feat: add traefik role

Justfile

@@ -20,11 +20,12 @@ tofu-destroy-instances:
     tofu -chdir={{ opentofu_dir }} apply -auto-approve -destroy -target=module.master -target=module.worker
 
 ansible-run-playbook:
-    ansible-playbook -i ansible/inventories/incus/incus.yaml -c community.general.incus ansible/playbooks/provision.yaml -e ansible_user=root
+    ansible-playbook -i ansible/inventories/incus/incus.yaml -c community.general.incus ansible/playbooks/provisioning.yaml -e ansible_user=root
     ansible-playbook -i ansible/inventories/incus/incus.yaml -c community.general.incus ansible/site.yaml
 
-get-admin-conf:
+headlamp:
-    incus exec master-0 -- cat /etc/kubernetes/admin.conf > k8s-admin.conf
+    incus exec master-0 -- cat /etc/kubernetes/admin.conf > .incus-admin.conf
+    flatpak run io.kinvolk.Headlamp --kubeconfig "$(pwd)/.incus-admin.conf"
 
 clean: tofu-destroy
     git clean -fdx

ansible/inventories/bare_metal/group_vars/all.yaml

@@ -3,3 +3,7 @@ ansible_become_exe: sudo.ws
 ansible_user: kolibri
 vip_interface: eno1
 vip_address: 10.0.0.200
+cluster_pod_subnet: 172.16.0.0/16
+cluster_service_subnet: 10.96.0.0/16
+lb_pool_start: 10.0.0.210
+lb_pool_stop: 10.0.0.220

ansible/inventories/incus/group_vars/all.yaml

@@ -2,3 +2,7 @@ ansible_python_interpreter: /usr/bin/python3
 ansible_user: kolibri
 vip_interface: enp5s0
 vip_address: 10.150.0.100
+cluster_pod_subnet: 172.16.0.0/16
+cluster_service_subnet: 10.96.0.0/16
+lb_pool_start: 10.150.0.210
+lb_pool_stop: 10.150.0.220

ansible/playbooks/reset.yaml

@@ -6,3 +6,8 @@
       ansible.builtin.command: kubeadm reset -f
       args:
         removes: /etc/kubernetes/*.conf
+
+    - name: Clear CNI configuration
+      ansible.builtin.file:
+        path: /etc/cni/net.d
+        state: absent

ansible/roles/kubernetes_cilium/defaults/main.yaml

@@ -0,0 +1,14 @@
+cilium_chart_version: 1.19.5
+
+cilium_values:
+  ipam:
+    operator:
+      clusterPoolIPv4PodCIDRList:
+        - "{{ cluster_pod_subnet }}"
+  hubble:
+    relay:
+      enabled: true
+    ui:
+      enabled: true
+  l2announcements:
+    enabled: true

ansible/roles/kubernetes_cilium/tasks/main.yaml

@@ -0,0 +1,27 @@
+- name: Ensure Cilium repository exists
+  kubernetes.core.helm_repository:
+    name: cilium
+    url: https://helm.cilium.io/
+
+- name: Ensure Cilium is installed
+  kubernetes.core.helm:
+    release_name: cilium
+    release_namespace: kube-system
+    chart_ref: cilium/cilium
+    chart_version: "{{ cilium_chart_version }}"
+    values: "{{ cilium_values }}"
+  run_once: true
+
+- name: Ensure LoadBalancer IP pool exists
+  kubernetes.core.k8s:
+    state: present
+    definition:
+      apiVersion: cilium.io/v2
+      kind: CiliumLoadBalancerIPPool
+      metadata:
+        name: homelab-pool
+      spec:
+        blocks:
+          - start: "{{ lb_pool_start }}"
+            stop: "{{ lb_pool_stop }}"
+  run_once: true

ansible/roles/kubernetes_common/tasks/packages.yaml

@@ -4,5 +4,6 @@
       - kubeadm
       - kubelet
       - containerd
-      - open-iscsi
+      - kubectl
+      - helm
     update_cache: true

ansible/roles/kubernetes_common/tasks/repo.yaml

@@ -6,3 +6,13 @@
     suites: /
     signed_by: https://pkgs.k8s.io/core:/stable:/v1.36/deb/Release.key
     state: present
+
+- name: Add Helm APT repository
+  ansible.builtin.deb822_repository:
+    name: helm
+    types: deb
+    uris: https://packages.buildkite.com/helm-linux/helm-debian/any/
+    suites: any
+    components: main
+    signed_by: https://packages.buildkite.com/helm-linux/helm-debian/gpgkey
+    state: present

ansible/roles/kubernetes_control_plane/tasks/cilium.yaml

@@ -1,12 +0,0 @@
-- name: Ensure Cilium repository exists
-  kubernetes.core.helm_repository:
-    name: cilium
-    url: https://helm.cilium.io/
-
-- name: Ensure Cilium is installed
-  kubernetes.core.helm:
-    release_name: cilium
-    release_namespace: kube-system
-    chart_ref: cilium/cilium
-    chart_version: 1.19.5
-  run_once: true

ansible/roles/kubernetes_control_plane/tasks/copy-config.yaml

@@ -1,4 +1,5 @@
-- name: Copy Kubernetes Admin configuration
+- name: Setup Kubernetes admin config for root user
+  become: true
   block:
     - name: Ensure .kube directory
       ansible.builtin.file:
@@ -7,7 +8,7 @@
         owner: "{{ ansible_facts['user_id'] }}"
         group: "{{ ansible_facts['user_id'] }}"
         mode: "0755"
-    - name: Copy Admin configuration
+    - name: Copy admin configuration
       ansible.builtin.copy:
         src: /etc/kubernetes/admin.conf
         dest: "{{ ansible_facts['env']['HOME'] }}/.kube/config"

ansible/roles/kubernetes_control_plane/tasks/init-cluster.yaml

@@ -0,0 +1,21 @@
+- name: Check if cluster is initialised
+  ansible.builtin.stat:
+    path: /etc/kubernetes/admin.conf
+  register: kubernetes_control_plane_admin_conf
+  run_once: true
+
+- name: Initialise Kubernetes cluster
+  when: not kubernetes_control_plane_admin_conf.stat.exists
+  block:
+    - name: Copy kubeadm config
+      ansible.builtin.template:
+        src: kubeadm-config.yaml.j2
+        dest: /tmp/kubeadm-config.yaml
+        mode: "0600"
+      run_once: true
+
+    - name: Initialise Kubernetes with kubeadm
+      ansible.builtin.command: kubeadm init --config /tmp/kubeadm-config.yaml
+      args:
+        creates: /etc/kubernetes/admin.conf
+      run_once: true

ansible/roles/kubernetes_control_plane/tasks/join-cluster.yaml

@@ -0,0 +1,20 @@
+- name: Generate join command
+  ansible.builtin.command: kubeadm token create --print-join-command --kubeconfig /etc/kubernetes/admin.conf
+  register: kubernetes_control_plane_join_command
+  run_once: true
+  changed_when: false
+
+- name: Get certificate key
+  ansible.builtin.command: kubeadm init phase upload-certs --upload-certs --kubeconfig /etc/kubernetes/admin.conf
+  register: kubernetes_control_plane_certificate_key
+  run_once: true
+  changed_when: false
+
+- name: Join additional control planes
+  ansible.builtin.command: >-
+    {{ kubernetes_control_plane_join_command.stdout }}
+    --control-plane
+    --certificate-key
+    {{ kubernetes_control_plane_certificate_key.stdout_lines[-1] }}
+  args:
+    creates: /etc/kubernetes/admin.conf

ansible/roles/kubernetes_control_plane/tasks/kube-vip.yaml

@@ -1,4 +1,4 @@
-- name: Ensure kube-vip static pod
+- name: Ensure kube-vip static pod manifest exists
   ansible.builtin.template:
     src: kube-vip.yaml.j2
     dest: /etc/kubernetes/manifests/kube-vip.yaml

ansible/roles/kubernetes_control_plane/tasks/main.yaml

@@ -1,63 +1,14 @@
-- name: Install kube-vip static pod
+- name: Configure kube-vip static pod manifest
   ansible.builtin.import_tasks: kube-vip.yaml
 
-- name: Copy kubeadm config
-  ansible.builtin.template:
-    src: kubeadm-config.yaml.j2
-    dest: /tmp/kubeadm-config.yaml
-    mode: "0600"
-
 - name: Initialise Kubernetes cluster
-  ansible.builtin.command: kubeadm init --config /tmp/kubeadm-config.yaml
+  ansible.builtin.include_tasks: init-cluster.yaml
-  args:
-    creates: /etc/kubernetes/admin.conf
-  run_once: true
 
+- name: Join nodes as control planes
+  ansible.builtin.include_tasks: join-cluster.yaml
 
-- name: Copy Kubernetes Admin Configuration
+- name: Copy Kubernetes admin configuration on all nodes
-  ansible.builtin.include_tasks: copy-config.yaml
-  run_once: true
-
-
-- name: Generate Join Command
-  ansible.builtin.command: kubeadm token create --print-join-command
-  register: kubernetes_control_plane_join_command
-  run_once: true
-  changed_when: true
-
-
-- name: Get Certificate Key
-  ansible.builtin.shell: set -o pipefail && kubeadm init phase upload-certs --upload-certs | tail -n 1
-  register: kubernetes_control_plane_certificate_key
-  run_once: true
-  changed_when: true
-
-
-- name: Join Additional Control Planes
-  ansible.builtin.command: >-
-    {{ kubernetes_control_plane_join_command.stdout }}
-    --control-plane
-    --certificate-key
-    {{ kubernetes_control_plane_certificate_key.stdout }}
-  args:
-    creates: /etc/kubernetes/admin.conf
-
-
-- name: Copy Kubernetes Admin Configuration
   ansible.builtin.include_tasks: copy-config.yaml
 
-
+- name: Remove control plane scheduling restrictions
-- name: Untaint control planes
+  ansible.builtin.include_tasks: untaint.yaml
-  ansible.builtin.import_tasks: untaint.yaml
-
-
-- name: Install Tools
-  ansible.builtin.import_tasks: tools.yaml
-
-
-- name: Install Cilium CNI
-  ansible.builtin.import_tasks: cilium.yaml
-
-
-# - name: Install Longhorn CSI
-#   ansible.builtin.import_tasks: longhorn.yaml

ansible/roles/kubernetes_control_plane/tasks/tools.yaml

@@ -1,18 +0,0 @@
-- name: Add Helm APT repository
-  ansible.builtin.deb822_repository:
-    name: helm
-    types: deb
-    uris: https://packages.buildkite.com/helm-linux/helm-debian/any/
-    suites: any
-    components: main
-    signed_by: https://packages.buildkite.com/helm-linux/helm-debian/gpgkey
-    state: present
-
-
-- name: Install Kubernetes Tools
-  ansible.builtin.apt:
-    pkg:
-      - kubectl
-      - helm
-    state: present
-    update_cache: true

ansible/roles/kubernetes_control_plane/tasks/untaint.yaml

@@ -1,7 +1,7 @@
-- name: Remove control plane NoSchedule taint from all nodes
+- name: Remove control plane NoSchedule taint
   kubernetes.core.k8s_taint:
     state: absent
-    name: "{{ inventory_hostname_short }}"
+    name: "{{ ansible_facts['hostname'] }}"
     taints:
       - key: node-role.kubernetes.io/control-plane
         effect: NoSchedule

ansible/roles/kubernetes_control_plane/templates/kubeadm-config.yaml.j2

@@ -6,10 +6,13 @@ apiVersion: kubeadm.k8s.io/v1beta4
 kind: ClusterConfiguration
 clusterName: aeon
 controlPlaneEndpoint: "{{ vip_address }}"
+networking:
+  podSubnet: "{{ cluster_pod_subnet }}"
+  serviceSubnet: "{{ cluster_service_subnet }}"
 ---
 apiVersion: kubelet.config.k8s.io/v1beta1
 kind: KubeletConfiguration
 cgroupDriver: systemd
 failSwapOn: false
 memorySwap:
-  swapBehaviour: LimitedSwap
+  swapBehavior: LimitedSwap

ansible/roles/kubernetes_longhorn/tasks/main.yaml

@@ -1,3 +1,8 @@
+- name: Ensure open-iscsi is installed
+  ansible.builtin.apt:
+    pkg: open-iscsi
+    state: present
+
 - name: Ensure Longhorn repository exists
   kubernetes.core.helm_repository:
     name: longhorn

ansible/roles/kubernetes_traefik/defaults/main.yaml

@@ -0,0 +1,12 @@
+traefik_chart_version: 41.0.1
+
+traefik_values:
+  providers:
+    kubernetesGateway:
+      enabled: true
+  gateway:
+    enabled: true
+    listeners:
+      web:
+        port: 8000
+        protocol: HTTP

ansible/roles/kubernetes_traefik/tasks/main.yaml

@@ -0,0 +1,20 @@
+- name: Install Gateway API CRDs
+  kubernetes.core.k8s:
+    src: https://github.com/kubernetes-sigs/gateway-api/releases/latest/download/standard-install.yaml
+    state: present
+  run_once: true
+
+- name: Ensure Traefik repository exists
+  kubernetes.core.helm_repository:
+    name: traefik
+    url: https://traefik.github.io/charts
+
+- name: Ensure Traefik is installed
+  kubernetes.core.helm:
+    release_name: traefik
+    release_namespace: traefik
+    chart_ref: traefik/traefik
+    chart_version: "{{ traefik_chart_version }}"
+    create_namespace: true
+    values: "{{ traefik_values }}"
+  run_once: true

ansible/site.yaml

@@ -14,7 +14,10 @@
   become: true
   roles:
     - kubernetes_control_plane
-    - kubernetes_metric_server
+    - kubernetes_cilium
+    - kubernetes_metrics_server
+    - kubernetes_longhorn
+    - kubernetes_traefik
 
 # # =======================
 # # JOIN MASTERS TO CLUSTER