homelab-infrastructure/ansible/playbooks/master-playbook.yaml

- name: Primary Master Initialisation
  hosts: masters[0]
  tasks:
    - name: Initialise high-availability Kubernetes cluster
      ansible.builtin.command: >-
        kubeadm init
        --pod-network-cidr="172.16.0.0/16"
        --control-plane-endpoint="{{ ansible_default_ipv4.address }}:6443"
        --upload-certs
      args:
        creates: /etc/kubernetes/admin.conf
    - name: Copy Kubernetes Admin Config
      ansible.builtin.command: "{{ item }}"
      loop:
        - mkdir -p $HOME/.kube
        - cp /etc/kubernetes/admin.conf $HOME/.kube/config
        - chown $(id -u):$(id -g) $HOME/.kube/config
      args:
        creates: $HOME/.kube/config

    - name: Install Pod Network (Calico)
      ansible.builtin.shell: kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico.yaml > pod_network_setup.txt
      args:
        chdir: $HOME
        creates: pod_network_setup.txt

    - name: Add Helm repositories
      kubernetes.core.helm_repository:
        name: "{{ item.name }}"
        repo_url: "{{ item.url }}"
      loop:
        - name: metrics-server
          url: https://kubernetes-sigs.github.io/metrics-server/
        - name: prometheus-community
          url: https://prometheus-community.github.io/helm-charts
        - name: longhorn
          url: https://charts.longhorn.io
        - name: traefik
          url: https://traefik.github.io/charts
        - name: minecraft-server-charts
          url: https://itzg.github.io/minecraft-server-charts/

    - name: Install Metrics Server
      kubernetes.core.helm:
        release_name: metrics-server
        release_namespace: kube-system
        chart_ref: metrics-server/metrics-server
        chart_version: 3.13.0
        values:
          args:
            - --kubelet-insecure-tls

    - name: Install Longhorn
      kubernetes.core.helm:
        release_name: longhorn
        release_namespace: longhorn-system
        create_namespace: true
        chart_ref: longhorn/longhorn
        chart_version: 1.12.0

    - name: Install Prometheus
      kubernetes.core.helm:
        release_name: prometheus
        release_namespace: monitoring
        create_namespace: true
        chart_ref: prometheus-community/prometheus
        chart_version: 29.10.0
        state: absent

    - name: Install Traefik
      kubernetes.core.helm:
        release_name: traefik
        release_namespace: default
        create_namespace: true
        chart_ref: traefik/traefik
        chart_version: 40.2.0
        values:
          deployment:
            kind: DaemonSet
          securityContext:
            capabilities:
              drop: [ALL]
              add: [NET_BIND_SERVICE]
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
          ports:
            web:
              port: 80
              containerPort: 80
              hostPort: 80
            websecure:
              port: 443
              containerPort: 443
              hostPort: 443

    - name: Install Minecraft
      kubernetes.core.helm:
        release_name: minecraft
        release_namespace: default
        chart_ref: minecraft-server-charts/minecraft
        chart_version: 5.1.3
        values:
          minecraftServer:
            eula: true
          persistence:
            dataDir:
              enabled: true

    - name: Extract Control Plane Decryption Key & Join Token
      block:
        - name: Generate Fresh Join Command
          ansible.builtin.command: kubeadm token create --print-join-command
          register: join_command_raw

        - name: Upload Certs and Capture Certificate Key
          shell: kubeadm init phase upload-certs --upload-certs | tail -n 1
          register: cert_key_raw

        - name: Set facts across playbooks
          ansible.builtin.set_fact:
            k8s_join_base: "{{ join_command_raw.stdout }}"
            k8s_cert_key: "{{ cert_key_raw.stdout }}"
          delegate_to: localhost
          delegate_facts: true


- name: Join Secondary Control Planes
  hosts: masters:!masters[0] # <--- Targets masters 1 and 2
  tasks:
    - name: Join Cluster as Control Plane Node
      ansible.builtin.shell: "{{ hostvars['localhost']['k8s_join_base'] }} --control-plane --certificate-key {{ hostvars['localhost']['k8s_cert_key'] }}"
      args:
        creates: /etc/kubernetes/admin.conf

    - name: Copy Kubernetes Admin Config
      ansible.builtin.shell: "{{ item }}"
      loop:
        - mkdir -p $HOME/.kube
        - cp /etc/kubernetes/admin.conf $HOME/.kube/config
        - chown $(id -u):$(id -g) $HOME/.kube/config
      args:
        creates: $HOME/.kube/config

- name: Remove control plane taint
  hosts: masters[0]
  tasks:
    - name: Remove control plane NoSchedule taint from all nodes
      kubernetes.core.k8s_taint:
        state: absent
        name: "{{ item }}"
        taints:
          - key: node-role.kubernetes.io/control-plane
            effect: NoSchedule
      loop: "{{ groups['masters'] }}"