initial commit
This commit is contained in:
commit
dc1869db6b
|
@ -0,0 +1,159 @@
|
||||||
|
local PipelineLinting = {
|
||||||
|
kind: 'pipeline',
|
||||||
|
name: 'linting',
|
||||||
|
platform: {
|
||||||
|
os: 'linux',
|
||||||
|
arch: 'amd64',
|
||||||
|
},
|
||||||
|
steps: [
|
||||||
|
{
|
||||||
|
name: 'ansible-later',
|
||||||
|
image: 'thegeeklab/ansible-later',
|
||||||
|
commands: [
|
||||||
|
'ansible-later',
|
||||||
|
],
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: 'python-format',
|
||||||
|
image: 'python:3.9',
|
||||||
|
environment: {
|
||||||
|
PY_COLORS: 1,
|
||||||
|
},
|
||||||
|
commands: [
|
||||||
|
'pip install -qq yapf',
|
||||||
|
'[ ! -z "$(find . -type f -name *.py)" ] && yapf -rd ./',
|
||||||
|
],
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: 'python-flake8',
|
||||||
|
image: 'python:3.9',
|
||||||
|
environment: {
|
||||||
|
PY_COLORS: 1,
|
||||||
|
},
|
||||||
|
commands: [
|
||||||
|
'pip install -qq flake8',
|
||||||
|
'flake8',
|
||||||
|
],
|
||||||
|
},
|
||||||
|
],
|
||||||
|
trigger: {
|
||||||
|
ref: ['refs/heads/main', 'refs/tags/**', 'refs/pull/**'],
|
||||||
|
},
|
||||||
|
};
|
||||||
|
|
||||||
|
local PipelineDeployment(scenario='rocky9') = {
|
||||||
|
kind: 'pipeline',
|
||||||
|
name: 'testing-' + scenario,
|
||||||
|
platform: {
|
||||||
|
os: 'linux',
|
||||||
|
arch: 'amd64',
|
||||||
|
},
|
||||||
|
concurrency: {
|
||||||
|
limit: 1,
|
||||||
|
},
|
||||||
|
workspace: {
|
||||||
|
base: '/drone/src',
|
||||||
|
path: '${DRONE_REPO_NAME}',
|
||||||
|
},
|
||||||
|
steps: [
|
||||||
|
{
|
||||||
|
name: 'ansible-molecule',
|
||||||
|
image: 'thegeeklab/molecule:3',
|
||||||
|
environment: {
|
||||||
|
HCLOUD_TOKEN: { from_secret: 'hcloud_token' },
|
||||||
|
},
|
||||||
|
commands: [
|
||||||
|
'molecule test -s ' + scenario,
|
||||||
|
],
|
||||||
|
},
|
||||||
|
],
|
||||||
|
depends_on: [
|
||||||
|
'linting',
|
||||||
|
],
|
||||||
|
trigger: {
|
||||||
|
ref: ['refs/heads/main', 'refs/tags/**'],
|
||||||
|
},
|
||||||
|
};
|
||||||
|
|
||||||
|
local PipelineDocumentation = {
|
||||||
|
kind: 'pipeline',
|
||||||
|
name: 'documentation',
|
||||||
|
platform: {
|
||||||
|
os: 'linux',
|
||||||
|
arch: 'amd64',
|
||||||
|
},
|
||||||
|
steps: [
|
||||||
|
{
|
||||||
|
name: 'generate',
|
||||||
|
image: 'thegeeklab/ansible-doctor',
|
||||||
|
environment: {
|
||||||
|
ANSIBLE_DOCTOR_LOG_LEVEL: 'INFO',
|
||||||
|
ANSIBLE_DOCTOR_FORCE_OVERWRITE: true,
|
||||||
|
ANSIBLE_DOCTOR_EXCLUDE_FILES: 'molecule/',
|
||||||
|
ANSIBLE_DOCTOR_TEMPLATE: 'hugo-book',
|
||||||
|
ANSIBLE_DOCTOR_ROLE_NAME: '${DRONE_REPO_NAME#*.}',
|
||||||
|
ANSIBLE_DOCTOR_OUTPUT_DIR: '_docs/',
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: 'publish',
|
||||||
|
image: 'plugins/gh-pages',
|
||||||
|
settings: {
|
||||||
|
remote_url: 'https://gitea.rknet.org/ansible/${DRONE_REPO_NAME}',
|
||||||
|
netrc_machine: 'gitea.rknet.org',
|
||||||
|
username: { from_secret: 'gitea_username' },
|
||||||
|
password: { from_secret: 'gitea_token' },
|
||||||
|
pages_directory: '_docs/',
|
||||||
|
target_branch: 'docs',
|
||||||
|
},
|
||||||
|
when: {
|
||||||
|
ref: ['refs/heads/main'],
|
||||||
|
},
|
||||||
|
},
|
||||||
|
],
|
||||||
|
trigger: {
|
||||||
|
ref: ['refs/heads/main', 'refs/tags/**', 'refs/pull/**'],
|
||||||
|
},
|
||||||
|
depends_on: [
|
||||||
|
'testing-rocky9',
|
||||||
|
],
|
||||||
|
};
|
||||||
|
|
||||||
|
local PipelineNotification = {
|
||||||
|
kind: 'pipeline',
|
||||||
|
name: 'notification',
|
||||||
|
platform: {
|
||||||
|
os: 'linux',
|
||||||
|
arch: 'amd64',
|
||||||
|
},
|
||||||
|
clone: {
|
||||||
|
disable: true,
|
||||||
|
},
|
||||||
|
steps: [
|
||||||
|
{
|
||||||
|
name: 'matrix',
|
||||||
|
image: 'thegeeklab/drone-matrix',
|
||||||
|
settings: {
|
||||||
|
homeserver: { from_secret: 'matrix_homeserver' },
|
||||||
|
roomid: { from_secret: 'matrix_roomid' },
|
||||||
|
template: 'Status: **{{ build.Status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.Link }}){{#if build.Branch}} ({{ build.Branch }}){{/if}} by {{ commit.Author }}<br/> Message: {{ commit.Message.Title }}',
|
||||||
|
username: { from_secret: 'matrix_username' },
|
||||||
|
password: { from_secret: 'matrix_password' },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
],
|
||||||
|
depends_on: [
|
||||||
|
'documentation',
|
||||||
|
],
|
||||||
|
trigger: {
|
||||||
|
status: ['success', 'failure'],
|
||||||
|
ref: ['refs/heads/main', 'refs/tags/**'],
|
||||||
|
},
|
||||||
|
};
|
||||||
|
|
||||||
|
[
|
||||||
|
PipelineLinting,
|
||||||
|
PipelineDeployment(scenario='rocky9'),
|
||||||
|
PipelineDocumentation,
|
||||||
|
PipelineNotification,
|
||||||
|
]
|
|
@ -0,0 +1,11 @@
|
||||||
|
# ---> Ansible
|
||||||
|
*.retry
|
||||||
|
plugins
|
||||||
|
library
|
||||||
|
|
||||||
|
# ---> Python
|
||||||
|
# Byte-compiled / optimized / DLL files
|
||||||
|
__pycache__/
|
||||||
|
*.py[cod]
|
||||||
|
*$py.class
|
||||||
|
|
|
@ -0,0 +1,19 @@
|
||||||
|
---
|
||||||
|
ansible:
|
||||||
|
custom_modules:
|
||||||
|
- iptables_raw
|
||||||
|
- openssl_pkcs12
|
||||||
|
- proxmox_kvm
|
||||||
|
- ucr
|
||||||
|
- corenetworks_dns
|
||||||
|
- corenetworks_token
|
||||||
|
|
||||||
|
rules:
|
||||||
|
exclude_files:
|
||||||
|
- molecule/
|
||||||
|
- "LICENSE*"
|
||||||
|
- "**/*.md"
|
||||||
|
- "**/*.ini"
|
||||||
|
|
||||||
|
exclude_filter:
|
||||||
|
- LINT0009
|
|
@ -0,0 +1 @@
|
||||||
|
.drone*
|
|
@ -0,0 +1,21 @@
|
||||||
|
MIT License
|
||||||
|
|
||||||
|
Copyright (c) 2022 Robert Kaussow <mail@thegeeklab.de>
|
||||||
|
|
||||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
|
in the Software without restriction, including without limitation the rights
|
||||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
copies of the Software, and to permit persons to whom the Software is furnished
|
||||||
|
to do so, subject to the following conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice (including the next
|
||||||
|
paragraph) shall be included in all copies or substantial portions of the
|
||||||
|
Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
|
||||||
|
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS
|
||||||
|
OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
||||||
|
WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF
|
||||||
|
OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|
@ -0,0 +1,10 @@
|
||||||
|
# xoxys.k3s
|
||||||
|
|
||||||
|
[![Build Status](https://img.shields.io/drone/build/ansible/xoxys.k3s?logo=drone&server=https%3A%2F%2Fdrone.rknet.org)](https://drone.rknet.org/ansible/xoxys.k3s)
|
||||||
|
[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg?label=license)](LICENSE)
|
||||||
|
|
||||||
|
Setup K3s cluster nodes. You can find the full documentation at [https://galaxy.geekdocs.de](https://galaxy.geekdocs.de/roles/cloud/k3s/).
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
|
|
@ -0,0 +1,43 @@
|
||||||
|
---
|
||||||
|
k3s_version: v1.25.0+k3s1
|
||||||
|
|
||||||
|
k3s_packages_extra:
|
||||||
|
- container-selinux
|
||||||
|
- selinux-policy-base
|
||||||
|
|
||||||
|
k3s_reset: False
|
||||||
|
k3s_token: "secure-token"
|
||||||
|
k3s_node_ip: "{{ ansible_default_ipv4.address }}"
|
||||||
|
k3s_init_log_enabled: False
|
||||||
|
|
||||||
|
k3s_config_dir: /etc/rancher/k3s
|
||||||
|
k3s_data_dir: /var/lib/rancher/k3s
|
||||||
|
k3s_log_dir: /var/log/rancher/k3s
|
||||||
|
|
||||||
|
k3s_server: True
|
||||||
|
k3s_server_bind_ip: "0.0.0.0"
|
||||||
|
k3s_server_nodes:
|
||||||
|
- "{{ ansible_hostname }}"
|
||||||
|
k3s_server_flannel_backend_enabled: True
|
||||||
|
k3s_server_network_policy_enabled: True
|
||||||
|
k3s_server_feature_gates: []
|
||||||
|
|
||||||
|
k3s_server_admission_plugins:
|
||||||
|
- NodeRestriction
|
||||||
|
- EventRateLimit
|
||||||
|
- ServiceAccount
|
||||||
|
- NamespaceLifecycle
|
||||||
|
|
||||||
|
k3s_server_admission_configuration:
|
||||||
|
- name: EventRateLimit
|
||||||
|
configuration:
|
||||||
|
kind: Configuration
|
||||||
|
apiVersion: eventratelimit.admission.k8s.io/v1alpha1
|
||||||
|
limits:
|
||||||
|
- type: Namespace
|
||||||
|
qps: 50
|
||||||
|
burst: 100
|
||||||
|
cacheSize: 2000
|
||||||
|
- type: User
|
||||||
|
qps: 10
|
||||||
|
burst: 50
|
|
@ -0,0 +1,10 @@
|
||||||
|
---
|
||||||
|
- name: Restart K3s service
|
||||||
|
service:
|
||||||
|
name: k3s
|
||||||
|
state: restarted
|
||||||
|
daemon_reload: yes
|
||||||
|
enabled: yes
|
||||||
|
listen: __k3s_restart
|
||||||
|
become: True
|
||||||
|
become_user: root
|
|
@ -0,0 +1,23 @@
|
||||||
|
# Standards: 0.2
|
||||||
|
---
|
||||||
|
galaxy_info:
|
||||||
|
# @meta author:value: [Robert Kaussow](https://gitea.rknet.org/xoxys)
|
||||||
|
author: "Robert Kaussow <mail@thegeeklab.de>"
|
||||||
|
namespace: xoxys
|
||||||
|
role_name: k3s
|
||||||
|
# @meta description: >
|
||||||
|
# [![Source Code](https://img.shields.io/badge/gitea-source%20code-blue?logo=gitea&logoColor=white)](https://gitea.rknet.org/ansible/xoxys.k3s)
|
||||||
|
# [![Build Status](https://img.shields.io/drone/build/ansible/xoxys.k3s?logo=drone&server=https%3A%2F%2Fdrone.rknet.org)](https://drone.rknet.org/ansible/xoxys.k3s)
|
||||||
|
# [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg?label=license)](https://gitea.rknet.org/ansible/xoxys.k3s/src/branch/main/LICENSE)
|
||||||
|
#
|
||||||
|
# Setup K3s cluster nodes.
|
||||||
|
# @end
|
||||||
|
description: Setup K3s cluster nodes
|
||||||
|
license: MIT
|
||||||
|
min_ansible_version: 2.10
|
||||||
|
platforms:
|
||||||
|
- name: EL
|
||||||
|
versions:
|
||||||
|
- 7
|
||||||
|
galaxy_tags: []
|
||||||
|
dependencies: []
|
|
@ -0,0 +1 @@
|
||||||
|
rocky9
|
|
@ -0,0 +1,3 @@
|
||||||
|
[pytest]
|
||||||
|
filterwarnings =
|
||||||
|
ignore::DeprecationWarning
|
|
@ -0,0 +1,6 @@
|
||||||
|
---
|
||||||
|
collections:
|
||||||
|
- name: https://gitea.rknet.org/ansible/xoxys.general/releases/download/v2.1.1/xoxys-general-2.1.1.tar.gz
|
||||||
|
- name: community.general
|
||||||
|
|
||||||
|
roles: []
|
|
@ -0,0 +1,16 @@
|
||||||
|
---
|
||||||
|
- name: Converge
|
||||||
|
hosts: all
|
||||||
|
vars:
|
||||||
|
k3s_reset: False
|
||||||
|
k3s_packages_extra:
|
||||||
|
- container-selinux
|
||||||
|
- selinux-policy-base
|
||||||
|
- https://github.com/k3s-io/k3s-selinux/releases/download/v1.2.stable.2/k3s-selinux-1.2-2.el8.noarch.rpm
|
||||||
|
k3s_init_log_enabled: True
|
||||||
|
pre_tasks:
|
||||||
|
- name: Override host variables
|
||||||
|
ansible.builtin.set_fact:
|
||||||
|
k3s_node_ip: "{{ ansible_default_ipv4.address }}"
|
||||||
|
roles:
|
||||||
|
- role: xoxys.k3s
|
|
@ -0,0 +1,120 @@
|
||||||
|
---
|
||||||
|
- name: Create
|
||||||
|
hosts: localhost
|
||||||
|
connection: local
|
||||||
|
gather_facts: false
|
||||||
|
no_log: "{{ molecule_no_log }}"
|
||||||
|
vars:
|
||||||
|
ssh_port: 22
|
||||||
|
ssh_user: root
|
||||||
|
ssh_path: "{{ lookup('env', 'MOLECULE_EPHEMERAL_DIRECTORY') }}/ssh_key"
|
||||||
|
tasks:
|
||||||
|
- name: Create SSH key
|
||||||
|
user:
|
||||||
|
name: "{{ lookup('env', 'USER') }}"
|
||||||
|
generate_ssh_key: true
|
||||||
|
ssh_key_file: "{{ ssh_path }}"
|
||||||
|
force: true
|
||||||
|
register: generated_ssh_key
|
||||||
|
|
||||||
|
- name: Register the SSH key name
|
||||||
|
set_fact:
|
||||||
|
ssh_key_name: "molecule-generated-{{ 12345 | random | to_uuid }}"
|
||||||
|
|
||||||
|
- name: Register SSH key for test instance(s)
|
||||||
|
hcloud_ssh_key:
|
||||||
|
name: "{{ ssh_key_name }}"
|
||||||
|
public_key: "{{ generated_ssh_key.ssh_public_key }}"
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Create molecule instance(s)
|
||||||
|
hcloud_server:
|
||||||
|
name: "{{ item.name }}"
|
||||||
|
server_type: "{{ item.server_type }}"
|
||||||
|
ssh_keys:
|
||||||
|
- "{{ ssh_key_name }}"
|
||||||
|
image: "{{ item.image }}"
|
||||||
|
location: "{{ item.location | default(omit) }}"
|
||||||
|
datacenter: "{{ item.datacenter | default(omit) }}"
|
||||||
|
user_data: "{{ item.user_data | default(omit) }}"
|
||||||
|
api_token: "{{ lookup('env', 'HCLOUD_TOKEN') }}"
|
||||||
|
state: present
|
||||||
|
register: server
|
||||||
|
loop: "{{ molecule_yml.platforms }}"
|
||||||
|
async: 7200
|
||||||
|
poll: 0
|
||||||
|
|
||||||
|
- name: Wait for instance(s) creation to complete
|
||||||
|
async_status:
|
||||||
|
jid: "{{ item.ansible_job_id }}"
|
||||||
|
register: hetzner_jobs
|
||||||
|
until: hetzner_jobs.finished
|
||||||
|
retries: 300
|
||||||
|
loop: "{{ server.results }}"
|
||||||
|
|
||||||
|
- name: Create volume(s)
|
||||||
|
hcloud_volume:
|
||||||
|
name: "{{ item.name }}"
|
||||||
|
server: "{{ item.name }}"
|
||||||
|
location: "{{ item.location | default(omit) }}"
|
||||||
|
size: "{{ item.volume_size | default(10) }}"
|
||||||
|
api_token: "{{ lookup('env', 'HCLOUD_TOKEN') }}"
|
||||||
|
state: "present"
|
||||||
|
loop: "{{ molecule_yml.platforms }}"
|
||||||
|
when: item.volume | default(False) | bool
|
||||||
|
register: volumes
|
||||||
|
async: 7200
|
||||||
|
poll: 0
|
||||||
|
|
||||||
|
- name: Wait for volume(s) creation to complete
|
||||||
|
async_status:
|
||||||
|
jid: "{{ item.ansible_job_id }}"
|
||||||
|
register: hetzner_volumes
|
||||||
|
until: hetzner_volumes.finished
|
||||||
|
retries: 300
|
||||||
|
when: volumes.changed
|
||||||
|
loop: "{{ volumes.results }}"
|
||||||
|
|
||||||
|
# Mandatory configuration for Molecule to function.
|
||||||
|
|
||||||
|
- name: Populate instance config dict
|
||||||
|
set_fact:
|
||||||
|
instance_conf_dict:
|
||||||
|
{
|
||||||
|
"instance": "{{ item.hcloud_server.name }}",
|
||||||
|
"ssh_key_name": "{{ ssh_key_name }}",
|
||||||
|
"address": "{{ item.hcloud_server.ipv4_address }}",
|
||||||
|
"user": "{{ ssh_user }}",
|
||||||
|
"port": "{{ ssh_port }}",
|
||||||
|
"identity_file": "{{ ssh_path }}",
|
||||||
|
"volume": "{{ item.item.item.volume | default(False) | bool }}",
|
||||||
|
}
|
||||||
|
loop: "{{ hetzner_jobs.results }}"
|
||||||
|
register: instance_config_dict
|
||||||
|
when: server.changed | bool
|
||||||
|
|
||||||
|
- name: Convert instance config dict to a list
|
||||||
|
set_fact:
|
||||||
|
instance_conf: "{{ instance_config_dict.results | map(attribute='ansible_facts.instance_conf_dict') | list }}"
|
||||||
|
when: server.changed | bool
|
||||||
|
|
||||||
|
- name: Dump instance config
|
||||||
|
copy:
|
||||||
|
content: |
|
||||||
|
# Molecule managed
|
||||||
|
|
||||||
|
{{ instance_conf | to_nice_yaml(indent=2) }}
|
||||||
|
dest: "{{ molecule_instance_config }}"
|
||||||
|
when: server.changed | bool
|
||||||
|
|
||||||
|
- name: Wait for SSH
|
||||||
|
wait_for:
|
||||||
|
port: "{{ ssh_port }}"
|
||||||
|
host: "{{ item.address }}"
|
||||||
|
search_regex: SSH
|
||||||
|
delay: 10
|
||||||
|
loop: "{{ lookup('file', molecule_instance_config) | from_yaml }}"
|
||||||
|
|
||||||
|
- name: Wait for VM to settle down
|
||||||
|
pause:
|
||||||
|
seconds: 30
|
|
@ -0,0 +1,78 @@
|
||||||
|
---
|
||||||
|
- name: Destroy
|
||||||
|
hosts: localhost
|
||||||
|
connection: local
|
||||||
|
gather_facts: false
|
||||||
|
no_log: "{{ molecule_no_log }}"
|
||||||
|
tasks:
|
||||||
|
- name: Check existing instance config file
|
||||||
|
stat:
|
||||||
|
path: "{{ molecule_instance_config }}"
|
||||||
|
register: cfg
|
||||||
|
|
||||||
|
- name: Populate the instance config
|
||||||
|
set_fact:
|
||||||
|
instance_conf: "{{ (lookup('file', molecule_instance_config) | from_yaml) if cfg.stat.exists else [] }}"
|
||||||
|
|
||||||
|
- name: Destroy molecule instance(s)
|
||||||
|
hcloud_server:
|
||||||
|
name: "{{ item.instance }}"
|
||||||
|
api_token: "{{ lookup('env', 'HCLOUD_TOKEN') }}"
|
||||||
|
state: absent
|
||||||
|
register: server
|
||||||
|
loop: "{{ instance_conf }}"
|
||||||
|
async: 7200
|
||||||
|
poll: 0
|
||||||
|
|
||||||
|
- name: Wait for instance(s) deletion to complete
|
||||||
|
async_status:
|
||||||
|
jid: "{{ item.ansible_job_id }}"
|
||||||
|
register: hetzner_jobs
|
||||||
|
until: hetzner_jobs.finished
|
||||||
|
retries: 300
|
||||||
|
loop: "{{ server.results }}"
|
||||||
|
|
||||||
|
- pause:
|
||||||
|
seconds: 5
|
||||||
|
|
||||||
|
- name: Destroy volume(s)
|
||||||
|
hcloud_volume:
|
||||||
|
name: "{{ item.instance }}"
|
||||||
|
server: "{{ item.instance }}"
|
||||||
|
api_token: "{{ lookup('env', 'HCLOUD_TOKEN') }}"
|
||||||
|
state: "absent"
|
||||||
|
register: volumes
|
||||||
|
loop: "{{ instance_conf }}"
|
||||||
|
when: item.volume | default(False) | bool
|
||||||
|
async: 7200
|
||||||
|
poll: 0
|
||||||
|
|
||||||
|
- name: Wait for volume(s) deletion to complete
|
||||||
|
async_status:
|
||||||
|
jid: "{{ item.ansible_job_id }}"
|
||||||
|
register: hetzner_volumes
|
||||||
|
until: hetzner_volumes.finished
|
||||||
|
retries: 300
|
||||||
|
when: volumes.changed
|
||||||
|
loop: "{{ volumes.results }}"
|
||||||
|
|
||||||
|
- name: Remove registered SSH key
|
||||||
|
hcloud_ssh_key:
|
||||||
|
name: "{{ instance_conf[0].ssh_key_name }}"
|
||||||
|
state: absent
|
||||||
|
when: (instance_conf | default([])) | length > 0
|
||||||
|
|
||||||
|
# Mandatory configuration for Molecule to function.
|
||||||
|
|
||||||
|
- name: Populate instance config
|
||||||
|
set_fact:
|
||||||
|
instance_conf: {}
|
||||||
|
|
||||||
|
- name: Dump instance config
|
||||||
|
copy:
|
||||||
|
content: |
|
||||||
|
# Molecule managed
|
||||||
|
|
||||||
|
{{ instance_conf | to_nice_yaml(indent=2) }}
|
||||||
|
dest: "{{ molecule_instance_config }}"
|
||||||
|
when: server.changed | bool
|
|
@ -0,0 +1,24 @@
|
||||||
|
---
|
||||||
|
dependency:
|
||||||
|
name: galaxy
|
||||||
|
options:
|
||||||
|
role-file: molecule/requirements.yml
|
||||||
|
requirements-file: molecule/requirements.yml
|
||||||
|
env:
|
||||||
|
ANSIBLE_GALAXY_DISPLAY_PROGRESS: "false"
|
||||||
|
driver:
|
||||||
|
name: delegated
|
||||||
|
platforms:
|
||||||
|
- name: rocky9-k3s
|
||||||
|
image: rocky-9
|
||||||
|
server_type: cx11
|
||||||
|
lint: |
|
||||||
|
/usr/local/bin/flake8
|
||||||
|
provisioner:
|
||||||
|
name: ansible
|
||||||
|
env:
|
||||||
|
ANSIBLE_FILTER_PLUGINS: ${ANSIBLE_FILTER_PLUGINS:-./plugins/filter}
|
||||||
|
ANSIBLE_LIBRARY: ${ANSIBLE_LIBRARY:-./library}
|
||||||
|
log: False
|
||||||
|
verifier:
|
||||||
|
name: testinfra
|
|
@ -0,0 +1,15 @@
|
||||||
|
---
|
||||||
|
- name: Prepare
|
||||||
|
hosts: all
|
||||||
|
gather_facts: false
|
||||||
|
tasks:
|
||||||
|
- name: Bootstrap python for Ansible
|
||||||
|
raw: |
|
||||||
|
command -v python3 python || (
|
||||||
|
(test -e /usr/bin/dnf && sudo dnf install -y python3) ||
|
||||||
|
(test -e /usr/bin/apt && (apt -y update && apt install -y python-minimal)) ||
|
||||||
|
(test -e /usr/bin/yum && sudo yum -y -qq install python3) ||
|
||||||
|
echo "Warning: Python not boostrapped due to unknown platform."
|
||||||
|
)
|
||||||
|
become: true
|
||||||
|
changed_when: false
|
|
@ -0,0 +1,26 @@
|
||||||
|
import os
|
||||||
|
|
||||||
|
import testinfra.utils.ansible_runner
|
||||||
|
|
||||||
|
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
|
||||||
|
os.environ["MOLECULE_INVENTORY_FILE"]
|
||||||
|
).get_hosts("all")
|
||||||
|
|
||||||
|
|
||||||
|
def test_k3s_running_and_enabled(host):
|
||||||
|
k3s = host.service("k3s")
|
||||||
|
assert k3s.is_running
|
||||||
|
assert k3s.is_enabled
|
||||||
|
|
||||||
|
|
||||||
|
def test_k3s_node_ready(host):
|
||||||
|
jsonpth = '{range .items[*]}{@.metadata.name}:{range @.status.conditions[?(@.type=="Ready")]}{@.type}={@.status};{end}{end}' # noqa
|
||||||
|
nodes = host.run(f"kubectl get nodes -o jsonpath='{jsonpth}'").stdout
|
||||||
|
|
||||||
|
assert "rocky9-k3s:Ready=True;" in nodes
|
||||||
|
|
||||||
|
|
||||||
|
def test_k3s_cluster_ready(host):
|
||||||
|
cluster = host.run("kubectl get --raw='/readyz'").stdout
|
||||||
|
|
||||||
|
assert cluster == "ok"
|
|
@ -0,0 +1,12 @@
|
||||||
|
[flake8]
|
||||||
|
ignore = D100, D101, D102, D103, D105, D107, E402, W503
|
||||||
|
max-line-length = 99
|
||||||
|
inline-quotes = double
|
||||||
|
exclude = .git,.tox,__pycache__,build,dist,tests,*.pyc,*.egg-info,.cache,.eggs,env*
|
||||||
|
|
||||||
|
[yapf]
|
||||||
|
based_on_style = google
|
||||||
|
column_limit = 99
|
||||||
|
dedent_closing_brackets = true
|
||||||
|
coalesce_brackets = true
|
||||||
|
split_before_logical_operator = true
|
|
@ -0,0 +1,59 @@
|
||||||
|
---
|
||||||
|
- block:
|
||||||
|
- name: Ensure k3s-init service is stopped
|
||||||
|
systemd:
|
||||||
|
name: k3s-init
|
||||||
|
state: stopped
|
||||||
|
failed_when: False
|
||||||
|
|
||||||
|
- name: Clean previous runs of k3s-init
|
||||||
|
command: systemctl reset-failed k3s-init
|
||||||
|
failed_when: False
|
||||||
|
changed_when: False
|
||||||
|
args:
|
||||||
|
warn: False
|
||||||
|
|
||||||
|
- name: Init cluster inside the transient k3s-init service
|
||||||
|
command:
|
||||||
|
cmd: >-
|
||||||
|
systemd-run
|
||||||
|
-p RestartSec=2
|
||||||
|
-p Restart=on-failure
|
||||||
|
--unit=k3s-init
|
||||||
|
k3s server {{ __k3s_server_init_args }}
|
||||||
|
creates: "{{ __k3s_service_file }}"
|
||||||
|
args:
|
||||||
|
warn: False
|
||||||
|
register: __k3s_init
|
||||||
|
become: True
|
||||||
|
become_user: root
|
||||||
|
|
||||||
|
- block:
|
||||||
|
- name: Verify that all nodes actually joined
|
||||||
|
command: >-
|
||||||
|
k3s kubectl get nodes
|
||||||
|
-l "node-role.kubernetes.io/master=true"
|
||||||
|
-o=jsonpath="{.items[*].metadata.name}"
|
||||||
|
register: __k3s_init_nodes
|
||||||
|
until: __k3s_init_nodes.rc == 0 and (__k3s_init_nodes.stdout.split() | length) == (k3s_server_nodes | length)
|
||||||
|
retries: 6
|
||||||
|
delay: 10
|
||||||
|
changed_when: False
|
||||||
|
always:
|
||||||
|
- name: Fetch k3s-init logs
|
||||||
|
command: journalctl --all --unit=k3s-init.service
|
||||||
|
changed_when: False
|
||||||
|
register: __k3s_init_log
|
||||||
|
- name: Save k3s-init logs
|
||||||
|
copy:
|
||||||
|
content: "{{ __k3s_init_log.stdout }}"
|
||||||
|
dest: "{{ k3s_log_dir }}/k3s-init.log"
|
||||||
|
when: k3s_init_log_enabled | bool
|
||||||
|
- name: Kill the temporary service used for initialization
|
||||||
|
systemd:
|
||||||
|
name: k3s-init
|
||||||
|
state: stopped
|
||||||
|
failed_when: False
|
||||||
|
become: True
|
||||||
|
become_user: root
|
||||||
|
when: __k3s_init.changed | bool
|
|
@ -0,0 +1,7 @@
|
||||||
|
---
|
||||||
|
- include_tasks: reset.yml
|
||||||
|
when: k3s_reset | bool
|
||||||
|
- include_tasks: prepare.yml
|
||||||
|
- include_tasks: init.yml
|
||||||
|
when: k3s_server | bool
|
||||||
|
- include_tasks: setup.yml
|
|
@ -0,0 +1,69 @@
|
||||||
|
---
|
||||||
|
- block:
|
||||||
|
- name: Import Rancher public key
|
||||||
|
rpm_key:
|
||||||
|
state: present
|
||||||
|
key: https://rpm.rancher.io/public.key
|
||||||
|
|
||||||
|
- name: Ensure dependencies are installed
|
||||||
|
package:
|
||||||
|
name: "{{ item }}"
|
||||||
|
state: present
|
||||||
|
loop: "{{ k3s_packages_extra }}"
|
||||||
|
|
||||||
|
- name: Prepare directory structure
|
||||||
|
file:
|
||||||
|
path: "{{ item }}"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: 0700
|
||||||
|
state: directory
|
||||||
|
loop:
|
||||||
|
- "{{ k3s_config_dir }}"
|
||||||
|
- "{{ k3s_config_dir }}/server"
|
||||||
|
- "{{ k3s_data_dir }}"
|
||||||
|
- "{{ k3s_log_dir }}"
|
||||||
|
|
||||||
|
- name: Download K3s binary
|
||||||
|
get_url:
|
||||||
|
url: https://github.com/k3s-io/k3s/releases/download/{{ k3s_version }}/k3s
|
||||||
|
checksum: sha256:https://github.com/k3s-io/k3s/releases/download/{{ k3s_version }}/sha256sum-amd64.txt
|
||||||
|
dest: /usr/local/bin/k3s
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: 0755
|
||||||
|
|
||||||
|
- name: Copy K3s config file
|
||||||
|
template:
|
||||||
|
src: "etc/rancher/k3s/config.yaml.j2"
|
||||||
|
dest: "/etc/rancher/k3s/config.yaml"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: 0600
|
||||||
|
notify: __k3s_restart
|
||||||
|
|
||||||
|
- name: Copy K3s server config files
|
||||||
|
template:
|
||||||
|
src: "etc/rancher/k3s/server/{{ item }}.j2"
|
||||||
|
dest: "/etc/rancher/k3s/server/{{ item }}"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: 0600
|
||||||
|
loop:
|
||||||
|
- admission-config.yaml
|
||||||
|
when: k3s_server | bool
|
||||||
|
notify: __k3s_restart
|
||||||
|
|
||||||
|
- name: Create kubectl symlink
|
||||||
|
file:
|
||||||
|
src: /usr/local/bin/k3s
|
||||||
|
dest: /usr/local/bin/kubectl
|
||||||
|
state: link
|
||||||
|
|
||||||
|
- name: Create crictl symlink
|
||||||
|
file:
|
||||||
|
src: /usr/local/bin/k3s
|
||||||
|
dest: /usr/local/bin/crictl
|
||||||
|
state: link
|
||||||
|
become: True
|
||||||
|
become_user: root
|
|
@ -0,0 +1,57 @@
|
||||||
|
---
|
||||||
|
- name: Disable services
|
||||||
|
service:
|
||||||
|
name: "{{ item }}"
|
||||||
|
state: stopped
|
||||||
|
enabled: False
|
||||||
|
failed_when: False
|
||||||
|
loop:
|
||||||
|
- k3s
|
||||||
|
- k3s-init
|
||||||
|
|
||||||
|
- name: Kill containerd-shim-runc"
|
||||||
|
register: __k3s_pkill_containerd_shim_runc
|
||||||
|
command: pkill -9 -f "k3s/data/[^/]+/bin/containerd-shim-runc"
|
||||||
|
changed_when: __k3s_pkill_containerd_shim_runc.rc == 0
|
||||||
|
failed_when: False
|
||||||
|
|
||||||
|
- name: Get the list of mounted filesystems
|
||||||
|
shell: set -o pipefail && cat /proc/mounts | awk '{ print $2}' | grep -E "^{{ item }}"
|
||||||
|
loop:
|
||||||
|
- /run/k3s
|
||||||
|
- /var/lib/kubelet
|
||||||
|
- /run/netns
|
||||||
|
- /var/lib/kubelet/pods
|
||||||
|
- /var/lib/kubelet/plugins
|
||||||
|
- /run/netns/cni-
|
||||||
|
- "{{ k3s_data_dir }}"
|
||||||
|
register: __k3s_mounted_fs
|
||||||
|
args:
|
||||||
|
executable: /bin/bash
|
||||||
|
failed_when: False
|
||||||
|
changed_when: False
|
||||||
|
|
||||||
|
- name: Umount filesystem
|
||||||
|
mount:
|
||||||
|
path: "{{ item }}"
|
||||||
|
state: unmounted
|
||||||
|
loop: "{{ __k3s_mounted_fs.results | map(attribute='stdout_lines') | list | flatten | reverse }}"
|
||||||
|
|
||||||
|
- name: Remove service files, binaries and data
|
||||||
|
file:
|
||||||
|
name: "{{ item }}"
|
||||||
|
state: absent
|
||||||
|
loop:
|
||||||
|
- /usr/local/bin/k3s
|
||||||
|
- "{{ __k3s_service_file }}"
|
||||||
|
- "{{ k3s_config_dir }}"
|
||||||
|
- "{{ k3s_data_dir }}"
|
||||||
|
- "{{ k3s_log_dir }}"
|
||||||
|
- /run/k3s
|
||||||
|
- /run/flannel
|
||||||
|
- /var/lib/kubelet
|
||||||
|
- /var/lib/cni/
|
||||||
|
|
||||||
|
- name: Reload systemd daemon
|
||||||
|
systemd:
|
||||||
|
daemon_reload: True
|
|
@ -0,0 +1,59 @@
|
||||||
|
---
|
||||||
|
- block:
|
||||||
|
- name: Copy K3s service file
|
||||||
|
template:
|
||||||
|
src: "etc/systemd/system/k3s.service.j2"
|
||||||
|
dest: "{{ __k3s_service_file }}"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: 0644
|
||||||
|
notify: __k3s_restart
|
||||||
|
|
||||||
|
- name: Force restart
|
||||||
|
meta: flush_handlers
|
||||||
|
|
||||||
|
- name: Ensure K3s service is up and running
|
||||||
|
service:
|
||||||
|
name: k3s
|
||||||
|
daemon_reload: True
|
||||||
|
enabled: True
|
||||||
|
state: started
|
||||||
|
|
||||||
|
- name: Wait for node-token
|
||||||
|
wait_for:
|
||||||
|
path: "{{ k3s_data_dir }}/server/node-token"
|
||||||
|
|
||||||
|
- name: Read node-token from server
|
||||||
|
slurp:
|
||||||
|
path: "{{ k3s_data_dir }}/server/node-token"
|
||||||
|
register: __k3s_node_token
|
||||||
|
|
||||||
|
- name: Store server node-token
|
||||||
|
set_fact:
|
||||||
|
token: "{{ __k3s_node_token.content | b64decode | regex_replace('\n', '') }}"
|
||||||
|
|
||||||
|
- name: Set server address
|
||||||
|
command: >-
|
||||||
|
k3s kubectl config set-cluster default
|
||||||
|
--server=https://{{ __k3s_server_ip }}:6443
|
||||||
|
--kubeconfig /etc/rancher/k3s/k3s.yaml
|
||||||
|
changed_when: False
|
||||||
|
|
||||||
|
- name: Create directory .kube
|
||||||
|
file:
|
||||||
|
path: "{{ ansible_user_dir }}/.kube"
|
||||||
|
state: directory
|
||||||
|
owner: "{{ ansible_user }}"
|
||||||
|
group: "{{ ansible_user }}"
|
||||||
|
mode: 0740
|
||||||
|
|
||||||
|
- name: Copy kube config to user home
|
||||||
|
copy:
|
||||||
|
src: /etc/rancher/k3s/k3s.yaml
|
||||||
|
dest: "{{ ansible_user_dir }}/.kube/config"
|
||||||
|
remote_src: True
|
||||||
|
owner: "{{ ansible_user }}"
|
||||||
|
group: "{{ ansible_user }}"
|
||||||
|
mode: "preserve"
|
||||||
|
become: True
|
||||||
|
become_user: root
|
|
@ -0,0 +1,13 @@
|
||||||
|
#jinja2: lstrip_blocks: True
|
||||||
|
- anonymous-auth=false
|
||||||
|
- authorization-mode=Node,RBAC
|
||||||
|
- profiling=0
|
||||||
|
- service-account-lookup=true
|
||||||
|
- tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
||||||
|
- admission-control-config-file=/etc/rancher/k3s/server/admission-config.yaml
|
||||||
|
{% if k3s_server_admission_plugins | length > 0 %}
|
||||||
|
- enable-admission-plugins={{ k3s_server_admission_plugins | join(',') }}
|
||||||
|
{% endif %}
|
||||||
|
{% if k3s_server_feature_gates | length > 0 %}
|
||||||
|
- feature-gates={{ k3s_server_feature_gates | join(',') }}
|
||||||
|
{%- endif %}
|
|
@ -0,0 +1,25 @@
|
||||||
|
#jinja2: lstrip_blocks: True
|
||||||
|
---
|
||||||
|
{% set __k3s_kube_apiserver_arg = lookup('template', '_internal/apiserver-arg.yaml.j2') | from_yaml %}
|
||||||
|
data-dir: "{{ k3s_data_dir }}"
|
||||||
|
token: "{{ k3s_token }}"
|
||||||
|
node-ip: "{{ k3s_node_ip }}"
|
||||||
|
|
||||||
|
{% if k3s_server | bool %}
|
||||||
|
bind-address: "{{ k3s_server_bind_ip }}"
|
||||||
|
secrets-encryption: True
|
||||||
|
disable:
|
||||||
|
- traefik
|
||||||
|
{% if __k3s_kube_apiserver_arg is iterable %}
|
||||||
|
kube-apiserver-arg:
|
||||||
|
{{ __k3s_kube_apiserver_arg | to_nice_yaml(indent=2) | indent(2, False) }}
|
||||||
|
{% endif %}
|
||||||
|
{% if not k3s_server_flannel_backend_enabled | bool %}
|
||||||
|
flannel-backend: "none"
|
||||||
|
{% endif %}
|
||||||
|
{% if not k3s_server_network_policy_enabled | bool %}
|
||||||
|
disable-network-policy: True
|
||||||
|
{% endif %}
|
||||||
|
{% else %}
|
||||||
|
server: "https://{{ __k3s_server_ip }}:6443"
|
||||||
|
{% endif %}
|
|
@ -0,0 +1,10 @@
|
||||||
|
#jinja2: lstrip_blocks: True
|
||||||
|
---
|
||||||
|
apiVersion: apiserver.config.k8s.io/v1
|
||||||
|
kind: AdmissionConfiguration
|
||||||
|
{% if k3s_server_admission_configuration | length > 0 %}
|
||||||
|
plugins:
|
||||||
|
{{ k3s_server_admission_configuration | to_nice_yaml(indent=2) | indent(2, False) }}
|
||||||
|
{% else %}
|
||||||
|
plugins: []
|
||||||
|
{% endif %}
|
|
@ -0,0 +1,24 @@
|
||||||
|
#jinja2: lstrip_blocks: True
|
||||||
|
{{ ansible_managed | comment }}
|
||||||
|
[Unit]
|
||||||
|
Description=K3s Kubernetes
|
||||||
|
Documentation=https://k3s.io
|
||||||
|
After=network-online.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=notify
|
||||||
|
ExecStartPre=-/sbin/modprobe br_netfilter
|
||||||
|
ExecStartPre=-/sbin/modprobe overlay
|
||||||
|
ExecStart=/usr/local/bin/k3s {{ "server" if k3s_server | bool else "agent" }} --config {{ k3s_config_dir }}/config.yaml
|
||||||
|
KillMode=process
|
||||||
|
Delegate=yes
|
||||||
|
LimitNOFILE=1048576
|
||||||
|
LimitNPROC=infinity
|
||||||
|
LimitCORE=infinity
|
||||||
|
TasksMax=infinity
|
||||||
|
TimeoutStartSec=0
|
||||||
|
Restart=always
|
||||||
|
RestartSec=5s
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
|
@ -0,0 +1,14 @@
|
||||||
|
---
|
||||||
|
__k3s_server_ip: "{{ hostvars[k3s_server_nodes[0]].k3s_node_ip }}"
|
||||||
|
|
||||||
|
__k3s_server_init_args: >-
|
||||||
|
{% if k3s_server_nodes | length > 1 %}
|
||||||
|
{% if ansible_hostname == hostvars[k3s_server_nodes[0]]['ansible_hostname'] %}
|
||||||
|
--cluster-init
|
||||||
|
{% else %}
|
||||||
|
--server https://{{ __k3s_server_ip }}:6443
|
||||||
|
{% endif %}
|
||||||
|
{% endif %}
|
||||||
|
--config {{ k3s_config_dir }}/config.yaml
|
||||||
|
|
||||||
|
__k3s_service_file: /etc/systemd/system/k3s.service
|
Loading…
Reference in New Issue