89 lines
2.9 KiB
YAML
89 lines
2.9 KiB
YAML
# Install a snap with classic confinement
|
|
- name: Microk8s | Installing microk8s from channel '{{ microk8s_channel }}'
|
|
become: true
|
|
community.general.snap:
|
|
name: microk8s
|
|
channel: "{{ microk8s_channel }}"
|
|
classic: true
|
|
|
|
- name: Microk8s | Patch microk8s configuration
|
|
notify: ["Restart microk8s"]
|
|
block:
|
|
- name: Microk8s | Enable privileged mode
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
path: /var/snap/microk8s/current/args/kube-apiserver
|
|
line: "--allow-privileged=true"
|
|
insertafter: "^--insecure-port=0$"
|
|
|
|
- name: Microk8s | Fixing Disk Pressure
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
path: /var/snap/microk8s/current/args/kubelet
|
|
line: "{{ item }}"
|
|
insertafter: "^--read-only-port=0$"
|
|
with_items:
|
|
- "--image-gc-high-threshold=70"
|
|
- "--image-gc-low-threshold=60"
|
|
|
|
- name: Microk8s | Setup alternative DNS names
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
path: /var/snap/microk8s/current/certs/csr.conf.template
|
|
line: "DNS.6 = {{ microk8s_alt_names }}"
|
|
insertafter: "^DNS.5 = kubernetes.default.svc.cluster.local$"
|
|
|
|
- name: Microk8s | Waiting for microk8s to be ready # noqa no-changed-when
|
|
become: true
|
|
ansible.builtin.command:
|
|
cmd: "microk8s.status --wait-ready --format short -t {{ microk8s_status_timeout }}"
|
|
register: microk8s_wait_result
|
|
failed_when: "'microk8s is running' not in microk8s_wait_result.stdout"
|
|
changed_when: false
|
|
|
|
- name: Microk8s | Adding required users to group microk8s
|
|
become: true
|
|
ansible.builtin.user:
|
|
name: "{{ ansible_user }}"
|
|
groups:
|
|
- microk8s
|
|
append: true
|
|
register: user_group_task
|
|
|
|
- name: Reset ssh connection to allow user changes to affect ansible user # noqa no-handler
|
|
when: user_group_task.changed
|
|
ansible.builtin.meta: reset_connection
|
|
|
|
- name: Microk8s | Required plugins (microk8s)
|
|
ansible.builtin.include_tasks: microk8s/plugins.yml
|
|
loop:
|
|
- { plugin: "ha-cluster", wait: 30, args: "--force", enabled: false }
|
|
- { plugin: "rbac", wait: 30, args: "", enabled: true }
|
|
- { plugin: "dns", wait: 30, args: "", enabled: true }
|
|
- { plugin: "storage", wait: 10, args: "", enabled: true }
|
|
- { plugin: "ingress", wait: 60, args: "", enabled: true }
|
|
- { plugin: "hostpath-storage", wait: 10, args: "", enabled: true }
|
|
|
|
- name: Microk8s | Check if ufw is enabled
|
|
become: true
|
|
ansible.builtin.shell:
|
|
cmd: "ufw status"
|
|
register: ufw_status
|
|
changed_when: false
|
|
|
|
- name: Microk8s | Configure required ufw rules
|
|
ansible.builtin.include_tasks: microk8s/ufw.yml
|
|
when:
|
|
- ufw_status.stdout.find("Status: active") != -1
|
|
|
|
- name: Microk8s | Store kubeconfig
|
|
ansible.builtin.shell:
|
|
cmd: "microk8s config > {{ k8s_kubeconfig }}"
|
|
creates: "{{ k8s_kubeconfig }}"
|
|
|
|
- name: Microk8s | Hardening kubeconfig permissions
|
|
ansible.builtin.file:
|
|
path: "{{ k8s_kubeconfig }}"
|
|
state: file
|
|
mode: "0600"
|