doc: add quick start guide

.gitignore

@@ -8,3 +8,4 @@ ansible/lookup_plugins
 !.editorconfig
 !.vscode
 !.pre-commit-config.yaml
+!.yamlfmt.yaml

.yamlfmt.yaml

@@ -0,0 +1,5 @@
+formatter:
+  indent: 2
+  retain_line_breaks_single: true
+  scan_folded_as_literal: true
+  indentless_arrays: false

Justfile

@@ -5,7 +5,7 @@ ansible_proton_pass_plugin_ref := "4bd0741c347646060ec59c73f8adf7ed8e706cf3"
 ansible_proton_pass_plugin_url := "https://raw.githubusercontent.com/protonpass/proton-pass-ansible-integration/" + ansible_proton_pass_plugin_ref + "/lookup_plugins/proton_pass.py"
 
 up: tofu-apply ansible-run-playbook
-down: tofu-destroy-instances
+down: tofu-destroy
 
 tofu-init:
     tofu -chdir={{ opentofu_dir }} init -upgrade

README.md

@@ -1,5 +1,30 @@
 # Home Infrastructure
 
+## Quick Start
+
+Get started with a local Kubernetes cluster which can be used to design and test
+new configuration before pushing them to real machines.
+
+1. Login with Proton Pass and start the SSH daemon.
+
+    ```shell
+    pass-cli login
+    pass-cli ssh-agent daemon start
+    export SSH_AUTH_SOCK="$HOME/.ssh/proton-pass-agent.sock"
+    ```
+
+2. Launch Incus virtual machines
+
+    ```shell
+    just up
+    ```
+
+3. Tear down the Incus virtual machines
+
+    ```shell
+    just down
+    ```
+
 ## Setup
 
 ```shell
@@ -15,3 +40,19 @@ The Kolibri automation user is used for all other playbooks and has permissions
 ```shell
 ansible-playbook -i ansible/inventories/bare_metal/hosts.yaml ansible/playbooks/provision.yaml -K -e ansible_user=<your_interactive_user>
 ```
+
+## Local Testing with Incus
+
+```shell
+just up
+```
+
+```shell
+just headlamp
+```
+
+> The above command runs the Flatpak version of Headlamp which may not have permissions
+> to access the Kubernetes config file copied from the instance.
+>
+> You should run `flatpak override --user --filesystem=$(pwd) io.kinvolk.Headlamp`
+> to ensure that Headlamp can access the directory contents.

ansible/inventories/bare_metal/group_vars/all.yaml

@@ -5,5 +5,3 @@ vip_interface: eno1
 vip_address: 10.0.0.200
 cluster_pod_subnet: 172.16.0.0/16
 cluster_service_subnet: 10.96.0.0/16
-lb_pool_start: 10.0.0.210
-lb_pool_stop: 10.0.0.220

ansible/inventories/incus/group_vars/all.yaml

@@ -4,5 +4,3 @@ vip_interface: enp5s0
 vip_address: 10.150.0.100
 cluster_pod_subnet: 172.16.0.0/16
 cluster_service_subnet: 10.96.0.0/16
-lb_pool_start: 10.150.0.210
-lb_pool_stop: 10.150.0.220

ansible/roles/keepalived/handlers/main.yaml

@@ -1,4 +0,0 @@
-- name: Restart keepalived
-  ansible.builtin.service:
-    name: keepalived
-    state: restarted

ansible/roles/keepalived/tasks/main.yaml

@@ -1,12 +0,0 @@
-- name: Install keepalived
-  ansible.builtin.apt:
-    pkg:
-      - keepalived
-    state: present
-
-- name: Install keepalived config
-  ansible.builtin.template:
-    src: keepalived.conf.j2
-    dest: /etc/keepalived/keepalived.conf
-    mode: "0644"
-  notify: Restart keepalived

ansible/roles/keepalived/templates/keepalived.conf.j2

@@ -1,19 +0,0 @@
-vrrp_instance VI_1 {
-    state MASTER
-    interface enp5s0
-    virtual_router_id 51
-    priority 100
-    advert_int 1
-    authentication {
-        auth_type PASS
-        auth_pass 1111
-    }
-    virtual_ipaddress {
-        10.150.0.100
-        10.150.0.101
-        10.150.0.102
-    }
-
-    # Allow packets addressed to the VIPs above to be received
-    accept
-}

ansible/roles/kubernetes_cilium/defaults/main.yaml

@@ -1,14 +0,0 @@
-cilium_chart_version: 1.19.5
-
-cilium_values:
-  ipam:
-    operator:
-      clusterPoolIPv4PodCIDRList:
-        - "{{ cluster_pod_subnet }}"
-  hubble:
-    relay:
-      enabled: true
-    ui:
-      enabled: true
-  l2announcements:
-    enabled: true

ansible/roles/kubernetes_cilium/tasks/main.yaml

@@ -1,27 +0,0 @@
-- name: Ensure Cilium repository exists
-  kubernetes.core.helm_repository:
-    name: cilium
-    url: https://helm.cilium.io/
-
-- name: Ensure Cilium is installed
-  kubernetes.core.helm:
-    release_name: cilium
-    release_namespace: kube-system
-    chart_ref: cilium/cilium
-    chart_version: "{{ cilium_chart_version }}"
-    values: "{{ cilium_values }}"
-  run_once: true
-
-- name: Ensure LoadBalancer IP pool exists
-  kubernetes.core.k8s:
-    state: present
-    definition:
-      apiVersion: cilium.io/v2
-      kind: CiliumLoadBalancerIPPool
-      metadata:
-        name: homelab-pool
-      spec:
-        blocks:
-          - start: "{{ lb_pool_start }}"
-            stop: "{{ lb_pool_stop }}"
-  run_once: true

ansible/roles/kubernetes_control_plane/templates/kube-vip.yaml.j2

@@ -29,9 +29,7 @@ spec:
     - name: cp_namespace
       value: kube-system
     - name: svc_enable
-      value: "true"
-    - name: svc_leasename
-      value: plndr-svcs-lock
+      value: "false"
     - name: vip_leaderelection
       value: "true"
     - name: vip_leasename

ansible/roles/kubernetes_longhorn/tasks/main.yaml

@@ -1,18 +0,0 @@
-- name: Ensure open-iscsi is installed
-  ansible.builtin.apt:
-    pkg: open-iscsi
-    state: present
-
-- name: Ensure Longhorn repository exists
-  kubernetes.core.helm_repository:
-    name: longhorn
-    url: https://charts.longhorn.io
-
-- name: Ensure Longhorn is installed
-  kubernetes.core.helm:
-    release_name: longhorn
-    release_namespace: longhorn-system
-    chart_ref: longhorn/longhorn
-    chart_version: 1.12.0
-    create_namespace: true
-  run_once: true

ansible/roles/kubernetes_metrics_server/tasks/main.yaml

@@ -1,15 +0,0 @@
-- name: Ensure Metrics Server repository exists
-  kubernetes.core.helm_repository:
-    name: metrics-server
-    url: https://kubernetes-sigs.github.io/metrics-server/
-
-- name: Ensure Metrics Server is installed
-  kubernetes.core.helm:
-    release_name: metrics-server
-    release_namespace: kube-system
-    chart_ref: metrics-server/metrics-server
-    chart_version: 3.13.1
-    values:
-      args:
-        - --kubelet-insecure-tls
-  run_once: true

ansible/roles/kubernetes_traefik/defaults/main.yaml

@@ -1,12 +0,0 @@
-traefik_chart_version: 41.0.1
-
-traefik_values:
-  providers:
-    kubernetesGateway:
-      enabled: true
-  gateway:
-    enabled: true
-    listeners:
-      web:
-        port: 8000
-        protocol: HTTP

ansible/roles/kubernetes_traefik/tasks/main.yaml

@@ -1,20 +0,0 @@
-- name: Install Gateway API CRDs
-  kubernetes.core.k8s:
-    src: https://github.com/kubernetes-sigs/gateway-api/releases/latest/download/standard-install.yaml
-    state: present
-  run_once: true
-
-- name: Ensure Traefik repository exists
-  kubernetes.core.helm_repository:
-    name: traefik
-    url: https://traefik.github.io/charts
-
-- name: Ensure Traefik is installed
-  kubernetes.core.helm:
-    release_name: traefik
-    release_namespace: traefik
-    chart_ref: traefik/traefik
-    chart_version: "{{ traefik_chart_version }}"
-    create_namespace: true
-    values: "{{ traefik_values }}"
-  run_once: true

ansible/site.yaml

@@ -14,18 +14,3 @@
   become: true
   roles:
     - kubernetes_control_plane
-    - kubernetes_cilium
-    - kubernetes_metrics_server
-    - kubernetes_longhorn
-    - kubernetes_traefik
-
-# # =======================
-# # JOIN MASTERS TO CLUSTER
-# # =======================
-
-# - name: Adkfk
-#   hosts: masters[0]
-#   tasks:
-#     - name: Generate Kubernetes 'join' command
-#       ansible.builtin.command: echo hi
-#       changed_when: true