fix: use import instead of include

.gitignore

@@ -3,8 +3,10 @@
 terraform.tfstate
 terraform.tfstate.backup
 ansible/lookup_plugins
+ansible/galaxy_roles
 
 !.gitignore
 !.editorconfig
 !.vscode
 !.pre-commit-config.yaml
+!.yamlfmt.yaml

.yamlfmt.yaml

@@ -0,0 +1,5 @@
+formatter:
+  indent: 2
+  retain_line_breaks_single: true
+  scan_folded_as_literal: true
+  indentless_arrays: false

Justfile

@@ -4,31 +4,36 @@ opentofu_dir := "infra/"
 ansible_proton_pass_plugin_ref := "4bd0741c347646060ec59c73f8adf7ed8e706cf3"
 ansible_proton_pass_plugin_url := "https://raw.githubusercontent.com/protonpass/proton-pass-ansible-integration/" + ansible_proton_pass_plugin_ref + "/lookup_plugins/proton_pass.py"
 
+init: tofu-init fetch-ansible-deps fetch-ansible-plugins
 up: tofu-apply ansible-run-playbook
-down: tofu-destroy-instances
+down: tofu-destroy
 
 tofu-init:
     tofu -chdir={{ opentofu_dir }} init -upgrade
 
-tofu-apply: tofu-init
+tofu-apply:
     tofu -chdir={{ opentofu_dir }} apply -auto-approve
 
-tofu-destroy: tofu-init
+tofu-destroy:
     tofu -chdir={{ opentofu_dir }} apply -auto-approve -destroy
 
 tofu-destroy-instances:
     tofu -chdir={{ opentofu_dir }} apply -auto-approve -destroy -target=module.master -target=module.worker
 
 ansible-run-playbook:
-    ansible-playbook -i ansible/inventories/incus/incus.yaml -c community.general.incus ansible/playbooks/provision.yaml -e ansible_user=root
+    ansible-playbook -i ansible/inventories/incus/incus.yaml -c community.general.incus ansible/playbooks/provisioning.yaml -e ansible_user=root
     ansible-playbook -i ansible/inventories/incus/incus.yaml -c community.general.incus ansible/site.yaml
 
-get-admin-conf:
-    incus exec master-0 -- cat /etc/kubernetes/admin.conf > k8s-admin.conf
+headlamp:
+    incus exec master-0 -- cat /etc/kubernetes/admin.conf > .incus-admin.conf
+    flatpak run io.kinvolk.Headlamp --kubeconfig "$(pwd)/.incus-admin.conf"
 
 clean: tofu-destroy
     git clean -fdx
 
-fetch-plugins:
+fetch-ansible-deps:
+    ansible-galaxy install --role-file ansible/requirements.yml --roles-path ansible/galaxy_roles
+
+fetch-ansible-plugins:
     mkdir -p ansible/lookup_plugins
     curl -fsSL -o ansible/lookup_plugins/proton_pass.py {{ ansible_proton_pass_plugin_url }}

README.md

@@ -1,5 +1,39 @@
 # Home Infrastructure
 
+An Ansible + OpenTofu project for installing a minimal Kubernetes installation
+to bare-metal and virtual machines.
+
+## Quick Start
+
+Get started with a local Kubernetes cluster which can be used to design and test
+new configuration before pushing them to real machines.
+
+1. Login with Proton Pass and start the SSH daemon.
+
+    ```shell
+    pass-cli login
+    pass-cli ssh-agent daemon start
+    export SSH_AUTH_SOCK="$HOME/.ssh/proton-pass-agent.sock"
+    ```
+
+2. Install the Proton Pass plugin for Ansible
+
+    ```shell
+    just fetch-plugins
+    ```
+
+3. Launch Incus virtual machines
+
+    ```shell
+    just up
+    ```
+
+4. Tear down the Incus virtual machines
+
+    ```shell
+    just down
+    ```
+
 ## Setup
 
 ```shell
@@ -15,3 +49,19 @@ The Kolibri automation user is used for all other playbooks and has permissions
 ```shell
 ansible-playbook -i ansible/inventories/bare_metal/hosts.yaml ansible/playbooks/provision.yaml -K -e ansible_user=<your_interactive_user>
 ```
+
+## Local Testing with Incus
+
+```shell
+just up
+```
+
+```shell
+just headlamp
+```
+
+> The above command runs the Flatpak version of Headlamp which may not have permissions
+> to access the Kubernetes config file copied from the instance.
+>
+> You should run `flatpak override --user --filesystem=$(pwd) io.kinvolk.Headlamp`
+> to ensure that Headlamp can access the directory contents.

ansible.cfg

@@ -1,3 +1,4 @@
 [defaults]
+roles_path = ansible/roles:ansible/galaxy_roles
 lookup_plugins = ansible/lookup_plugins
 callback_result_format = yaml

ansible/inventories/bare_metal/hosts.yaml

@@ -1,8 +0,0 @@
-masters:
-  hosts:
-    vineta:
-      ansible_host: 10.0.0.201
-    rotfront:
-      ansible_host: 10.0.0.202
-    leng:
-      ansible_host: 10.0.0.203

ansible/inventories/hive/group_vars/all.yaml

@@ -3,3 +3,6 @@ ansible_become_exe: sudo.ws
 ansible_user: kolibri
 vip_interface: eno1
 vip_address: 10.0.0.200
+cluster_name: hive
+cluster_pod_subnet: 172.16.0.0/16
+cluster_service_subnet: 10.96.0.0/16

ansible/inventories/hive/hosts.yaml

@@ -0,0 +1,8 @@
+masters:
+  hosts:
+    vineta:
+      ansible_host: vineta.local
+    rotfront:
+      ansible_host: rotfront.local
+    leng:
+      ansible_host: leng.local

ansible/inventories/incus/group_vars/all.yaml

@@ -2,3 +2,6 @@ ansible_python_interpreter: /usr/bin/python3
 ansible_user: kolibri
 vip_interface: enp5s0
 vip_address: 10.150.0.100
+cluster_name: hive
+cluster_pod_subnet: 172.16.0.0/16
+cluster_service_subnet: 10.96.0.0/16

ansible/playbooks/performance.yaml

@@ -0,0 +1,7 @@
+---
+- name: Configure performance tuning
+  hosts: all
+  become: true
+  roles:
+    - giovtorres.tuned
+    - irqbalance

ansible/playbooks/provisioning.yaml

@@ -10,6 +10,7 @@
         groups:
           - sudo
         shell: /bin/bash
+        system: true
 
     - name: Ensure authorised keys for Kolibri
       ansible.posix.authorized_key:

ansible/playbooks/reset.yaml

@@ -6,3 +6,8 @@
       ansible.builtin.command: kubeadm reset -f
       args:
         removes: /etc/kubernetes/*.conf
+
+    - name: Clear CNI configuration
+      ansible.builtin.file:
+        path: /etc/cni/net.d
+        state: absent

ansible/requirements.yml

@@ -0,0 +1,6 @@
+---
+collections:
+  - ansible.posix
+roles:
+  - name: giovtorres.tuned
+    version: 2.0.2

ansible/roles/irqbalance/tasks/main.yaml

@@ -0,0 +1,11 @@
+---
+- name: Install irqbalance
+  ansible.builtin.package:
+    name: irqbalance
+    state: present
+
+- name: Ensure irqbalance service
+  ansible.builtin.service:
+    name: irqbalance
+    state: started
+    enabled: true

ansible/roles/keepalived/handlers/main.yaml

@@ -1,4 +0,0 @@
-- name: Restart keepalived
-  ansible.builtin.service:
-    name: keepalived
-    state: restarted

ansible/roles/keepalived/tasks/main.yaml

@@ -1,12 +0,0 @@
-- name: Install keepalived
-  ansible.builtin.apt:
-    pkg:
-      - keepalived
-    state: present
-
-- name: Install keepalived config
-  ansible.builtin.template:
-    src: keepalived.conf.j2
-    dest: /etc/keepalived/keepalived.conf
-    mode: "0644"
-  notify: Restart keepalived

ansible/roles/keepalived/templates/keepalived.conf.j2

@@ -1,19 +0,0 @@
-vrrp_instance VI_1 {
-    state MASTER
-    interface enp5s0
-    virtual_router_id 51
-    priority 100
-    advert_int 1
-    authentication {
-        auth_type PASS
-        auth_pass 1111
-    }
-    virtual_ipaddress {
-        10.150.0.100
-        10.150.0.101
-        10.150.0.102
-    }
-
-    # Allow packets addressed to the VIPs above to be received
-    accept
-}

ansible/roles/kubernetes_common/tasks/packages.yaml

@@ -4,5 +4,6 @@
       - kubeadm
       - kubelet
       - containerd
-      - open-iscsi
+      - kubectl
+      - helm
     update_cache: true

ansible/roles/kubernetes_common/tasks/repo.yaml

@@ -6,3 +6,13 @@
     suites: /
     signed_by: https://pkgs.k8s.io/core:/stable:/v1.36/deb/Release.key
     state: present
+
+- name: Add Helm APT repository
+  ansible.builtin.deb822_repository:
+    name: helm
+    types: deb
+    uris: https://packages.buildkite.com/helm-linux/helm-debian/any/
+    suites: any
+    components: main
+    signed_by: https://packages.buildkite.com/helm-linux/helm-debian/gpgkey
+    state: present

ansible/roles/kubernetes_control_plane/tasks/cilium.yaml

@@ -1,12 +0,0 @@
-- name: Ensure Cilium repository exists
-  kubernetes.core.helm_repository:
-    name: cilium
-    url: https://helm.cilium.io/
-
-- name: Ensure Cilium is installed
-  kubernetes.core.helm:
-    release_name: cilium
-    release_namespace: kube-system
-    chart_ref: cilium/cilium
-    chart_version: 1.19.5
-  run_once: true

ansible/roles/kubernetes_control_plane/tasks/copy-config.yaml

@@ -1,4 +1,5 @@
-- name: Copy Kubernetes Admin configuration
+- name: Setup Kubernetes admin config for root user
+  become: true
   block:
     - name: Ensure .kube directory
       ansible.builtin.file:
@@ -7,7 +8,7 @@
         owner: "{{ ansible_facts['user_id'] }}"
         group: "{{ ansible_facts['user_id'] }}"
         mode: "0755"
-    - name: Copy Admin configuration
+    - name: Copy admin configuration
       ansible.builtin.copy:
         src: /etc/kubernetes/admin.conf
         dest: "{{ ansible_facts['env']['HOME'] }}/.kube/config"

ansible/roles/kubernetes_control_plane/tasks/init-cluster.yaml

@@ -0,0 +1,21 @@
+- name: Check if cluster is initialised
+  ansible.builtin.stat:
+    path: /etc/kubernetes/admin.conf
+  register: kubernetes_control_plane_admin_conf
+  run_once: true
+
+- name: Initialise Kubernetes cluster
+  when: not kubernetes_control_plane_admin_conf.stat.exists
+  block:
+    - name: Copy kubeadm config
+      ansible.builtin.template:
+        src: kubeadm-config.yaml.j2
+        dest: /tmp/kubeadm-config.yaml
+        mode: "0600"
+      run_once: true
+
+    - name: Initialise Kubernetes with kubeadm
+      ansible.builtin.command: kubeadm init --config /tmp/kubeadm-config.yaml
+      args:
+        creates: /etc/kubernetes/admin.conf
+      run_once: true

ansible/roles/kubernetes_control_plane/tasks/join-cluster.yaml

@@ -0,0 +1,20 @@
+- name: Generate join command
+  ansible.builtin.command: kubeadm token create --print-join-command --kubeconfig /etc/kubernetes/admin.conf
+  register: kubernetes_control_plane_join_command
+  run_once: true
+  changed_when: false
+
+- name: Get certificate key
+  ansible.builtin.command: kubeadm init phase upload-certs --upload-certs --kubeconfig /etc/kubernetes/admin.conf
+  register: kubernetes_control_plane_certificate_key
+  run_once: true
+  changed_when: false
+
+- name: Join additional control planes
+  ansible.builtin.command: >-
+    {{ kubernetes_control_plane_join_command.stdout }}
+    --control-plane
+    --certificate-key
+    {{ kubernetes_control_plane_certificate_key.stdout_lines[-1] }}
+  args:
+    creates: /etc/kubernetes/admin.conf

ansible/roles/kubernetes_control_plane/tasks/kube-vip.yaml

@@ -1,4 +1,4 @@
-- name: Ensure kube-vip static pod
+- name: Ensure kube-vip static pod manifest exists
   ansible.builtin.template:
     src: kube-vip.yaml.j2
     dest: /etc/kubernetes/manifests/kube-vip.yaml

ansible/roles/kubernetes_control_plane/tasks/longhorn.yaml

@@ -1,13 +0,0 @@
-- name: Ensure Longhorn repository exists
-  kubernetes.core.helm_repository:
-    name: longhorn
-    url: https://charts.longhorn.io
-
-- name: Ensure Longhorn is installed
-  kubernetes.core.helm:
-    release_name: longhorn
-    release_namespace: longhorn-system
-    chart_ref: longhorn/longhorn
-    chart_version: 1.12.0
-    create_namespace: true
-  run_once: true

ansible/roles/kubernetes_control_plane/tasks/main.yaml

@@ -1,63 +1,14 @@
-- name: Install kube-vip static pod
+- name: Configure kube-vip static pod manifest
   ansible.builtin.import_tasks: kube-vip.yaml
 
-- name: Copy kubeadm config
-  ansible.builtin.template:
-    src: kubeadm-config.yaml.j2
-    dest: /tmp/kubeadm-config.yaml
-    mode: "0600"
-
 - name: Initialise Kubernetes cluster
-  ansible.builtin.command: kubeadm init --config /tmp/kubeadm-config.yaml
-  args:
-    creates: /etc/kubernetes/admin.conf
-  run_once: true
+  ansible.builtin.import_tasks: init-cluster.yaml
 
+- name: Join nodes as control planes
+  ansible.builtin.import_tasks: join-cluster.yaml
 
-- name: Copy Kubernetes Admin Configuration
-  ansible.builtin.include_tasks: copy-config.yaml
-  run_once: true
+- name: Copy Kubernetes admin configuration on all nodes
+  ansible.builtin.import_tasks: copy-config.yaml
 
-
-- name: Generate Join Command
-  ansible.builtin.command: kubeadm token create --print-join-command
-  register: kubernetes_control_plane_join_command
-  run_once: true
-  changed_when: true
-
-
-- name: Get Certificate Key
-  ansible.builtin.shell: set -o pipefail && kubeadm init phase upload-certs --upload-certs | tail -n 1
-  register: kubernetes_control_plane_certificate_key
-  run_once: true
-  changed_when: true
-
-
-- name: Join Additional Control Planes
-  ansible.builtin.command: >-
-    {{ kubernetes_control_plane_join_command.stdout }}
-    --control-plane
-    --certificate-key
-    {{ kubernetes_control_plane_certificate_key.stdout }}
-  args:
-    creates: /etc/kubernetes/admin.conf
-
-
-- name: Copy Kubernetes Admin Configuration
-  ansible.builtin.include_tasks: copy-config.yaml
-
-
-- name: Untaint control planes
+- name: Remove control plane scheduling restrictions
   ansible.builtin.import_tasks: untaint.yaml
-
-
-- name: Install Tools
-  ansible.builtin.import_tasks: tools.yaml
-
-
-- name: Install Cilium CNI
-  ansible.builtin.import_tasks: cilium.yaml
-
-
-# - name: Install Longhorn CSI
-#   ansible.builtin.import_tasks: longhorn.yaml

ansible/roles/kubernetes_control_plane/tasks/tools.yaml

@@ -1,18 +0,0 @@
-- name: Add Helm APT repository
-  ansible.builtin.deb822_repository:
-    name: helm
-    types: deb
-    uris: https://packages.buildkite.com/helm-linux/helm-debian/any/
-    suites: any
-    components: main
-    signed_by: https://packages.buildkite.com/helm-linux/helm-debian/gpgkey
-    state: present
-
-
-- name: Install Kubernetes Tools
-  ansible.builtin.apt:
-    pkg:
-      - kubectl
-      - helm
-    state: present
-    update_cache: true

ansible/roles/kubernetes_control_plane/tasks/untaint.yaml

@@ -1,7 +1,7 @@
-- name: Remove control plane NoSchedule taint from all nodes
+- name: Remove control plane NoSchedule taint
   kubernetes.core.k8s_taint:
     state: absent
-    name: "{{ inventory_hostname_short }}"
+    name: "{{ ansible_facts['hostname'] }}"
     taints:
       - key: node-role.kubernetes.io/control-plane
         effect: NoSchedule

ansible/roles/kubernetes_control_plane/templates/kube-vip.yaml.j2

@@ -29,9 +29,7 @@ spec:
     - name: cp_namespace
       value: kube-system
     - name: svc_enable
-      value: "true"
-    - name: svc_leasename
-      value: plndr-svcs-lock
+      value: "false"
     - name: vip_leaderelection
       value: "true"
     - name: vip_leasename

ansible/roles/kubernetes_control_plane/templates/kubeadm-config.yaml.j2

@@ -4,12 +4,15 @@ kind: InitConfiguration
 ---
 apiVersion: kubeadm.k8s.io/v1beta4
 kind: ClusterConfiguration
-clusterName: aeon
+clusterName: "{{ cluster_name }}"
 controlPlaneEndpoint: "{{ vip_address }}"
+networking:
+  podSubnet: "{{ cluster_pod_subnet }}"
+  serviceSubnet: "{{ cluster_service_subnet }}"
 ---
 apiVersion: kubelet.config.k8s.io/v1beta1
 kind: KubeletConfiguration
 cgroupDriver: systemd
 failSwapOn: false
 memorySwap:
-  swapBehaviour: LimitedSwap
+  swapBehavior: LimitedSwap

ansible/roles/kubernetes_metric_server/tasks/main.yaml

@@ -1,15 +0,0 @@
-- name: Ensure Metrics Server repository exists
-  kubernetes.core.helm_repository:
-    name: metrics-server
-    url: https://kubernetes-sigs.github.io/metrics-server/
-
-- name: Ensure Metrics Server is installed
-  kubernetes.core.helm:
-    release_name: metrics-server
-    release_namespace: kube-system
-    chart_ref: metrics-server/metrics-server
-    chart_version: 3.13.1
-    values:
-      args:
-        - --kubelet-insecure-tls
-  run_once: true

ansible/site.yaml

@@ -1,3 +1,6 @@
+- name: Apply power and performance settings
+  ansible.builtin.import_playbook: playbooks/performance.yaml
+
 - name: Baseline configuration
   hosts: all
   become: true
@@ -5,24 +8,8 @@
     - common
     - kubernetes_common
 
-# ========================
-# Setup Kubernetes Cluster
-# ========================
-
 - name: Initialise Kubernetes Cluster
   hosts: masters
   become: true
   roles:
     - kubernetes_control_plane
-    - kubernetes_metric_server
-
-# # =======================
-# # JOIN MASTERS TO CLUSTER
-# # =======================
-
-# - name: Adkfk
-#   hosts: masters[0]
-#   tasks:
-#     - name: Generate Kubernetes 'join' command
-#       ansible.builtin.command: echo hi
-#       changed_when: true

infra/main.tofu

@@ -3,14 +3,10 @@
 # ------
 
 locals {
+  image          = "ubuntu/26.04"
   root_disk_size = "16GiB"
   ext_disk_size  = "16GiB"
   network_cidr   = "10.150.0.1/24"
-
-  master_count = 3
-  worker_count = 0
-
-  image = "ubuntu/26.04"
 }
 
 # ---------
@@ -46,13 +42,13 @@ resource "incus_network" "this" {
 
 module "master" {
   source = "./modules/incus_vm"
-  count  = local.master_count
+  count  = var.master_count
 
-  name         = "master-${count.index}"
-  project      = incus_project.this.name
-  image        = incus_image.this.fingerprint
-  cpu          = 2
-  memory       = "2GiB"
+  name    = "master-${count.index}"
+  project = incus_project.this.name
+  image   = incus_image.this.fingerprint
+  cpu     = 2
+  memory  = "2GiB"
 
   network      = incus_network.this.name
   ipv4_address = cidrhost(local.network_cidr, 2 + (2 * count.index))
@@ -60,13 +56,13 @@ module "master" {
 
 module "worker" {
   source = "./modules/incus_vm"
-  count  = local.worker_count
+  count  = var.worker_count
 
-  name         = "worker-${count.index}"
-  project      = incus_project.this.name
-  image        = incus_image.this.fingerprint
-  cpu          = 2
-  memory       = "2GiB"
+  name    = "worker-${count.index}"
+  project = incus_project.this.name
+  image   = incus_image.this.fingerprint
+  cpu     = 2
+  memory  = "2GiB"
 
   network      = incus_network.this.name
   ipv4_address = cidrhost(local.network_cidr, 3 + (2 * count.index))
@@ -77,7 +73,7 @@ module "worker" {
 # ---------
 
 terraform {
-  required_version = "~> 1.12"
+  required_version = ">= 1.11.5"
 
   required_providers {
     incus = {

infra/variables.tofu

@@ -1,3 +1,17 @@
+variable "master_count" {
+  description = "The number of master nodes to provision."
+  type        = number
+  default     = 1
+  nullable    = false
+}
+
+variable "worker_count" {
+  description = "The number of worker nodes to provision."
+  type        = number
+  default     = 0
+  nullable    = false
+}
+
 variable "cpus" {
   description = "The number of CPU cores allocated to each virtual machine."
   type        = number