Initial commit
This commit is contained in:
@@ -0,0 +1,154 @@
|
||||
- name: Primary Master Initialisation
|
||||
hosts: masters[0]
|
||||
tasks:
|
||||
- name: Initialise high-availability Kubernetes cluster
|
||||
ansible.builtin.command: >-
|
||||
kubeadm init
|
||||
--pod-network-cidr="172.16.0.0/16"
|
||||
--control-plane-endpoint="{{ ansible_default_ipv4.address }}:6443"
|
||||
--upload-certs
|
||||
args:
|
||||
creates: /etc/kubernetes/admin.conf
|
||||
- name: Copy Kubernetes Admin Config
|
||||
ansible.builtin.command: "{{ item }}"
|
||||
loop:
|
||||
- mkdir -p $HOME/.kube
|
||||
- cp /etc/kubernetes/admin.conf $HOME/.kube/config
|
||||
- chown $(id -u):$(id -g) $HOME/.kube/config
|
||||
args:
|
||||
creates: $HOME/.kube/config
|
||||
|
||||
- name: Install Pod Network (Calico)
|
||||
ansible.builtin.shell: kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico.yaml > pod_network_setup.txt
|
||||
args:
|
||||
chdir: $HOME
|
||||
creates: pod_network_setup.txt
|
||||
|
||||
- name: Add Helm repositories
|
||||
kubernetes.core.helm_repository:
|
||||
name: "{{ item.name }}"
|
||||
repo_url: "{{ item.url }}"
|
||||
loop:
|
||||
- name: metrics-server
|
||||
url: https://kubernetes-sigs.github.io/metrics-server/
|
||||
- name: prometheus-community
|
||||
url: https://prometheus-community.github.io/helm-charts
|
||||
- name: longhorn
|
||||
url: https://charts.longhorn.io
|
||||
- name: traefik
|
||||
url: https://traefik.github.io/charts
|
||||
- name: minecraft-server-charts
|
||||
url: https://itzg.github.io/minecraft-server-charts/
|
||||
|
||||
- name: Install Metrics Server
|
||||
kubernetes.core.helm:
|
||||
release_name: metrics-server
|
||||
release_namespace: kube-system
|
||||
chart_ref: metrics-server/metrics-server
|
||||
chart_version: 3.13.0
|
||||
values:
|
||||
args:
|
||||
- --kubelet-insecure-tls
|
||||
|
||||
- name: Install Longhorn
|
||||
kubernetes.core.helm:
|
||||
release_name: longhorn
|
||||
release_namespace: longhorn-system
|
||||
create_namespace: true
|
||||
chart_ref: longhorn/longhorn
|
||||
chart_version: 1.12.0
|
||||
|
||||
- name: Install Prometheus
|
||||
kubernetes.core.helm:
|
||||
release_name: prometheus
|
||||
release_namespace: monitoring
|
||||
create_namespace: true
|
||||
chart_ref: prometheus-community/prometheus
|
||||
chart_version: 29.10.0
|
||||
state: absent
|
||||
|
||||
- name: Install Traefik
|
||||
kubernetes.core.helm:
|
||||
release_name: traefik
|
||||
release_namespace: default
|
||||
create_namespace: true
|
||||
chart_ref: traefik/traefik
|
||||
chart_version: 40.2.0
|
||||
values:
|
||||
deployment:
|
||||
kind: DaemonSet
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
add: [NET_BIND_SERVICE]
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
ports:
|
||||
web:
|
||||
port: 80
|
||||
containerPort: 80
|
||||
hostPort: 80
|
||||
websecure:
|
||||
port: 443
|
||||
containerPort: 443
|
||||
hostPort: 443
|
||||
|
||||
- name: Install Minecraft
|
||||
kubernetes.core.helm:
|
||||
release_name: minecraft
|
||||
release_namespace: default
|
||||
chart_ref: minecraft-server-charts/minecraft
|
||||
chart_version: 5.1.3
|
||||
values:
|
||||
minecraftServer:
|
||||
eula: true
|
||||
persistence:
|
||||
dataDir:
|
||||
enabled: true
|
||||
|
||||
- name: Extract Control Plane Decryption Key & Join Token
|
||||
block:
|
||||
- name: Generate Fresh Join Command
|
||||
ansible.builtin.command: kubeadm token create --print-join-command
|
||||
register: join_command_raw
|
||||
|
||||
- name: Upload Certs and Capture Certificate Key
|
||||
shell: kubeadm init phase upload-certs --upload-certs | tail -n 1
|
||||
register: cert_key_raw
|
||||
|
||||
- name: Set facts across playbooks
|
||||
ansible.builtin.set_fact:
|
||||
k8s_join_base: "{{ join_command_raw.stdout }}"
|
||||
k8s_cert_key: "{{ cert_key_raw.stdout }}"
|
||||
delegate_to: localhost
|
||||
delegate_facts: true
|
||||
|
||||
|
||||
- name: Join Secondary Control Planes
|
||||
hosts: masters:!masters[0] # <--- Targets masters 1 and 2
|
||||
tasks:
|
||||
- name: Join Cluster as Control Plane Node
|
||||
ansible.builtin.shell: "{{ hostvars['localhost']['k8s_join_base'] }} --control-plane --certificate-key {{ hostvars['localhost']['k8s_cert_key'] }}"
|
||||
args:
|
||||
creates: /etc/kubernetes/admin.conf
|
||||
|
||||
- name: Copy Kubernetes Admin Config
|
||||
ansible.builtin.shell: "{{ item }}"
|
||||
loop:
|
||||
- mkdir -p $HOME/.kube
|
||||
- cp /etc/kubernetes/admin.conf $HOME/.kube/config
|
||||
- chown $(id -u):$(id -g) $HOME/.kube/config
|
||||
args:
|
||||
creates: $HOME/.kube/config
|
||||
|
||||
- name: Remove control plane taint
|
||||
hosts: masters[0]
|
||||
tasks:
|
||||
- name: Remove control plane NoSchedule taint from all nodes
|
||||
kubernetes.core.k8s_taint:
|
||||
state: absent
|
||||
name: "{{ item }}"
|
||||
taints:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
effect: NoSchedule
|
||||
loop: "{{ groups['masters'] }}"
|
||||
@@ -0,0 +1,87 @@
|
||||
- name: Initialise Master and Worker Nodes
|
||||
hosts: all
|
||||
tasks:
|
||||
- name: Enable IPv4 forwarding
|
||||
ansible.posix.sysctl:
|
||||
name: net.ipv4.ip_forward
|
||||
value: 1
|
||||
sysctl_set: true
|
||||
|
||||
- name: Enable Kernel Modules
|
||||
community.general.modprobe:
|
||||
name: "{{ item }}"
|
||||
persistent: present
|
||||
loop:
|
||||
- br_netfilter
|
||||
- dm-crypt
|
||||
|
||||
- name: Ensure /sys mount is set to shared for container runtimes
|
||||
block:
|
||||
- name: Remount /sys as shared immediately
|
||||
ansible.builtin.command: mount --make-rshared {{ item }}
|
||||
loop:
|
||||
- /
|
||||
- /sys
|
||||
- /run
|
||||
changed_when: false
|
||||
|
||||
- name: Create Alpine local.d script for permanent shared mount
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/local.d/mount-shared.start
|
||||
content: |
|
||||
#!/bin/sh
|
||||
mount --make-rshared /
|
||||
mount --make-rshared /sys
|
||||
mount --make-rshared /run
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: Ensure Alpine local service is enabled on boot
|
||||
ansible.builtin.service:
|
||||
name: local
|
||||
enabled: true
|
||||
runlevel: default
|
||||
|
||||
- name: Install tools
|
||||
ansible.builtin.package:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
loop:
|
||||
- htop
|
||||
|
||||
- name: Install kubectl, kubelet, kubeadm and containerd
|
||||
ansible.builtin.package:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
loop:
|
||||
- kubectl
|
||||
- kubeadm
|
||||
- kubelet
|
||||
- containerd
|
||||
- cni-plugins
|
||||
- helm
|
||||
- open-iscsi
|
||||
|
||||
- name: Start kubelet and containerd
|
||||
ansible.builtin.service:
|
||||
name: "{{ item }}"
|
||||
enabled: true
|
||||
state: started
|
||||
loop:
|
||||
- kubelet
|
||||
- containerd
|
||||
- iscsid
|
||||
|
||||
- name: Add /opt/cni/bin to containerd CNI binary directories
|
||||
ansible.builtin.replace:
|
||||
path: /etc/containerd/config.toml
|
||||
regexp: "bin_dirs = \\['/usr/libexec/cni'\\]"
|
||||
replace: "bin_dirs = ['/opt/cni/bin', '/usr/libexec/cni']"
|
||||
notify: Restart containerd
|
||||
|
||||
handlers:
|
||||
- name: Restart containerd
|
||||
ansible.builtin.service:
|
||||
name: containerd
|
||||
state: restarted
|
||||
@@ -0,0 +1,24 @@
|
||||
- name: Extract Worker Join Token from Primary Master
|
||||
hosts: masters[0] # <--- Targets only the first master safely
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Generate worker join command
|
||||
ansible.builtin.command: kubeadm token create --print-join-command
|
||||
register: join_command_raw
|
||||
changed_when: false # Reading/generating a token text string changes no host state
|
||||
|
||||
- name: Save join command globally
|
||||
ansible.builtin.set_fact:
|
||||
k8s_worker_join: "{{ join_command_raw.stdout }}"
|
||||
delegate_to: localhost
|
||||
delegate_facts: true
|
||||
|
||||
- name: Join Worker Nodes to Cluster
|
||||
hosts: workers
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Join cluster
|
||||
ansible.builtin.shell: "{{ hostvars['localhost']['k8s_worker_join'] }} >> node_joined.txt"
|
||||
args:
|
||||
chdir: $HOME
|
||||
creates: node_joined.txt
|
||||
Reference in New Issue
Block a user