Initial ansible onboard
This commit is contained in:
@@ -0,0 +1,39 @@
|
||||
---
|
||||
# Based on ansible-lint config
|
||||
extends: default
|
||||
|
||||
rules:
|
||||
braces:
|
||||
max-spaces-inside: 1
|
||||
level: error
|
||||
brackets:
|
||||
max-spaces-inside: 1
|
||||
level: error
|
||||
colons:
|
||||
max-spaces-after: -1
|
||||
level: error
|
||||
commas:
|
||||
max-spaces-after: -1
|
||||
level: error
|
||||
comments:
|
||||
min-spaces-from-content: 1
|
||||
level: error
|
||||
comments-indentation: disable
|
||||
document-start: disable
|
||||
empty-lines:
|
||||
max: 3
|
||||
level: error
|
||||
hyphens:
|
||||
level: error
|
||||
indentation: disable
|
||||
key-duplicates: enable
|
||||
line-length: disable
|
||||
new-line-at-end-of-file: disable
|
||||
new-lines:
|
||||
type: unix
|
||||
trailing-spaces: disable
|
||||
truthy: disable
|
||||
octal-values:
|
||||
level: error
|
||||
forbid-explicit-octal: true
|
||||
forbid-implicit-octal: true
|
||||
@@ -0,0 +1,38 @@
|
||||
k8s_version: "1.29"
|
||||
kubectl_version: "1.29.0"
|
||||
|
||||
# load balancer configuration
|
||||
lb_provider: "metallb"
|
||||
lb_ips: "10.2.0.40-10.2.0.49"
|
||||
lb_http_port: 80
|
||||
lb_https_port: 443
|
||||
metallb_version: 0.14.5
|
||||
|
||||
# certificate manager
|
||||
issuer_email: webmaster@localhost.localdomain
|
||||
certmgr_version: 1.14.5
|
||||
|
||||
# microk8s specific
|
||||
microk8s_channel: "{{ k8s_version }}/stable"
|
||||
microk8s_privileged: true
|
||||
microk8s_alt_names: "localhost.localdomain"
|
||||
microk8s_status_timeout: 300
|
||||
|
||||
k8s_users: []
|
||||
|
||||
k8s_host_public_ip: "{{ ansible_default_ipv4.address }}"
|
||||
|
||||
k8s_net_devices:
|
||||
- "cni+"
|
||||
- "flannel+"
|
||||
|
||||
k8s_incoming_traffic:
|
||||
- { rule: "allow", port: "16443", proto: "tcp", from: "10.1.0.0/16" }
|
||||
- { rule: "allow", port: "10254", proto: "tcp", from: "10.1.0.0/16" }
|
||||
- { rule: "allow", port: "10254", proto: "tcp", from: "{{ k8s_host_public_ip }}" }
|
||||
|
||||
k8s_outgoing_traffic: []
|
||||
|
||||
k8s_allowed_hosts: []
|
||||
|
||||
k8s_iac_user: "provision"
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,305 @@
|
||||
# Copyright 2017 The Kubernetes Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: kubernetes-dashboard
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard
|
||||
namespace: kubernetes-dashboard
|
||||
automountServiceAccountToken: false
|
||||
|
||||
---
|
||||
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard
|
||||
namespace: kubernetes-dashboard
|
||||
spec:
|
||||
ports:
|
||||
- port: 443
|
||||
targetPort: 8443
|
||||
selector:
|
||||
k8s-app: kubernetes-dashboard
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard-certs
|
||||
namespace: kubernetes-dashboard
|
||||
type: Opaque
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard-csrf
|
||||
namespace: kubernetes-dashboard
|
||||
type: Opaque
|
||||
data:
|
||||
csrf: ""
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard-key-holder
|
||||
namespace: kubernetes-dashboard
|
||||
type: Opaque
|
||||
|
||||
---
|
||||
|
||||
kind: ConfigMap
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard-settings
|
||||
namespace: kubernetes-dashboard
|
||||
|
||||
---
|
||||
|
||||
kind: Role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard
|
||||
namespace: kubernetes-dashboard
|
||||
rules:
|
||||
# Allow Dashboard to get, update and delete Dashboard exclusive secrets.
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
|
||||
verbs: ["get", "update", "delete"]
|
||||
# Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
resourceNames: ["kubernetes-dashboard-settings"]
|
||||
verbs: ["get", "update"]
|
||||
# Allow Dashboard to get metrics.
|
||||
- apiGroups: [""]
|
||||
resources: ["services"]
|
||||
resourceNames: ["heapster", "dashboard-metrics-scraper"]
|
||||
verbs: ["proxy"]
|
||||
- apiGroups: [""]
|
||||
resources: ["services/proxy"]
|
||||
resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
|
||||
verbs: ["get"]
|
||||
|
||||
---
|
||||
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard
|
||||
rules:
|
||||
# Allow Metrics Scraper to get metrics from the Metrics server
|
||||
- apiGroups: ["metrics.k8s.io"]
|
||||
resources: ["pods", "nodes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard
|
||||
namespace: kubernetes-dashboard
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: kubernetes-dashboard
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kubernetes-dashboard
|
||||
namespace: kubernetes-dashboard
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: kubernetes-dashboard
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: kubernetes-dashboard
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kubernetes-dashboard
|
||||
namespace: kubernetes-dashboard
|
||||
|
||||
---
|
||||
|
||||
kind: Deployment
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard
|
||||
namespace: kubernetes-dashboard
|
||||
spec:
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
spec:
|
||||
containers:
|
||||
- name: kubernetes-dashboard
|
||||
image: kubernetesui/dashboard:v2.3.1
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- containerPort: 8443
|
||||
protocol: TCP
|
||||
args:
|
||||
- --auto-generate-certificates
|
||||
- --namespace=kubernetes-dashboard
|
||||
# Uncomment the following line to manually specify Kubernetes API server Host
|
||||
# If not specified, Dashboard will attempt to auto discover the API server and connect
|
||||
# to it. Uncomment only if the default does not work.
|
||||
# - --apiserver-host=http://my-address:port
|
||||
volumeMounts:
|
||||
- name: kubernetes-dashboard-certs
|
||||
mountPath: /certs
|
||||
# Create on-disk volume to store exec logs
|
||||
- mountPath: /tmp
|
||||
name: tmp-volume
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
scheme: HTTPS
|
||||
path: /
|
||||
port: 8443
|
||||
initialDelaySeconds: 30
|
||||
timeoutSeconds: 30
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsUser: 1001
|
||||
runAsGroup: 2001
|
||||
volumes:
|
||||
- name: kubernetes-dashboard-certs
|
||||
secret:
|
||||
secretName: kubernetes-dashboard-certs
|
||||
- name: tmp-volume
|
||||
emptyDir: {}
|
||||
serviceAccountName: kubernetes-dashboard
|
||||
automountServiceAccountToken: true
|
||||
nodeSelector:
|
||||
"kubernetes.io/os": linux
|
||||
# Comment the following tolerations if Dashboard must not be deployed on master
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
|
||||
---
|
||||
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: dashboard-metrics-scraper
|
||||
name: dashboard-metrics-scraper
|
||||
namespace: kubernetes-dashboard
|
||||
spec:
|
||||
ports:
|
||||
- port: 8000
|
||||
targetPort: 8000
|
||||
selector:
|
||||
k8s-app: dashboard-metrics-scraper
|
||||
|
||||
---
|
||||
|
||||
kind: Deployment
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: dashboard-metrics-scraper
|
||||
name: dashboard-metrics-scraper
|
||||
namespace: kubernetes-dashboard
|
||||
spec:
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: dashboard-metrics-scraper
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: dashboard-metrics-scraper
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
|
||||
spec:
|
||||
containers:
|
||||
- name: dashboard-metrics-scraper
|
||||
image: kubernetesui/metrics-scraper:v1.0.6
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
scheme: HTTP
|
||||
path: /
|
||||
port: 8000
|
||||
initialDelaySeconds: 30
|
||||
timeoutSeconds: 30
|
||||
volumeMounts:
|
||||
- mountPath: /tmp
|
||||
name: tmp-volume
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsUser: 1001
|
||||
runAsGroup: 2001
|
||||
serviceAccountName: kubernetes-dashboard
|
||||
automountServiceAccountToken: true
|
||||
nodeSelector:
|
||||
"kubernetes.io/os": linux
|
||||
# Comment the following tolerations if Dashboard must not be deployed on master
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
volumes:
|
||||
- name: tmp-volume
|
||||
emptyDir: {}
|
||||
@@ -0,0 +1,5 @@
|
||||
---
|
||||
- name: Restart microk8s # noqa no-changed-when
|
||||
become: true
|
||||
ansible.builtin.command:
|
||||
cmd: "snap restart microk8s"
|
||||
@@ -0,0 +1,23 @@
|
||||
*********************************
|
||||
Vagrant driver installation guide
|
||||
*********************************
|
||||
|
||||
Requirements
|
||||
============
|
||||
|
||||
* Vagrant
|
||||
* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop
|
||||
|
||||
Install
|
||||
=======
|
||||
|
||||
Please refer to the `Virtual environment`_ documentation for installation best
|
||||
practices. If not using a virtual environment, please consider passing the
|
||||
widely recommended `'--user' flag`_ when invoking ``pip``.
|
||||
|
||||
.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
|
||||
.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
|
||||
|
||||
.. code-block:: bash
|
||||
|
||||
$ pip install 'molecule_vagrant'
|
||||
@@ -0,0 +1,28 @@
|
||||
---
|
||||
- name: Converge
|
||||
hosts: all
|
||||
tasks:
|
||||
- name: Update Package Cache (apt/Ubuntu)
|
||||
become: true
|
||||
ansible.builtin.apt:
|
||||
update_cache: yes
|
||||
changed_when: false
|
||||
when: ansible_distribution == "Ubuntu"
|
||||
|
||||
- name: Update Package Cache (dnf/CentOS)
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
update_cache: yes
|
||||
changed_when: false
|
||||
when: ansible_distribution == "CentOS"
|
||||
|
||||
- name: Update Package Cache (yum/Amazon)
|
||||
become: true
|
||||
ansible.builtin.yum:
|
||||
update_cache: yes
|
||||
changed_when: false
|
||||
when: ansible_distribution == "Amazon"
|
||||
|
||||
- name: "Include microk8s"
|
||||
ansible.builtin.include_role:
|
||||
name: "microk8s"
|
||||
@@ -0,0 +1,50 @@
|
||||
---
|
||||
dependency:
|
||||
name: galaxy
|
||||
enabled: true
|
||||
driver:
|
||||
name: vagrant
|
||||
provider:
|
||||
name: libvirt
|
||||
provisioner:
|
||||
name: ansible
|
||||
config_options:
|
||||
defaults:
|
||||
callbacks_enabled: profile_tasks
|
||||
log: true
|
||||
inventory:
|
||||
group_vars: {}
|
||||
host_vars: {}
|
||||
platforms:
|
||||
- name: jammy
|
||||
box: "jaredeh/ubuntu2204-server"
|
||||
box_version: "0.1.1"
|
||||
interfaces:
|
||||
- auto_config: true
|
||||
network_name: private_network
|
||||
type: dhcp
|
||||
instance_raw_config_args:
|
||||
# use single quotes to avoid YAML parsing as dict due to ':'
|
||||
- 'vm.synced_folder ".", "/vagrant", type: "rsync"'
|
||||
# Run 'uname' a provisionning step **needs 'provision: true' to work**
|
||||
- 'vm.provision :shell, inline: "uname"'
|
||||
# Dictionary of `config` options. Note that string values need to be
|
||||
# explicitly enclosed in quotes.
|
||||
config_options:
|
||||
vm.boot_timeout: 600
|
||||
ssh.keep_alive: yes
|
||||
ssh.remote_user: 'ansible'
|
||||
synced_folder: true
|
||||
provider_options:
|
||||
video_type: 'vga'
|
||||
host: 'localhost'
|
||||
uri: 'qemu:///system'
|
||||
nested: true
|
||||
memory: 4096
|
||||
verifier:
|
||||
name: ansible
|
||||
lint: |
|
||||
set -e
|
||||
ansible-lint
|
||||
scenario:
|
||||
name: default
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
# This is an example playbook to execute Ansible tests.
|
||||
|
||||
- name: Verify
|
||||
hosts: all
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Example assertion
|
||||
ansible.builtin.assert:
|
||||
that: true
|
||||
@@ -0,0 +1,76 @@
|
||||
- name: CertManager | Copy latest manifest
|
||||
ansible.builtin.get_url:
|
||||
url: "https://github.com/cert-manager/cert-manager/releases/download/v{{ certmgr_version }}/cert-manager.yaml"
|
||||
dest: "{{ k8s_etc }}/k8s-certmanager.yaml"
|
||||
mode: "0600"
|
||||
|
||||
- name: CertManager | Apply manifest
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
src: "{{ k8s_etc }}/k8s-certmanager.yaml"
|
||||
wait: true
|
||||
|
||||
- name: CertManager | Register LetsEncrypt (prod)
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
wait: true
|
||||
definition:
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-prod
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
acme:
|
||||
# The ACME server URL
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
# Email address used for ACME registration
|
||||
email: "{{ issuer_email }}"
|
||||
# Name of a secret used to store the ACME account private key
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-prod
|
||||
# Enable the HTTP-01 challenge provider
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: public
|
||||
|
||||
- name: CertManager | Register LetsEncrypt (staging)
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
wait: true
|
||||
definition:
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-staging
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
acme:
|
||||
# The ACME server URL
|
||||
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
# Email address used for ACME registration
|
||||
email: "{{ issuer_email }}"
|
||||
# Name of a secret used to store the ACME account private key
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-staging
|
||||
# Enable the HTTP-01 challenge provider
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: public
|
||||
@@ -0,0 +1,141 @@
|
||||
- name: Create user k8s service account
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
wait: true
|
||||
definition:
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: "{{ k8s_iac_user }}"
|
||||
namespace: default
|
||||
tags:
|
||||
- k8s::iac
|
||||
|
||||
- name: Create secret token
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
wait: true
|
||||
definition:
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: "{{ k8s_iac_user }}-token"
|
||||
namespace: default
|
||||
annotations:
|
||||
kubernetes.io/service-account.name: "{{ k8s_iac_user }}"
|
||||
type: kubernetes.io/service-account-token
|
||||
tags:
|
||||
- k8s::iac
|
||||
|
||||
- name: Enabled IaC admin access to k8s
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
wait: true
|
||||
definition:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: admin-role-binding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cluster-admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
namespace: default
|
||||
name: "{{ k8s_iac_user }}"
|
||||
tags:
|
||||
- k8s::iac
|
||||
|
||||
- name: Get the secret name
|
||||
ansible.builtin.shell: |
|
||||
set -o pipefail
|
||||
microk8s.kubectl -n default get secret | grep {{ k8s_iac_user }} | awk '{ print $1 }'
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: secret_name
|
||||
tags:
|
||||
- k8s::iac
|
||||
changed_when: false
|
||||
|
||||
- name: Describe the secret and extract the token
|
||||
ansible.builtin.shell: |
|
||||
set -o pipefail
|
||||
microk8s.kubectl -n default describe secret {{ secret_name.stdout }} | grep token: | awk '{ print $2 }'
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: token
|
||||
tags:
|
||||
- k8s::iac
|
||||
changed_when: false
|
||||
|
||||
- name: Read system kubeconfig
|
||||
become: true
|
||||
ansible.builtin.command: "microk8s config"
|
||||
register: kubeconfig
|
||||
tags:
|
||||
- k8s::iac
|
||||
changed_when: false
|
||||
|
||||
- name: Set fact kubeconfig
|
||||
ansible.builtin.set_fact:
|
||||
kubeconfig_yaml: "{{ kubeconfig.stdout | from_yaml }}"
|
||||
tags:
|
||||
- k8s::iac
|
||||
|
||||
- name: Patch kubeconfig with user token
|
||||
ansible.builtin.set_fact:
|
||||
patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}"
|
||||
vars:
|
||||
new_kubeconfig:
|
||||
contexts:
|
||||
- context:
|
||||
cluster: microk8s-cluster
|
||||
user: "{{ k8s_iac_user }}"
|
||||
name: microk8s
|
||||
users:
|
||||
- name: "{{ k8s_iac_user }}"
|
||||
user:
|
||||
token: "{{ token.stdout }}"
|
||||
tags:
|
||||
- k8s::iac
|
||||
|
||||
- name: Check if a config already exists and its SHA1
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: "{{ k8s_kubeconfig }}"
|
||||
register: kubeconfig_exists
|
||||
tags:
|
||||
- k8s::iac
|
||||
|
||||
- name: Get new config SHA1
|
||||
set_fact:
|
||||
patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
|
||||
tags:
|
||||
- k8s::iac
|
||||
|
||||
- name: Write kubeconfig
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}"
|
||||
dest: "{{ k8s_kubeconfig }}"
|
||||
owner: "{{ k8s_iac_user }}"
|
||||
mode: "0600"
|
||||
when: kubeconfig_exists.stat.exists == false or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
|
||||
tags:
|
||||
- k8s::iac
|
||||
@@ -0,0 +1,31 @@
|
||||
- name: Loadbalancer | Setup '{{ lb_provider }}'
|
||||
ansible.builtin.include_tasks: "loadbalancer/{{ lb_provider }}.yaml"
|
||||
|
||||
- name: Loadbalancer | Create Loadbalancer for Nginx ingress
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
wait: true
|
||||
definition:
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ingress
|
||||
namespace: ingress
|
||||
spec:
|
||||
selector:
|
||||
name: nginx-ingress-microk8s
|
||||
type: LoadBalancer
|
||||
ports:
|
||||
- name: http
|
||||
protocol: TCP
|
||||
port: "{{ lb_http_port }}"
|
||||
targetPort: 80
|
||||
- name: https
|
||||
protocol: TCP
|
||||
port: "{{ lb_https_port }}"
|
||||
targetPort: 443
|
||||
@@ -0,0 +1,51 @@
|
||||
- name: MetalLB | Copy manifest files to host
|
||||
ansible.builtin.get_url:
|
||||
url: "https://raw.githubusercontent.com/metallb/metallb/v{{ metallb_version }}/config/manifests/metallb-native.yaml"
|
||||
dest: "{{ k8s_etc }}/metallb.yaml"
|
||||
mode: "0600"
|
||||
|
||||
- name: MetalLB | Apply manifests
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
src: "{{ k8s_etc }}/metallb.yaml"
|
||||
wait: true
|
||||
|
||||
- name: MetalLB | Create IPAddressPool
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
wait: true
|
||||
definition:
|
||||
apiVersion: metallb.io/v1beta1
|
||||
kind: IPAddressPool
|
||||
metadata:
|
||||
name: metallb-system
|
||||
namespace: metallb-system
|
||||
spec:
|
||||
addresses:
|
||||
- "{{ lb_ips }}"
|
||||
|
||||
- name: MetalLB | Create L2Advertisement
|
||||
environment:
|
||||
PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
kubeconfig: "{{ k8s_kubeconfig }}"
|
||||
wait: true
|
||||
definition:
|
||||
apiVersion: metallb.io/v1beta1
|
||||
kind: L2Advertisement
|
||||
metadata:
|
||||
name: example
|
||||
namespace: metallb-system
|
||||
@@ -0,0 +1,84 @@
|
||||
- name: Install requirements
|
||||
become: true
|
||||
ansible.builtin.package:
|
||||
pkg: "{{ item }}"
|
||||
state: present
|
||||
loop:
|
||||
- python3-pip
|
||||
- python3-virtualenv
|
||||
- snapd
|
||||
- jq
|
||||
tags: always
|
||||
|
||||
- name: Read current remote $HOME
|
||||
ansible.builtin.shell: "echo $HOME"
|
||||
register: remote_home_dir
|
||||
changed_when: false
|
||||
check_mode: false
|
||||
tags: always
|
||||
|
||||
- name: Set working folders
|
||||
ansible.builtin.set_fact:
|
||||
k8s_etc: "{{ remote_home_dir.stdout }}/.kube"
|
||||
k8s_kubeconfig: "{{ remote_home_dir.stdout }}/.kube/config"
|
||||
k8s_venv: "{{ remote_home_dir.stdout }}/.venv"
|
||||
tags: always
|
||||
|
||||
- name: Create required folders
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: "0750"
|
||||
loop:
|
||||
- "{{ k8s_etc }}"
|
||||
- "{{ k8s_venv }}"
|
||||
tags: always
|
||||
|
||||
- name: Install required PIP packages
|
||||
ansible.builtin.pip:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
virtualenv: "{{ k8s_venv }}"
|
||||
virtualenv_site_packages: true
|
||||
loop:
|
||||
- kubernetes
|
||||
- yq
|
||||
tags: always
|
||||
|
||||
- name: Install Microk8s
|
||||
ansible.builtin.include_tasks: microk8s/install.yml
|
||||
tags:
|
||||
- k8s::install
|
||||
|
||||
- name: Download kubectl
|
||||
become: true
|
||||
ansible.builtin.get_url:
|
||||
url: "https://dl.k8s.io/release/v{{ kubectl_version }}/bin/linux/amd64/kubectl"
|
||||
dest: "/usr/local/bin/kubectl"
|
||||
mode: "0755"
|
||||
owner: "root"
|
||||
tags:
|
||||
- k8s::install
|
||||
- k8s::kubectl
|
||||
|
||||
- name: Setup LoadBalancer
|
||||
ansible.builtin.include_tasks: loadbalancer.yml
|
||||
tags:
|
||||
- k8s::loadbalancer
|
||||
|
||||
- name: Setup CertManager
|
||||
ansible.builtin.include_tasks: certmanager.yml
|
||||
tags:
|
||||
- k8s::certmanager
|
||||
|
||||
- name: Setup IAC access
|
||||
ansible.builtin.include_tasks: iac.yml
|
||||
tags:
|
||||
- k8s::iac
|
||||
|
||||
- name: "Setup local user access to k8s - {{ item.username }}"
|
||||
ansible.builtin.include_tasks: "setupenv/main.yml"
|
||||
loop: "{{ k8s_users }}"
|
||||
when: k8s_users is defined
|
||||
tags:
|
||||
- k8s::users
|
||||
@@ -0,0 +1,88 @@
|
||||
# Install a snap with classic confinement
|
||||
- name: Microk8s | Installing microk8s from channel '{{ microk8s_channel }}'
|
||||
become: true
|
||||
community.general.snap:
|
||||
name: microk8s
|
||||
channel: "{{ microk8s_channel }}"
|
||||
classic: true
|
||||
|
||||
- name: Microk8s | Patch microk8s configuration
|
||||
notify: ["Restart microk8s"]
|
||||
block:
|
||||
- name: Microk8s | Enable privileged mode
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /var/snap/microk8s/current/args/kube-apiserver
|
||||
line: "--allow-privileged=true"
|
||||
insertafter: "^--insecure-port=0$"
|
||||
|
||||
- name: Microk8s | Fixing Disk Pressure
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /var/snap/microk8s/current/args/kubelet
|
||||
line: "{{ item }}"
|
||||
insertafter: "^--read-only-port=0$"
|
||||
with_items:
|
||||
- "--image-gc-high-threshold=70"
|
||||
- "--image-gc-low-threshold=60"
|
||||
|
||||
- name: Microk8s | Setup alternative DNS names
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /var/snap/microk8s/current/certs/csr.conf.template
|
||||
line: "DNS.6 = {{ microk8s_alt_names }}"
|
||||
insertafter: "^DNS.5 = kubernetes.default.svc.cluster.local$"
|
||||
|
||||
- name: Microk8s | Waiting for microk8s to be ready # noqa no-changed-when
|
||||
become: true
|
||||
ansible.builtin.command:
|
||||
cmd: "microk8s.status --wait-ready --format short -t {{ microk8s_status_timeout }}"
|
||||
register: microk8s_wait_result
|
||||
failed_when: "'microk8s is running' not in microk8s_wait_result.stdout"
|
||||
changed_when: false
|
||||
|
||||
- name: Microk8s | Adding required users to group microk8s
|
||||
become: true
|
||||
ansible.builtin.user:
|
||||
name: "{{ ansible_user }}"
|
||||
groups:
|
||||
- microk8s
|
||||
append: true
|
||||
register: user_group_task
|
||||
|
||||
- name: Reset ssh connection to allow user changes to affect ansible user # noqa no-handler
|
||||
when: user_group_task.changed
|
||||
ansible.builtin.meta: reset_connection
|
||||
|
||||
- name: Microk8s | Required plugins (microk8s)
|
||||
ansible.builtin.include_tasks: microk8s/plugins.yml
|
||||
loop:
|
||||
- { plugin: "ha-cluster", wait: 90, args: "", enabled: false }
|
||||
- { plugin: "rbac", wait: 30, args: "", enabled: true }
|
||||
- { plugin: "dns", wait: 30, args: "", enabled: true }
|
||||
- { plugin: "storage", wait: 10, args: "", enabled: true }
|
||||
- { plugin: "ingress", wait: 60, args: "", enabled: true }
|
||||
- { plugin: "hostpath-storage", wait: 10, args: "", enabled: true }
|
||||
|
||||
- name: Microk8s | Check if ufw is enabled
|
||||
become: true
|
||||
ansible.builtin.shell:
|
||||
cmd: "ufw status"
|
||||
register: ufw_status
|
||||
changed_when: false
|
||||
|
||||
- name: Microk8s | Configure required ufw rules
|
||||
ansible.builtin.include_tasks: microk8s/ufw.yml
|
||||
when:
|
||||
- ufw_status.stdout.find("Status: active") != -1
|
||||
|
||||
- name: Microk8s | Store kubeconfig
|
||||
ansible.builtin.shell:
|
||||
cmd: "microk8s config > {{ k8s_kubeconfig }}"
|
||||
creates: "{{ k8s_kubeconfig }}"
|
||||
|
||||
- name: Microk8s | Hardening kubeconfig permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ k8s_kubeconfig }}"
|
||||
state: file
|
||||
mode: "0600"
|
||||
@@ -0,0 +1,36 @@
|
||||
- name: Checking plugin '{{ item.plugin }}'
|
||||
ansible.builtin.shell:
|
||||
cmd: 'set -o pipefail && microk8s.status --format short | grep {{ item.plugin }} | awk ''{split($0,a,": "); print(a[2]);}'''
|
||||
executable: /bin/bash
|
||||
register: plugin_status
|
||||
changed_when: false
|
||||
|
||||
- name: Enable plugin '{{ item.plugin }}'
|
||||
when: plugin_status.stdout == "disabled" and item.enabled
|
||||
block:
|
||||
- name: Compose microk8s command args
|
||||
ansible.builtin.set_fact:
|
||||
micro_k8s_args: "{{ (item.args | length > 0) | ternary(item.plugin + ':' + item.args, item.plugin) }}"
|
||||
|
||||
- name: Enabling plugin '{{ item.plugin }}' # noqa no-changed-when
|
||||
ansible.builtin.command:
|
||||
cmd: "microk8s.enable {{ micro_k8s_args }}"
|
||||
|
||||
- name: Waiting for plugin to apply '{{ item.wait }}'
|
||||
ansible.builtin.pause:
|
||||
seconds: "{{ item.wait }}"
|
||||
|
||||
- name: Disable plugin '{{ item.plugin }}'
|
||||
when: plugin_status.stdout == "enabled" and not item.enabled
|
||||
block:
|
||||
- name: Compose microk8s command args
|
||||
ansible.builtin.set_fact:
|
||||
micro_k8s_args: "{{ (item.args | length > 0) | ternary(item.plugin + ':' + item.args, item.plugin) }}"
|
||||
|
||||
- name: Enabling plugin '{{ item.plugin }}' # noqa no-changed-when
|
||||
ansible.builtin.command:
|
||||
cmd: "microk8s.disable {{ micro_k8s_args }}"
|
||||
|
||||
- name: Waiting for plugin to apply '{{ item.wait }}'
|
||||
ansible.builtin.pause:
|
||||
seconds: "{{ item.wait }}"
|
||||
@@ -0,0 +1,51 @@
|
||||
- name: Allow in required devices
|
||||
become: true
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
direction: in
|
||||
interface: "{{ item }}"
|
||||
comment: ansible managed
|
||||
with_items:
|
||||
- "{{ k8s_net_devices }}"
|
||||
|
||||
- name: Allow out required devices
|
||||
become: true
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
direction: out
|
||||
interface: "{{ item }}"
|
||||
comment: ansible managed
|
||||
with_items:
|
||||
- "{{ k8s_net_devices }}"
|
||||
|
||||
- name: Allow incoming specific ports
|
||||
become: true
|
||||
community.general.ufw:
|
||||
rule: "{{ item.rule }}"
|
||||
src: "{{ item.from | d('any') }}"
|
||||
port: "{{ item.port | int }}"
|
||||
proto: "{{ item.proto }}"
|
||||
comment: ansible managed
|
||||
with_items:
|
||||
- "{{ k8s_incoming_traffic }}"
|
||||
|
||||
- name: Allow outgoing specified ports
|
||||
become: true
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "{{ item | int }}"
|
||||
direction: out
|
||||
comment: ansible managed
|
||||
with_items:
|
||||
- "{{ k8s_outgoing_traffic }}"
|
||||
|
||||
- name: Allow hosts to access the API
|
||||
become: true
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
src: "{{ item }}"
|
||||
port: 16443
|
||||
proto: tcp
|
||||
comment: ansible managed
|
||||
with_items:
|
||||
- "{{ k8s_allowed_hosts }}"
|
||||
@@ -0,0 +1,119 @@
|
||||
- name: Read current remote $HOME
|
||||
become: true
|
||||
ansible.builtin.user:
|
||||
name: "{{ item.username }}"
|
||||
state: present
|
||||
register: user_registered
|
||||
tags:
|
||||
- k8s::users
|
||||
|
||||
- name: Create required folders
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: "{{ folder }}"
|
||||
state: directory
|
||||
mode: "0750"
|
||||
owner: "{{ item.username }}"
|
||||
loop:
|
||||
- "{{ user_registered.home }}/.kube"
|
||||
- "{{ user_registered.home }}/.local/bin"
|
||||
loop_control:
|
||||
loop_var: folder
|
||||
tags:
|
||||
- k8s::users
|
||||
|
||||
- name: Check if secret exists
|
||||
ansible.builtin.shell: |
|
||||
set -o pipefail
|
||||
microk8s.kubectl -n {{ item.namespace | default('default') }} get secret | grep {{ item.username }}-token | wc -l | awk '{ print $1 }'
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: secret_exists
|
||||
when: item.enabled
|
||||
tags:
|
||||
- k8s::users
|
||||
changed_when: false
|
||||
|
||||
- name: Configure user access
|
||||
when: item.enabled and secret_exists.stdout != "0"
|
||||
block:
|
||||
- name: Get the secret name
|
||||
ansible.builtin.shell: |
|
||||
set -o pipefail
|
||||
microk8s.kubectl -n {{ item.namespace | default('default') }} get secret | grep {{ item.username }}-token | awk '{ print $1 }'
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: secret_name
|
||||
when: item.enabled
|
||||
tags:
|
||||
- k8s::users
|
||||
changed_when: false
|
||||
|
||||
- name: Describe the secret and extract the token
|
||||
ansible.builtin.shell: |
|
||||
set -o pipefail
|
||||
microk8s.kubectl -n {{ item.namespace | default('default') }} describe secret {{ secret_name.stdout }} | grep token: | awk '{ print $2 }'
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: token
|
||||
when: item.enabled
|
||||
tags:
|
||||
- k8s::users
|
||||
changed_when: false
|
||||
|
||||
- name: Read system kubeconfig
|
||||
become: true
|
||||
ansible.builtin.command: "microk8s config"
|
||||
register: kubeconfig
|
||||
tags:
|
||||
- k8s::users
|
||||
changed_when: false
|
||||
|
||||
- name: Set fact kubeconfig
|
||||
ansible.builtin.set_fact:
|
||||
kubeconfig_yaml: "{{ kubeconfig.stdout | from_yaml }}"
|
||||
tags:
|
||||
- k8s::users
|
||||
changed_when: false
|
||||
|
||||
- name: Patch kubeconfig with user token
|
||||
ansible.builtin.set_fact:
|
||||
patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}"
|
||||
vars:
|
||||
new_kubeconfig:
|
||||
contexts:
|
||||
- context:
|
||||
cluster: microk8s-cluster
|
||||
user: "{{ item.username }}"
|
||||
name: microk8s
|
||||
users:
|
||||
- name: "{{ item.username }}"
|
||||
user:
|
||||
token: "{{ token.stdout }}"
|
||||
tags:
|
||||
- k8s::users
|
||||
|
||||
- name: Check if a config already exists and its SHA1
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: "{{ user_registered.home }}/.kube/config"
|
||||
register: kubeconfig_exists
|
||||
tags:
|
||||
- k8s::users
|
||||
|
||||
- name: Get new config SHA1
|
||||
set_fact:
|
||||
patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
|
||||
tags:
|
||||
- k8s::users
|
||||
|
||||
- name: Write kubeconfig
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}"
|
||||
dest: "{{ user_registered.home }}/.kube/config"
|
||||
owner: "{{ item.username }}"
|
||||
mode: "0600"
|
||||
when: kubeconfig_exists.stat.exists == false or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
|
||||
tags:
|
||||
- k8s::users
|
||||
Reference in New Issue
Block a user