Initial ansible onboard

ansible/roles/microk8s/tasks/microk8s/install.yml

@@ -0,0 +1,88 @@
+# Install a snap with classic confinement
+- name: Microk8s | Installing microk8s from channel '{{ microk8s_channel }}'
+  become: true
+  community.general.snap:
+    name: microk8s
+    channel: "{{ microk8s_channel }}"
+    classic: true
+
+- name: Microk8s | Patch microk8s configuration
+  notify: ["Restart microk8s"]
+  block:
+    - name: Microk8s | Enable privileged mode
+      become: true
+      ansible.builtin.lineinfile:
+        path: /var/snap/microk8s/current/args/kube-apiserver
+        line: "--allow-privileged=true"
+        insertafter: "^--insecure-port=0$"
+
+    - name: Microk8s | Fixing Disk Pressure
+      become: true
+      ansible.builtin.lineinfile:
+        path: /var/snap/microk8s/current/args/kubelet
+        line: "{{ item }}"
+        insertafter: "^--read-only-port=0$"
+      with_items:
+        - "--image-gc-high-threshold=70"
+        - "--image-gc-low-threshold=60"
+
+    - name: Microk8s | Setup alternative DNS names
+      become: true
+      ansible.builtin.lineinfile:
+        path: /var/snap/microk8s/current/certs/csr.conf.template
+        line: "DNS.6 = {{ microk8s_alt_names }}"
+        insertafter: "^DNS.5 = kubernetes.default.svc.cluster.local$"
+
+- name: Microk8s | Waiting for microk8s to be ready # noqa no-changed-when
+  become: true
+  ansible.builtin.command:
+    cmd: "microk8s.status --wait-ready --format short -t {{ microk8s_status_timeout }}"
+  register: microk8s_wait_result
+  failed_when: "'microk8s is running' not in microk8s_wait_result.stdout"
+  changed_when: false
+
+- name: Microk8s | Adding required users to group microk8s
+  become: true
+  ansible.builtin.user:
+    name: "{{ ansible_user }}"
+    groups:
+      - microk8s
+    append: true
+  register: user_group_task
+
+- name: Reset ssh connection to allow user changes to affect ansible user # noqa no-handler
+  when: user_group_task.changed
+  ansible.builtin.meta: reset_connection
+
+- name: Microk8s | Required plugins (microk8s)
+  ansible.builtin.include_tasks: microk8s/plugins.yml
+  loop:
+    - { plugin: "ha-cluster", wait: 90, args: "", enabled: false }
+    - { plugin: "rbac", wait: 30, args: "", enabled: true }
+    - { plugin: "dns", wait: 30, args: "", enabled: true }
+    - { plugin: "storage", wait: 10, args: "", enabled: true }
+    - { plugin: "ingress", wait: 60, args: "", enabled: true }
+    - { plugin: "hostpath-storage", wait: 10, args: "", enabled: true }
+
+- name: Microk8s | Check if ufw is enabled
+  become: true
+  ansible.builtin.shell:
+    cmd: "ufw status"
+  register: ufw_status
+  changed_when: false
+
+- name: Microk8s | Configure required ufw rules
+  ansible.builtin.include_tasks: microk8s/ufw.yml
+  when:
+    - ufw_status.stdout.find("Status: active") != -1
+
+- name: Microk8s | Store kubeconfig
+  ansible.builtin.shell:
+    cmd: "microk8s config > {{ k8s_kubeconfig }}"
+    creates: "{{ k8s_kubeconfig }}"
+
+- name: Microk8s | Hardening kubeconfig permissions
+  ansible.builtin.file:
+    path: "{{ k8s_kubeconfig }}"
+    state: file
+    mode: "0600"

ansible/roles/microk8s/tasks/microk8s/plugins.yml

@@ -0,0 +1,36 @@
+- name: Checking plugin '{{ item.plugin }}'
+  ansible.builtin.shell:
+    cmd: 'set -o pipefail && microk8s.status --format short | grep {{ item.plugin }} | awk ''{split($0,a,": "); print(a[2]);}'''
+    executable: /bin/bash
+  register: plugin_status
+  changed_when: false
+
+- name: Enable plugin '{{ item.plugin }}'
+  when: plugin_status.stdout == "disabled" and item.enabled
+  block:
+    - name: Compose microk8s command args
+      ansible.builtin.set_fact:
+        micro_k8s_args: "{{ (item.args | length > 0) | ternary(item.plugin + ':' + item.args, item.plugin) }}"
+
+    - name: Enabling plugin '{{ item.plugin }}' # noqa no-changed-when
+      ansible.builtin.command:
+        cmd: "microk8s.enable {{ micro_k8s_args }}"
+
+    - name: Waiting for plugin to apply '{{ item.wait }}'
+      ansible.builtin.pause:
+        seconds: "{{ item.wait }}"
+
+- name: Disable plugin '{{ item.plugin }}'
+  when: plugin_status.stdout == "enabled" and not item.enabled
+  block:
+    - name: Compose microk8s command args
+      ansible.builtin.set_fact:
+        micro_k8s_args: "{{ (item.args | length > 0) | ternary(item.plugin + ':' + item.args, item.plugin) }}"
+
+    - name: Enabling plugin '{{ item.plugin }}' # noqa no-changed-when
+      ansible.builtin.command:
+        cmd: "microk8s.disable {{ micro_k8s_args }}"
+
+    - name: Waiting for plugin to apply '{{ item.wait }}'
+      ansible.builtin.pause:
+        seconds: "{{ item.wait }}"

ansible/roles/microk8s/tasks/microk8s/ufw.yml

@@ -0,0 +1,51 @@
+- name: Allow in required devices
+  become: true
+  community.general.ufw:
+    rule: allow
+    direction: in
+    interface: "{{ item }}"
+    comment: ansible managed
+  with_items:
+    - "{{ k8s_net_devices }}"
+
+- name: Allow out required devices
+  become: true
+  community.general.ufw:
+    rule: allow
+    direction: out
+    interface: "{{ item }}"
+    comment: ansible managed
+  with_items:
+    - "{{ k8s_net_devices }}"
+
+- name: Allow incoming specific ports
+  become: true
+  community.general.ufw:
+    rule: "{{ item.rule }}"
+    src: "{{ item.from | d('any') }}"
+    port: "{{ item.port | int }}"
+    proto: "{{ item.proto }}"
+    comment: ansible managed
+  with_items:
+    - "{{ k8s_incoming_traffic }}"
+
+- name: Allow outgoing specified ports
+  become: true
+  community.general.ufw:
+    rule: allow
+    port: "{{ item | int }}"
+    direction: out
+    comment: ansible managed
+  with_items:
+    - "{{ k8s_outgoing_traffic }}"
+
+- name: Allow hosts to access the API
+  become: true
+  community.general.ufw:
+    rule: allow
+    src: "{{ item }}"
+    port: 16443
+    proto: tcp
+    comment: ansible managed
+  with_items:
+    - "{{ k8s_allowed_hosts }}"