Encryption and major changes

ansible/roles/microk8s/tasks/certmanager.yml

@@ -1,6 +1,6 @@
 - name: CertManager | Copy latest manifest
   ansible.builtin.get_url:
-    url: "https://github.com/cert-manager/cert-manager/releases/download/v{{ certmgr_version }}/cert-manager.yaml"
+    url: "https://github.com/cert-manager/cert-manager/releases/download/v{{ microk8s_certmgr_version }}/cert-manager.yaml"
     dest: "{{ k8s_etc }}/k8s-certmanager.yaml"
     mode: "0600"
 
@@ -35,7 +35,7 @@
           # The ACME server URL
           server: https://acme-v02.api.letsencrypt.org/directory
           # Email address used for ACME registration
-          email: "{{ issuer_email }}"
+          email: "{{ microk8s_issuer_email }}"
           # Name of a secret used to store the ACME account private key
           privateKeySecretRef:
             name: letsencrypt-prod
@@ -65,7 +65,7 @@
           # The ACME server URL
           server: https://acme-staging-v02.api.letsencrypt.org/directory
           # Email address used for ACME registration
-          email: "{{ issuer_email }}"
+          email: "{{ microk8s_issuer_email }}"
           # Name of a secret used to store the ACME account private key
           privateKeySecretRef:
             name: letsencrypt-staging

ansible/roles/microk8s/tasks/iac.yml

@@ -11,7 +11,7 @@
       apiVersion: v1
       kind: ServiceAccount
       metadata:
-        name: "{{ k8s_iac_user }}"
+        name: "{{ microk8s_iac_user }}"
         namespace: default
   tags:
     - k8s::iac
@@ -29,10 +29,10 @@
       apiVersion: v1
       kind: Secret
       metadata:
-        name: "{{ k8s_iac_user }}-token"
+        name: "{{ microk8s_iac_user }}-token"
         namespace: default
         annotations:
-          kubernetes.io/service-account.name: "{{ k8s_iac_user }}"
+          kubernetes.io/service-account.name: "{{ microk8s_iac_user }}"
       type: kubernetes.io/service-account-token
   tags:
     - k8s::iac
@@ -58,14 +58,14 @@
       subjects:
         - kind: ServiceAccount
           namespace: default
-          name: "{{ k8s_iac_user }}"
+          name: "{{ microk8s_iac_user }}"
   tags:
     - k8s::iac
 
 - name: Get the secret name
   ansible.builtin.shell: |
     set -o pipefail
-    microk8s.kubectl -n default get secret | grep {{ k8s_iac_user }} | awk '{ print $1 }'
+    microk8s.kubectl -n default get secret | grep {{ microk8s_iac_user }} | awk '{ print $1 }'
   args:
     executable: /bin/bash
   register: secret_name
@@ -98,44 +98,48 @@
   tags:
     - k8s::iac
 
-- name: Patch kubeconfig with user token
-  ansible.builtin.set_fact:
-    patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}"
-  vars:
-    new_kubeconfig:
-      contexts:
-        - context:
-            cluster: microk8s-cluster
-            user: "{{ k8s_iac_user }}"
-          name: microk8s
-      users:
-        - name: "{{ k8s_iac_user }}"
-          user:
-            token: "{{ token.stdout }}"
-  tags:
-    - k8s::iac
+- name: Render kubeconfig
+  when: kubeconfig.stdout != ""
+  block:
+    - name: Patch kubeconfig with user token
+      ansible.builtin.set_fact:
+        patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}"
+      vars:
+        new_kubeconfig:
+          contexts:
+            - context:
+                cluster: microk8s-cluster
+                user: "{{ microk8s_iac_user }}"
+              name: microk8s
+          users:
+            - name: "{{ microk8s_iac_user }}"
+              user:
+                token: "{{ token.stdout }}"
+      tags:
+        - k8s::iac
 
-- name: Check if a config already exists and its SHA1
-  become: true
-  ansible.builtin.stat:
-    path: "{{ k8s_kubeconfig }}"
-  register: kubeconfig_exists
-  tags:
-    - k8s::iac
+    - name: Check if a config already exists and its SHA1
+      become: true
+      ansible.builtin.stat:
+        path: "{{ k8s_kubeconfig }}"
+      register: kubeconfig_exists
+      tags:
+        - k8s::iac
 
-- name: Get new config SHA1
-  ansible.builtin.set_fact:
-    patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
-  tags:
-    - k8s::iac
+    - name: Get new config SHA1
+      ansible.builtin.set_fact:
+        patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
+      tags:
+        - k8s::iac
 
-- name: Write kubeconfig
-  become: true
-  ansible.builtin.copy:
-    content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}"
-    dest: "{{ k8s_kubeconfig }}"
-    owner: "{{ k8s_iac_user }}"
-    mode: "0600"
-  when: not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
-  tags:
-    - k8s::iac
+    - name: Write kubeconfig
+      become: true
+      ansible.builtin.copy:
+        content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}"
+        dest: "{{ k8s_kubeconfig }}"
+        owner: "{{ microk8s_iac_user }}"
+        mode: "0600"
+      when:
+        - not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
+      tags:
+        - k8s::iac

ansible/roles/microk8s/tasks/loadbalancer.yml

@@ -1,5 +1,5 @@
-- name: Loadbalancer | Setup '{{ lb_provider }}'
-  ansible.builtin.include_tasks: "loadbalancer/{{ lb_provider }}.yaml"
+- name: Loadbalancer | Setup '{{ microk8s_lb_provider }}'
+  ansible.builtin.include_tasks: "loadbalancer/{{ microk8s_lb_provider }}.yaml"
 
 - name: Loadbalancer | Create Loadbalancer for Nginx ingress
   environment:
@@ -23,9 +23,9 @@
         ports:
           - name: http
             protocol: TCP
-            port: "{{ lb_http_port }}"
+            port: "{{ microk8s_lb_http_port }}"
             targetPort: 80
           - name: https
             protocol: TCP
-            port: "{{ lb_https_port }}"
+            port: "{{ microk8s_lb_https_port }}"
             targetPort: 443

ansible/roles/microk8s/tasks/loadbalancer/metallb.yaml

@@ -1,6 +1,6 @@
 - name: MetalLB | Copy manifest files to host
   ansible.builtin.get_url:
-    url: "https://raw.githubusercontent.com/metallb/metallb/v{{ metallb_version }}/config/manifests/metallb-native.yaml"
+    url: "https://raw.githubusercontent.com/metallb/metallb/v{{ microk8s_metallb_version }}/config/manifests/metallb-native.yaml"
     dest: "{{ k8s_etc }}/metallb.yaml"
     mode: "0600"
 
@@ -32,7 +32,7 @@
         namespace: metallb-system
       spec:
         addresses:
-          - "{{ lb_ips }}"
+          - "{{ microk8s_lb_ips }}"
 
 - name: MetalLB | Create L2Advertisement
   environment:

ansible/roles/microk8s/tasks/main.yml

@@ -53,7 +53,7 @@
 - name: Download kubectl
   become: true
   ansible.builtin.get_url:
-    url: "https://dl.k8s.io/release/v{{ kubectl_version }}/bin/linux/amd64/kubectl"
+    url: "https://dl.k8s.io/release/v{{ microk8s_kubectl_version }}/bin/linux/amd64/kubectl"
     dest: "/usr/local/bin/kubectl"
     mode: "0755"
     owner: "root"
@@ -78,7 +78,7 @@
 
 - name: "Setup local user access to k8s - {{ item.username }}"
   ansible.builtin.include_tasks: "setupenv/main.yml"
-  loop: "{{ k8s_users }}"
-  when: k8s_users is defined
+  loop: "{{ microk8s_users }}"
+  when: microk8s_users is defined
   tags:
     - k8s::users

ansible/roles/microk8s/tasks/microk8s/install.yml

@@ -1,4 +1,3 @@
-# Install a snap with classic confinement
 - name: Microk8s | Installing microk8s from channel '{{ microk8s_channel }}'
   become: true
   community.general.snap:
@@ -6,6 +5,25 @@
     channel: "{{ microk8s_channel }}"
     classic: true
 
+- name: Create encryption configuration
+  become: true
+  ansible.builtin.copy:
+    content: |
+      ---
+      apiVersion: apiserver.config.k8s.io/v1
+      kind: EncryptionConfiguration
+      resources:
+        - resources:
+          - secrets
+          providers:
+          - aescbc:
+              keys:
+              - name: k8s-crypto
+                secret: {{ microk8s_encryption_secret }}
+          - identity: {}
+    dest: "{{ microk8s_encryption_cfg }}"
+    mode: "0600"
+
 - name: Microk8s | Patch microk8s configuration
   notify: ["Restart microk8s"]
   block:
@@ -16,6 +34,13 @@
         line: "--allow-privileged=true"
         insertafter: "^--insecure-port=0$"
 
+    - name: Microk8s | Enable encryption provider
+      become: true
+      ansible.builtin.lineinfile:
+        path: /var/snap/microk8s/current/args/kube-apiserver
+        line: "--encryption-provider-config=/a13labs/microk8s/encryption.yaml"
+        insertafter: "^--insecure-port=0$"
+
     - name: Microk8s | Fixing Disk Pressure
       become: true
       ansible.builtin.lineinfile:
@@ -64,17 +89,8 @@
     - { plugin: "ingress", wait: 60, args: "", enabled: true }
     - { plugin: "hostpath-storage", wait: 10, args: "", enabled: true }
 
-- name: Microk8s | Check if ufw is enabled
-  become: true
-  ansible.builtin.shell:
-    cmd: "ufw status"
-  register: ufw_status
-  changed_when: false
-
 - name: Microk8s | Configure required ufw rules
   ansible.builtin.include_tasks: microk8s/ufw.yml
-  when:
-    - ufw_status.stdout.find("Status: active") != -1
 
 - name: Microk8s | Store kubeconfig
   ansible.builtin.shell:

ansible/roles/microk8s/tasks/microk8s/ufw.yml

@@ -6,7 +6,7 @@
     interface: "{{ item }}"
     comment: ansible managed
   with_items:
-    - "{{ k8s_net_devices }}"
+    - "{{ microk8s_net_devices }}"
   retries: 5
   delay: 10
 
@@ -18,7 +18,7 @@
     interface: "{{ item }}"
     comment: ansible managed
   with_items:
-    - "{{ k8s_net_devices }}"
+    - "{{ microk8s_net_devices }}"
   retries: 5
   delay: 10
 
@@ -31,7 +31,7 @@
     proto: "{{ item.proto }}"
     comment: ansible managed
   with_items:
-    - "{{ k8s_incoming_traffic }}"
+    - "{{ microk8s_incoming_traffic }}"
   retries: 5
   delay: 10
 
@@ -43,7 +43,7 @@
     direction: out
     comment: ansible managed
   with_items:
-    - "{{ k8s_outgoing_traffic }}"
+    - "{{ microk8s_outgoing_traffic }}"
   retries: 5
   delay: 10
 
@@ -56,6 +56,6 @@
     proto: tcp
     comment: ansible managed
   with_items:
-    - "{{ k8s_allowed_hosts }}"
+    - "{{ microk8s_allowed_hosts }}"
   retries: 5
   delay: 10

ansible/roles/microk8s/tasks/setupenv/main.yml

@@ -36,7 +36,7 @@
   ignore_errors: true
 
 - name: Configure user access
-  when: item.enabled and secret_exists.stdout != "0"
+  when: item.enabled and secret_exists.stdout != "0" and secret_exists.stdout != ""
   block:
     - name: Get the secret name
       ansible.builtin.shell: |