include_tasks: tasks/configure_dhcp_entry.yml
vars:
host_mac_address: "{{ install_mac_address }}"
host_ip_address: "{{ ip_address }}"
handlers:
- name: Restart dnsmasq
delegate_to: "{{ dhcp_server }}"
become: true
ansible.builtin.service:
name: dnsmasq
state: restarted
- name: Create OpenShift installer files
hosts: matchbox
gather_facts: true
vars:
cluster_group: "internal_cluster"
download_dir: "/var/cache/openshift-install"
tasks:
- name: Remove previous directory
ansible.builtin.file:
path: ~/homelab/terraform/{{ cluster_group }}
state: absent
- name: Create directory
ansible.builtin.file:
path: ~/homelab/terraform/{{ cluster_group }}
state: directory
mode: '0755'
- name: OpenShift Installer install-config.yaml
ansible.builtin.template:
src: templates/install-config.yaml.j2
dest: ~/homelab/terraform/{{ cluster_group }}/install-config.yaml
mode: '0644'
- name: OpenShift Installer agent-config.yaml
ansible.builtin.template:
src: templates/agent-config.yaml.j2
dest: ~/homelab/terraform/{{ cluster_group }}/agent-config.yaml
mode: '0644'
- name: Create directory for OpenShift Installer files
become: true
ansible.builtin.file:
path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}"
state: directory
mode: '0755'
owner: root
group: root
- name: Check if OpenShift installer file exists
ansible.builtin.stat:
path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_installer_file }}"
register: openshift_installer_file
- name: Download and install OpenShift installer package
when: not openshift_installer_file.stat.exists
block:
- name: Download OpenShift Installer file
become: true
ansible.builtin.get_url:
url: "{{ hostvars[groups[cluster_group][0]].openshift_installer_download_url }}"
dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
mode: '0644'
- name: Unarchive installer file
become: true
ansible.builtin.unarchive:
src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install-linux.tar.gz
dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
remote_src: true
- name: Copy install binary
become: true
ansible.builtin.copy:
src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install
dest: /usr/local/bin
remote_src: true
owner: wed
group: wed
mode: '0755'
- name: Check if OpenShift client file exists
ansible.builtin.stat:
path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_client_file }}"
register: openshift_client_file
- name: Download and install OpenShift client package
when: not openshift_client_file.stat.exists
block:
- name: Download OpenShift Client file
become: true
ansible.builtin.get_url:
url: "{{ hostvars[groups[cluster_group][0]].openshift_client_download_url }}"
dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
mode: '0644'
- name: Unarchive client file
become: true
ansible.builtin.unarchive:
src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-client-linux.tar.gz
dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
remote_src: true
- name: Copy client binary
become: true
ansible.builtin.copy:
src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/oc
dest: /usr/local/bin
remote_src: true
owner: wed
group: wed
mode: '0755'
- name: Check if OpenShift image exists
ansible.builtin.stat:
path: ~/homelab/terraform/{{ cluster_group }}/boot-artifacts/agent.x86_64-initrd.img
register: openshift_image_exists
- name: OpenShift image creation
ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
args:
chdir: ~/homelab/terraform/{{ cluster_group }}
when: not openshift_image_exists.stat.exists
changed_when: true
- name: Create a directory if it does not exist
become: true
ansible.builtin.file:
path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
state: directory
owner: matchbox
group: matchbox
mode: '0755'
- name: Copy file with owner and permissions
become: true
ansible.builtin.copy:
src: "{{ ansible_env['HOME'] }}/homelab/terraform/{{ cluster_group }}/boot-artifacts/"
dest: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}/"
remote_src: true
owner: matchbox
group: matchbox
mode: '0644'
- name: Verify directory permissions
become: true
ansible.builtin.file:
path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
state: directory
owner: matchbox
group: matchbox
mode: '0755'
- name: Create Terraform matchbox groups file from template
ansible.builtin.template:
src: templates/groups.tf.j2
dest: ~/homelab/terraform/{{ cluster_group }}/groups.tf
mode: '0644'
- name: Create Terraform matchbox profiles file from template
ansible.builtin.template:
src: templates/profiles.tf.j2
dest: ~/homelab/terraform/{{ cluster_group }}/profiles.tf
mode: '0644'
- name: Create Terraform matchbox provider file from template
ansible.builtin.template:
src: templates/provider.tf.j2
dest: ~/homelab/terraform/{{ cluster_group }}/provider.tf
mode: '0644'
- name: Configure Matchbox via Terraform
community.general.terraform:
project_path: ~/homelab/terraform/{{ cluster_group }}
state: present
force_init: true

30
ansible/playbooks/deploy-fastpass-4step.yml
View File

@@ -1,30 +0,0 @@
---
# - name: Step 1 - Install Prerequisites
# hosts: fastpass
# become: true
# gather_facts: true
# roles:
# - role: kubernetes-prerequisites
# - name: Step 2 - Deploy First Control Plane Node
# hosts: fastpass_control_plane[0]
# become: true
# gather_facts: false
# roles:
# - role: fastpass-first-control-plane
- name: Step 3 - Deploy Additional Control Plane Nodes
hosts: fastpass_control_plane[1:]
become: true
gather_facts: true # false
roles:
- role: fastpass-additional-control-plane
vars:
cluster_name: "fastpass"
# - name: Step 4 - Deploy Worker Nodes
# hosts: fastpass_workers
# become: true
# gather_facts: false
# roles:
# - role: fastpass-workers

157
ansible/playbooks/deploy-fastpass-cluster.yml
View File

@@ -1,157 +0,0 @@
---
# FastPass Kubernetes Cluster Deployment
# This playbook deploys a complete Kubernetes cluster on Fedora
- name: 1. Preflight checks and system preparation
hosts: fastpass
become: true
gather_facts: true
roles:
- role: kubernetes
- name: 2. Initialize first control plane node
hosts: fastpass_control_plane[0]
become: true
gather_facts: false
roles:
- role: fastpass-control-plane
- name: 3. Install Calico CNI
hosts: fastpass_control_plane[0]
become: false
gather_facts: false
environment:
KUBECONFIG: "{{ kubeconfig_path }}"
tasks:
- name: Check if Calico is already installed
ansible.builtin.shell: kubectl get pods -n kube-system -l k8s-app=calico-node --no-headers | wc -l
delegate_to: localhost
register: calico_check
ignore_errors: true
- name: Display Calico check result
ansible.builtin.debug:
msg: "Calico pods found: {{ calico_check.stdout | trim }}"
delegate_to: localhost
- name: Install Calico CNI
ansible.builtin.command: kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/{{ calico_version | default('v3.28.0') }}/manifests/calico.yaml
delegate_to: localhost
when: calico_check.stdout | trim == "0"
register: calico_install_result
ignore_errors: true
- name: Display Calico installation result
ansible.builtin.debug:
msg: "Calico install stdout: {{ calico_install_result.stdout }}"
delegate_to: localhost
when: calico_check.stdout | trim == "0"
- name: Wait for Calico node pods to be ready
ansible.builtin.command: kubectl wait --for=condition=ready pod -l k8s-app=calico-node -n kube-system --timeout=300s
delegate_to: localhost
when: calico_check.stdout | trim == "0"
- name: 4. Wait for first control plane to be fully ready
hosts: fastpass_control_plane[0]
become: false
gather_facts: false
environment:
KUBECONFIG: "{{ kubeconfig_path }}"
tasks:
- name: Wait for API server to be ready on first node
ansible.builtin.wait_for:
host: "{{ inventory_hostname }}"
port: "{{ control_plane_port | default('6443') }}"
timeout: 300
delegate_to: localhost
- name: Wait for first control plane node to be ready
ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} wait --for=condition=ready node {{ inventory_hostname }} --timeout=300s
delegate_to: localhost
- name: Verify control plane status
ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} get nodes -o wide
delegate_to: localhost
register: node_status
- name: Display cluster status
ansible.builtin.debug:
msg: "{{ node_status.stdout_lines }}"
- name: 5. Join additional control plane nodes
hosts: fastpass_control_plane[1:]
become: true
gather_facts: false
roles:
- role: fastpass-control-plane-join
- name: 6. Wait for all control plane nodes to be ready
hosts: fastpass_control_plane[0]
become: false
gather_facts: false
environment:
KUBECONFIG: "{{ kubeconfig_path }}"
tasks:
- name: Wait for all control plane nodes to be ready
ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} wait --for=condition=ready node --selector=node-role.kubernetes.io/control-plane --timeout=600s
delegate_to: localhost
- name: Display all control plane nodes
ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} get nodes --selector=node-role.kubernetes.io/control-plane -o wide
delegate_to: localhost
register: control_plane_status
- name: Show control plane status
ansible.builtin.debug:
msg: "{{ control_plane_status.stdout_lines }}"
- name: 7. Join worker nodes
hosts: fastpass_workers
become: true
gather_facts: false
roles:
- role: fastpass-workers
- name: 8. Final cluster validation
hosts: fastpass_control_plane[0]
become: false
gather_facts: false
environment:
KUBECONFIG: "{{ kubeconfig_path }}"
tasks:
- name: Wait for all nodes to be ready
ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} wait --for=condition=ready node --all --timeout=300s
delegate_to: localhost
- name: Verify all pods are running
ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} get pods --all-namespaces
delegate_to: localhost
register: pod_status
- name: Display final cluster status
ansible.builtin.debug:
msg: |
========================================
FastPass Kubernetes Cluster Status
========================================
{{ pod_status.stdout }}
========================================
- name: Show final node status
ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} get nodes -o wide
delegate_to: localhost
register: final_node_status
- name: Display final node status
ansible.builtin.debug:
msg: "{{ final_node_status.stdout_lines }}"
- name: Test DNS-based control plane endpoint
ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} cluster-info
delegate_to: localhost
register: cluster_info
- name: Display cluster info
ansible.builtin.debug:
msg: "{{ cluster_info.stdout_lines }}"

177
ansible/playbooks/deploy-haproxy-cloudflare.yml
View File

@@ -1,177 +0,0 @@
---
# ansible/playbooks/deploy-haproxy-cloudflare.yml
- name: Deploy HAProxy with Cloudflare DNS certificates
hosts: lightning-lane
become: true
vars:
# Certbot Cloudflare configuration
haproxy_certbot_enable: true
haproxy_certbot_challenge_method: "dns-cloudflare"
haproxy_certbot_email: "ryan@mk-labs.cloud"
haproxy_certbot_staging: false # Set to true for testing
haproxy_certbot_cloudflare_api_token: "{{ vault_cloudflare_api_token }}"
# Request wildcard certificate
haproxy_certbot_domains:
- domain: "*.local.mk-labs.cloud"
include_base: true # Also include local.mk-labs.cloud
# HAProxy Stats
haproxy_stats_password: "{{ vault_haproxy_stats_password }}"
# Frontend configuration
haproxy_frontends:
- name: https_front
bind: "*:443 ssl crt {{ haproxy_ssl_cert_dir }}/live crt {{ haproxy_ssl_default_crt }} alpn h2,http/1.1"
mode: http
options:
- "http-server-close"
- "forwardfor"
acls:
- "netbox hdr(host) -i fire-station.local.mk-labs.cloud"
- "wordpress hdr(host) -i be-our-guest.local.mk-labs.cloud"
- "plane hdr(host) -i people-mover.local.mk-labs.cloud"
- "minecraft hdr(host) -i arcade.local.mk-labs.cloud"
use_backends:
- "netbox_back if netbox"
- "wordpress_back if wordpress"
- "plane_back if plane"
- "minecraft_back if minecraft"
# Backend configuration
haproxy_backends:
- name: netbox_back
mode: http
balance: roundrobin
options:
- "httpchk GET /api/"
servers:
- name: fire-station
address: 10.1.71.102:8000
check: true
- name: wordpress_back
mode: http
balance: roundrobin
servers:
- name: be-our-guest
address: 10.1.71.101:80
check: true
- name: plane_back
mode: http
balance: roundrobin
servers:
- name: people-mover
address: 10.1.71.112:8080
check: true
- name: minecraft_back
mode: http
balance: roundrobin
servers:
- name: arcade
address: 10.1.71.111:25565
check: true
# TCP services
haproxy_tcp_services:
- name: postgres
frontend_port: 5432
backend_port: 5432
balance: leastconn
timeout_client: 1h
timeout_server: 1h
servers:
- name: netbox-db
address: 10.1.71.102
check: true
- name: ssh_jump
frontend_port: 2222
backend_port: 22
balance: source
servers:
- name: main-street-usa
address: 10.1.71.11
check: true
- name: tomorrowland
address: 10.1.71.12
check: true
- name: fantasyland
address: 10.1.71.13
check: true
- name: minecraft_java
frontend_port: 25565
backend_port: 25565
balance: roundrobin
servers:
- name: arcade
address: 10.1.71.111
check: true
# Firewall configuration
haproxy_firewall_allowed_ports:
- 80/tcp
- 443/tcp
- 2222/tcp
- 5432/tcp
- 8404/tcp
- 25565/tcp
pre_tasks:
- name: Ensure required groups exist
ansible.builtin.group:
name: "{{ item }}"
state: present
loop:
- haproxy
roles:
- haproxy
post_tasks:
- name: Wait for HAProxy to be ready
ansible.builtin.wait_for:
host: "{{ ansible_default_ipv4.address }}"
port: 443
timeout: 60
- name: Display deployment summary
ansible.builtin.debug:
msg: |
╔════════════════════════════════════════════════════════════╗
║ HAProxy Deployment Complete - lightning-lane ║
╚════════════════════════════════════════════════════════════╝
Stats Interface: http://{{ ansible_default_ipv4.address }}:8404/stats
Username: {{ haproxy_stats_username }}
HTTPS Services:
{% for frontend in haproxy_frontends %}
{% if frontend.acls is defined %}
{% for acl in frontend.acls %}
- {{ acl.split()[1] | regex_replace('hdr\\(host\\)', '') | regex_replace('-i', '') | trim }}
{% endfor %}
{% endif %}
{% endfor %}
TCP Services:
{% for tcp in haproxy_tcp_services %}
- {{ tcp.name }}: {{ ansible_default_ipv4.address }}:{{ tcp.frontend_port }}
{% endfor %}
Certificates:
{% for domain in haproxy_certbot_domains %}
- {{ domain.domain }}{% if domain.include_base | default(false) %} + base domain{% endif %}
{% endfor %}
Next steps:
1. Verify certificate: certbot certificates
2. Test renewal: certbot renew --dry-run
3. Check HAProxy stats interface
4. Test HTTPS endpoints

17
ansible/playbooks/deploy_k8s.yml
View File

@@ -1,17 +0,0 @@
# ------------------------------------------------------------------------------
# FILE: deploy_k8s.yml
# ------------------------------------------------------------------------------
- name: 1. Prepare all nodes for Kubernetes
hosts: fastpass
roles:
- role: kubernetes
- name: 2. Initialize and configure the control plane
hosts: fastpass_control_plane
roles:
- role: fastpass-control-plane
- name: 3. Join worker nodes to the cluster
hosts: fastpass_workers
roles:
- role: fastpass-workers

22
ansible/playbooks/deploy_minecraft.yml
View File

@@ -1,22 +0,0 @@
---
# - name: Install additional packages
# hosts: papermc_server
# become: true
# tasks:
# - name: Install python-apt packages
# ansible.builtin.package:
# name: "libapt-pkg"
# state: latest
# update_cache: true
- name: 1. Deploy Paper Minecraft server
hosts: papermc_server
roles:
vars:
user:
home_dir: /opt/minecraft
name: wed
roles:
- role: apigban.papermc_role
become: yes

41
ansible/playbooks/examples/multi-cluster-kubeconfig.yml
View File

@@ -1,41 +0,0 @@
---
# Example playbook showing how to use the modular kubeconfig management
# across multiple clusters in your homelab
- name: Setup kubeconfig for FastPass cluster
hosts: fastpass_control_plane[0]
gather_facts: true
roles:
- role: kubeconfig-manager
vars:
cluster_name: "fastpass"
- name: Setup kubeconfig for Hub cluster
hosts: hub_cluster
gather_facts: true
roles:
- role: kubeconfig-manager
vars:
cluster_name: "hub"
- name: Setup kubeconfig for Internal cluster
hosts: internal_cluster[0]
gather_facts: true
roles:
- role: kubeconfig-manager
vars:
cluster_name: "internal"
# Alternative approach using the generic cluster-kubeconfig role
- name: Setup kubeconfig for any cluster
hosts: "{{ target_cluster_hosts }}"
gather_facts: true
roles:
- role: cluster-kubeconfig
vars:
cluster_name: "{{ target_cluster_name }}"
# Usage examples:
# ansible-playbook -i inventory.yml examples/multi-cluster-kubeconfig.yml
# ansible-playbook -i inventory.yml examples/multi-cluster-kubeconfig.yml --limit fastpass_control_plane[0]
# ansible-playbook -i inventory.yml examples/multi-cluster-kubeconfig.yml -e target_cluster_hosts=hub_cluster -e target_cluster_name=hub

60
ansible/playbooks/examples/setup-fastpass-network.yml
View File

@@ -1,60 +0,0 @@
---
# Example: Setup network infrastructure for FastPass cluster
# This demonstrates the modular approach for DNS and load balancer setup
- name: Setup FastPass Cluster Network Infrastructure
hosts: fastpass_control_plane[0]
gather_facts: true
vars:
cluster_name: "fastpass"
cluster_endpoint: "{{ control_plane_endpoint }}"
cluster_vip: "{{ ansible_default_ipv4.address }}"
control_plane_nodes: "{{ groups['fastpass_control_plane'] }}"
tasks:
- name: Display cluster configuration
ansible.builtin.debug:
msg: |
Setting up network for FastPass cluster:
- Cluster Name: {{ cluster_name }}
- Endpoint: {{ cluster_endpoint }}
- VIP: {{ cluster_vip }}
- Control Plane Nodes: {{ control_plane_nodes | join(', ') }}
- name: Setup cluster network infrastructure
ansible.builtin.include_role:
name: cluster-network-setup
vars:
cluster_name: "{{ cluster_name }}"
cluster_endpoint: "{{ cluster_endpoint }}"
cluster_vip: "{{ cluster_vip }}"
control_plane_nodes: "{{ control_plane_nodes }}"
# Alternative approach using task file directly
- name: Alternative - Use Technitium DNS task directly
hosts: localhost
gather_facts: false
vars:
cluster_endpoint: "{{ hostvars[groups['fastpass_control_plane'][0]]['control_plane_endpoint'] }}"
cluster_vip: "{{ hostvars[groups['fastpass_control_plane'][0]]['ansible_default_ipv4']['address'] }}"
tasks:
- name: Create DNS entry using task file
ansible.builtin.include_tasks: ../tasks/add_technitium_dns_entry.yml
vars:
dns_record_name: "{{ cluster_endpoint.split('.')[0] }}"
dns_zone: "{{ base_domain }}"
dns_ip_address: "{{ cluster_vip }}"
dns_record_type: "A"
dns_ttl: 360
dns_create_ptr: true
dns_debug: true
when: use_task_approach | default(false)
# Usage examples:
#
# Use modular approach (recommended):
# ansible-playbook -i inventory.yml playbooks/examples/setup-fastpass-network.yml
#
# Use task file approach:
# ansible-playbook -i inventory.yml playbooks/examples/setup-fastpass-network.yml -e use_task_approach=true

10
ansible/playbooks/idm-servers.yml
View File

@@ -1,10 +0,0 @@
---
- name: Playbook to configure IPA server
hosts: ipaserver
become: true
vars_files:
- idm-vault.yml
roles:
- role: freeipa.ansible_freeipa.ipaserver
state: present

115
ansible/playbooks/reset-fastpass-cluster.yml
View File

@@ -1,115 +0,0 @@
---
- name: Reset FastPass Kubernetes Cluster
hosts: fastpass
become: true
gather_facts: false
tasks:
- name: Stop and disable kubelet service
ansible.builtin.systemd:
name: kubelet
state: stopped
enabled: false
ignore_errors: true
- name: Stop and disable containerd service
ansible.builtin.systemd:
name: containerd
state: stopped
enabled: false
ignore_errors: true
- name: Remove Kubernetes packages
ansible.builtin.dnf:
name:
- kubelet
- kubeadm
- kubectl
- kubernetes-cni
- containernetworking-plugins
state: absent
ignore_errors: true
- name: Remove containerd
ansible.builtin.dnf:
name: containerd
state: absent
ignore_errors: true
- name: Remove Docker repository
ansible.builtin.file:
path: /etc/yum.repos.d/docker-ce.repo
state: absent
ignore_errors: true
- name: Remove Kubernetes repository
ansible.builtin.file:
path: /etc/yum.repos.d/kubernetes.repo
state: absent
ignore_errors: true
- name: Remove Kubernetes directories
ansible.builtin.file:
path: "{{ item }}"
state: absent
loop:
- /etc/kubernetes
- /var/lib/kubelet
- /var/lib/etcd
- /etc/cni/net.d
- /opt/cni/bin
- /var/lib/containerd
- /etc/containerd
ignore_errors: true
- name: Remove CNI plugins
ansible.builtin.file:
path: /opt/cni
state: absent
ignore_errors: true
- name: Remove iptables rules
ansible.builtin.shell: |
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
ignore_errors: true
- name: Remove firewall Kubernetes service
ansible.builtin.file:
path: /etc/firewalld/services/kubernetes.xml
state: absent
ignore_errors: true
- name: Remove firewall rules for Kubernetes
ansible.builtin.shell: |
firewall-cmd --permanent --remove-service=kubernetes || true
firewall-cmd --reload || true
ignore_errors: true
- name: Reset network interfaces
ansible.builtin.shell: |
ip link delete cni0 || true
ip link delete flannel.1 || true
ip link delete cali* || true
ignore_errors: true
- name: Clean up systemd drop-in files
ansible.builtin.file:
path: /usr/lib/systemd/system/kubelet.service.d
state: absent
ignore_errors: true
- name: Reset hostname to original
ansible.builtin.hostname:
name: "{{ inventory_hostname }}"
- name: Clean package cache
ansible.builtin.dnf:
clean: all
ignore_errors: true
- name: Reboot system
ansible.builtin.reboot:
reboot_timeout: 300

12
ansible/playbooks/roles/cluster-kubeconfig/tasks/main.yml
View File

@@ -1,12 +0,0 @@
---
# role: cluster-kubeconfig
# description: Generic role for any Kubernetes cluster kubeconfig management
# author: mk-labs
# version: 1.0.0
- name: Setup kubeconfig for {{ cluster_name }} cluster
ansible.builtin.include_role:
name: kubeconfig-manager
vars:
cluster_name: "{{ cluster_name }}"
kubeconfig_source_path: "{{ kubeconfig_source_path | default('/etc/kubernetes/admin.conf') }}"

48
ansible/playbooks/roles/cluster-network-setup/tasks/main.yml
View File

@@ -1,48 +0,0 @@
---
# role: cluster-network-setup
# description: Combined DNS and Load Balancer setup for Kubernetes clusters
# author: mk-labs
# version: 1.0.0
- name: Setup DNS entry for cluster
ansible.builtin.include_role:
name: dns-manager
vars:
cluster_endpoint: "{{ cluster_endpoint }}"
cluster_vip: "{{ cluster_vip }}"
- name: Setup Traefik load balancer for cluster
ansible.builtin.include_role:
name: traefik-manager
vars:
cluster_name: "{{ cluster_name }}"
cluster_endpoint: "{{ cluster_endpoint }}"
control_plane_nodes: "{{ control_plane_nodes }}"
when: traefik_enabled | default(true)
- name: Wait for DNS propagation
ansible.builtin.wait_for:
timeout: 30
delegate_to: localhost
- name: Test cluster endpoint connectivity
ansible.builtin.wait_for:
host: "{{ cluster_endpoint }}"
port: "{{ cluster_api_port | default(6443) }}"
timeout: 60
delegate_to: localhost
register: connectivity_test
failed_when: false
- name: Display network setup results
ansible.builtin.debug:
msg: |
🌐 Network Setup Complete for {{ cluster_name }}:
DNS Entry: {{ cluster_endpoint }} → {{ cluster_vip }}
Load Balancer: {{ 'Configured' if traefik_enabled | default(true) else 'Skipped' }}
Connectivity: {{ 'Success' if connectivity_test.failed == false else 'Failed - Check firewall/network' }}
Next steps:
1. Verify: kubectl --kubeconfig ~/.kube/config-{{ cluster_name }} cluster-info
2. Switch context: kubectl config use-context {{ cluster_name }}-admin

38
ansible/playbooks/roles/containerd/README.md
View File

@@ -1,38 +0,0 @@
Role Name
=========
A brief description of the role goes here.
Requirements
------------
Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
Role Variables
--------------
A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
Dependencies
------------
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- hosts: servers
roles:
- { role: username.rolename, x: 42 }
License
-------
BSD
Author Information
------------------
An optional section for the role authors to include contact information, or a website (HTML is not allowed).

3
ansible/playbooks/roles/containerd/defaults/main.yml
View File

@@ -1,3 +0,0 @@
#SPDX-License-Identifier: MIT-0
---
# defaults file for containerd

3
ansible/playbooks/roles/containerd/handlers/main.yml
View File

@@ -1,3 +0,0 @@
#SPDX-License-Identifier: MIT-0
---
# handlers file for containerd

35
ansible/playbooks/roles/containerd/meta/main.yml
View File

@@ -1,35 +0,0 @@
#SPDX-License-Identifier: MIT-0
galaxy_info:
author: your name
description: your role description
company: your company (optional)
# If the issue tracker for your role is not on github, uncomment the
# next line and provide a value
# issue_tracker_url: http://example.com/issue/tracker
# Choose a valid license ID from https://spdx.org - some suggested licenses:
# - BSD-3-Clause (default)
# - MIT
# - GPL-2.0-or-later
# - GPL-3.0-only
# - Apache-2.0
# - CC-BY-4.0
license: license (GPL-2.0-or-later, MIT, etc)
min_ansible_version: 2.1
# If this a Container Enabled role, provide the minimum Ansible Container version.
# min_ansible_container_version:
galaxy_tags: []
# List tags for your role here, one per line. A tag is a keyword that describes
# and categorizes the role. Users find roles by searching for tags. Be sure to
# remove the '[]' above, if you add tags to this list.
#
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
# Maximum 20 tags per role.
dependencies: []
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
# if you add dependencies to this list.

74
ansible/playbooks/roles/containerd/tasks/main.yml
View File

@@ -1,74 +0,0 @@
---
# tasks file for containerd
- name: Install containerd dependencies
become: true
ansible.builtin.package:
name: "{{ item }}"
state: present
loop:
"{{ containerd_dependencies }}"
- name: Install via apt
become: true
when: ansible_os_family == "Debian"
block:
- name: Add repo using key from URL (apt)
ansible.builtin.deb822_repository:
name: docker
types: deb
uris: https://download.docker.com/linux/ubuntu
suites: "{{ ansible_distribution_release }}"
components: stable
architectures: amd64
signed_by: https://download.docker.com/linux/ubuntu/gpg
- name: Update apt cache
ansible.builtin.apt:
update_cache: true
- name: Install via dnf
become: true
when: ansible_os_family == "RedHat"
block:
- name: Add repo using key from URL (dnf)
ansible.builtin.yum_repository:
name: docker
description: "Docker repository"
baseurl: https://download.docker.com/linux/ubuntu
gpgcheck: true
gpgkey: https://download.docker.com/linux/ubuntu/gpg
- name: Update dnf cache
ansible.builtin.dnf:
update_cache: true
- name: Install containerd
become: true
ansible.builtin.package:
name: containerd.io
state: present
- name: Create containerd config directory
ansible.builtin.file:
path: /etc/containerd
state: directory
owner: root
group: root
mode: '0755'
- name: Check if containerd config file exists
ansible.builtin.stat:
path: /etc/containerd/config.toml
register: containerd_config_file
- name: Generate default containerd config and enable SystemdCgroup
when: containerd_config_file.stat.exists == false
ansible.builtin.shell: |
containerd config default > /etc/containerd/config.toml
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
- name: Restart and enable containerd service
ansible.builtin.systemd:
name: containerd
state: restarted
enabled: true

3
ansible/playbooks/roles/containerd/tests/inventory
View File

@@ -1,3 +0,0 @@
#SPDX-License-Identifier: MIT-0
localhost

6
ansible/playbooks/roles/containerd/tests/test.yml
View File

@@ -1,6 +0,0 @@
#SPDX-License-Identifier: MIT-0
---
- hosts: localhost
remote_user: root
roles:
- containerd

3
ansible/playbooks/roles/containerd/vars/main.yml
View File

@@ -1,3 +0,0 @@
#SPDX-License-Identifier: MIT-0
---
# vars file for containerd

38
ansible/playbooks/roles/fastpass-additional-control-plane/README.md
View File

@@ -1,38 +0,0 @@
Role Name
=========
A brief description of the role goes here.
Requirements
------------
Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
Role Variables
--------------
A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
Dependencies
------------
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- hosts: servers
roles:
- { role: username.rolename, x: 42 }
License
-------
BSD
Author Information
------------------
An optional section for the role authors to include contact information, or a website (HTML is not allowed).

22
ansible/playbooks/roles/fastpass-additional-control-plane/defaults/main.yml
View File

@@ -1,22 +0,0 @@
---
# FastPass Additional Control Plane Role Defaults
# Kubernetes services for control plane
kubernetes_services_control_plane:
- kubernetes_API
- etcd
- kubelet
- kube-scheduler
- kube-controller-manager
# Join token configuration
join_token_ttl: "24h"
certificate_key_ttl: "2h"
# Default cluster configuration
pod_network_cidr: "10.244.0.0/16"
service_cidr: "10.96.0.0/12"
# Kubelet configuration
kubelet_cgroup_driver: "systemd"
container_runtime_endpoint: "unix:///run/containerd/containerd.sock"

2
ansible/playbooks/roles/fastpass-additional-control-plane/handlers/main.yml
View File

@@ -1,2 +0,0 @@
---
# handlers file for fastpass-additional-control-plane

33
ansible/playbooks/roles/fastpass-additional-control-plane/meta/main.yml
View File

@@ -1,33 +0,0 @@
---
galaxy_info:
author: Ryan Blundon
description: FastPass Additional Control Plane - Deploy additional control plane nodes to existing FastPass Kubernetes cluster
company: Homelab
license: MIT
min_ansible_version: "2.9"
platforms:
- name: Ubuntu
versions:
- focal
- jammy
- name: Debian
versions:
- bullseye
- bookworm
galaxy_tags:
- kubernetes
- k8s
- controlplane
- cluster
- fastpass
- kubeadm
dependencies:
- role: dns-manager
when: cluster_name is defined
- role: kubeconfig-manager
when: cluster_name is defined

29
ansible/playbooks/roles/fastpass-additional-control-plane/tasks/main.yml
View File

@@ -1,29 +0,0 @@
---
# role: fastpass-additional-control-plane
# description: FastPass Additional Control Plane - Deploy additional control plane nodes to existing FastPass Kubernetes cluster
# author: Ryan Blundon
# version: 1.0.0
# date: 2025-10-05
# This role joins additional nodes to an existing Kubernetes cluster as control plane nodes
# It follows the same patterns as fastpass-first-control-plane but uses kubeadm join instead of kubeadm init
- name: Display role information
ansible.builtin.debug:
msg: "Starting FastPass Additional Control Plane deployment for {{ inventory_hostname }}"
- name: Setup DNS record for cluster
ansible.builtin.include_role:
name: dns-manager
vars:
host_name: "{{ cluster_name }}"
- name: Open services for control plane
become: true
when: ansible_os_family == "Debian"
block:
- name: Open firewall ports for control plane
community.general.ufw:
rule: allow
name: "{{ item }}"
loop: "{{ kubernetes_services_control_plane }}"

3
ansible/playbooks/roles/fastpass-additional-control-plane/tests/inventory
View File

@@ -1,3 +0,0 @@
#SPDX-License-Identifier: MIT-0
localhost

6
ansible/playbooks/roles/fastpass-additional-control-plane/tests/test.yml
View File

@@ -1,6 +0,0 @@
#SPDX-License-Identifier: MIT-0
---
- hosts: localhost
remote_user: root
roles:
- fastpass-additional-control-plane

2
ansible/playbooks/roles/fastpass-additional-control-plane/vars/main.yml
View File

@@ -1,2 +0,0 @@
---
# vars file for fastpass-additional-control-plane

15
ansible/playbooks/roles/fastpass-first-control-plane/defaults/main.yml
View File

@@ -1,15 +0,0 @@
---
# FastPass First Control Plane Role Defaults
# Kubernetes services for control plane
kubernetes_services_control_plane:
- kubernetes_API
- etcd
- kubelet
- kube-scheduler
- kube-controller-manager
kubernetes_services_worker:
- kubelet
- kube-proxy
- NodePort

103
ansible/playbooks/roles/fastpass-first-control-plane/tasks/main.yml
View File

@@ -1,103 +0,0 @@
---
# role: fastpass-first-control-plane
# description: FastPass First Control Plane
# author: Ryan Blundon
# version: 1.0.0
# date: 2025-09-27
- name: Setup DNS record for cluster
ansible.builtin.include_role:
name: dns-manager
vars:
host_name: "{{ cluster_name }}"
- name: Open services for control plane
become: true
when: ansible_os_family == "Debian"
block:
- name: Open firewall ports for control plane
community.general.ufw:
rule: allow
name: "{{ item }}"
loop: "{{ kubernetes_services_control_plane }}"
- name: Create initial kubelet config file
become: true
ansible.builtin.copy:
dest: /var/lib/kubelet/config.yaml
owner: root
group: root
mode: "0644"
content: |
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
cgroupDriver: systemd
containerRuntimeEndpoint: unix:///run/containerd/containerd.sock
- name: Initialize Kubernetes cluster
become: true
ansible.builtin.command:
argv:
- kubeadm
- init
- --apiserver-advertise-address={{ ip_address }}
- --control-plane-endpoint={{ cluster_name }}
- --pod-network-cidr={{ pod_network_cidr }}
- --service-cidr={{ service_cidr }}
args:
creates: /etc/kubernetes/admin.conf
register: kubeadm_init
changed_when: kubeadm_init.rc == 0
- name: Ensure kubelet is enabled and started
become: true
ansible.builtin.systemd:
name: kubelet
enabled: true
state: started
- name: Setup kubeconfig for FastPass cluster
ansible.builtin.include_role:
name: kubeconfig-manager
# - name: Download tigera-operator manifest
# delegate_to: localhost
# ansible.builtin.get_url:
# url: https://raw.githubusercontent.com/projectcalico/calico/{{ calico_version }}/manifests/tigera-operator.yaml
# dest: /tmp/tigera-operator.yaml
# mode: "0644"
# - name: Install tigera-operator from downloaded file
# delegate_to: localhost
# kubernetes.core.k8s:
# kubeconfig: "{{ local_home }}/.kube/config"
# state: present
# src: /tmp/tigera-operator.yaml
# - name: Download Calico CRDs
# delegate_to: localhost
# ansible.builtin.get_url:
# url: https://raw.githubusercontent.com/projectcalico/calico/{{ calico_version }}/manifests/custom-resources.yaml
# dest: /tmp/custom-resources.yaml
# mode: "0644"
# - name: Install Calico CRDs from downloaded file
# delegate_to: localhost
# kubernetes.core.k8s:
# kubeconfig: "{{ local_home }}/.kube/config"
# state: present
# src: /tmp/custom-resources.yaml
- name: Download Flannel CNI
delegate_to: localhost
ansible.builtin.get_url:
url: https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml
dest: /tmp/kube-flannel.yaml
mode: "0644"
- name: Install Flannel CNI from downloaded file
delegate_to: localhost
kubernetes.core.k8s:
kubeconfig: "{{ local_home }}/.kube/config"
state: present
src: /tmp/kube-flannel.yaml

38
ansible/playbooks/roles/fastpass-worker-nodes/README.md
View File

@@ -1,38 +0,0 @@
Role Name
=========
A brief description of the role goes here.
Requirements
------------
Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
Role Variables
--------------
A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
Dependencies
------------
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- hosts: servers
roles:
- { role: username.rolename, x: 42 }
License
-------
BSD
Author Information
------------------
An optional section for the role authors to include contact information, or a website (HTML is not allowed).

3
ansible/playbooks/roles/fastpass-worker-nodes/defaults/main.yml
View File

@@ -1,3 +0,0 @@
#SPDX-License-Identifier: MIT-0
---
# defaults file for fastpass-worker-nodes

3
ansible/playbooks/roles/fastpass-worker-nodes/handlers/main.yml
View File

@@ -1,3 +0,0 @@
#SPDX-License-Identifier: MIT-0
---
# handlers file for fastpass-worker-nodes

35
ansible/playbooks/roles/fastpass-worker-nodes/meta/main.yml
View File

@@ -1,35 +0,0 @@
#SPDX-License-Identifier: MIT-0
galaxy_info:
author: your name
description: your role description
company: your company (optional)
# If the issue tracker for your role is not on github, uncomment the
# next line and provide a value
# issue_tracker_url: http://example.com/issue/tracker
# Choose a valid license ID from https://spdx.org - some suggested licenses:
# - BSD-3-Clause (default)
# - MIT
# - GPL-2.0-or-later
# - GPL-3.0-only
# - Apache-2.0
# - CC-BY-4.0
license: license (GPL-2.0-or-later, MIT, etc)
min_ansible_version: 2.1
# If this a Container Enabled role, provide the minimum Ansible Container version.
# min_ansible_container_version:
galaxy_tags: []
# List tags for your role here, one per line. A tag is a keyword that describes
# and categorizes the role. Users find roles by searching for tags. Be sure to
# remove the '[]' above, if you add tags to this list.
#
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
# Maximum 20 tags per role.
dependencies: []
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
# if you add dependencies to this list.

3
ansible/playbooks/roles/fastpass-worker-nodes/tasks/main.yml
View File

@@ -1,3 +0,0 @@
#SPDX-License-Identifier: MIT-0
---
# tasks file for fastpass-worker-nodes

3
ansible/playbooks/roles/fastpass-worker-nodes/tests/inventory
View File

@@ -1,3 +0,0 @@
#SPDX-License-Identifier: MIT-0
localhost

6
ansible/playbooks/roles/fastpass-worker-nodes/tests/test.yml
View File

@@ -1,6 +0,0 @@
#SPDX-License-Identifier: MIT-0
---
- hosts: localhost
remote_user: root
roles:
- fastpass-worker-nodes

3
ansible/playbooks/roles/fastpass-worker-nodes/vars/main.yml
View File

@@ -1,3 +0,0 @@
#SPDX-License-Identifier: MIT-0
---
# vars file for fastpass-worker-nodes

86
ansible/playbooks/roles/kubeconfig-manager/README.md
View File

@@ -1,86 +0,0 @@
# Kubeconfig Manager Role
A reusable Ansible role for managing kubeconfig files across multiple Kubernetes clusters.
## Features
- Fetches kubeconfig from remote Kubernetes nodes
- Merges multiple cluster configs into a single `~/.kube/config` file
- Creates backups before merging
- Provides unique cluster, context, and user names
- Works with any Kubernetes cluster (vanilla K8s, OpenShift, etc.)
## Requirements
- Ansible 2.9+
- Access to Kubernetes cluster admin.conf file
- Local kubectl installation (optional, for testing)
## Role Variables
| Variable | Default | Description |
|----------|---------|-------------|
| `cluster_name` | `kubernetes` | Name of the cluster (required) |
| `kubeconfig_source_path` | `/etc/kubernetes/admin.conf` | Path to kubeconfig on remote host |
| `context_suffix` | `admin` | Suffix for context name |
## Example Usage
### In a playbook:
```yaml
- name: Setup kubeconfig for FastPass cluster
hosts: fastpass_control_plane[0]
roles:
- role: kubeconfig-manager
vars:
cluster_name: "fastpass"
- name: Setup kubeconfig for Hub cluster
hosts: hub_cluster
roles:
- role: kubeconfig-manager
vars:
cluster_name: "hub"
kubeconfig_source_path: "/etc/kubernetes/admin.conf"
```
### As an included role:
```yaml
- name: Manage kubeconfig
ansible.builtin.include_role:
name: kubeconfig-manager
vars:
cluster_name: "{{ my_cluster_name }}"
```
## Generated Structure
The role creates contexts with this naming pattern:
- **Cluster**: `{{ cluster_name }}`
- **Context**: `{{ cluster_name }}-admin`
- **User**: `{{ cluster_name }}-admin`
## File Structure
```
~/.kube/
├── config # Merged kubeconfig
├── config-fastpass # Individual cluster configs
├── config-hub
├── config-internal
└── config.backup.1234567890 # Timestamped backups
```
## Dependencies
None
## License
MIT
## Author
mk-labs

11
ansible/playbooks/roles/kubeconfig-manager/defaults/main.yml
View File

@@ -1,11 +0,0 @@
---
# Default variables for kubeconfig-manager role
# Source path for the kubeconfig file on the remote host
kubeconfig_source_path: "/etc/kubernetes/admin.conf"
# Cluster name - should be provided by the calling playbook
cluster_name: "kubernetes"
# Context suffix for the cluster
context_suffix: "admin"

34
ansible/playbooks/roles/kubeconfig-manager/tasks/main.yml
View File

@@ -1,34 +0,0 @@
---
# role: kubeconfig-manager
# description: Reusable role for managing kubeconfig files across multiple clusters
# author: mk-labs
# version: 1.0.0
- name: Get local user environment
delegate_to: localhost
ansible.builtin.set_fact:
local_home: "{{ lookup('env', 'HOME') }}"
local_user: "{{ lookup('env', 'USER') }}"
- name: Debug local environment
delegate_to: localhost
ansible.builtin.debug:
msg: "Local user: {{ local_user }}, Home directory: {{ local_home }}"
- name: Create .kube directory
delegate_to: localhost
ansible.builtin.file:
path: "{{ local_home }}/.kube"
state: directory
owner: "{{ local_user }}"
mode: "0755"
- name: Copy kubeconfig from remote host
ansible.builtin.fetch:
src: "{{ kubeconfig_source_path | default('/etc/kubernetes/admin.conf') }}"
dest: "{{ local_home }}/.kube/config-{{ cluster_name }}"
flat: true
mode: "0644"
- name: Include kubeconfig merge tasks
ansible.builtin.include_tasks: merge-kubeconfig.yml

103
ansible/playbooks/roles/kubeconfig-manager/tasks/merge-kubeconfig.yml
View File

@@ -1,103 +0,0 @@
---
# Kubeconfig merging tasks
- name: Check if main kubeconfig exists
delegate_to: localhost
ansible.builtin.stat:
path: "{{ local_home }}/.kube/config"
register: main_kubeconfig
- name: Create backup of existing kubeconfig
delegate_to: localhost
ansible.builtin.copy:
src: "{{ local_home }}/.kube/config"
dest: "{{ local_home }}/.kube/config.backup.{{ ansible_date_time.epoch }}"
mode: "0644"
when: main_kubeconfig.stat.exists
- name: Read new cluster kubeconfig
delegate_to: localhost
ansible.builtin.slurp:
src: "{{ local_home }}/.kube/config-{{ cluster_name }}"
register: new_kubeconfig_content
- name: Parse new kubeconfig
delegate_to: localhost
ansible.builtin.set_fact:
new_kubeconfig: "{{ new_kubeconfig_content.content | b64decode | from_yaml }}"
- name: Update cluster name in kubeconfig
delegate_to: localhost
ansible.builtin.set_fact:
updated_kubeconfig:
apiVersion: "{{ new_kubeconfig.apiVersion }}"
kind: "{{ new_kubeconfig.kind }}"
clusters:
- name: "{{ cluster_name }}"
cluster: "{{ new_kubeconfig.clusters[0].cluster }}"
contexts:
- name: "{{ cluster_name }}-admin"
context:
cluster: "{{ cluster_name }}"
user: "{{ cluster_name }}-admin"
users:
- name: "{{ cluster_name }}-admin"
user: "{{ new_kubeconfig.users[0].user }}"
current-context: "{{ cluster_name }}-admin"
- name: Merge with existing kubeconfig or create new one
delegate_to: localhost
block:
- name: Read existing kubeconfig
ansible.builtin.slurp:
src: "{{ local_home }}/.kube/config"
register: existing_kubeconfig_content
when: main_kubeconfig.stat.exists
- name: Parse existing kubeconfig
ansible.builtin.set_fact:
existing_kubeconfig: "{{ existing_kubeconfig_content.content | b64decode | from_yaml }}"
when: main_kubeconfig.stat.exists
- name: Merge kubeconfigs
ansible.builtin.set_fact:
merged_kubeconfig:
apiVersion: "{{ existing_kubeconfig.apiVersion | default('v1') }}"
kind: "{{ existing_kubeconfig.kind | default('Config') }}"
clusters: "{{ (existing_kubeconfig.clusters | default([])) + updated_kubeconfig.clusters }}"
contexts: "{{ (existing_kubeconfig.contexts | default([])) + updated_kubeconfig.contexts }}"
users: "{{ (existing_kubeconfig.users | default([])) + updated_kubeconfig.users }}"
current-context: "{{ updated_kubeconfig['current-context'] }}"
when: main_kubeconfig.stat.exists
- name: Use new kubeconfig as merged config
ansible.builtin.set_fact:
merged_kubeconfig: "{{ updated_kubeconfig }}"
when: not main_kubeconfig.stat.exists
- name: Write merged kubeconfig
delegate_to: localhost
ansible.builtin.copy:
content: "{{ merged_kubeconfig | to_nice_yaml }}"
dest: "{{ local_home }}/.kube/config"
mode: "0644"
owner: "{{ local_user }}"
- name: Display available contexts
delegate_to: localhost
ansible.builtin.debug:
msg: |
Kubeconfig updated successfully!
Available contexts:
{% for context in merged_kubeconfig.contexts %}
- {{ context.name }}
{% endfor %}
Current context: {{ merged_kubeconfig['current-context'] }}
To switch contexts, use:
kubectl config use-context <context-name>
To list all contexts:
kubectl config get-contexts

34
ansible/playbooks/roles/kubernetes-prerequisites/defaults/main.yml
View File

@@ -1,34 +0,0 @@
---
# Kubernetes Prerequisites Role Defaults
# Kubernetes version to install (should be overridden in group_vars)
kubernetes_version: "v1.33"
# CNI plugin to install
cni_plugin: "calico"
# SELinux configuration
selinux_state: "permissive"
# Kernel modules to load
required_kernel_modules:
- overlay
- br_netfilter
# Sysctl parameters for Kubernetes
k8s_sysctl_params:
- "net.bridge.bridge-nf-call-iptables = 1"
- "net.bridge.bridge-nf-call-ip6tables = 1"
- "net.ipv4.ip_forward = 1"
containerd_dependencies:
- curl
- gnupg2
- software-properties-common
- apt-transport-https
- ca-certificates
kubernetes_packages:
- kubelet
- kubeadm
- kubectl

76
ansible/playbooks/roles/kubernetes-prerequisites/tasks/main.yml
View File

@@ -1,76 +0,0 @@
---
# Role to set/install Kubernetes prerequisites
- name: 1. Set Kubernetes-compatible hostname
ansible.builtin.hostname:
name: "{{ kubernetes_hostnames[inventory_hostname] | default(inventory_hostname) }}"
- name: 2. Disable swap
ansible.builtin.include_role:
name: no-swap
- name: 3. Manage SELinux
become: true
when: ansible_os_family == "RedHat"
block:
- name: 3.1 Install python3-libselinux for managing selinux
ansible.builtin.dnf:
name: python3-libselinux
state: present
- name: 3.2 Set SELinux to permissive mode
ansible.posix.selinux:
policy: targeted
state: "{{ selinux_state }}"
- name: 4 Manage Time Synchronization
ansible.builtin.include_role:
name: time-sync
- name: 5.1 Manage firewall (ufw)
become: true
when: ansible_os_family == "Debian"
block:
- name: 5.1.1 Install ufw
ansible.builtin.package:
name: ufw
state: present
- name: 5.1.2 Open firewall ports OpenSSH
community.general.ufw:
rule: allow
name: OpenSSH
- name: 5.1.3 Enable ufw
community.general.ufw:
state: enabled
- name: 5.2 Manage firewall (firewalld)
become: true
when: ansible_os_family == "RedHat"
block:
- name: 5.2.1 Install firewalld
ansible.builtin.package:
name: firewalld
state: present
- name: 5.2.2 Add SSH service to default zone (ensure SSH access)
ansible.posix.firewalld:
service: ssh
permanent: true
immediate: true
state: enabled
- name: 5.2.3 Start and enable firewalld
ansible.builtin.systemd:
name: firewalld
state: started
enabled: true
- name: 6 Install kubernetes
ansible.builtin.include_role:
name: kubernetes
- name: 7 Install containerd
ansible.builtin.include_role:
name: containerd

38
ansible/playbooks/roles/kubernetes/README.md
View File

@@ -1,38 +0,0 @@
Role Name
=========
A brief description of the role goes here.
Requirements
------------
Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
Role Variables
--------------
A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
Dependencies
------------
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- hosts: servers
roles:
- { role: username.rolename, x: 42 }
License
-------
BSD
Author Information
------------------
An optional section for the role authors to include contact information, or a website (HTML is not allowed).

2
ansible/playbooks/roles/kubernetes/defaults/main.yml
View File

@@ -1,2 +0,0 @@
---
# defaults file for kubernetes

3
ansible/playbooks/roles/kubernetes/handlers/main.yml
View File

@@ -1,3 +0,0 @@
#SPDX-License-Identifier: MIT-0
---
# handlers file for kubernetes

35
ansible/playbooks/roles/kubernetes/meta/main.yml
View File

@@ -1,35 +0,0 @@
#SPDX-License-Identifier: MIT-0
galaxy_info:
author: your name
description: your role description
company: your company (optional)
# If the issue tracker for your role is not on github, uncomment the
# next line and provide a value
# issue_tracker_url: http://example.com/issue/tracker
# Choose a valid license ID from https://spdx.org - some suggested licenses:
# - BSD-3-Clause (default)
# - MIT
# - GPL-2.0-or-later
# - GPL-3.0-only
# - Apache-2.0
# - CC-BY-4.0
license: license (GPL-2.0-or-later, MIT, etc)
min_ansible_version: 2.1
# If this a Container Enabled role, provide the minimum Ansible Container version.
# min_ansible_container_version:
galaxy_tags: []
# List tags for your role here, one per line. A tag is a keyword that describes
# and categorizes the role. Users find roles by searching for tags. Be sure to
# remove the '[]' above, if you add tags to this list.
#
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
# Maximum 20 tags per role.
dependencies: []
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
# if you add dependencies to this list.

97
ansible/playbooks/roles/kubernetes/tasks/main.yml
View File

@@ -1,97 +0,0 @@
---
# tasks file for kubernetes
- name: Load required kernel modules
become: true
community.general.modprobe:
name: "{{ item }}"
loop: "{{ required_kernel_modules }}"
- name: Persist kernel modules on boot
become: true
ansible.builtin.copy:
dest: /etc/modules-load.d/k8s.conf
content: "{{ required_kernel_modules | join('\n') }}"
owner: root
group: root
mode: '0644'
- name: Configure required sysctl params for Kubernetes
become: true
ansible.builtin.copy:
dest: /etc/sysctl.d/kubernetes.conf
content: "{{ k8s_sysctl_params | join('\n') }}"
owner: root
group: root
mode: '0644'
- name: Apply sysctl params without reboot
become: true
ansible.builtin.command: sysctl --system
- name: Manage firewall (ufw)
become: true
when: ansible_os_family == "Debian"
block:
- name: Create Kubernetes service definition (ufw)
ansible.builtin.template:
dest: /etc/ufw/applications.d/kubernetes
owner: root
group: root
mode: '0644'
src: kubernetes-ufw-service.xml.j2
- name: Manage firewall (firewalld)
become: true
when: ansible_os_family == "RedHat"
block:
- name: Create Kubernetes service definition (firewalld)
ansible.builtin.template:
dest: /etc/firewalld/services/kubernetes.xml
owner: root
group: root
mode: '0644'
src: kubernetes-firewalld-service.xml.j2
- name: Install via apt
become: true
when: ansible_os_family == "Debian"
block:
- name: Add Kubernetes apt key
ansible.builtin.apt_key:
url: "https://pkgs.k8s.io/core:/stable:/v{{ kubernetes_version }}/deb/Release.key"
state: present
- name: Add Kubernetes repository
ansible.builtin.apt_repository:
repo: "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.28/deb/ /"
state: present
filename: kubernetes
- name: Update apt cache
ansible.builtin.apt:
update_cache: true
- name: Install via dnf (may not work)
become: true
when: ansible_os_family == "RedHat"
block:
- name: Add repo using key from URL (dnf)
ansible.builtin.yum_repository:
name: kubernetes
description: "Kubernetes repository"
baseurl: https://pkgs.k8s.io/core:/stable:/{{ kubernetes_version }}/rpm/
gpgcheck: true
gpgkey: https://pkgs.k8s.io/core:/stable:/{{ kubernetes_version }}/rpm/repodata/repomd.xml.key
- name: Update dnf cache
ansible.builtin.dnf:
update_cache: true
- name: Install Kubernetes packages
become: true
ansible.builtin.package:
name: "{{ item }}"
update_cache: true
state: present
loop:
"{{ kubernetes_packages }}"

49
ansible/playbooks/roles/kubernetes/templates/kubernetes-firewalld-service.xml.j2
View File

@@ -1,49 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<service>
<short>kubernetes_API</short>
<description>Kubernetes API</description>
<port protocol="tcp" port="6443"/>
</service>
<service>
<short>etcd</short>
<description>Kubernetes etcd</description>
<port protocol="tcp" port="2379-2380"/>
</service>
<service>
<short>kubelet</short>
<description>Kubernetes Kubelet</description>
<port protocol="tcp" port="10250"/>
</service>
<service>
<short>kube-scheduler</short>
<description>Kubernetes kube-scheduler</description>
<port protocol="tcp" port="10259"/>
</service>
<service>
<short>kube-controller-manager</short>
<description>Kubernetes kube-controller-manager</description>
<port protocol="tcp" port="10257"/>
</service>
<service>
<short>kube-proxy</short>
<description>Kubernetes kube-proxy</description>
<port protocol="tcp" port="10256"/>
</service>
<service>
<short>NodePort</short>
<description>NodePort</description>
<port protocol="tcp" port="30000-32767"/>
</service>
<service>
<short>NodePort</short>
<description>NodePort</description>
<port protocol="udp" port="30000-32767"/>
</service>

34
ansible/playbooks/roles/kubernetes/templates/kubernetes-ufw-service.xml.j2
View File

@@ -1,34 +0,0 @@
[kubernetes_API]
title=Kubernetes API
description=KKubernetes API
ports=6443/tcp
[etcd]
title=Kubernetes etcd
description=Kubernetes etcd
ports=2379:2380/tcp
[kubelet]
title=Kubernetes Kubelet
description=Kubernetes Kubelet
ports=10250/tcp
[kube-scheduler]
title=Kubernetes kube-scheduler
description=Kubernetes kube-scheduler
ports=10259/tcp
[kube-controller-manager]
title=Kubernetes kube-controller-manager
description=Kubernetes kube-controller-manager
ports=10257/tcp
[kube-proxy]
title=Kubernetes kube-proxy
description=Kubernetes kube-proxy
ports=10256/tcp
[NodePort]
title=NodePort
description=NodePort
ports=30000:32767/tcp|30000:32767/udp

3
ansible/playbooks/roles/kubernetes/tests/inventory
View File

@@ -1,3 +0,0 @@
#SPDX-License-Identifier: MIT-0
localhost

6
ansible/playbooks/roles/kubernetes/tests/test.yml
View File

@@ -1,6 +0,0 @@
#SPDX-License-Identifier: MIT-0
---
- hosts: localhost
remote_user: root
roles:
- kubernetes

3
ansible/playbooks/roles/kubernetes/vars/main.yml
View File

@@ -1,3 +0,0 @@
#SPDX-License-Identifier: MIT-0
---
# vars file for kubernetes

12
ansible/playbooks/roles/traefik-manager/defaults/main.yml
View File

@@ -1,12 +0,0 @@
---
# Default variables for traefik-manager role
# Traefik Configuration
traefik_config_dir: "/etc/traefik"
traefik_host: "{{ traefik_server | default(groups['traefik_servers'][0] | default('localhost')) }}"
cluster_api_port: 6443
# Cluster Configuration (to be provided by calling role)
# cluster_name: "fastpass"
# cluster_endpoint: "fastpass.local.mk-labs.cloud"
# control_plane_nodes: ["space-mountain", "big-thunder-mountain", "splash-mountain"]

8
ansible/playbooks/roles/traefik-manager/handlers/main.yml
View File

@@ -1,8 +0,0 @@
---
# Handlers for traefik-manager role
- name: reload traefik
ansible.builtin.systemd:
name: traefik
state: reloaded
delegate_to: "{{ traefik_host }}"

45
ansible/playbooks/roles/traefik-manager/tasks/main.yml
View File

@@ -1,45 +0,0 @@
---
# role: traefik-manager
# description: Reusable role for managing Traefik load balancer configuration
# author: mk-labs
# version: 1.0.0
- name: Create Traefik configuration directory
ansible.builtin.file:
path: "{{ traefik_config_dir }}/dynamic"
state: directory
mode: "0755"
delegate_to: "{{ traefik_host }}"
- name: Generate Traefik TCP router configuration for Kubernetes API
ansible.builtin.template:
src: k8s-api-router.yml.j2
dest: "{{ traefik_config_dir }}/dynamic/{{ cluster_name }}-api.yml"
mode: "0644"
delegate_to: "{{ traefik_host }}"
notify: reload traefik
- name: Generate Traefik service configuration for control plane nodes
ansible.builtin.template:
src: k8s-api-service.yml.j2
dest: "{{ traefik_config_dir }}/dynamic/{{ cluster_name }}-service.yml"
mode: "0644"
delegate_to: "{{ traefik_host }}"
notify: reload traefik
- name: Verify Traefik configuration syntax
ansible.builtin.command: |
traefik --configfile={{ traefik_config_dir }}/traefik.yml --dry-run
delegate_to: "{{ traefik_host }}"
register: traefik_syntax_check
failed_when: traefik_syntax_check.rc != 0
changed_when: false
- name: Display Traefik configuration status
ansible.builtin.debug:
msg: |
✅ Traefik configuration created successfully:
- Router: {{ cluster_name }}-api
- Service: {{ cluster_name }}-backend
- Endpoint: {{ cluster_endpoint }}:{{ cluster_api_port }}
- Backend nodes: {{ control_plane_nodes | join(', ') }}

23
ansible/playbooks/roles/traefik-manager/templates/k8s-api-router.yml.j2
View File

@@ -1,23 +0,0 @@
---
# Traefik TCP Router for {{ cluster_name }} Kubernetes API
tcp:
routers:
{{ cluster_name }}-api:
rule: "HostSNI(`{{ cluster_endpoint }}`)"
service: "{{ cluster_name }}-backend"
tls:
passthrough: true
entryPoints:
- "k8s-api"
services:
{{ cluster_name }}-backend:
loadBalancer:
servers:
{% for node in control_plane_nodes %}
- address: "{{ hostvars[node]['ansible_default_ipv4']['address'] }}:{{ cluster_api_port }}"
{% endfor %}
healthCheck:
path: "/healthz"
interval: "10s"
timeout: "3s"

8
ansible/playbooks/test-control-plane.yml
View File

@@ -1,8 +0,0 @@
---
- name: Test Control Plane Initialization on Single Node
hosts: space-mountain
become: true
gather_facts: false
roles:
- role: fastpass-control-plane

8
ansible/playbooks/test-kubernetes-role.yml
View File

@@ -1,8 +0,0 @@
---
- name: Test Kubernetes Role on Single Node
hosts: space-mountain
become: true
gather_facts: true
roles:
- role: kubernetes

8
ansible/playbooks/test-prerequisites.yml
View File

@@ -1,8 +0,0 @@
---
- name: Test Kubernetes Prerequisites Role
hosts: space-mountain
become: true
gather_facts: true
roles:
- role: kubernetes-prerequisites

114
ansible/scripts/setup-cluster-network.sh
View File

@@ -1,114 +0,0 @@
#!/bin/bash
# FastPass Homelab - Cluster Network Setup Script
# This script sets up DNS (via Technitium) and load balancer configuration for any Kubernetes cluster
set -e
# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color
# Function to print colored output
print_status() {
local status=$1
local message=$2
case $status in
"INFO")
echo -e "${BLUE}ℹ️ INFO${NC}: $message"
;;
"SUCCESS")
echo -e "${GREEN}✅ SUCCESS${NC}: $message"
;;
"ERROR")
echo -e "${RED}❌ ERROR${NC}: $message"
;;
"WARN")
echo -e "${YELLOW}⚠️ WARN${NC}: $message"
;;
esac
}
# Usage function
usage() {
echo "Usage: $0 <cluster_name> <cluster_endpoint> <control_plane_group>"
echo ""
echo "Examples:"
echo " $0 fastpass fastpass.local.mk-labs.cloud fastpass_control_plane"
echo " $0 hub hub.local.mk-labs.cloud hub_cluster"
echo " $0 internal internal.local.mk-labs.cloud internal_cluster"
echo ""
echo "This script will:"
echo " 1. Create DNS entry for the cluster endpoint"
echo " 2. Configure Traefik load balancer"
echo " 3. Test connectivity"
echo ""
exit 1
}
# Check arguments
if [ $# -ne 3 ]; then
print_status "ERROR" "Invalid number of arguments"
usage
fi
CLUSTER_NAME=$1
CLUSTER_ENDPOINT=$2
CONTROL_PLANE_GROUP=$3
print_status "INFO" "Setting up network for cluster: $CLUSTER_NAME"
print_status "INFO" "Endpoint: $CLUSTER_ENDPOINT"
print_status "INFO" "Control plane group: $CONTROL_PLANE_GROUP"
# Check if inventory file exists
if [ ! -f "inventory.yml" ]; then
print_status "ERROR" "inventory.yml not found. Please run from ansible directory."
exit 1
fi
# Create temporary playbook
TEMP_PLAYBOOK=$(mktemp /tmp/cluster-network-setup-XXXXXX.yml)
cat > "$TEMP_PLAYBOOK" << EOF
---
- name: Setup network infrastructure for $CLUSTER_NAME
hosts: ${CONTROL_PLANE_GROUP}[0]
gather_facts: true
tasks:
- name: Setup cluster network infrastructure
ansible.builtin.include_role:
name: cluster-network-setup
vars:
cluster_name: "$CLUSTER_NAME"
cluster_endpoint: "$CLUSTER_ENDPOINT"
cluster_vip: "{{ ansible_default_ipv4.address }}"
control_plane_nodes: "{{ groups['$CONTROL_PLANE_GROUP'] }}"
EOF
print_status "INFO" "Running network setup playbook..."
# Run the network setup
if ansible-playbook -i inventory.yml "$TEMP_PLAYBOOK"; then
print_status "SUCCESS" "Network setup completed for $CLUSTER_NAME"
# Test connectivity
print_status "INFO" "Testing connectivity to $CLUSTER_ENDPOINT:6443..."
if timeout 10 bash -c "</dev/tcp/$CLUSTER_ENDPOINT/6443"; then
print_status "SUCCESS" "Connectivity test passed"
else
print_status "WARN" "Connectivity test failed - may need time to propagate"
fi
print_status "INFO" "Network setup complete. You can now:"
echo " 1. Deploy your cluster"
echo " 2. Test with: kubectl --server=https://$CLUSTER_ENDPOINT:6443 cluster-info"
else
print_status "ERROR" "Network setup failed"
exit 1
fi
# Cleanup
rm -f "$TEMP_PLAYBOOK"

91
ansible/scripts/setup-kubeconfig.sh
View File

@@ -1,91 +0,0 @@
#!/bin/bash
# FastPass Homelab - Kubeconfig Setup Script
# This script makes it easy to add any cluster's kubeconfig to your local config
set -e
# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color
# Function to print colored output
print_status() {
local status=$1
local message=$2
case $status in
"INFO")
echo -e "${BLUE}ℹ️ INFO${NC}: $message"
;;
"SUCCESS")
echo -e "${GREEN}✅ SUCCESS${NC}: $message"
;;
"ERROR")
echo -e "${RED}❌ ERROR${NC}: $message"
;;
"WARN")
echo -e "${YELLOW}⚠️ WARN${NC}: $message"
;;
esac
}
# Usage function
usage() {
echo "Usage: $0 <cluster_name> <host_group>"
echo ""
echo "Examples:"
echo " $0 fastpass fastpass_control_plane[0]"
echo " $0 hub hub_cluster"
echo " $0 internal internal_cluster[0]"
echo ""
echo "Available clusters in your homelab:"
echo " - fastpass (FastPass Kubernetes cluster)"
echo " - hub (OpenShift Hub cluster)"
echo " - internal (Internal OpenShift cluster)"
echo ""
exit 1
}
# Check arguments
if [ $# -ne 2 ]; then
print_status "ERROR" "Invalid number of arguments"
usage
fi
CLUSTER_NAME=$1
HOST_GROUP=$2
print_status "INFO" "Setting up kubeconfig for cluster: $CLUSTER_NAME"
print_status "INFO" "Target hosts: $HOST_GROUP"
# Check if inventory file exists
if [ ! -f "inventory.yml" ]; then
print_status "ERROR" "inventory.yml not found. Please run from ansible directory."
exit 1
fi
# Run the kubeconfig setup
print_status "INFO" "Running Ansible playbook..."
ansible-playbook -i inventory.yml \
playbooks/examples/multi-cluster-kubeconfig.yml \
--limit "$HOST_GROUP" \
-e "target_cluster_hosts=$HOST_GROUP" \
-e "target_cluster_name=$CLUSTER_NAME" \
--tags kubeconfig
if [ $? -eq 0 ]; then
print_status "SUCCESS" "Kubeconfig setup completed for $CLUSTER_NAME"
print_status "INFO" "You can now use: kubectl config use-context ${CLUSTER_NAME}-admin"
# Show available contexts
echo ""
print_status "INFO" "Available contexts:"
kubectl config get-contexts 2>/dev/null || print_status "WARN" "kubectl not found or kubeconfig not accessible"
else
print_status "ERROR" "Kubeconfig setup failed"
exit 1
fi

210
ansible/scripts/test-fastpass-deployment.sh
View File

@@ -1,210 +0,0 @@
#!/bin/bash
# FastPass Kubernetes Cluster Deployment Test Script
# This script validates the Ansible playbooks before deployment
set -e
echo "🧪 FastPass Kubernetes Cluster Deployment Test"
echo "=============================================="
# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color
# Function to print colored output
print_status() {
local status=$1
local message=$2
case $status in
"PASS")
echo -e "${GREEN}✅ PASS${NC}: $message"
;;
"FAIL")
echo -e "${RED}❌ FAIL${NC}: $message"
;;
"WARN")
echo -e "${YELLOW}⚠️ WARN${NC}: $message"
;;
esac
}
# Test 1: Check if Ansible is installed
echo ""
echo "1. Checking Ansible installation..."
if command -v ansible-playbook &> /dev/null; then
ANSIBLE_VERSION=$(ansible-playbook --version | head -n1)
print_status "PASS" "Ansible found: $ANSIBLE_VERSION"
else
print_status "FAIL" "Ansible not found. Please install Ansible."
exit 1
fi
# Test 2: Check inventory file
echo ""
echo "2. Checking inventory file..."
if [ -f "inventory.yml" ]; then
print_status "PASS" "Inventory file found: inventory.yml"
# Check if fastpass groups exist
if grep -q "fastpass_control_plane:" inventory.yml; then
print_status "PASS" "fastpass_control_plane group found"
else
print_status "FAIL" "fastpass_control_plane group not found in inventory"
fi
if grep -q "fastpass_workers:" inventory.yml; then
print_status "PASS" "fastpass_workers group found"
else
print_status "FAIL" "fastpass_workers group not found in inventory"
fi
else
print_status "FAIL" "Inventory file not found: inventory.yml"
exit 1
fi
# Test 3: Check playbook files
echo ""
echo "3. Checking playbook files..."
if [ -f "playbooks/deploy-fastpass-cluster.yml" ]; then
print_status "PASS" "Main deployment playbook found"
else
print_status "FAIL" "Main deployment playbook not found"
fi
if [ -f "playbooks/deploy_k8s.yml" ]; then
print_status "PASS" "Legacy deployment playbook found"
else
print_status "WARN" "Legacy deployment playbook not found"
fi
# Test 4: Check role files
echo ""
echo "4. Checking role files..."
ROLES=(
"playbooks/roles/kubernetes/tasks/main.yml"
"playbooks/roles/fastpass-control-plane/tasks/main.yml"
"playbooks/roles/fastpass-control-plane-join/tasks/main.yml"
"playbooks/roles/fastpass-workers/tasks/main.yml"
"playbooks/roles/fastpass-workers/tasks/node-labels.yml"
)
for role in "${ROLES[@]}"; do
if [ -f "$role" ]; then
print_status "PASS" "Role file found: $role"
else
print_status "FAIL" "Role file not found: $role"
fi
done
# Test 5: Check group_vars
echo ""
echo "5. Checking group variables..."
if [ -f "group_vars/fastpass/vars" ]; then
print_status "PASS" "FastPass group variables found"
# Check for required variables
if grep -q "pod_network_cidr:" group_vars/fastpass/vars; then
print_status "PASS" "pod_network_cidr variable found"
else
print_status "WARN" "pod_network_cidr variable not found"
fi
if grep -q "control_plane_endpoint:" group_vars/fastpass/vars; then
print_status "PASS" "control_plane_endpoint variable found"
else
print_status "WARN" "control_plane_endpoint variable not found"
fi
else
print_status "FAIL" "FastPass group variables not found"
fi
# Test 6: Validate playbook syntax
echo ""
echo "6. Validating playbook syntax..."
if ansible-playbook --syntax-check playbooks/deploy-fastpass-cluster.yml > /dev/null 2>&1; then
print_status "PASS" "Main playbook syntax is valid"
else
print_status "FAIL" "Main playbook syntax is invalid"
echo "Running syntax check with verbose output:"
ansible-playbook --syntax-check playbooks/deploy-fastpass-cluster.yml
fi
# Test 7: Check for common issues
echo ""
echo "7. Checking for common issues..."
# Check for hardcoded values
if grep -r "10.244.0.0/16" playbooks/ | grep -v "group_vars" > /dev/null; then
print_status "WARN" "Hardcoded pod network CIDR found in playbooks"
else
print_status "PASS" "No hardcoded pod network CIDR found"
fi
# Check for proper kubeconfig usage
if grep -r "kubectl --kubeconfig" playbooks/ > /dev/null; then
print_status "PASS" "Proper kubeconfig usage found"
else
print_status "WARN" "No explicit kubeconfig usage found"
fi
# Test 8: DNS validation
echo ""
echo "8. Validating DNS setup..."
CONTROL_PLANE_ENDPOINT="fastpass.local.mk-labs.cloud"
if nslookup "$CONTROL_PLANE_ENDPOINT" > /dev/null 2>&1; then
print_status "PASS" "DNS resolution successful for $CONTROL_PLANE_ENDPOINT"
# Get A records
A_RECORDS=$(nslookup "$CONTROL_PLANE_ENDPOINT" | grep -A 10 "Name:" | grep "Address:" | awk '{print $2}' | sort)
RECORD_COUNT=$(echo "$A_RECORDS" | wc -l)
if [ "$RECORD_COUNT" -ge 1 ]; then
print_status "PASS" "Found $RECORD_COUNT A record(s) for load balancing"
echo " DNS records:"
echo "$A_RECORDS" | while read -r ip; do
echo " - $ip"
done
else
print_status "WARN" "No A records found for $CONTROL_PLANE_ENDPOINT"
fi
else
print_status "FAIL" "DNS resolution failed for $CONTROL_PLANE_ENDPOINT"
echo " Please run: ./scripts/validate-dns-setup.sh for detailed DNS validation"
fi
# Test 9: Check SSH connectivity (if hosts are available)
echo ""
echo "9. Checking SSH connectivity..."
if [ -n "$1" ]; then
echo "Testing SSH connectivity to specified host: $1"
if ssh -o ConnectTimeout=5 -o BatchMode=yes "$1" exit 2>/dev/null; then
print_status "PASS" "SSH connectivity to $1 successful"
else
print_status "FAIL" "SSH connectivity to $1 failed"
fi
else
print_status "WARN" "No host specified for SSH test. Use: $0 <hostname>"
fi
# Summary
echo ""
echo "=============================================="
echo "🎯 Deployment Test Summary"
echo "=============================================="
echo ""
echo "To deploy the FastPass cluster:"
echo "1. Ensure all tests above pass"
echo "2. Run: ansible-playbook -i inventory.yml playbooks/deploy-fastpass-cluster.yml"
echo ""
echo "To test with a specific host:"
echo " $0 <hostname>"
echo ""
echo "To validate DNS setup:"
echo " ./scripts/validate-dns-setup.sh"
echo ""
echo "To validate the deployment:"
echo " ./scripts/manage-kubeconfigs.sh test"
echo ""

9
ansible/test-fastpass-role.yml
View File

@@ -1,9 +0,0 @@
---
- name: Test FastPass First Control Plane Role
hosts: localhost
gather_facts: true
vars:
cluster_name: "fastpass"
kubernetes_services_control_plane: []
roles:
- role: playbooks/roles/fastpass-first-control-plane