Compare commits
No commits in common. "docs" and "main" have entirely different histories.
11
.gitignore
vendored
Normal file
11
.gitignore
vendored
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
# ---> Ansible
|
||||||
|
*.retry
|
||||||
|
plugins
|
||||||
|
library
|
||||||
|
|
||||||
|
# ---> Python
|
||||||
|
# Byte-compiled / optimized / DLL files
|
||||||
|
__pycache__/
|
||||||
|
*.py[cod]
|
||||||
|
*$py.class
|
||||||
|
|
||||||
7
.markdownlint.yml
Normal file
7
.markdownlint.yml
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
default: True
|
||||||
|
MD013: False
|
||||||
|
MD041: False
|
||||||
|
MD024: False
|
||||||
|
MD004:
|
||||||
|
style: dash
|
||||||
1
.prettierignore
Normal file
1
.prettierignore
Normal file
@ -0,0 +1 @@
|
|||||||
|
LICENSE
|
||||||
47
.woodpecker/docs.yaml
Normal file
47
.woodpecker/docs.yaml
Normal file
@ -0,0 +1,47 @@
|
|||||||
|
---
|
||||||
|
when:
|
||||||
|
- event: [pull_request]
|
||||||
|
- event: [push, manual]
|
||||||
|
branch:
|
||||||
|
- ${CI_REPO_DEFAULT_BRANCH}
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: generate
|
||||||
|
image: quay.io/thegeeklab/ansible-doctor
|
||||||
|
environment:
|
||||||
|
ANSIBLE_DOCTOR_EXCLUDE_FILES: "['molecule/']"
|
||||||
|
ANSIBLE_DOCTOR_RENDERER__FORCE_OVERWRITE: "true"
|
||||||
|
ANSIBLE_DOCTOR_LOGGING__LEVEL: info
|
||||||
|
ANSIBLE_DOCTOR_ROLE__NAME: ${CI_REPO_NAME}
|
||||||
|
ANSIBLE_DOCTOR_TEMPLATE__NAME: readme
|
||||||
|
|
||||||
|
- name: format
|
||||||
|
image: quay.io/thegeeklab/alpine-tools
|
||||||
|
commands:
|
||||||
|
- prettier -w README.md
|
||||||
|
|
||||||
|
- name: diff
|
||||||
|
image: quay.io/thegeeklab/alpine-tools
|
||||||
|
commands:
|
||||||
|
- git diff --color=always README.md
|
||||||
|
|
||||||
|
- name: publish
|
||||||
|
image: quay.io/thegeeklab/wp-git-action
|
||||||
|
settings:
|
||||||
|
action:
|
||||||
|
- commit
|
||||||
|
- push
|
||||||
|
author_email: ci-bot@rknet.org
|
||||||
|
author_name: ci-bot
|
||||||
|
branch: main
|
||||||
|
message: "[skip ci] automated docs update"
|
||||||
|
netrc_machine: gitea.rknet.org
|
||||||
|
netrc_password:
|
||||||
|
from_secret: gitea_token
|
||||||
|
when:
|
||||||
|
- event: [push, manual]
|
||||||
|
branch:
|
||||||
|
- ${CI_REPO_DEFAULT_BRANCH}
|
||||||
|
|
||||||
|
depends_on:
|
||||||
|
- test
|
||||||
30
.woodpecker/lint.yaml
Normal file
30
.woodpecker/lint.yaml
Normal file
@ -0,0 +1,30 @@
|
|||||||
|
---
|
||||||
|
when:
|
||||||
|
- event: [pull_request, tag]
|
||||||
|
- event: [push, manual]
|
||||||
|
branch:
|
||||||
|
- ${CI_REPO_DEFAULT_BRANCH}
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: ansible-lint
|
||||||
|
image: quay.io/thegeeklab/ansible-dev-tools:1
|
||||||
|
commands:
|
||||||
|
- ansible-lint
|
||||||
|
environment:
|
||||||
|
FORCE_COLOR: "1"
|
||||||
|
|
||||||
|
- name: python-format
|
||||||
|
image: docker.io/python:3.12
|
||||||
|
commands:
|
||||||
|
- pip install -qq ruff
|
||||||
|
- ruff format --check --diff .
|
||||||
|
environment:
|
||||||
|
PY_COLORS: "1"
|
||||||
|
|
||||||
|
- name: python-lint
|
||||||
|
image: docker.io/python:3.12
|
||||||
|
commands:
|
||||||
|
- pip install -qq ruff
|
||||||
|
- ruff check .
|
||||||
|
environment:
|
||||||
|
PY_COLORS: "1"
|
||||||
26
.woodpecker/notify.yml
Normal file
26
.woodpecker/notify.yml
Normal file
@ -0,0 +1,26 @@
|
|||||||
|
---
|
||||||
|
when:
|
||||||
|
- event: [tag]
|
||||||
|
- event: [push, manual]
|
||||||
|
branch:
|
||||||
|
- ${CI_REPO_DEFAULT_BRANCH}
|
||||||
|
|
||||||
|
runs_on: [success, failure]
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: matrix
|
||||||
|
image: quay.io/thegeeklab/wp-matrix
|
||||||
|
settings:
|
||||||
|
homeserver:
|
||||||
|
from_secret: matrix_homeserver
|
||||||
|
room_id:
|
||||||
|
from_secret: matrix_room_id
|
||||||
|
user_id:
|
||||||
|
from_secret: matrix_user_id
|
||||||
|
access_token:
|
||||||
|
from_secret: matrix_access_token
|
||||||
|
when:
|
||||||
|
- status: [failure]
|
||||||
|
|
||||||
|
depends_on:
|
||||||
|
- docs
|
||||||
25
.woodpecker/test.yaml
Normal file
25
.woodpecker/test.yaml
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
---
|
||||||
|
when:
|
||||||
|
- event: [pull_request, tag]
|
||||||
|
- event: [push, manual]
|
||||||
|
branch:
|
||||||
|
- ${CI_REPO_DEFAULT_BRANCH}
|
||||||
|
|
||||||
|
variables:
|
||||||
|
- &molecule_image quay.io/thegeeklab/ansible-dev-tools:1
|
||||||
|
- &molecule_base
|
||||||
|
depends_on: []
|
||||||
|
environment:
|
||||||
|
PY_COLORS: "1"
|
||||||
|
HCLOUD_TOKEN:
|
||||||
|
from_secret: molecule_hcloud_token
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: molecule-default
|
||||||
|
image: *molecule_image
|
||||||
|
<<: *molecule_base
|
||||||
|
commands:
|
||||||
|
- molecule test -s default
|
||||||
|
|
||||||
|
depends_on:
|
||||||
|
- lint
|
||||||
20
.yamllint
Normal file
20
.yamllint
Normal file
@ -0,0 +1,20 @@
|
|||||||
|
---
|
||||||
|
extends: default
|
||||||
|
|
||||||
|
rules:
|
||||||
|
truthy:
|
||||||
|
allowed-values: ["True", "False"]
|
||||||
|
comments:
|
||||||
|
min-spaces-from-content: 1
|
||||||
|
comments-indentation: False
|
||||||
|
line-length: disable
|
||||||
|
braces:
|
||||||
|
min-spaces-inside: 0
|
||||||
|
max-spaces-inside: 1
|
||||||
|
brackets:
|
||||||
|
min-spaces-inside: 0
|
||||||
|
max-spaces-inside: 0
|
||||||
|
indentation: enable
|
||||||
|
octal-values:
|
||||||
|
forbid-implicit-octal: True
|
||||||
|
forbid-explicit-octal: True
|
||||||
21
LICENSE
Normal file
21
LICENSE
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
MIT License
|
||||||
|
|
||||||
|
Copyright (c) 2022 Robert Kaussow <mail@thegeeklab.de>
|
||||||
|
|
||||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
|
in the Software without restriction, including without limitation the rights
|
||||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
copies of the Software, and to permit persons to whom the Software is furnished
|
||||||
|
to do so, subject to the following conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice (including the next
|
||||||
|
paragraph) shall be included in all copies or substantial portions of the
|
||||||
|
Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
|
||||||
|
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS
|
||||||
|
OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
||||||
|
WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF
|
||||||
|
OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||||
@ -1,18 +1,16 @@
|
|||||||
---
|
# xoxys.k3s
|
||||||
title: k3s
|
|
||||||
type: docs
|
|
||||||
---
|
|
||||||
|
|
||||||
[](https://gitea.rknet.org/ansible/xoxys.k3s)
|
[](https://ci.rknet.org/repos/ansible/xoxys.k3s)
|
||||||
[](https://drone.rknet.org/ansible/xoxys.k3s)
|
|
||||||
[](https://gitea.rknet.org/ansible/xoxys.k3s/src/branch/main/LICENSE)
|
[](https://gitea.rknet.org/ansible/xoxys.k3s/src/branch/main/LICENSE)
|
||||||
|
|
||||||
Setup K3s cluster nodes.
|
Setup K3s cluster nodes.
|
||||||
|
|
||||||
<!--more-->
|
## Table of content
|
||||||
|
|
||||||
- [Requirements](#requirements)
|
- [Requirements](#requirements)
|
||||||
- [Default Variables](#default-variables)
|
- [Default Variables](#default-variables)
|
||||||
|
- [k3s_flannel_external_ip](#k3s_flannel_external_ip)
|
||||||
|
- [k3s_flannel_ipv6_masq_enabled](#k3s_flannel_ipv6_masq_enabled)
|
||||||
- [k3s_init_log_enabled](#k3s_init_log_enabled)
|
- [k3s_init_log_enabled](#k3s_init_log_enabled)
|
||||||
- [k3s_iscsi_enabled](#k3s_iscsi_enabled)
|
- [k3s_iscsi_enabled](#k3s_iscsi_enabled)
|
||||||
- [k3s_node_ip](#k3s_node_ip)
|
- [k3s_node_ip](#k3s_node_ip)
|
||||||
@ -46,17 +44,34 @@ Setup K3s cluster nodes.
|
|||||||
- [k3s_server_workload_enabled](#k3s_server_workload_enabled)
|
- [k3s_server_workload_enabled](#k3s_server_workload_enabled)
|
||||||
- [k3s_token](#k3s_token)
|
- [k3s_token](#k3s_token)
|
||||||
- [k3s_version](#k3s_version)
|
- [k3s_version](#k3s_version)
|
||||||
- [Discovered Tags](#discovered-tags)
|
|
||||||
- [Dependencies](#dependencies)
|
- [Dependencies](#dependencies)
|
||||||
|
- [License](#license)
|
||||||
|
- [Author](#author)
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Requirements
|
## Requirements
|
||||||
|
|
||||||
- Minimum Ansible version: `2.1`
|
- Minimum Ansible version: `2.10`
|
||||||
|
|
||||||
## Default Variables
|
## Default Variables
|
||||||
|
|
||||||
|
### k3s_flannel_external_ip
|
||||||
|
|
||||||
|
#### Default value
|
||||||
|
|
||||||
|
```YAML
|
||||||
|
k3s_flannel_external_ip: _unset_
|
||||||
|
```
|
||||||
|
|
||||||
|
### k3s_flannel_ipv6_masq_enabled
|
||||||
|
|
||||||
|
#### Default value
|
||||||
|
|
||||||
|
```YAML
|
||||||
|
k3s_flannel_ipv6_masq_enabled: false
|
||||||
|
```
|
||||||
|
|
||||||
### k3s_init_log_enabled
|
### k3s_init_log_enabled
|
||||||
|
|
||||||
#### Default value
|
#### Default value
|
||||||
@ -78,7 +93,8 @@ k3s_iscsi_enabled: false
|
|||||||
#### Default value
|
#### Default value
|
||||||
|
|
||||||
```YAML
|
```YAML
|
||||||
k3s_node_ip: '{{ ansible_default_ipv4.address }}'
|
k3s_node_ip:
|
||||||
|
- '{{ ansible_default_ipv4.address }}'
|
||||||
```
|
```
|
||||||
|
|
||||||
### k3s_node_labels
|
### k3s_node_labels
|
||||||
@ -202,7 +218,8 @@ k3s_server_cloud_controller_enabled: true
|
|||||||
#### Default value
|
#### Default value
|
||||||
|
|
||||||
```YAML
|
```YAML
|
||||||
k3s_server_cluster_cidr: 10.42.0.0/16
|
k3s_server_cluster_cidr:
|
||||||
|
- 10.42.0.0/16
|
||||||
```
|
```
|
||||||
|
|
||||||
### k3s_server_cluster_dns
|
### k3s_server_cluster_dns
|
||||||
@ -308,7 +325,8 @@ k3s_server_resource_patches: []
|
|||||||
#### Default value
|
#### Default value
|
||||||
|
|
||||||
```YAML
|
```YAML
|
||||||
k3s_server_service_cidr: 10.43.0.0/16
|
k3s_server_service_cidr:
|
||||||
|
- 10.43.0.0/16
|
||||||
```
|
```
|
||||||
|
|
||||||
### k3s_server_service_node_port_range
|
### k3s_server_service_node_port_range
|
||||||
@ -340,15 +358,17 @@ k3s_token: secure-token
|
|||||||
#### Default value
|
#### Default value
|
||||||
|
|
||||||
```YAML
|
```YAML
|
||||||
k3s_version: 1.27.5+k3s1
|
k3s_version: 1.28.6+k3s2
|
||||||
```
|
```
|
||||||
|
|
||||||
## Discovered Tags
|
|
||||||
|
|
||||||
skip_ansible_later
|
|
||||||
:
|
|
||||||
|
|
||||||
|
|
||||||
## Dependencies
|
## Dependencies
|
||||||
|
|
||||||
None.
|
None.
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
MIT
|
||||||
|
|
||||||
|
## Author
|
||||||
|
|
||||||
|
[Robert Kaussow](https://gitea.rknet.org/xoxys)
|
||||||
72
defaults/main.yml
Normal file
72
defaults/main.yml
Normal file
@ -0,0 +1,72 @@
|
|||||||
|
---
|
||||||
|
k3s_version: 1.28.6+k3s2
|
||||||
|
|
||||||
|
k3s_packages:
|
||||||
|
- epel-release
|
||||||
|
- python3-kubernetes
|
||||||
|
- container-selinux
|
||||||
|
- selinux-policy-base
|
||||||
|
|
||||||
|
k3s_packages_extra: []
|
||||||
|
|
||||||
|
k3s_reset: False
|
||||||
|
k3s_token: "secure-token"
|
||||||
|
k3s_node_name: "{{ ansible_hostname }}"
|
||||||
|
k3s_node_ip:
|
||||||
|
- "{{ ansible_default_ipv4.address }}"
|
||||||
|
k3s_init_log_enabled: False
|
||||||
|
k3s_selinux_enabled: False
|
||||||
|
k3s_protect_kernel_defaults: False
|
||||||
|
|
||||||
|
k3s_server: True
|
||||||
|
k3s_server_bind_ip: "0.0.0.0"
|
||||||
|
k3s_server_cluster_domain: "cluster.local"
|
||||||
|
k3s_server_cluster_cidr:
|
||||||
|
- "10.42.0.0/16"
|
||||||
|
k3s_server_service_cidr:
|
||||||
|
- "10.43.0.0/16"
|
||||||
|
k3s_server_service_node_port_range: "30000-32767"
|
||||||
|
k3s_server_cluster_dns: "10.43.0.10"
|
||||||
|
k3s_server_nodes:
|
||||||
|
- "{{ ansible_hostname }}"
|
||||||
|
k3s_server_flannel_backend_enabled: True
|
||||||
|
k3s_flannel_ipv6_masq_enabled: False
|
||||||
|
# @var k3s_flannel_external_ip:value: $ "_unset_"
|
||||||
|
k3s_server_network_policy_enabled: True
|
||||||
|
k3s_server_cloud_controller_enabled: True
|
||||||
|
k3s_server_kube_proxy_enabled: True
|
||||||
|
k3s_server_workload_enabled: True
|
||||||
|
k3s_server_feature_gates: []
|
||||||
|
|
||||||
|
k3s_server_components_disabled:
|
||||||
|
- traefik
|
||||||
|
|
||||||
|
k3s_server_manifests_templates: []
|
||||||
|
k3s_server_manifests_urls: []
|
||||||
|
|
||||||
|
k3s_server_admission_plugins:
|
||||||
|
- NodeRestriction
|
||||||
|
- EventRateLimit
|
||||||
|
- ServiceAccount
|
||||||
|
- NamespaceLifecycle
|
||||||
|
|
||||||
|
k3s_server_admission_configuration:
|
||||||
|
- name: EventRateLimit
|
||||||
|
configuration:
|
||||||
|
kind: Configuration
|
||||||
|
apiVersion: eventratelimit.admission.k8s.io/v1alpha1
|
||||||
|
limits:
|
||||||
|
- type: Namespace
|
||||||
|
qps: 50
|
||||||
|
burst: 100
|
||||||
|
cacheSize: 2000
|
||||||
|
- type: User
|
||||||
|
qps: 10
|
||||||
|
burst: 50
|
||||||
|
|
||||||
|
k3s_server_resource_creations: []
|
||||||
|
k3s_server_resource_patches: []
|
||||||
|
|
||||||
|
k3s_node_labels: {}
|
||||||
|
|
||||||
|
k3s_iscsi_enabled: False
|
||||||
16
handlers/main.yml
Normal file
16
handlers/main.yml
Normal file
@ -0,0 +1,16 @@
|
|||||||
|
---
|
||||||
|
- name: Restart K3s service
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: k3s
|
||||||
|
state: restarted
|
||||||
|
daemon_reload: True
|
||||||
|
enabled: True
|
||||||
|
listen: __k3s_restart
|
||||||
|
|
||||||
|
- name: Restart iscsid service
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: iscsid
|
||||||
|
state: restarted
|
||||||
|
daemon_reload: True
|
||||||
|
enabled: True
|
||||||
|
listen: __iscsid_restart
|
||||||
293
index.md
293
index.md
@ -1,293 +0,0 @@
|
|||||||
---
|
|
||||||
title: k3s
|
|
||||||
type: docs
|
|
||||||
---
|
|
||||||
|
|
||||||
[](https://gitea.rknet.org/ansible/xoxys.k3s) [](https://drone.rknet.org/ansible/xoxys.k3s) [](https://gitea.rknet.org/ansible/xoxys.k3s/src/branch/main/LICENSE)
|
|
||||||
|
|
||||||
Setup K3s cluster nodes.
|
|
||||||
|
|
||||||
<!--more-->
|
|
||||||
|
|
||||||
- [Default Variables](#default-variables)
|
|
||||||
- [k3s_init_log_enabled](#k3s_init_log_enabled)
|
|
||||||
- [k3s_iscsi_enabled](#k3s_iscsi_enabled)
|
|
||||||
- [k3s_node_ip](#k3s_node_ip)
|
|
||||||
- [k3s_node_labels](#k3s_node_labels)
|
|
||||||
- [k3s_node_name](#k3s_node_name)
|
|
||||||
- [k3s_packages](#k3s_packages)
|
|
||||||
- [k3s_packages_extra](#k3s_packages_extra)
|
|
||||||
- [k3s_protect_kernel_defaults](#k3s_protect_kernel_defaults)
|
|
||||||
- [k3s_reset](#k3s_reset)
|
|
||||||
- [k3s_selinux_enabled](#k3s_selinux_enabled)
|
|
||||||
- [k3s_server](#k3s_server)
|
|
||||||
- [k3s_server_admission_configuration](#k3s_server_admission_configuration)
|
|
||||||
- [k3s_server_admission_plugins](#k3s_server_admission_plugins)
|
|
||||||
- [k3s_server_bind_ip](#k3s_server_bind_ip)
|
|
||||||
- [k3s_server_cloud_controller_enabled](#k3s_server_cloud_controller_enabled)
|
|
||||||
- [k3s_server_components_disabled](#k3s_server_components_disabled)
|
|
||||||
- [k3s_server_feature_gates](#k3s_server_feature_gates)
|
|
||||||
- [k3s_server_flannel_backend_enabled](#k3s_server_flannel_backend_enabled)
|
|
||||||
- [k3s_server_manifests_templates](#k3s_server_manifests_templates)
|
|
||||||
- [k3s_server_manifests_urls](#k3s_server_manifests_urls)
|
|
||||||
- [k3s_server_network_policy_enabled](#k3s_server_network_policy_enabled)
|
|
||||||
- [k3s_server_nodes](#k3s_server_nodes)
|
|
||||||
- [k3s_server_resource_creations](#k3s_server_resource_creations)
|
|
||||||
- [k3s_server_resource_patches](#k3s_server_resource_patches)
|
|
||||||
- [k3s_server_workload_enabled](#k3s_server_workload_enabled)
|
|
||||||
- [k3s_token](#k3s_token)
|
|
||||||
- [k3s_version](#k3s_version)
|
|
||||||
- [Discovered Tags](#discovered-tags)
|
|
||||||
- [Dependencies](#dependencies)
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Default Variables
|
|
||||||
|
|
||||||
### k3s_init_log_enabled
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_init_log_enabled: false
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_iscsi_enabled
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_iscsi_enabled: false
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_node_ip
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_node_ip: '{{ ansible_default_ipv4.address }}'
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_node_labels
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_node_labels: {}
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_node_name
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_node_name: '{{ ansible_hostname }}'
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_packages
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_packages:
|
|
||||||
- epel-release
|
|
||||||
- python3-kubernetes
|
|
||||||
- container-selinux
|
|
||||||
- selinux-policy-base
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_packages_extra
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_packages_extra: []
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_protect_kernel_defaults
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_protect_kernel_defaults: false
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_reset
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_reset: false
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_selinux_enabled
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_selinux_enabled: false
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_server
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_server: true
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_server_admission_configuration
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_server_admission_configuration:
|
|
||||||
- name: EventRateLimit
|
|
||||||
configuration:
|
|
||||||
kind: Configuration
|
|
||||||
apiVersion: eventratelimit.admission.k8s.io/v1alpha1
|
|
||||||
limits:
|
|
||||||
- type: Namespace
|
|
||||||
qps: 50
|
|
||||||
burst: 100
|
|
||||||
cacheSize: 2000
|
|
||||||
- type: User
|
|
||||||
qps: 10
|
|
||||||
burst: 50
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_server_admission_plugins
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_server_admission_plugins:
|
|
||||||
- NodeRestriction
|
|
||||||
- EventRateLimit
|
|
||||||
- ServiceAccount
|
|
||||||
- NamespaceLifecycle
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_server_bind_ip
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_server_bind_ip: 0.0.0.0
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_server_cloud_controller_enabled
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_server_cloud_controller_enabled: true
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_server_components_disabled
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_server_components_disabled:
|
|
||||||
- traefik
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_server_feature_gates
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_server_feature_gates: []
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_server_flannel_backend_enabled
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_server_flannel_backend_enabled: true
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_server_manifests_templates
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_server_manifests_templates: []
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_server_manifests_urls
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_server_manifests_urls: []
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_server_network_policy_enabled
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_server_network_policy_enabled: true
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_server_nodes
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_server_nodes:
|
|
||||||
- '{{ ansible_hostname }}'
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_server_resource_creations
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_server_resource_creations: []
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_server_resource_patches
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_server_resource_patches: []
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_server_workload_enabled
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_server_workload_enabled: true
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_token
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_token: secure-token
|
|
||||||
```
|
|
||||||
|
|
||||||
### k3s_version
|
|
||||||
|
|
||||||
#### Default value
|
|
||||||
|
|
||||||
```YAML
|
|
||||||
k3s_version: 1.25.3+k3s1
|
|
||||||
```
|
|
||||||
|
|
||||||
## Discovered Tags
|
|
||||||
|
|
||||||
skip_ansible_later
|
|
||||||
:
|
|
||||||
|
|
||||||
|
|
||||||
## Dependencies
|
|
||||||
|
|
||||||
None.
|
|
||||||
21
meta/main.yml
Normal file
21
meta/main.yml
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
---
|
||||||
|
galaxy_info:
|
||||||
|
# @meta author:value: [Robert Kaussow](https://gitea.rknet.org/xoxys)
|
||||||
|
author: "Robert Kaussow <mail@thegeeklab.de>"
|
||||||
|
namespace: xoxys
|
||||||
|
role_name: k3s
|
||||||
|
# @meta description: >
|
||||||
|
# [](https://ci.rknet.org/repos/ansible/xoxys.k3s)
|
||||||
|
# [](https://gitea.rknet.org/ansible/xoxys.k3s/src/branch/main/LICENSE)
|
||||||
|
#
|
||||||
|
# Setup K3s cluster nodes.
|
||||||
|
# @end
|
||||||
|
description: Setup K3s cluster nodes
|
||||||
|
license: MIT
|
||||||
|
min_ansible_version: "2.10"
|
||||||
|
platforms:
|
||||||
|
- name: EL
|
||||||
|
versions:
|
||||||
|
- "9"
|
||||||
|
galaxy_tags: []
|
||||||
|
dependencies: []
|
||||||
57
molecule/default/converge.yml
Normal file
57
molecule/default/converge.yml
Normal file
@ -0,0 +1,57 @@
|
|||||||
|
---
|
||||||
|
- name: Converge
|
||||||
|
hosts: all
|
||||||
|
vars:
|
||||||
|
kernel_custom_config:
|
||||||
|
- file: 90-kubelet
|
||||||
|
content:
|
||||||
|
- name: vm.panic_on_oom
|
||||||
|
value: 0
|
||||||
|
- name: vm.overcommit_memory
|
||||||
|
value: 1
|
||||||
|
- name: kernel.panic
|
||||||
|
value: 10
|
||||||
|
- name: kernel.panic_on_oops
|
||||||
|
value: 1
|
||||||
|
- name: kernel.keys.root_maxbytes
|
||||||
|
value: 25000000
|
||||||
|
k3s_reset: False
|
||||||
|
k3s_packages_extra:
|
||||||
|
- https://github.com/k3s-io/k3s-selinux/releases/download/v1.5.stable.1/k3s-selinux-1.5-1.el9.noarch.rpm
|
||||||
|
k3s_server_nodes:
|
||||||
|
- "rocky9-k3s"
|
||||||
|
k3s_server_flannel_backend_enabled: False
|
||||||
|
k3s_server_network_policy_enabled: False
|
||||||
|
k3s_server_cloud_controller_enabled: True
|
||||||
|
k3s_server_workload_enabled: True
|
||||||
|
k3s_server_manifests_templates:
|
||||||
|
- "calico-installation.yaml.j2"
|
||||||
|
k3s_server_manifests_urls:
|
||||||
|
- url: https://raw.githubusercontent.com/projectcalico/calico/v3.27.2/manifests/tigera-operator.yaml
|
||||||
|
dest: tigera-operator.yaml
|
||||||
|
# - url: https://github.com/hetznercloud/hcloud-cloud-controller-manager/releases/latest/download/ccm.yaml
|
||||||
|
# dest: hcloud-ccm.yaml
|
||||||
|
k3s_init_log_enabled: True
|
||||||
|
k3s_selinux_enabled: True
|
||||||
|
k3s_protect_kernel_defaults: True
|
||||||
|
# k3s_server_resource_creations:
|
||||||
|
# - kind: Secret
|
||||||
|
# name: hcloud
|
||||||
|
# definition:
|
||||||
|
# metadata:
|
||||||
|
# namespace: kube-system
|
||||||
|
# apiVersion: v1
|
||||||
|
# type: Opaque
|
||||||
|
# data:
|
||||||
|
# token: "{{ hcloud_token | b64encode }}"
|
||||||
|
k3s_node_labels:
|
||||||
|
node.kubernetes.io/exclude-from-external-load-balancers: "true"
|
||||||
|
k3s_iscsi_enabled: True
|
||||||
|
pre_tasks:
|
||||||
|
- name: Override host variables
|
||||||
|
ansible.builtin.set_fact:
|
||||||
|
k3s_node_ip:
|
||||||
|
- "{{ ansible_default_ipv4.address }}"
|
||||||
|
roles:
|
||||||
|
- role: xoxys.kernel
|
||||||
|
- role: xoxys.k3s
|
||||||
17
molecule/default/molecule.yml
Normal file
17
molecule/default/molecule.yml
Normal file
@ -0,0 +1,17 @@
|
|||||||
|
---
|
||||||
|
driver:
|
||||||
|
name: molecule_hetznercloud
|
||||||
|
dependency:
|
||||||
|
name: galaxy
|
||||||
|
options:
|
||||||
|
role-file: requirements.yml
|
||||||
|
requirements-file: requirements.yml
|
||||||
|
platforms:
|
||||||
|
- name: "rocky9-k3s"
|
||||||
|
server_type: "cx22"
|
||||||
|
image: "rocky-9"
|
||||||
|
provisioner:
|
||||||
|
name: ansible
|
||||||
|
log: False
|
||||||
|
verifier:
|
||||||
|
name: testinfra
|
||||||
11
molecule/default/prepare.yml
Normal file
11
molecule/default/prepare.yml
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
---
|
||||||
|
- name: Prepare
|
||||||
|
hosts: all
|
||||||
|
gather_facts: False
|
||||||
|
tasks:
|
||||||
|
- name: Bootstrap Python for Ansible
|
||||||
|
ansible.builtin.raw: |
|
||||||
|
command -v python3 python ||
|
||||||
|
((test -e /usr/bin/apt && (apt -y update && apt install -y python-minimal)) ||
|
||||||
|
echo "Warning: Python not boostrapped due to unknown platform.")
|
||||||
|
changed_when: False
|
||||||
21
molecule/default/templates/calico-installation.yaml.j2
Normal file
21
molecule/default/templates/calico-installation.yaml.j2
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
---
|
||||||
|
apiVersion: operator.tigera.io/v1
|
||||||
|
kind: Installation
|
||||||
|
metadata:
|
||||||
|
name: default
|
||||||
|
spec:
|
||||||
|
calicoNetwork:
|
||||||
|
ipPools:
|
||||||
|
- blockSize: 26
|
||||||
|
cidr: "10.42.0.0/16"
|
||||||
|
encapsulation: "VXLANCrossSubnet"
|
||||||
|
natOutgoing: Enabled
|
||||||
|
nodeSelector: all()
|
||||||
|
nodeMetricsPort: 9091
|
||||||
|
typhaMetricsPort: 9093
|
||||||
|
---
|
||||||
|
apiVersion: operator.tigera.io/v1
|
||||||
|
kind: APIServer
|
||||||
|
metadata:
|
||||||
|
name: default
|
||||||
|
spec: {}
|
||||||
46
molecule/default/tests/test_default.py
Normal file
46
molecule/default/tests/test_default.py
Normal file
@ -0,0 +1,46 @@
|
|||||||
|
import json
|
||||||
|
import os
|
||||||
|
|
||||||
|
import testinfra.utils.ansible_runner
|
||||||
|
|
||||||
|
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
|
||||||
|
os.environ["MOLECULE_INVENTORY_FILE"]
|
||||||
|
).get_hosts("all")
|
||||||
|
|
||||||
|
|
||||||
|
def test_k3s_running_and_enabled(host):
|
||||||
|
k3s = host.service("k3s")
|
||||||
|
assert k3s.is_running
|
||||||
|
assert k3s.is_enabled
|
||||||
|
|
||||||
|
|
||||||
|
def test_iscsid_running_and_enabled(host):
|
||||||
|
k3s = host.service("iscsid")
|
||||||
|
assert k3s.is_running
|
||||||
|
assert k3s.is_enabled
|
||||||
|
|
||||||
|
|
||||||
|
def test_k3s_node_ready(host):
|
||||||
|
jsonpth = '{range .items[*]}{@.metadata.name}:{range @.status.conditions[?(@.type=="Ready")]}{@.type}={@.status};{end}{end}' # noqa
|
||||||
|
nodes = host.run(f"k3s kubectl get nodes -o jsonpath='{jsonpth}'").stdout
|
||||||
|
|
||||||
|
assert "rocky9-k3s:Ready=True;" in nodes
|
||||||
|
|
||||||
|
|
||||||
|
def test_k3s_node_labels(host):
|
||||||
|
jsonpth = "{.items[0].metadata.labels}" # noqa
|
||||||
|
nodes = host.run(f"k3s kubectl get nodes -o jsonpath='{jsonpth}'").stdout
|
||||||
|
|
||||||
|
assert '"node.kubernetes.io/exclude-from-external-load-balancers":"true"' in nodes
|
||||||
|
|
||||||
|
|
||||||
|
def test_k3s_cluster_ready(host):
|
||||||
|
cluster = host.run("k3s kubectl get --raw='/readyz'").stdout
|
||||||
|
|
||||||
|
assert cluster == "ok"
|
||||||
|
|
||||||
|
|
||||||
|
def test_k3s_cni(host):
|
||||||
|
cni = json.loads(host.file("/etc/cni/net.d/10-calico.conflist").content_string)
|
||||||
|
|
||||||
|
assert cni["plugins"][0]["type"] == "calico"
|
||||||
17
pyproject.toml
Normal file
17
pyproject.toml
Normal file
@ -0,0 +1,17 @@
|
|||||||
|
[tool.ruff]
|
||||||
|
exclude = [".git", "__pycache__"]
|
||||||
|
|
||||||
|
line-length = 99
|
||||||
|
indent-width = 4
|
||||||
|
|
||||||
|
[tool.ruff.lint]
|
||||||
|
ignore = ["W191", "E111", "E114", "E117", "S101", "S105"]
|
||||||
|
select = ["F", "E", "I", "W", "S"]
|
||||||
|
|
||||||
|
[tool.ruff.format]
|
||||||
|
quote-style = "double"
|
||||||
|
indent-style = "space"
|
||||||
|
line-ending = "lf"
|
||||||
|
|
||||||
|
[tool.pytest.ini_options]
|
||||||
|
filterwarnings = ["ignore::FutureWarning", "ignore::DeprecationWarning"]
|
||||||
9
requirements.yml
Normal file
9
requirements.yml
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
---
|
||||||
|
collections:
|
||||||
|
- name: ansible.posix
|
||||||
|
- name: kubernetes.core
|
||||||
|
|
||||||
|
roles:
|
||||||
|
- src: https://gitea.rknet.org/ansible/xoxys.kernel
|
||||||
|
scm: git
|
||||||
|
version: main
|
||||||
54
tasks/init.yml
Normal file
54
tasks/init.yml
Normal file
@ -0,0 +1,54 @@
|
|||||||
|
---
|
||||||
|
- name: Ensure k3s-init service is stopped
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: k3s-init
|
||||||
|
state: stopped
|
||||||
|
failed_when: False
|
||||||
|
|
||||||
|
- name: Clean previous runs of k3s-init
|
||||||
|
ansible.builtin.command: systemctl reset-failed k3s-init # noqa command-instead-of-module
|
||||||
|
failed_when: False
|
||||||
|
changed_when: False
|
||||||
|
|
||||||
|
- name: Init cluster inside the transient k3s-init service
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: >-
|
||||||
|
systemd-run
|
||||||
|
-p RestartSec=2
|
||||||
|
-p Restart=on-failure
|
||||||
|
--unit=k3s-init
|
||||||
|
{{ __k3s_binary }} server {{ __k3s_server_init_args }}
|
||||||
|
creates: "{{ __k3s_service_file }}"
|
||||||
|
register: __k3s_init
|
||||||
|
|
||||||
|
- name: Wait for k3s-init to finish
|
||||||
|
when: __k3s_init.changed | bool # noqa no-handler
|
||||||
|
block:
|
||||||
|
- name: Verify that all nodes actually joined
|
||||||
|
ansible.builtin.command: >-
|
||||||
|
{{ __k3s_binary }} kubectl get nodes
|
||||||
|
-l "node-role.kubernetes.io/control-plane=true"
|
||||||
|
-o=jsonpath="{.items[*].metadata.name}"
|
||||||
|
register: __k3s_init_nodes
|
||||||
|
until: __k3s_init_nodes.rc == 0 and (__k3s_init_nodes.stdout.split() | length) == (k3s_server_nodes | length)
|
||||||
|
retries: 30
|
||||||
|
delay: 10
|
||||||
|
changed_when: False
|
||||||
|
always:
|
||||||
|
- name: Fetch k3s-init logs
|
||||||
|
ansible.builtin.command: journalctl --all --unit=k3s-init.service
|
||||||
|
changed_when: False
|
||||||
|
register: __k3s_init_log
|
||||||
|
|
||||||
|
- name: Save k3s-init logs
|
||||||
|
ansible.builtin.copy:
|
||||||
|
content: "{{ __k3s_init_log.stdout }}"
|
||||||
|
dest: "{{ __k3s_log_dir }}/k3s-init.log"
|
||||||
|
mode: "0640"
|
||||||
|
when: k3s_init_log_enabled | bool
|
||||||
|
|
||||||
|
- name: Kill the temporary service used for initialization
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: k3s-init
|
||||||
|
state: stopped
|
||||||
|
failed_when: False
|
||||||
23
tasks/iscsi.yml
Normal file
23
tasks/iscsi.yml
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
---
|
||||||
|
- name: Ensure iscsi is installed
|
||||||
|
ansible.builtin.package:
|
||||||
|
name: "{{ item }}"
|
||||||
|
state: present
|
||||||
|
loop:
|
||||||
|
- iscsi-initiator-utils
|
||||||
|
|
||||||
|
- name: Configure iscsi-initiator
|
||||||
|
ansible.builtin.copy:
|
||||||
|
content: "InitiatorName=$(/sbin/iscsi-iname)"
|
||||||
|
dest: /etc/iscsi/initiatorname.iscsi
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
notify: __iscsid_restart
|
||||||
|
|
||||||
|
- name: Ensure iscsid service is up and running
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: iscsid
|
||||||
|
daemon_reload: True
|
||||||
|
enabled: True
|
||||||
|
state: started
|
||||||
14
tasks/main.yml
Normal file
14
tasks/main.yml
Normal file
@ -0,0 +1,14 @@
|
|||||||
|
---
|
||||||
|
- name: Reset k3s
|
||||||
|
ansible.builtin.include_tasks: reset.yml
|
||||||
|
when: k3s_reset | bool
|
||||||
|
- name: Prepare k3s
|
||||||
|
ansible.builtin.include_tasks: prepare.yml
|
||||||
|
- name: Initialize cluster
|
||||||
|
ansible.builtin.include_tasks: init.yml
|
||||||
|
when: k3s_server | bool
|
||||||
|
- name: Setup k3s
|
||||||
|
ansible.builtin.include_tasks: setup.yml
|
||||||
|
- name: Setup iscsi
|
||||||
|
ansible.builtin.include_tasks: iscsi.yml
|
||||||
|
when: k3s_iscsi_enabled | bool
|
||||||
96
tasks/prepare.yml
Normal file
96
tasks/prepare.yml
Normal file
@ -0,0 +1,96 @@
|
|||||||
|
---
|
||||||
|
- name: Import Rancher public key
|
||||||
|
ansible.builtin.rpm_key:
|
||||||
|
state: present
|
||||||
|
key: https://rpm.rancher.io/public.key
|
||||||
|
|
||||||
|
- name: Ensure dependencies are installed
|
||||||
|
ansible.builtin.package:
|
||||||
|
name: "{{ item }}"
|
||||||
|
state: present
|
||||||
|
loop: "{{ k3s_packages + k3s_packages_extra }}"
|
||||||
|
|
||||||
|
- name: Check if cluster is installed
|
||||||
|
ansible.builtin.stat:
|
||||||
|
path: "{{ __k3s_config_dir }}/k3s.yaml"
|
||||||
|
register: __k3s_installed
|
||||||
|
|
||||||
|
- name: Prepare directory structure
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ item }}"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0700"
|
||||||
|
state: directory
|
||||||
|
loop:
|
||||||
|
- "{{ __k3s_config_dir }}"
|
||||||
|
- "{{ __k3s_config_dir }}/server"
|
||||||
|
- "{{ __k3s_data_dir }}"
|
||||||
|
- "{{ __k3s_manifests_dir }}"
|
||||||
|
- "{{ __k3s_log_dir }}"
|
||||||
|
|
||||||
|
- name: Download K3s binary
|
||||||
|
ansible.builtin.get_url:
|
||||||
|
url: https://github.com/k3s-io/k3s/releases/download/v{{ k3s_version }}/k3s
|
||||||
|
checksum: sha256:https://github.com/k3s-io/k3s/releases/download/v{{ k3s_version }}/sha256sum-amd64.txt
|
||||||
|
dest: /usr/local/bin/k3s
|
||||||
|
timeout: 30
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0755"
|
||||||
|
notify: __k3s_restart
|
||||||
|
|
||||||
|
- name: Copy K3s config file
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: "etc/rancher/k3s/config.yaml.j2"
|
||||||
|
dest: "{{ __k3s_config_dir }}/config.yaml"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0600"
|
||||||
|
notify: __k3s_restart
|
||||||
|
|
||||||
|
- name: Copy K3s kubelet config file
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: "etc/rancher/k3s/kubelet.yaml.j2"
|
||||||
|
dest: "{{ __k3s_config_dir }}/kubelet.yaml"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0600"
|
||||||
|
notify: __k3s_restart
|
||||||
|
|
||||||
|
- name: Copy K3s server config files
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: "etc/rancher/k3s/server/{{ item }}.j2"
|
||||||
|
dest: "{{ __k3s_config_dir }}/server/{{ item }}"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0600"
|
||||||
|
loop:
|
||||||
|
- admission-config.yaml
|
||||||
|
when: k3s_server | bool
|
||||||
|
notify: __k3s_restart
|
||||||
|
|
||||||
|
- name: Copy auto-deploying manifests to the server
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: "{{ item }}"
|
||||||
|
dest: "{{ __k3s_manifests_dir }}/{{ item | basename | replace('.j2', '') }}"
|
||||||
|
mode: "0644"
|
||||||
|
loop: "{{ k3s_server_manifests_templates }}"
|
||||||
|
loop_control:
|
||||||
|
label: "{{ __k3s_manifests_dir }}/{{ item | basename | replace('.j2', '') }}"
|
||||||
|
when:
|
||||||
|
- ansible_hostname == hostvars[k3s_server_nodes[0]]['ansible_hostname']
|
||||||
|
- not __k3s_installed.stat.exists
|
||||||
|
|
||||||
|
- name: Download auto-deploying manifests to the server
|
||||||
|
ansible.builtin.get_url:
|
||||||
|
url: "{{ item.url }}"
|
||||||
|
dest: "{{ __k3s_manifests_dir }}/{{ item.dest | default(item.url | basename) }}"
|
||||||
|
timeout: 30
|
||||||
|
mode: "0644"
|
||||||
|
loop: "{{ k3s_server_manifests_urls }}"
|
||||||
|
loop_control:
|
||||||
|
label: "{{ __k3s_manifests_dir }}/{{ item.dest | default(item.url | basename) }}"
|
||||||
|
when:
|
||||||
|
- ansible_hostname == hostvars[k3s_server_nodes[0]]['ansible_hostname']
|
||||||
|
- not __k3s_installed.stat.exists
|
||||||
60
tasks/reset.yml
Normal file
60
tasks/reset.yml
Normal file
@ -0,0 +1,60 @@
|
|||||||
|
---
|
||||||
|
- name: Disable services
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: "{{ item }}"
|
||||||
|
state: stopped
|
||||||
|
enabled: False
|
||||||
|
failed_when: False
|
||||||
|
loop:
|
||||||
|
- k3s
|
||||||
|
- k3s-init
|
||||||
|
- kubepods
|
||||||
|
|
||||||
|
- name: Kill containerd-shim-runc
|
||||||
|
register: __k3s_pkill_containerd_shim_runc
|
||||||
|
ansible.builtin.command: pkill -9 -f "k3s/data/[^/]+/bin/containerd-shim-runc"
|
||||||
|
changed_when: __k3s_pkill_containerd_shim_runc.rc == 0
|
||||||
|
failed_when: False
|
||||||
|
|
||||||
|
- name: Get the list of mounted filesystems
|
||||||
|
ansible.builtin.shell: set -o pipefail && cat /proc/mounts | awk '{ print $2}' | grep -E "^{{ item }}"
|
||||||
|
loop:
|
||||||
|
- /run/k3s
|
||||||
|
- /var/lib/kubelet
|
||||||
|
- /run/netns
|
||||||
|
- /var/lib/kubelet/pods
|
||||||
|
- /var/lib/kubelet/plugins
|
||||||
|
- /run/netns/cni-
|
||||||
|
- "{{ __k3s_data_dir }}"
|
||||||
|
register: __k3s_mounted_fs
|
||||||
|
args:
|
||||||
|
executable: /bin/bash
|
||||||
|
failed_when: False
|
||||||
|
changed_when: False
|
||||||
|
|
||||||
|
- name: Umount filesystem
|
||||||
|
ansible.posix.mount:
|
||||||
|
path: "{{ item }}"
|
||||||
|
state: unmounted
|
||||||
|
loop: "{{ __k3s_mounted_fs.results | map(attribute='stdout_lines') | list | flatten | reverse }}"
|
||||||
|
|
||||||
|
- name: Remove service files, binaries and data
|
||||||
|
ansible.builtin.file:
|
||||||
|
name: "{{ item }}"
|
||||||
|
state: absent
|
||||||
|
loop:
|
||||||
|
- /usr/local/bin/k3s
|
||||||
|
- "{{ __k3s_service_file }}"
|
||||||
|
- "{{ __k3s_config_dir }}"
|
||||||
|
- "{{ __k3s_data_dir }}"
|
||||||
|
- "{{ __k3s_log_dir }}"
|
||||||
|
- /etc/cni
|
||||||
|
- /run/k3s
|
||||||
|
- /run/flannel
|
||||||
|
- /var/lib/kubelet
|
||||||
|
- /var/lib/cni
|
||||||
|
- /var/run/netns
|
||||||
|
|
||||||
|
- name: Reload systemd daemon
|
||||||
|
ansible.builtin.service:
|
||||||
|
daemon_reload: True
|
||||||
92
tasks/setup.yml
Normal file
92
tasks/setup.yml
Normal file
@ -0,0 +1,92 @@
|
|||||||
|
---
|
||||||
|
- name: Copy K3s service file
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: "etc/systemd/system/k3s.service.j2"
|
||||||
|
dest: "{{ __k3s_service_file }}"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: "0644"
|
||||||
|
notify: __k3s_restart
|
||||||
|
|
||||||
|
- name: Force restart
|
||||||
|
ansible.builtin.meta: flush_handlers
|
||||||
|
|
||||||
|
- name: Ensure K3s service is up and running
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: k3s
|
||||||
|
daemon_reload: True
|
||||||
|
enabled: True
|
||||||
|
state: started
|
||||||
|
|
||||||
|
- name: Wait for Kubernetes API
|
||||||
|
ansible.builtin.command: >-
|
||||||
|
{{ __k3s_binary }} kubectl get --raw='/readyz'
|
||||||
|
register: __k3s_api_readyz
|
||||||
|
until: __k3s_api_readyz.rc == 0 and __k3s_api_readyz.stdout == "ok"
|
||||||
|
retries: 30
|
||||||
|
delay: 10
|
||||||
|
changed_when: False
|
||||||
|
when: k3s_server | bool
|
||||||
|
|
||||||
|
- name: Set server address
|
||||||
|
ansible.builtin.command: >-
|
||||||
|
{{ __k3s_binary }} kubectl config set-cluster default
|
||||||
|
--server=https://{{ __k3s_server_ip }}:6443
|
||||||
|
--kubeconfig {{ __k3s_config_dir }}/k3s.yaml
|
||||||
|
changed_when: False
|
||||||
|
|
||||||
|
- name: Create setup resources
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kind: "{{ item.kind }}"
|
||||||
|
name: "{{ item.name }}"
|
||||||
|
kubeconfig: "{{ __k3s_config_dir }}/k3s.yaml"
|
||||||
|
state: present
|
||||||
|
definition: "{{ item.definition }}"
|
||||||
|
loop: "{{ k3s_server_resource_creations }}"
|
||||||
|
loop_control:
|
||||||
|
label: "{{ item.kind | lower }}/{{ item.name | lower }}"
|
||||||
|
when: k3s_server | bool
|
||||||
|
|
||||||
|
- name: Wait for initial setup
|
||||||
|
ansible.builtin.command: >-
|
||||||
|
{{ __k3s_binary }} kubectl get deployment coredns
|
||||||
|
-n kube-system
|
||||||
|
-o go-template={% raw %}'{{ .status.availableReplicas }}'{% endraw %}
|
||||||
|
register: __k3s_init_setup
|
||||||
|
until: __k3s_init_setup.rc == 0 and __k3s_init_setup.stdout == "1"
|
||||||
|
retries: 30
|
||||||
|
delay: 10
|
||||||
|
changed_when: False
|
||||||
|
when: k3s_server | bool
|
||||||
|
|
||||||
|
- name: Add node role label
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kind: "Node"
|
||||||
|
name: "{{ k3s_node_name }}"
|
||||||
|
kubeconfig: "{{ __k3s_config_dir }}/k3s.yaml"
|
||||||
|
state: patched
|
||||||
|
definition:
|
||||||
|
metadata:
|
||||||
|
labels: "{{ (__k3s_node_lables['control'] if k3s_server | bool else __k3s_node_lables['worker']) | combine(__k3s_node_lables['general'], k3s_node_labels) }}"
|
||||||
|
delegate_to: "{{ hostvars[k3s_server_nodes[0]]['inventory_hostname'] }}"
|
||||||
|
|
||||||
|
- name: Patch existing resources
|
||||||
|
kubernetes.core.k8s:
|
||||||
|
kind: "{{ item.kind }}"
|
||||||
|
name: "{{ item.name }}"
|
||||||
|
kubeconfig: "{{ __k3s_config_dir }}/k3s.yaml"
|
||||||
|
state: patched
|
||||||
|
definition: "{{ item.definition }}"
|
||||||
|
loop: "{{ k3s_server_resource_patches }}"
|
||||||
|
loop_control:
|
||||||
|
label: "{{ item.kind | lower }}/{{ item.name | lower }}"
|
||||||
|
when: k3s_server | bool
|
||||||
|
|
||||||
|
- name: Remove auto-deploying manifests
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ __k3s_manifests_dir }}/{{ item.dest | default(item.url) | default(item) | basename | replace('.j2', '') }}"
|
||||||
|
state: absent
|
||||||
|
loop: "{{ k3s_server_manifests_urls + k3s_server_manifests_templates }}"
|
||||||
|
loop_control:
|
||||||
|
label: "{{ __k3s_manifests_dir }}/{{ item.dest | default(item.url) | default(item) | basename | replace('.j2', '') }}"
|
||||||
|
when: ansible_hostname == hostvars[k3s_server_nodes[0]]['ansible_hostname']
|
||||||
14
templates/_internal/apiserver-arg.yaml.j2
Normal file
14
templates/_internal/apiserver-arg.yaml.j2
Normal file
@ -0,0 +1,14 @@
|
|||||||
|
#jinja2: lstrip_blocks: True
|
||||||
|
- anonymous-auth=false
|
||||||
|
- authorization-mode=Node,RBAC
|
||||||
|
- profiling=0
|
||||||
|
- service-account-lookup=true
|
||||||
|
- request-timeout=300s
|
||||||
|
- tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
||||||
|
- admission-control-config-file={{ __k3s_config_dir }}/server/admission-config.yaml
|
||||||
|
{% if k3s_server_admission_plugins | length > 0 %}
|
||||||
|
- enable-admission-plugins={{ k3s_server_admission_plugins | join(',') }}
|
||||||
|
{% endif %}
|
||||||
|
{% if k3s_server_feature_gates | length > 0 %}
|
||||||
|
- feature-gates={{ k3s_server_feature_gates | join(',') }}
|
||||||
|
{%- endif %}
|
||||||
2
templates/_internal/kube-controller-manager-arg.yaml.j2
Normal file
2
templates/_internal/kube-controller-manager-arg.yaml.j2
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
- terminated-pod-gc-threshold=10
|
||||||
|
- use-service-account-credentials=true
|
||||||
5
templates/_internal/kubelet-arg.yaml.j2
Normal file
5
templates/_internal/kubelet-arg.yaml.j2
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
#jinja2: lstrip_blocks: True
|
||||||
|
- config={{ __k3s_config_dir }}/kubelet.yaml
|
||||||
|
{% if not k3s_server_cloud_controller_enabled | bool %}
|
||||||
|
- cloud-provider=external
|
||||||
|
{% endif %}
|
||||||
6
templates/_internal/node-taint.yaml.j2
Normal file
6
templates/_internal/node-taint.yaml.j2
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
#jinja2: lstrip_blocks: True
|
||||||
|
{% if k3s_server | bool %}
|
||||||
|
{% if not k3s_server_workload_enabled | bool %}
|
||||||
|
- CriticalAddonsOnly=true:NoExecute
|
||||||
|
{% endif %}
|
||||||
|
{% endif %}
|
||||||
65
templates/etc/rancher/k3s/config.yaml.j2
Normal file
65
templates/etc/rancher/k3s/config.yaml.j2
Normal file
@ -0,0 +1,65 @@
|
|||||||
|
#jinja2: lstrip_blocks: True
|
||||||
|
---
|
||||||
|
{% set __k3s_kube_apiserver_arg = lookup("template", "_internal/apiserver-arg.yaml.j2") | from_yaml %}
|
||||||
|
{% set __k3s_kube_controller_manager_arg = lookup("template", "_internal/kube-controller-manager-arg.yaml.j2") | from_yaml %}
|
||||||
|
{% set __k3s_kubelet_arg = lookup("template", "_internal/kubelet-arg.yaml.j2") | from_yaml %}
|
||||||
|
{% set __k3s_node_taint = lookup("template", "_internal/node-taint.yaml.j2") | from_yaml %}
|
||||||
|
token: "{{ k3s_token }}"
|
||||||
|
node-name: "{{ k3s_node_name }}"
|
||||||
|
node-ip: "{{ k3s_node_ip | join(',') }}"
|
||||||
|
{% if __k3s_node_taint is iterable %}
|
||||||
|
node-taint:
|
||||||
|
{{ __k3s_node_taint | to_nice_yaml(indent=2) | indent(2, False) }}
|
||||||
|
{% endif %}
|
||||||
|
{% if __k3s_kubelet_arg is iterable %}
|
||||||
|
kubelet-arg:
|
||||||
|
{{ __k3s_kubelet_arg | to_nice_yaml(indent=2) | indent(2, False) }}
|
||||||
|
{% endif %}
|
||||||
|
selinux: {{ k3s_selinux_enabled | bool | lower }}
|
||||||
|
protect-kernel-defaults: {{ k3s_protect_kernel_defaults | bool | lower }}
|
||||||
|
|
||||||
|
{% if k3s_server | bool %}
|
||||||
|
bind-address: "{{ k3s_server_bind_ip }}"
|
||||||
|
cluster-domain: "{{ k3s_server_cluster_domain }}"
|
||||||
|
cluster-cidr: "{{ k3s_server_cluster_cidr | join(',') }}"
|
||||||
|
cluster-dns: "{{ k3s_server_cluster_dns }}"
|
||||||
|
service-cidr: "{{ k3s_server_service_cidr | join(',') }}"
|
||||||
|
service-node-port-range: "{{ k3s_server_service_node_port_range }}"
|
||||||
|
secrets-encryption: True
|
||||||
|
write-kubeconfig: "{{ __k3s_config_dir }}/k3s.yaml"
|
||||||
|
write-kubeconfig-mode: "0600"
|
||||||
|
tls-san-security: True
|
||||||
|
{% if k3s_server_components_disabled | length > 0 %}
|
||||||
|
disable:
|
||||||
|
{{ k3s_server_components_disabled | to_nice_yaml(indent=2) | indent(2, False) }}
|
||||||
|
{% endif %}
|
||||||
|
{% if __k3s_kube_apiserver_arg is iterable %}
|
||||||
|
kube-apiserver-arg:
|
||||||
|
{{ __k3s_kube_apiserver_arg | to_nice_yaml(indent=2) | indent(2, False) }}
|
||||||
|
{% endif %}
|
||||||
|
{% if __k3s_kube_controller_manager_arg is iterable %}
|
||||||
|
kube-controller-manager-arg:
|
||||||
|
{{ __k3s_kube_controller_manager_arg | to_nice_yaml(indent=2) | indent(2, False) }}
|
||||||
|
{% endif %}
|
||||||
|
{% if not k3s_server_flannel_backend_enabled | bool %}
|
||||||
|
flannel-backend: "none"
|
||||||
|
{% else %}
|
||||||
|
{% if k3s_flannel_ipv6_masq_enabled | bool %}
|
||||||
|
flannel-ipv6-masq: True
|
||||||
|
{% endif %}
|
||||||
|
{% if k3s_flannel_external_ip is defined %}
|
||||||
|
flannel-external-ip: "{{ k3s_flannel_external_ip }}"
|
||||||
|
{% endif %}
|
||||||
|
{% endif %}
|
||||||
|
{% if not k3s_server_cloud_controller_enabled | bool %}
|
||||||
|
disable-cloud-controller: True
|
||||||
|
{% endif %}
|
||||||
|
{% if not k3s_server_network_policy_enabled | bool %}
|
||||||
|
disable-network-policy: True
|
||||||
|
{% endif %}
|
||||||
|
{% if not k3s_server_kube_proxy_enabled | bool %}
|
||||||
|
disable-kube-proxy: True
|
||||||
|
{% endif %}
|
||||||
|
{% else %}
|
||||||
|
server: "https://{{ __k3s_server_ip }}:6443"
|
||||||
|
{% endif %}
|
||||||
8
templates/etc/rancher/k3s/kubelet.yaml.j2
Normal file
8
templates/etc/rancher/k3s/kubelet.yaml.j2
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
#jinja2: lstrip_blocks: True
|
||||||
|
---
|
||||||
|
apiVersion: kubelet.config.k8s.io/v1beta1
|
||||||
|
kind: KubeletConfiguration
|
||||||
|
shutdownGracePeriod: 30s
|
||||||
|
shutdownGracePeriodCriticalPods: 10s
|
||||||
|
streamingConnectionIdleTimeout: 5m
|
||||||
|
makeIPTablesUtilChains: True
|
||||||
10
templates/etc/rancher/k3s/server/admission-config.yaml.j2
Normal file
10
templates/etc/rancher/k3s/server/admission-config.yaml.j2
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
#jinja2: lstrip_blocks: True
|
||||||
|
---
|
||||||
|
apiVersion: apiserver.config.k8s.io/v1
|
||||||
|
kind: AdmissionConfiguration
|
||||||
|
{% if k3s_server_admission_configuration | length > 0 %}
|
||||||
|
plugins:
|
||||||
|
{{ k3s_server_admission_configuration | to_nice_yaml(indent=2) | indent(2, False) }}
|
||||||
|
{% else %}
|
||||||
|
plugins: []
|
||||||
|
{% endif %}
|
||||||
24
templates/etc/systemd/system/k3s.service.j2
Normal file
24
templates/etc/systemd/system/k3s.service.j2
Normal file
@ -0,0 +1,24 @@
|
|||||||
|
#jinja2: lstrip_blocks: True
|
||||||
|
{{ ansible_managed | comment }}
|
||||||
|
[Unit]
|
||||||
|
Description=K3s Kubernetes
|
||||||
|
Documentation=https://k3s.io
|
||||||
|
After=network-online.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=notify
|
||||||
|
ExecStartPre=-/sbin/modprobe br_netfilter
|
||||||
|
ExecStartPre=-/sbin/modprobe overlay
|
||||||
|
ExecStart={{ __k3s_binary }} {{ "server" if k3s_server | bool else "agent" }} --config {{ __k3s_config_dir }}/config.yaml
|
||||||
|
KillMode=process
|
||||||
|
Delegate=yes
|
||||||
|
LimitNOFILE=1048576
|
||||||
|
LimitNPROC=infinity
|
||||||
|
LimitCORE=infinity
|
||||||
|
TasksMax=infinity
|
||||||
|
TimeoutStartSec=0
|
||||||
|
Restart=always
|
||||||
|
RestartSec=5s
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
28
vars/main.yml
Normal file
28
vars/main.yml
Normal file
@ -0,0 +1,28 @@
|
|||||||
|
---
|
||||||
|
__k3s_binary: /usr/local/bin/k3s
|
||||||
|
__k3s_server_ip: "{{ hostvars[k3s_server_nodes[0]].k3s_node_ip | first }}"
|
||||||
|
|
||||||
|
__k3s_server_init_args: >-
|
||||||
|
{% if k3s_server_nodes | length > 1 %}
|
||||||
|
{% if ansible_hostname == hostvars[k3s_server_nodes[0]]['ansible_hostname'] %}
|
||||||
|
--cluster-init
|
||||||
|
{% else %}
|
||||||
|
--server https://{{ __k3s_server_ip }}:6443
|
||||||
|
{% endif %}
|
||||||
|
{% endif %}
|
||||||
|
--config {{ __k3s_config_dir }}/config.yaml
|
||||||
|
|
||||||
|
__k3s_service_file: /etc/systemd/system/k3s.service
|
||||||
|
|
||||||
|
__k3s_config_dir: /etc/rancher/k3s
|
||||||
|
__k3s_data_dir: /var/lib/rancher/k3s
|
||||||
|
__k3s_manifests_dir: "{{ __k3s_data_dir }}/server/manifests"
|
||||||
|
__k3s_log_dir: /var/log/rancher/k3s
|
||||||
|
|
||||||
|
__k3s_node_lables:
|
||||||
|
general:
|
||||||
|
node-role.kubernetes.io/k3s-node: "true"
|
||||||
|
control:
|
||||||
|
node-role.kubernetes.io/control-plane: "true"
|
||||||
|
worker:
|
||||||
|
node-role.kubernetes.io/worker: "true"
|
||||||
Loading…
Reference in New Issue
Block a user