adrien/ansible-role-kubernetes
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Update role
Some checks failed
continuous-integration/drone/push Build is failing
Details

Browse source
This commit is contained in:
Adrien Reslinger 2022-10-27 23:38:04 +02:00
parent 48e99ac551
commit d4dac488f9
Signed by: adrien
GPG key ID: DA7B27055C66D6DE
7 changed files with 298 additions and 279 deletions
Download patch file Download diff file Expand all files Collapse all files

20
tasks/Debian.yml
View file

@ -1,21 +1,21 @@
--- ---
- name: add docker apt key - name: Add docker apt key
apt_key: ansible.builtin.apt_key:
url: https://download.docker.com/linux/ubuntu/gpg url: https://download.docker.com/linux/ubuntu/gpg
state: present state: present
when: when:
- docker_ver == "docker_ce" - docker_ver == "docker_ce"
- name: add docker repository - name: Add docker repository
apt_repository: ansible.builtin.apt_repository:
repo: 'deb [arch=amd64] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable' repo: 'deb [arch=amd64] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable'
state: present state: present
update_cache: yes update_cache: true
when: when:
- docker_ver == "docker_ce" - docker_ver == "docker_ce"
- name: "Ensure GRUB_CMDLINE_LINUX is updated" - name: "Ensure GRUB_CMDLINE_LINUX is updated"
lineinfile: ansible.builtin.lineinfile:
dest: /etc/default/grub dest: /etc/default/grub
regexp: '^(GRUB_CMDLINE_LINUX=".*)"$' regexp: '^(GRUB_CMDLINE_LINUX=".*)"$'
line: '\1 cgroup_enable=memory swapaccount=1"' line: '\1 cgroup_enable=memory swapaccount=1"'
@ -24,12 +24,12 @@
- not docker_installed.stat.exists - not docker_installed.stat.exists
- name: "Update grub.conf" - name: "Update grub.conf"
command: update-grub ansible.builtin.command: update-grub
when: when:
- not docker_installed.stat.exists - not docker_installed.stat.exists
- name: "Ensure DEFAULT_FORWARD_POLICY in /etc/default/ufw is updated" - name: "Ensure DEFAULT_FORWARD_POLICY in /etc/default/ufw is updated"
lineinfile: ansible.builtin.lineinfile:
dest: /etc/default/ufw dest: /etc/default/ufw
regexp: '^(DEFAULT_FORWARD_POLICY=").*"$' regexp: '^(DEFAULT_FORWARD_POLICY=").*"$'
line: '\1ACCEPT"' line: '\1ACCEPT"'
@ -38,11 +38,11 @@
tags: [docker,firewall] tags: [docker,firewall]
# Need Certificat ? Only in local # Need Certificat ? Only in local
#- name: "Add docker port 2376/TCP " # - name: "Add docker port 2376/TCP "
# ufw: rule=allow port=2376 proto=tcp # ufw: rule=allow port=2376 proto=tcp
# notify: reload ufw # notify: reload ufw
# tags: [docker,firewall] # tags: [docker,firewall]
#- name: "Start UFW rules" # - name: "Start UFW rules"
# service: name=ufw state=started # service: name=ufw state=started
# tags: [docker,firewall] # tags: [docker,firewall]

44
tasks/RedHat.yml
View file

@ -1,16 +1,16 @@
--- ---
#- name: Add kubernetes repository # - name: Add kubernetes repository
# yumrepo: # yumrepo:
# name: kubernetes # name: kubernetes
# description: "Kubernetes Repository" # description: "Kubernetes Repository"
# baseurl: https://packages.cloud.google.com/yum/repos/kubernetes-$releasever-x86_64 # baseurl: https://packages.cloud.google.com/yum/repos/kubernetes-$releasever-x86_64
# gpgcheck: yes # gpgcheck: yes
# enabled: yes # enabled: true
# gpgkey: https://packages.cloud.google.com/yum/doc/yum-key.gpg # gpgkey: https://packages.cloud.google.com/yum/doc/yum-key.gpg
# state: present # state: present
#- name: Add Official kubernetes's repo # - name: Add Official kubernetes's repo
# template: # ansible.builtin.template:
# src: "etc/yum.repos.d/kubernetes.repo.j2" # src: "etc/yum.repos.d/kubernetes.repo.j2"
# dest: "/etc/yum.repos.d/kubernetes.repo" # dest: "/etc/yum.repos.d/kubernetes.repo"
# group: root # group: root
@ -22,7 +22,7 @@
# - kubernetes_cri != "k3s" # - kubernetes_cri != "k3s"
- name: Add Official kubernetes's repo on servers - name: Add Official kubernetes's repo on servers
yum_repository: ansible.builtin.yum_repository:
name: kubernetes name: kubernetes
description: Kubernetes description: Kubernetes
baseurl: https://packages.cloud.google.com/yum/repos/kubernetes-el7-$basearch baseurl: https://packages.cloud.google.com/yum/repos/kubernetes-el7-$basearch
@ -39,7 +39,7 @@
- kubernetes_cri != "k3s" - kubernetes_cri != "k3s"
- name: Add Official kubernetes's repo for Desktop - name: Add Official kubernetes's repo for Desktop
yum_repository: ansible.builtin.yum_repository:
name: kubernetes name: kubernetes
description: Kubernetes description: Kubernetes
baseurl: https://packages.cloud.google.com/yum/repos/kubernetes-el7-$basearch baseurl: https://packages.cloud.google.com/yum/repos/kubernetes-el7-$basearch
@ -53,8 +53,8 @@
- not ansible_machine == "armv6l" - not ansible_machine == "armv6l"
- not kubernetes_server|bool - not kubernetes_server|bool
#- name: redhat | Installing K8s Packages # - name: Redhat | Installing K8s Packages
# package: # ansible.builtin.package:
# name: # name:
# - kubectl # - kubectl
# - kubelet # - kubelet
@ -67,8 +67,8 @@
# register: result # register: result
# until: result is successful # until: result is successful
#- name: Register kubernetes firewalld service # - name: Register kubernetes firewalld service
# template: # ansible.builtin.template:
# src: "etc/firewalld/services/kubernetes.xml.j2" # src: "etc/firewalld/services/kubernetes.xml.j2"
# dest: "/etc/firewalld/services/kubernetes.xml" # dest: "/etc/firewalld/services/kubernetes.xml"
# group: root # group: root
@ -78,18 +78,18 @@
# when: # when:
# - kubernetes_server|bool # - kubernetes_server|bool
# #
#- name: Reload firewalld configuration # - name: Reload firewalld configuration
# service: # ansible.builtin.service:
# name: firewalld # name: firewalld
# state: reloaded # state: reloaded
# enabled: yes # enabled: true
# when: # when:
# - kubernetes_server|bool # - kubernetes_server|bool
# - need_firewalld_reload is changed # - need_firewalld_reload is changed
# #
## Définir interface ## Définir interface
#- name: Open Firewalld # - name: Open Firewalld
# firewalld: # ansible.posix.firewalld:
# zone: external # zone: external
# service: kubernetes # service: kubernetes
# permanent: true # permanent: true
@ -100,15 +100,15 @@
## - firewall_name == "firewalld" ## - firewall_name == "firewalld"
# - kubernetes_server|bool # - kubernetes_server|bool
#- name: Create kubernetes firewalld zone # - name: Create kubernetes firewalld zone
# firewalld: # ansible.posix.firewalld:
# zone: kubernetes # zone: kubernetes
# permanent: true # permanent: true
# state: present # state: present
# when: # when:
# - kubernetes_server|bool # - kubernetes_server|bool
- name: Add kubernetes networks to trusted firewalld zone - name: Add kubernetes networks to trusted firewalld zone
firewalld: ansible.posix.firewalld:
# zone: kubernetes # zone: kubernetes
zone: trusted zone: trusted
permanent: true permanent: true
@ -122,11 +122,11 @@
- "10.96.0.0/12" - "10.96.0.0/12"
- name: Install kubernetes tools - name: Install kubernetes tools
dnf: ansible.builtin.dnf:
name: "{{ kubernetes_package_name }}" name: "{{ kubernetes_package_name }}"
enablerepo: "kubernetes" enablerepo: "kubernetes"
state: present state: present
update_cache: yes update_cache: true
disable_excludes: kubernetes disable_excludes: kubernetes
# notify: Restart kubelet # notify: Restart kubelet
when: when:
@ -134,11 +134,11 @@
- (not kubernetes_server|bool) or ( kubernetes_server|bool and kubernetes_cri != "k3s") - (not kubernetes_server|bool) or ( kubernetes_server|bool and kubernetes_cri != "k3s")
- name: Install kubernetes tools - name: Install kubernetes tools
yum: ansible.builtin.yum:
name: "{{ kubernetes_package_name }}" name: "{{ kubernetes_package_name }}"
enablerepo: "kubernetes" enablerepo: "kubernetes"
state: present state: present
update_cache: yes update_cache: true
# notify: Restart kubelet # notify: Restart kubelet
when: when:
- ansible_pkg_mgr == "yum" - ansible_pkg_mgr == "yum"

56
tasks/cluster_k3s.yml
View file

@ -1,6 +1,6 @@
--- ---
- name: Install Wireguard - name: Install Wireguard
include_role: ansible.builtin.include_role:
name: wireguard name: wireguard
# when: # when:
# - kubernetes_cni == "wireguard" # - kubernetes_cni == "wireguard"
@ -13,7 +13,7 @@
- ansible_os_family == "RedHat" - ansible_os_family == "RedHat"
- name: Install the k3s-selinux rpm from a remote repo for yum distro - name: Install the k3s-selinux rpm from a remote repo for yum distro
yum: ansible.builtin.yum:
name: "https://github.com/k3s-io/k3s-selinux/releases/download/v1.2.stable.2/k3s-selinux-1.2-2.el7.noarch.rpm" name: "https://github.com/k3s-io/k3s-selinux/releases/download/v1.2.stable.2/k3s-selinux-1.2-2.el7.noarch.rpm"
state: present state: present
when: when:
@ -22,7 +22,7 @@
- ansible_distribution_major_version == '7' - ansible_distribution_major_version == '7'
- name: Install the k3s-selinux rpm from a remote repo for dnf distro - name: Install the k3s-selinux rpm from a remote repo for dnf distro
dnf: ansible.builtin.dnf:
name: "https://github.com/k3s-io/k3s-selinux/releases/download/v1.2.stable.2/k3s-selinux-1.2-2.el8.noarch.rpm" name: "https://github.com/k3s-io/k3s-selinux/releases/download/v1.2.stable.2/k3s-selinux-1.2-2.el8.noarch.rpm"
state: present state: present
when: when:
@ -31,13 +31,14 @@
- ansible_distribution_major_version == '8' - ansible_distribution_major_version == '8'
- name: Check if /usr/local/bin/k3s already existe - name: Check if /usr/local/bin/k3s already existe
stat: ansible.builtin.stat:
path: /usr/local/bin/k3s path: /usr/local/bin/k3s
register: k3s_bin register: k3s_bin
check_mode: false
changed_when: False changed_when: False
- name: retreive k3s binary for x86_64 - name: Retreive k3s binary for x86_64
get_url: ansible.builtin.get_url:
url: "https://github.com/rancher/k3s/releases/download/v1.25.3%2Bk3s1/k3s" url: "https://github.com/rancher/k3s/releases/download/v1.25.3%2Bk3s1/k3s"
dest: "/usr/local/bin/k3s" dest: "/usr/local/bin/k3s"
group: root group: root
@ -47,8 +48,8 @@
- not k3s_bin.stat.exists - not k3s_bin.stat.exists
- ansible_machine == "x86_64" - ansible_machine == "x86_64"
- name: retreive k3s binary for arm64 - name: Retreive k3s binary for arm64
get_url: ansible.builtin.get_url:
url: "https://github.com/rancher/k3s/releases/download/v1.25.3%2Bk3s1/k3s-arm64" url: "https://github.com/rancher/k3s/releases/download/v1.25.3%2Bk3s1/k3s-arm64"
dest: "/usr/local/bin/k3s" dest: "/usr/local/bin/k3s"
group: root group: root
@ -58,8 +59,8 @@
- not k3s_bin.stat.exists - not k3s_bin.stat.exists
- ansible_machine == "arm64" - ansible_machine == "arm64"
- name: retreive k3s binary for armv6/armv7 - name: Retreive k3s binary for armv6/armv7
get_url: ansible.builtin.get_url:
url: "https://github.com/rancher/k3s/releases/download/v1.25.3%2Bk3s1/k3s-armhf" url: "https://github.com/rancher/k3s/releases/download/v1.25.3%2Bk3s1/k3s-armhf"
dest: "/usr/local/bin/k3s" dest: "/usr/local/bin/k3s"
group: root group: root
@ -70,7 +71,7 @@
- (ansible_machine == "armv7l") or (ansible_machine == "armv6l") - (ansible_machine == "armv7l") or (ansible_machine == "armv6l")
- name: Create tools link - name: Create tools link
file: ansible.builtin.file:
src: "k3s" src: "k3s"
dest: "/usr/local/bin/{{ item }}" dest: "/usr/local/bin/{{ item }}"
owner: root owner: root
@ -82,7 +83,7 @@
- "ctr" - "ctr"
- name: Create thin volumes for k3s - name: Create thin volumes for k3s
lvol: community.general.lvol:
vg: "{{ item.vg }}" vg: "{{ item.vg }}"
lv: "{{ item.name }}" lv: "{{ item.name }}"
thinpool: kubernetes thinpool: kubernetes
@ -90,15 +91,15 @@
with_items: with_items:
- { name: var_lib_k3s, vg: vg_sys, size: 10g, mount_point: /var/lib/rancher/k3s, mount_opts: "discard"} - { name: var_lib_k3s, vg: vg_sys, size: 10g, mount_point: /var/lib/rancher/k3s, mount_opts: "discard"}
- name: create file system on containerd lv - name: Create file system on containerd lv
filesystem: community.general.filesystem:
fstype: ext4 fstype: ext4
dev: "/dev/{{ item.vg }}/{{ item.name }}" dev: "/dev/{{ item.vg }}/{{ item.name }}"
with_items: with_items:
- { name: var_lib_k3s, vg: vg_sys, size: 10g, mount_point: /var/lib/rancher/k3s, mount_opts: "discard"} - { name: var_lib_k3s, vg: vg_sys, size: 10g, mount_point: /var/lib/rancher/k3s, mount_opts: "discard"}
- name: mount logical volumes - name: Mount logical volumes
mount: ansible.posix.mount:
name: "{{ item.mount_point }}" name: "{{ item.mount_point }}"
src: "/dev/{{ item.vg }}/{{ item.name }}" src: "/dev/{{ item.vg }}/{{ item.name }}"
fstype: ext4 fstype: ext4
@ -108,7 +109,7 @@
- { name: var_lib_k3s, vg: vg_sys, size: 10g, mount_point: /var/lib/rancher/k3s, mount_opts: "discard"} - { name: var_lib_k3s, vg: vg_sys, size: 10g, mount_point: /var/lib/rancher/k3s, mount_opts: "discard"}
- name: Audit policies directory - name: Audit policies directory
file: ansible.builtin.file:
path: "/etc/kubernetes/policies" path: "/etc/kubernetes/policies"
state: directory state: directory
owner: root owner: root
@ -118,7 +119,7 @@
- kubernetes_master|bool - kubernetes_master|bool
- name: Configure audit policy - name: Configure audit policy
copy: ansible.builtin.copy:
src: "etc/kubernetes/policies/audit-policy.yaml" src: "etc/kubernetes/policies/audit-policy.yaml"
dest: "/etc/kubernetes/policies/audit-policy.yaml" dest: "/etc/kubernetes/policies/audit-policy.yaml"
group: root group: root
@ -129,16 +130,18 @@
# Check controlers # Check controlers
- name: Check if /etc/rancher/k3s/k3s.yaml already existe - name: Check if /etc/rancher/k3s/k3s.yaml already existe
stat: ansible.builtin.stat:
path: /etc/rancher/k3s/k3s.yaml path: /etc/rancher/k3s/k3s.yaml
register: st register: st
check_mode: false
changed_when: False changed_when: False
when: when:
- kubernetes_master|bool - kubernetes_master|bool
- name: Create KubernetesMasterConfigured group - name: Create KubernetesMasterConfigured group
group_by: ansible.builtin.group_by:
key: KubernetesMasterConfigured_{{ kubernetes_cluster_name }} key: KubernetesMasterConfigured_{{ kubernetes_cluster_name }}
check_mode: false
when: when:
- kubernetes_master|bool - kubernetes_master|bool
- st.stat.exists - st.stat.exists
@ -148,7 +151,7 @@
# run_once: true # run_once: true
block: block:
- name: Deploy systemd service - name: Deploy systemd service
template: ansible.builtin.template:
src: "{{ item }}.j2" src: "{{ item }}.j2"
dest: "{{ item }}" dest: "{{ item }}"
owner: root owner: root
@ -166,7 +169,7 @@
daemon_reload: true daemon_reload: true
- name: Enable k3s on boot - name: Enable k3s on boot
service: ansible.builtin.service:
name: k3s name: k3s
state: started state: started
enabled: true enabled: true
@ -180,8 +183,9 @@
path: /var/lib/rancher/k3s/server/token path: /var/lib/rancher/k3s/server/token
- name: Add {{ ansible_hostname }} to KubernetesMasterConfigured group - name: Add {{ ansible_hostname }} to KubernetesMasterConfigured group
group_by: ansible.builtin.group_by:
key: KubernetesMasterConfigured_{{ kubernetes_cluster_name }} key: KubernetesMasterConfigured_{{ kubernetes_cluster_name }}
check_mode: false
when: when:
- kubernetes_master|bool - kubernetes_master|bool
@ -191,8 +195,8 @@
# Manque kubernetes_server_token, kubernetes_master url # Manque kubernetes_server_token, kubernetes_master url
#- name: Deploy systemd service # - name: Deploy systemd service
# template: # ansible.builtin.template:
# src: "etc/systemd/system/{{ item }}.j2" # src: "etc/systemd/system/{{ item }}.j2"
# dest: "/etc/systemd/system/{{ item }}" # dest: "/etc/systemd/system/{{ item }}"
# owner: root # owner: root
@ -207,7 +211,7 @@
- name: Enable k3s on boot - name: Enable k3s on boot
service: ansible.builtin.service:
name: k3s name: k3s
state: started state: started
enabled: true enabled: true

94
tasks/cluster_kubeadm.yml
View file

@ -1,27 +1,27 @@
--- ---
- name: Install Containerd - name: Install Containerd
include_role: ansible.builtin.include_role:
name: containerd name: containerd
when: when:
- kubernetes_cri == "containerd" - kubernetes_cri == "containerd"
#register: kubernetes_cri_changed # register: kubernetes_cri_changed
- name: Install CRI-O - name: Install CRI-O
include_role: ansible.builtin.include_role:
name: cri-o name: cri-o
when: when:
- kubernetes_cri == "cri-o" - kubernetes_cri == "cri-o"
#register: kubernetes_cri_changed # register: kubernetes_cri_changed
#- name: Restart kubelet after kubernetes cri installation # - name: Restart kubelet after kubernetes cri installation
# service: # ansible.builtin.service:
# name: kubelet # name: kubelet
# status: restarted # status: restarted
# when: # when:
# - kubernetes_cri_changed is changed # - kubernetes_cri_changed is changed
- name: Configure NetworkManager for Calico - name: Configure NetworkManager for Calico
copy: ansible.builtin.copy:
src: "etc/NetworkManager/conf.d/calico.conf" src: "etc/NetworkManager/conf.d/calico.conf"
dest: "/etc/NetworkManager/conf.d/calico.conf" dest: "/etc/NetworkManager/conf.d/calico.conf"
group: root group: root
@ -33,14 +33,14 @@
register: kubernetes_network_networkmanager_changed register: kubernetes_network_networkmanager_changed
- name: Restart kubelet after kubernetes cri installation - name: Restart kubelet after kubernetes cri installation
service: ansible.builtin.service:
name: NetworkManager name: NetworkManager
status: reload status: reload
when: when:
- kubernetes_network_networkmanager_changed is changed - kubernetes_network_networkmanager_changed is changed
- name: Configuring IPVS kernel module to be load on boot - name: Configuring IPVS kernel module to be load on boot
template: ansible.builtin.template:
src: "etc/modules-load.d/ipvs.conf.j2" src: "etc/modules-load.d/ipvs.conf.j2"
dest: "/etc/modules-load.d/ipvs.conf" dest: "/etc/modules-load.d/ipvs.conf"
group: root group: root
@ -50,7 +50,7 @@
- kubernetes_kubeproxy_mode == "ipvs" - kubernetes_kubeproxy_mode == "ipvs"
- name: Load IPVS kernel module for EL7 - name: Load IPVS kernel module for EL7
modprobe: community.general.modprobe:
name: "{{ item }}" name: "{{ item }}"
state: present state: present
with_items: with_items:
@ -66,7 +66,7 @@
- ansible_distribution_major_version == '7' - ansible_distribution_major_version == '7'
- name: Load IPVS kernel module for EL8 - name: Load IPVS kernel module for EL8
modprobe: community.general.modprobe:
name: "{{ item }}" name: "{{ item }}"
state: present state: present
with_items: with_items:
@ -81,7 +81,7 @@
- ansible_distribution_major_version == '8' - ansible_distribution_major_version == '8'
- name: Create thin volumes for kubernetes - name: Create thin volumes for kubernetes
lvol: community.general.lvol:
vg: "{{ item.vg }}" vg: "{{ item.vg }}"
lv: "{{ item.name }}" lv: "{{ item.name }}"
thinpool: kubernetes thinpool: kubernetes
@ -93,8 +93,8 @@
when: when:
- kubernetes_master|bool - kubernetes_master|bool
- name: create file system on containerd lv - name: Create file system on containerd lv
filesystem: community.general.filesystem:
fstype: ext4 fstype: ext4
dev: "/dev/{{ item.vg }}/{{ item.name }}" dev: "/dev/{{ item.vg }}/{{ item.name }}"
with_items: with_items:
@ -104,8 +104,8 @@
when: when:
- kubernetes_master|bool - kubernetes_master|bool
- name: mount logical volumes - name: Mount logical volumes
mount: ansible.posix.mount:
name: "{{ item.mount_point }}" name: "{{ item.mount_point }}"
src: "/dev/{{ item.vg }}/{{ item.name }}" src: "/dev/{{ item.vg }}/{{ item.name }}"
fstype: ext4 fstype: ext4
@ -120,14 +120,14 @@
- kubernetes_master|bool - kubernetes_master|bool
- name: Ensuring /var/lib/etcd/lost+found Folder does not exists - name: Ensuring /var/lib/etcd/lost+found Folder does not exists
file: ansible.builtin.file:
path: "/var/lib/etcd/lost+found" path: "/var/lib/etcd/lost+found"
state: "absent" state: "absent"
when: when:
- partition_formated is changed - partition_formated is changed
- name: Secure etcd directory - name: Secure etcd directory
file: ansible.builtin.file:
path: "/var/lib/etcd" path: "/var/lib/etcd"
state: directory state: directory
owner: root owner: root
@ -137,7 +137,7 @@
- kubernetes_master|bool - kubernetes_master|bool
- name: Ensuring /etc/systemd/system/kubelet.service.d Folder Exists - name: Ensuring /etc/systemd/system/kubelet.service.d Folder Exists
file: ansible.builtin.file:
path: "/etc/systemd/system/kubelet.service.d" path: "/etc/systemd/system/kubelet.service.d"
state: "directory" state: "directory"
group: root group: root
@ -147,7 +147,7 @@
- ansible_service_mgr == "systemd" - ansible_service_mgr == "systemd"
- name: Configure kubelet service - name: Configure kubelet service
template: ansible.builtin.template:
src: "etc/{{ item }}.j2" src: "etc/{{ item }}.j2"
dest: "/etc/{{ item }}" dest: "/etc/{{ item }}"
group: root group: root
@ -160,7 +160,7 @@
- ansible_service_mgr == "systemd" - ansible_service_mgr == "systemd"
- name: Configure kubelet service for CRI-O - name: Configure kubelet service for CRI-O
template: ansible.builtin.template:
src: "etc/{{ item }}.j2" src: "etc/{{ item }}.j2"
dest: "/etc/{{ item }}" dest: "/etc/{{ item }}"
group: root group: root
@ -173,7 +173,7 @@
- kubernetes_cri == "cri-o" - kubernetes_cri == "cri-o"
- name: Configure kubelet service - name: Configure kubelet service
template: ansible.builtin.template:
src: "etc/{{ item }}.j2" src: "etc/{{ item }}.j2"
dest: "/etc/{{ item }}" dest: "/etc/{{ item }}"
group: root group: root
@ -185,13 +185,13 @@
- not ansible_service_mgr == "systemd" - not ansible_service_mgr == "systemd"
- name: Enable kubelet on boot - name: Enable kubelet on boot
service: ansible.builtin.service:
name: kubelet name: kubelet
state: started state: started
enabled: yes enabled: true
- name: Audit policies directory - name: Audit policies directory
file: ansible.builtin.file:
path: "/etc/kubernetes/policies" path: "/etc/kubernetes/policies"
state: directory state: directory
owner: root owner: root
@ -205,7 +205,7 @@
# Ou récupération de ces règles pour une utilisation avec falco # Ou récupération de ces règles pour une utilisation avec falco
- name: Configure audit policy - name: Configure audit policy
copy: ansible.builtin.copy:
src: "etc/kubernetes/policies/audit-policy.yaml" src: "etc/kubernetes/policies/audit-policy.yaml"
dest: "/etc/kubernetes/policies/audit-policy.yaml" dest: "/etc/kubernetes/policies/audit-policy.yaml"
group: root group: root
@ -216,39 +216,44 @@
# First controler # First controler
- name: Check if /etc/kubernetes/admin.conf already existe - name: Check if /etc/kubernetes/admin.conf already existe
stat: ansible.builtin.stat:
path: /etc/kubernetes/admin.conf path: /etc/kubernetes/admin.conf
register: st register: st
check_mode: false
changed_when: False changed_when: False
- name: Create KubernetesMasterConfigured group - name: Create KubernetesMasterConfigured group
group_by: ansible.builtin.group_by:
key: KubernetesMasterConfigured_{{ kubernetes_cluster_name }} key: KubernetesMasterConfigured_{{ kubernetes_cluster_name }}
check_mode: false
when: when:
- st.stat.exists - st.stat.exists
- name: Retreive kubeadm Major version - name: Retreive kubeadm Major version
shell: set -o pipefail && kubeadm version | sed 's/.*{Major:"\([0-9]\)".*/\1/' ansible.builtin.shell: set -o pipefail && kubeadm version | sed 's/.*{Major:"\([0-9]\)".*/\1/'
register: kubeadm_version_major register: kubeadm_version_major
check_mode: false
changed_when: False changed_when: False
- name: Retreive kubeadm Minor version - name: Retreive kubeadm Minor version
shell: set -o pipefail && kubeadm version | sed -e 's/.* Minor:"\([0-9]*\)".*/\1/' ansible.builtin.shell: set -o pipefail && kubeadm version | sed -e 's/.* Minor:"\([0-9]*\)".*/\1/'
register: kubeadm_version_minor register: kubeadm_version_minor
check_mode: false
changed_when: False changed_when: False
- name: Defined a default lb_kubemaster - name: Defined a default lb_kubemaster
set_fact: ansible.builtin.set_fact:
lb_kubemaster: "{{ groups['KubernetesMasters_' ~ kubernetes_cluster_name][0] }}" lb_kubemaster: "{{ groups['KubernetesMasters_' ~ kubernetes_cluster_name][0] }}"
when: when:
- lb_kubemaster is undefined - lb_kubemaster is undefined
# - groups['KubernetesMasters'] | length > 1 # - groups['KubernetesMasters'] | length > 1
changed_when: False changed_when: False
check_mode: false
- name: Deploy First controler - name: Deploy First controler
block: block:
- name: Deploy initial kubeadm config - name: Deploy initial kubeadm config
template: ansible.builtin.template:
src: kubeadm-config.yaml.j2 src: kubeadm-config.yaml.j2
dest: /root/kubeadm-config.yaml dest: /root/kubeadm-config.yaml
owner: root owner: root
@ -256,11 +261,12 @@
mode: 0600 mode: 0600
- name: Init Kubernetes on {{ groups['KubernetesMasters_' ~ kubernetes_cluster_name][0] }} - name: Init Kubernetes on {{ groups['KubernetesMasters_' ~ kubernetes_cluster_name][0] }}
command: kubeadm init --config=/root/kubeadm-config.yaml ansible.builtin.command: kubeadm init --config=/root/kubeadm-config.yaml
- name: Add {{ ansible_hostname }} to KubernetesMasterConfigured group - name: Add {{ ansible_hostname }} to KubernetesMasterConfigured group
group_by: ansible.builtin.group_by:
key: KubernetesMasterConfigured_{{ kubernetes_cluster_name }} key: KubernetesMasterConfigured_{{ kubernetes_cluster_name }}
check_mode: false
when: when:
- groups['KubernetesMasterConfigured_' ~ kubernetes_cluster_name] is not defined - groups['KubernetesMasterConfigured_' ~ kubernetes_cluster_name] is not defined
@ -269,14 +275,15 @@
# End of first controler # End of first controler
- name: Test if server node already included - name: Test if server node already included
command: kubectl --kubeconfig=/etc/kubernetes/admin.conf get nodes {{ ansible_hostname | lower }} ansible.builtin.command: kubectl --kubeconfig=/etc/kubernetes/admin.conf get nodes {{ ansible_hostname | lower }}
delegate_to: "{{ lb_kubemaster }}" delegate_to: "{{ lb_kubemaster }}"
register: server_enrolled register: server_enrolled
changed_when: False changed_when: False
ignore_errors: yes ignore_errors: yes
check_mode: false
#- name: Deploy kubeadm config # - name: Deploy kubeadm config
# template: # ansible.builtin.template:
# src: kubeadm-config.yaml.j2 # src: kubeadm-config.yaml.j2
# dest: /root/kubeadm-config.yaml # dest: /root/kubeadm-config.yaml
# owner: root # owner: root
@ -287,22 +294,24 @@
# - server_enrolled.rc == 1 # - server_enrolled.rc == 1
- name: Retreive certificats key on {{ lb_kubemaster }} - name: Retreive certificats key on {{ lb_kubemaster }}
shell: set -o pipefail && kubeadm init phase upload-certs --upload-certs | grep -v upload-certs ansible.builtin.shell: set -o pipefail && kubeadm init phase upload-certs --upload-certs | grep -v upload-certs
register: kubernetes_certificateKey register: kubernetes_certificateKey
check_mode: false
delegate_to: "{{ lb_kubemaster }}" delegate_to: "{{ lb_kubemaster }}"
when: when:
- server_enrolled.rc == 1 - server_enrolled.rc == 1
- kubernetes_master|bool - kubernetes_master|bool
- name: Retreive token on "{{ lb_kubemaster }}" - name: Retreive token on "{{ lb_kubemaster }}"
command: kubeadm token create ansible.builtin.command: kubeadm token create
register: kubetoken register: kubetoken
delegate_to: "{{ lb_kubemaster }}" delegate_to: "{{ lb_kubemaster }}"
check_mode: false
when: when:
- server_enrolled.rc == 1 - server_enrolled.rc == 1
- name: Retreive hash certificat - name: Retreive hash certificat
shell: > ansible.builtin.shell: >
set -o pipefail && set -o pipefail &&
openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt |
openssl rsa -pubin -outform der 2>/dev/null | openssl rsa -pubin -outform der 2>/dev/null |
@ -310,11 +319,12 @@
sed 's/^.* //' sed 's/^.* //'
register: cacerthash register: cacerthash
delegate_to: "{{ lb_kubemaster }}" delegate_to: "{{ lb_kubemaster }}"
check_mode: false
when: when:
- server_enrolled.rc == 1 - server_enrolled.rc == 1
- name: Deploy kubeadm config - name: Deploy kubeadm config
template: ansible.builtin.template:
src: kubeadm-config.yaml.j2 src: kubeadm-config.yaml.j2
dest: /root/kubeadm-config.yaml dest: /root/kubeadm-config.yaml
owner: root owner: root
@ -324,6 +334,6 @@
- server_enrolled.rc == 1 - server_enrolled.rc == 1
- name: Join '{{ ansible_hostname }}' to Kubernetes cluster - name: Join '{{ ansible_hostname }}' to Kubernetes cluster
command: kubeadm join --config=/root/kubeadm-config.yaml ansible.builtin.command: kubeadm join --config=/root/kubeadm-config.yaml
when: when:
- server_enrolled.rc == 1 - server_enrolled.rc == 1

45
tasks/install_server.yml
View file

@ -1,51 +1,53 @@
--- ---
- name: Include vars for not taint Kubernetes masters - name: Include vars for not taint Kubernetes masters
include_vars: masters.yml ansible.builtin.include_vars: masters.yml
when: when:
- kubernetes_master|bool - kubernetes_master|bool
- not kubernetes_master_taint|bool - not kubernetes_master_taint|bool
- name: Add master to KubernetesMasters_ClusterName group - name: Add master to KubernetesMasters_ClusterName group
group_by: ansible.builtin.group_by:
key: KubernetesMasters_{{ kubernetes_cluster_name }} key: KubernetesMasters_{{ kubernetes_cluster_name }}
check_mode: false
when: when:
- "'KubernetesMasters' in group_names" - "'KubernetesMasters' in group_names"
- name: Add node to KubernetesNodes_ClusterName group - name: Add node to KubernetesNodes_ClusterName group
group_by: ansible.builtin.group_by:
key: KubernetesNodes_{{ kubernetes_cluster_name }} key: KubernetesNodes_{{ kubernetes_cluster_name }}
check_mode: false
when: when:
- "'KubernetesNodes' in group_names" - "'KubernetesNodes' in group_names"
- name: Disable SWAP since kubernetes can't work with swap enabled (1/2) - name: Disable SWAP since kubernetes can't work with swap enabled (1/2)
command: swapoff -a ansible.builtin.command: swapoff -a
changed_when: false changed_when: false
- name: Remove swapfile from /etc/fstab (2/2) - name: Remove swapfile from /etc/fstab (2/2)
mount: ansible.posix.mount:
name: swap name: swap
fstype: swap fstype: swap
state: absent state: absent
- name: Create a thin pool for kubernetes - name: Create a thin pool for kubernetes
lvol: community.general.lvol:
vg: vg_sys vg: vg_sys
thinpool: kubernetes thinpool: kubernetes
size: "{{ lv_kubernetes_size | default('20g') }}" size: "{{ lv_kubernetes_size | default('20g') }}"
## Install API loadbalancer ## Install API loadbalancer
#- include_tasks: "load_balancer.yml" # - ansible.builtin.include_tasks: "load_balancer.yml"
# when: # when:
# - kubernetes_master|bool # - kubernetes_master|bool
# - groups['KubernetesMasters'] | length > 1 # - groups['KubernetesMasters'] | length > 1
- name: Kubernetes cluster with kubeadm - name: Kubernetes cluster with kubeadm
include_tasks: "cluster_kubeadm.yml" ansible.builtin.include_tasks: "cluster_kubeadm.yml"
when: when:
- kubernetes_cri != "k3s" - kubernetes_cri != "k3s"
- name: Kubernetes cluster with k3s - name: Kubernetes cluster with k3s
include_tasks: "cluster_k3s.yml" ansible.builtin.include_tasks: "cluster_k3s.yml"
when: when:
- kubernetes_cri == "k3s" - kubernetes_cri == "k3s"
@ -54,7 +56,7 @@
# #
- name: Make /root/.kube directory - name: Make /root/.kube directory
file: ansible.builtin.file:
path: "/root/.kube" path: "/root/.kube"
owner: root owner: root
group: root group: root
@ -64,10 +66,10 @@
- kubernetes_master|bool - kubernetes_master|bool
- name: Copy kubeconfig file from /etc/kubernetes/admin.conf - name: Copy kubeconfig file from /etc/kubernetes/admin.conf
copy: ansible.builtin.copy:
src: "/etc/kubernetes/admin.conf" src: "/etc/kubernetes/admin.conf"
dest: /root/.kube/config dest: /root/.kube/config
remote_src: yes remote_src: true
owner: root owner: root
group: root group: root
mode: 0600 mode: 0600
@ -76,10 +78,10 @@
- kubernetes_cri != "k3s" - kubernetes_cri != "k3s"
- name: Copy kubeconfig file from /etc/rancher/k3s/k3s.yaml - name: Copy kubeconfig file from /etc/rancher/k3s/k3s.yaml
copy: ansible.builtin.copy:
src: "/etc/rancher/k3s/k3s.yaml" src: "/etc/rancher/k3s/k3s.yaml"
dest: /root/.kube/config dest: /root/.kube/config
remote_src: yes remote_src: true
owner: root owner: root
group: root group: root
mode: 0600 mode: 0600
@ -91,24 +93,23 @@
# Manque autoconfig de .kube/config local # Manque autoconfig de .kube/config local
# #
#- name: Fetching CA certificat # - name: Fetching CA certificat
# copy: # ansible.builtin.copy:
# src: /etc/kubernetes/pki/ca.crt # src: /etc/kubernetes/pki/ca.crt
# dest: /root/.kube/{{ kubernetes_cluster_name }}/ca.crt # dest: /root/.kube/{{ kubernetes_cluster_name }}/ca.crt
# when: # when:
# - kubernetes_master|bigip_pool # - kubernetes_master|bigip_pool
- name: Check if a node is still tainted - name: Check if a node is still tainted
command: kubectl --kubeconfig=/etc/kubernetes/admin.conf get nodes '{{ ansible_hostname | lower }}' -o jsonpath='{.spec.taints}' ansible.builtin.command: kubectl --kubeconfig=/etc/kubernetes/admin.conf get nodes '{{ ansible_hostname | lower }}' -o jsonpath='{.spec.taints}'
register: current_taint register: current_taint
check_mode: no check_mode: false
when: when:
- kubernetes_master_taint|bool - kubernetes_master_taint|bool
- name: taint the machine if needed - name: Taint the machine if needed
# command: kubectl --kubeconfig=/etc/kubernetes/admin.conf taint nodes --all node-role.kubernetes.io/master- # ansible.builtin.command: kubectl --kubeconfig=/etc/kubernetes/admin.conf taint nodes --all node-role.kubernetes.io/master-
command: kubectl --kubeconfig=/etc/kubernetes/admin.conf taint nodes '{{ ansible_hostname | lower }}' node-role.kubernetes.io/master- ansible.builtin.command: kubectl --kubeconfig=/etc/kubernetes/admin.conf taint nodes '{{ ansible_hostname | lower }}' node-role.kubernetes.io/master-
when: when:
- kubernetes_master_taint|bool - kubernetes_master_taint|bool
- current_taint.stdout - current_taint.stdout

12
tasks/load_balancer.yml
View file

@ -1,21 +1,21 @@
--- ---
- name: Install needed packages - name: Install needed packages
package: ansible.builtin.package:
name: name:
- keepalived - keepalived
- curl - curl
state: present state: present
update_cache: yes update_cache: true
notify: Restart keepalived notify: Restart keepalived
- name: Install check_apiserver.sh script for keepalived - name: Install check_apiserver.sh script for keepalived
template: ansible.builtin.template:
src: etc/keepalived/check_apiserver.sh.j2 src: etc/keepalived/check_apiserver.sh.j2
dest: /etc/keepalived/check_apiserver.sh dest: /etc/keepalived/check_apiserver.sh
owner: root owner: root
group: root group: root
mode: 0755 mode: 0755
- name: Install keepalived config file - name: Install keepalived config file
template: ansible.builtin.template:
src: etc/keepalived/keepalived.conf.j2 src: etc/keepalived/keepalived.conf.j2
dest: /etc/keepalived/keepalived.conf dest: /etc/keepalived/keepalived.conf
owner: root owner: root
@ -27,7 +27,7 @@
- groups['KubernetesMasters'][0] == ansible_hostname - groups['KubernetesMasters'][0] == ansible_hostname
notify: Restart keepalived notify: Restart keepalived
- name: Install keepalived config file - name: Install keepalived config file
template: ansible.builtin.template:
src: etc/keepalived/keepalived.conf.j2 src: etc/keepalived/keepalived.conf.j2
dest: /etc/keepalived/keepalived.conf dest: /etc/keepalived/keepalived.conf
owner: root owner: root
@ -40,4 +40,4 @@
notify: Restart keepalived notify: Restart keepalived
- name: Flush handlers - name: Flush handlers
meta: flush_handlers ansible.builtin.meta: flush_handlers

26
tasks/main.yml
View file

@ -4,58 +4,62 @@
- kubernetes - kubernetes
block: block:
- name: Include vars for {{ ansible_os_family }} - name: Include vars for {{ ansible_os_family }}
include_vars: "{{ ansible_os_family }}.yml" ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
- name: Define vars for master - name: Define vars for master
set_fact: ansible.builtin.set_fact:
kubernetes_server: true kubernetes_server: true
kubernetes_master: true kubernetes_master: true
kubernetes_master_taint: false kubernetes_master_taint: false
check_mode: false
when: when:
- "'KubernetesMasters' in group_names" - "'KubernetesMasters' in group_names"
- "'KubernetesNodes' not in group_names" - "'KubernetesNodes' not in group_names"
- name: Define vars for node - name: Define vars for node
set_fact: ansible.builtin.set_fact:
kubernetes_server: true kubernetes_server: true
kubernetes_master: false kubernetes_master: false
kubernetes_master_taint: false kubernetes_master_taint: false
check_mode: false
when: when:
- "'KubernetesNodes' in group_names" - "'KubernetesNodes' in group_names"
- "'KubernetesMasters' not in group_names" - "'KubernetesMasters' not in group_names"
- name: Define vars for taint master - name: Define vars for taint master
set_fact: ansible.builtin.set_fact:
kubernetes_server: true kubernetes_server: true
kubernetes_master: true kubernetes_master: true
kubernetes_master_taint: true kubernetes_master_taint: true
check_mode: false
when: when:
- "'KubernetesNodes' in group_names" - "'KubernetesNodes' in group_names"
- "'KubernetesMasters' in group_names" - "'KubernetesMasters' in group_names"
- name: Define vars for tooling - name: Define vars for tooling
set_fact: ansible.builtin.set_fact:
kubernetes_sever: false kubernetes_sever: false
check_mode: false
when: when:
- "'KubernetesMasters' not in group_names" - "'KubernetesMasters' not in group_names"
- "'KubernetesNodes' not in group_names" - "'KubernetesNodes' not in group_names"
- name: Install kubernetes rules for {{ ansible_os_family }} OS family - name: Install kubernetes rules for {{ ansible_os_family }} OS family
include_tasks: "{{ ansible_os_family }}.yml" ansible.builtin.include_tasks: "{{ ansible_os_family }}.yml"
#- name: Install kubernetes tools # - name: Install kubernetes tools
# package: # ansible.builtin.package:
# name: "{{ kubernetes_package_name }}" # name: "{{ kubernetes_package_name }}"
# state: present # state: present
# update_cache: yes # update_cache: true
## notify: Restart kubelet ## notify: Restart kubelet
# when: # when:
# - (not kubernetes_server|bool) or ( kubernetes_server|bool and kubernetes_cri != "k3s") # - (not kubernetes_server|bool) or ( kubernetes_server|bool and kubernetes_cri != "k3s")
- name: Include kubernetes server rules - name: Include kubernetes server rules
include_tasks: "install_server.yml" ansible.builtin.include_tasks: "install_server.yml"
when: when:
- kubernetes_server|bool - kubernetes_server|bool
#- name: Install python library for docker # - name: Install python library for docker
# package: name="{{ python_openshift_lib }}" state=latest update_cache=yes # package: name="{{ python_openshift_lib }}" state=latest update_cache=yes