homelab/.kiro/specs/fastpass-additional-control-plane/tasks.md

Implementation Plan

• 1. Create role directory structure and basic configuration

  • Create the fastpass-additional-control-plane role directory structure
  • Set up defaults/main.yml with required variables and firewall services
  • Create meta/main.yml with role metadata and dependencies
  • Requirements: 2.1, 2.2, 2.4

• 2. Implement join token and certificate key retrieval

  • 2.1 Create tasks to generate new join tokens from first control plane

    • Write Ansible tasks to execute kubeadm token create on first control plane node
    • Implement token validation and expiration checking
    • Add error handling for token generation failures
    • Requirements: 1.4, 5.4

  • 2.2 Implement certificate key retrieval and management

    • Create tasks to upload and retrieve certificate keys from first control plane
    • Add certificate key expiration handling and rotation
    • Implement secure handling of certificate keys in variables
    • Requirements: 1.4, 5.1

  • 2.3 Create discovery token CA certificate hash retrieval

    • Write tasks to extract CA certificate hash from first control plane
    • Implement validation of certificate hash format
    • Add error handling for certificate retrieval failures
    • Requirements: 1.4, 5.4

• 3. Implement DNS configuration and firewall setup

  • 3.1 Configure DNS records for additional control plane nodes

    • Integrate dns-manager role for consistent DNS record creation
    • Pass appropriate host_name variable to dns-manager
    • Add DNS propagation wait and validation
    • Requirements: 3.1, 3.2, 3.4

  • 3.2 Set up firewall rules for control plane services

    • Reuse kubernetes_services_control_plane from defaults
    • Implement UFW firewall rule creation for Debian/Ubuntu systems
    • Add conditional logic for different operating systems
    • Requirements: 1.2, 2.4

• 4. Implement kubelet configuration and cluster join

  • 4.1 Create initial kubelet configuration

    • Write kubelet config.yaml with systemd cgroup driver
    • Set containerd socket endpoint configuration
    • Ensure proper file permissions and ownership
    • Requirements: 1.3, 2.3

  • 4.2 Execute kubeadm join for control plane

    • Implement kubeadm join command with control-plane flag
    • Use retrieved join token, certificate key, and CA cert hash
    • Add proper command argument construction and validation
    • Include idempotency checks to prevent duplicate joins
    • Requirements: 1.1, 1.4, 5.1, 5.2

  • 4.3 Ensure kubelet service management

    • Enable and start kubelet systemd service
    • Add service status validation and error handling
    • Implement service restart logic if needed
    • Requirements: 1.3, 1.5

• 5. Implement kubeconfig management and validation

  • 5.1 Configure kubeconfig for additional control plane nodes

    • Integrate kubeconfig-manager role for consistent configuration
    • Pass cluster_name variable to kubeconfig-manager
    • Ensure proper kubeconfig merging with existing configurations
    • Requirements: 4.1, 4.2, 4.3

  • 5.2 Implement cluster join validation

    • Create tasks to verify node successfully joined as control plane
    • Add kubectl commands to check node status and roles
    • Implement cluster health validation checks
    • Requirements: 1.5, 4.4

• 6. Add comprehensive error handling and idempotency

  • 6.1 Implement pre-flight validation checks

    • Check if node is already joined to cluster
    • Validate required variables are defined
    • Verify first control plane node accessibility
    • Add system resource and prerequisite checks
    • Requirements: 5.1, 5.2, 5.4, 5.5

  • 6.2 Add retry logic and failure recovery

    • Implement retry mechanisms for transient failures
    • Add exponential backoff for network-related operations
    • Create cleanup tasks for partial join failures
    • Requirements: 5.3, 5.4

• 7. Integration with FastPass deployment workflow

  • 7.1 Ensure compatibility with deploy-fastpass-4step.yml

    • Verify role works with fastpass_control_plane[1:] host group
    • Test integration with existing playbook structure
    • Validate dependency on first control plane completion
    • Requirements: 6.1, 6.2, 6.3, 6.4

  • 7.2 Add proper task documentation and metadata

    • Include role header with author, version, and description
    • Add inline comments for complex task logic
    • Document required variables and their purposes
    • Requirements: 2.2, 2.5

• * 8. Create comprehensive testing and validation

  • * 8.1 Write unit tests for individual tasks

    • Create test cases for token retrieval logic
    • Test kubeadm join command construction
    • Validate error handling scenarios
    • Requirements: 1.1, 1.4, 5.1

  • * 8.2 Implement integration tests

    • Test multi-node control plane deployment
    • Validate cluster health after additional nodes join
    • Test failover scenarios and cluster resilience
    • Requirements: 1.5, 6.5

  • * 8.3 Add validation scripts and health checks

    • Create scripts to verify cluster state after deployment
    • Implement automated health validation
    • Add performance and resource usage monitoring
    • Requirements: 1.5, 4.4