Initial ansible onboard

2024-09-24 15:19:51 +02:00
parent 7366659355
commit f445996797
492 changed files with 2214589 additions and 0 deletions
@@ -0,0 +1,141 @@
+- name: Create user k8s service account
+  environment:
+    PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
+  vars:
+    ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
+  kubernetes.core.k8s:
+    state: present
+    kubeconfig: "{{ k8s_kubeconfig }}"
+    wait: true
+    definition:
+      apiVersion: v1
+      kind: ServiceAccount
+      metadata:
+        name: "{{ k8s_iac_user }}"
+        namespace: default
+  tags:
+    - k8s::iac
+
+- name: Create secret token
+  environment:
+    PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
+  vars:
+    ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
+  kubernetes.core.k8s:
+    state: present
+    kubeconfig: "{{ k8s_kubeconfig }}"
+    wait: true
+    definition:
+      apiVersion: v1
+      kind: Secret
+      metadata:
+        name: "{{ k8s_iac_user }}-token"
+        namespace: default
+        annotations:
+          kubernetes.io/service-account.name: "{{ k8s_iac_user }}"
+      type: kubernetes.io/service-account-token
+  tags:
+    - k8s::iac
+
+- name: Enabled IaC admin access to k8s
+  environment:
+    PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
+  vars:
+    ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
+  kubernetes.core.k8s:
+    state: present
+    kubeconfig: "{{ k8s_kubeconfig }}"
+    wait: true
+    definition:
+      apiVersion: rbac.authorization.k8s.io/v1
+      kind: ClusterRoleBinding
+      metadata:
+        name: admin-role-binding
+      roleRef:
+        apiGroup: rbac.authorization.k8s.io
+        kind: ClusterRole
+        name: cluster-admin
+      subjects:
+        - kind: ServiceAccount
+          namespace: default
+          name: "{{ k8s_iac_user }}"
+  tags:
+    - k8s::iac
+
+- name: Get the secret name
+  ansible.builtin.shell: |
+    set -o pipefail
+    microk8s.kubectl -n default get secret | grep {{ k8s_iac_user }} | awk '{ print $1 }'
+  args:
+    executable: /bin/bash
+  register: secret_name
+  tags:
+    - k8s::iac
+  changed_when: false
+
+- name: Describe the secret and extract the token
+  ansible.builtin.shell: |
+    set -o pipefail
+    microk8s.kubectl -n default describe secret {{ secret_name.stdout }} | grep token: | awk '{ print $2 }'
+  args:
+    executable: /bin/bash
+  register: token
+  tags:
+    - k8s::iac
+  changed_when: false
+
+- name: Read system kubeconfig
+  become: true
+  ansible.builtin.command: "microk8s config"
+  register: kubeconfig
+  tags:
+    - k8s::iac
+  changed_when: false
+
+- name: Set fact kubeconfig
+  ansible.builtin.set_fact:
+    kubeconfig_yaml: "{{ kubeconfig.stdout | from_yaml }}"
+  tags:
+    - k8s::iac
+
+- name: Patch kubeconfig with user token
+  ansible.builtin.set_fact:
+    patched_kubeconfig_yaml: "{{ kubeconfig_yaml | combine(new_kubeconfig, recursive=True) }}"
+  vars:
+    new_kubeconfig:
+      contexts:
+        - context:
+            cluster: microk8s-cluster
+            user: "{{ k8s_iac_user }}"
+          name: microk8s
+      users:
+        - name: "{{ k8s_iac_user }}"
+          user:
+            token: "{{ token.stdout }}"
+  tags:
+    - k8s::iac
+
+- name: Check if a config already exists and its SHA1
+  become: true
+  ansible.builtin.stat:
+    path: "{{ k8s_kubeconfig }}"
+  register: kubeconfig_exists
+  tags:
+    - k8s::iac
+
+- name: Get new config SHA1
+  set_fact:
+    patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
+  tags:
+    - k8s::iac
+
+- name: Write kubeconfig
+  become: true
+  ansible.builtin.copy:
+    content: "{{ patched_kubeconfig_yaml | to_nice_yaml }}"
+    dest: "{{ k8s_kubeconfig }}"
+    owner: "{{ k8s_iac_user }}"
+    mode: "0600"
+  when: kubeconfig_exists.stat.exists == false or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
+  tags:
+    - k8s::iac