105 lines
3.4 KiB
YAML
105 lines
3.4 KiB
YAML
- name: Microk8s | Installing microk8s from channel '{{ microk8s_channel }}'
|
|
become: true
|
|
community.general.snap:
|
|
name: microk8s
|
|
channel: "{{ microk8s_channel }}"
|
|
classic: true
|
|
|
|
- name: Create encryption configuration
|
|
become: true
|
|
ansible.builtin.copy:
|
|
content: |
|
|
---
|
|
apiVersion: apiserver.config.k8s.io/v1
|
|
kind: EncryptionConfiguration
|
|
resources:
|
|
- resources:
|
|
- secrets
|
|
providers:
|
|
- aescbc:
|
|
keys:
|
|
- name: k8s-crypto
|
|
secret: {{ microk8s_encryption_secret }}
|
|
- identity: {}
|
|
dest: "{{ microk8s_encryption_cfg }}"
|
|
mode: "0600"
|
|
|
|
- name: Microk8s | Patch microk8s configuration
|
|
notify: ["Restart microk8s"]
|
|
block:
|
|
- name: Microk8s | Enable privileged mode
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
path: /var/snap/microk8s/current/args/kube-apiserver
|
|
line: "--allow-privileged=true"
|
|
insertafter: "^--insecure-port=0$"
|
|
|
|
- name: Microk8s | Enable encryption provider
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
path: /var/snap/microk8s/current/args/kube-apiserver
|
|
line: "--encryption-provider-config=/a13labs/microk8s/encryption.yaml"
|
|
insertafter: "^--insecure-port=0$"
|
|
|
|
- name: Microk8s | Fixing Disk Pressure
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
path: /var/snap/microk8s/current/args/kubelet
|
|
line: "{{ item }}"
|
|
insertafter: "^--read-only-port=0$"
|
|
with_items:
|
|
- "--image-gc-high-threshold=70"
|
|
- "--image-gc-low-threshold=60"
|
|
|
|
- name: Microk8s | Setup alternative DNS names
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
path: /var/snap/microk8s/current/certs/csr.conf.template
|
|
line: "DNS.6 = {{ microk8s_alt_names }}"
|
|
insertafter: "^DNS.5 = kubernetes.default.svc.cluster.local$"
|
|
|
|
- name: Microk8s | Waiting for microk8s to be ready # noqa no-changed-when
|
|
become: true
|
|
ansible.builtin.command:
|
|
cmd: "microk8s.status --wait-ready --format short -t {{ microk8s_status_timeout }}"
|
|
register: microk8s_wait_result
|
|
failed_when: "'microk8s is running' not in microk8s_wait_result.stdout"
|
|
changed_when: false
|
|
|
|
- name: Microk8s | Adding required users to group microk8s
|
|
become: true
|
|
ansible.builtin.user:
|
|
name: "{{ ansible_user }}"
|
|
groups:
|
|
- microk8s
|
|
append: true
|
|
register: user_group_task
|
|
|
|
- name: Reset ssh connection to allow user changes to affect ansible user # noqa no-handler
|
|
when: user_group_task.changed
|
|
ansible.builtin.meta: reset_connection
|
|
|
|
- name: Microk8s | Required plugins (microk8s)
|
|
ansible.builtin.include_tasks: microk8s/plugins.yml
|
|
loop:
|
|
- { plugin: "ha-cluster", wait: 30, args: "--force", enabled: false }
|
|
- { plugin: "rbac", wait: 30, args: "", enabled: true }
|
|
- { plugin: "dns", wait: 30, args: "", enabled: true }
|
|
- { plugin: "storage", wait: 10, args: "", enabled: true }
|
|
- { plugin: "ingress", wait: 60, args: "", enabled: true }
|
|
- { plugin: "hostpath-storage", wait: 10, args: "", enabled: true }
|
|
|
|
- name: Microk8s | Configure required ufw rules
|
|
ansible.builtin.include_tasks: microk8s/ufw.yml
|
|
|
|
- name: Microk8s | Store kubeconfig
|
|
ansible.builtin.shell:
|
|
cmd: "microk8s config > {{ k8s_kubeconfig }}"
|
|
creates: "{{ k8s_kubeconfig }}"
|
|
|
|
- name: Microk8s | Hardening kubeconfig permissions
|
|
ansible.builtin.file:
|
|
path: "{{ k8s_kubeconfig }}"
|
|
state: file
|
|
mode: "0600"
|