feat: update control plane role

ansible/playbooks/master-playbook.yaml

@@ -1,137 +0,0 @@
-- name: Primary Master Initialisation
-  hosts: masters[0]
-  tasks:
-    - name: Initialise high-availability Kubernetes cluster
-      ansible.builtin.command: >-
-        kubeadm init --pod-network-cidr="172.16.0.0/16" --control-plane-endpoint="{{ ansible_default_ipv4.address }}:6443" --upload-certs
-      args:
-        creates: /etc/kubernetes/admin.conf
-    - name: Copy Kubernetes Admin Config
-      ansible.builtin.command: "{{ item }}"
-      loop:
-        - mkdir -p $HOME/.kube
-        - cp /etc/kubernetes/admin.conf $HOME/.kube/config
-        - chown $(id -u):$(id -g) $HOME/.kube/config
-      args:
-        creates: $HOME/.kube/config
-    - name: Install Pod Network (Calico)
-      ansible.builtin.shell: kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico.yaml > pod_network_setup.txt
-      args:
-        chdir: $HOME
-        creates: pod_network_setup.txt
-    - name: Add Helm repositories
-      kubernetes.core.helm_repository:
-        name: "{{ item.name }}"
-        repo_url: "{{ item.url }}"
-      loop:
-        - name: metrics-server
-          url: https://kubernetes-sigs.github.io/metrics-server/
-        - name: prometheus-community
-          url: https://prometheus-community.github.io/helm-charts
-        - name: longhorn
-          url: https://charts.longhorn.io
-        - name: traefik
-          url: https://traefik.github.io/charts
-        - name: minecraft-server-charts
-          url: https://itzg.github.io/minecraft-server-charts/
-    - name: Install Metrics Server
-      kubernetes.core.helm:
-        release_name: metrics-server
-        release_namespace: kube-system
-        chart_ref: metrics-server/metrics-server
-        chart_version: 3.13.0
-        values:
-          args:
-            - --kubelet-insecure-tls
-    - name: Install Longhorn
-      kubernetes.core.helm:
-        release_name: longhorn
-        release_namespace: longhorn-system
-        create_namespace: true
-        chart_ref: longhorn/longhorn
-        chart_version: 1.12.0
-    - name: Install Prometheus
-      kubernetes.core.helm:
-        release_name: prometheus
-        release_namespace: monitoring
-        create_namespace: true
-        chart_ref: prometheus-community/prometheus
-        chart_version: 29.10.0
-        state: absent
-    - name: Install Traefik
-      kubernetes.core.helm:
-        release_name: traefik
-        release_namespace: default
-        create_namespace: true
-        chart_ref: traefik/traefik
-        chart_version: 40.2.0
-        values:
-          deployment:
-            kind: DaemonSet
-          securityContext:
-            capabilities:
-              drop: [ALL]
-              add: [NET_BIND_SERVICE]
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-          ports:
-            web:
-              port: 80
-              containerPort: 80
-              hostPort: 80
-            websecure:
-              port: 443
-              containerPort: 443
-              hostPort: 443
-    - name: Install Minecraft
-      kubernetes.core.helm:
-        release_name: minecraft
-        release_namespace: default
-        chart_ref: minecraft-server-charts/minecraft
-        chart_version: 5.1.3
-        values:
-          minecraftServer:
-            eula: true
-          persistence:
-            dataDir:
-              enabled: true
-    - name: Extract Control Plane Decryption Key & Join Token
-      block:
-        - name: Generate Fresh Join Command
-          ansible.builtin.command: kubeadm token create --print-join-command
-          register: join_command_raw
-        - name: Upload Certs and Capture Certificate Key
-          shell: kubeadm init phase upload-certs --upload-certs | tail -n 1
-          register: cert_key_raw
-        - name: Set facts across playbooks
-          ansible.builtin.set_fact:
-            k8s_join_base: "{{ join_command_raw.stdout }}"
-            k8s_cert_key: "{{ cert_key_raw.stdout }}"
-          delegate_to: localhost
-          delegate_facts: true
-- name: Join Secondary Control Planes
-  hosts: masters:!masters[0] # <--- Targets masters 1 and 2
-  tasks:
-    - name: Join Cluster as Control Plane Node
-      ansible.builtin.shell: "{{ hostvars['localhost']['k8s_join_base'] }} --control-plane --certificate-key {{ hostvars['localhost']['k8s_cert_key'] }}"
-      args:
-        creates: /etc/kubernetes/admin.conf
-    - name: Copy Kubernetes Admin Config
-      ansible.builtin.shell: "{{ item }}"
-      loop:
-        - mkdir -p $HOME/.kube
-        - cp /etc/kubernetes/admin.conf $HOME/.kube/config
-        - chown $(id -u):$(id -g) $HOME/.kube/config
-      args:
-        creates: $HOME/.kube/config
-- name: Remove control plane taint
-  hosts: masters[0]
-  tasks:
-    - name: Remove control plane NoSchedule taint from all nodes
-      kubernetes.core.k8s_taint:
-        state: absent
-        name: "{{ item }}"
-        taints:
-          - key: node-role.kubernetes.io/control-plane
-            effect: NoSchedule
-      loop: "{{ groups['masters'] }}"

ansible/playbooks/provisioning.yaml

@@ -1,4 +1,4 @@
-- name: Provision kolibri automation user
+- name: Create Kolibri automation user
   hosts: all
   become: true
   tasks:

ansible/playbooks/reset.yaml

@@ -0,0 +1,8 @@
+- name: Reset nodes
+  hosts: all
+  become: true
+  tasks:
+    - name: Reset kubeadm
+      ansible.builtin.command: kubeadm reset -f
+      args:
+        removes: /etc/kubernetes/*.conf

ansible/playbooks/setup-playbook.yaml

@@ -1,78 +0,0 @@
-- name: Initialise Master and Worker Nodes
-  hosts: all
-  tasks:
-    - name: Enable IPv4 forwarding
-      ansible.posix.sysctl:
-        name: net.ipv4.ip_forward
-        value: 1
-        sysctl_set: true
-    - name: Enable Kernel Modules
-      community.general.modprobe:
-        name: "{{ item }}"
-        persistent: present
-      loop:
-        - br_netfilter
-        - dm-crypt
-    - name: Ensure /sys mount is set to shared for container runtimes
-      block:
-        - name: Remount /sys as shared immediately
-          ansible.builtin.command: mount --make-rshared {{ item }}
-          loop:
-            - /
-            - /sys
-            - /run
-          changed_when: false
-        - name: Create Alpine local.d script for permanent shared mount
-          ansible.builtin.copy:
-            dest: /etc/local.d/mount-shared.start
-            content: |
-              #!/bin/sh
-              mount --make-rshared /
-              mount --make-rshared /sys
-              mount --make-rshared /run
-            owner: root
-            group: root
-            mode: '0755'
-        - name: Ensure Alpine local service is enabled on boot
-          ansible.builtin.service:
-            name: local
-            enabled: true
-            runlevel: default
-    - name: Install tools
-      ansible.builtin.package:
-        name: "{{ item }}"
-        state: present
-      loop:
-        - htop
-    - name: Install kubectl, kubelet, kubeadm and containerd
-      ansible.builtin.package:
-        name: "{{ item }}"
-        state: present
-      loop:
-        - kubectl
-        - kubeadm
-        - kubelet
-        - containerd
-        - cni-plugins
-        - helm
-        - open-iscsi
-    - name: Start kubelet and containerd
-      ansible.builtin.service:
-        name: "{{ item }}"
-        enabled: true
-        state: started
-      loop:
-        - kubelet
-        - containerd
-        - iscsid
-    - name: Add /opt/cni/bin to containerd CNI binary directories
-      ansible.builtin.replace:
-        path: /etc/containerd/config.toml
-        regexp: "bin_dirs = \\['/usr/libexec/cni'\\]"
-        replace: "bin_dirs = ['/opt/cni/bin', '/usr/libexec/cni']"
-      notify: Restart containerd
-  handlers:
-    - name: Restart containerd
-      ansible.builtin.service:
-        name: containerd
-        state: restarted

ansible/playbooks/worker-playbook.yaml

@@ -1,22 +0,0 @@
-- name: Extract Worker Join Token from Primary Master
-  hosts: masters[0] # <--- Targets only the first master safely
-  gather_facts: false
-  tasks:
-    - name: Generate worker join command
-      ansible.builtin.command: kubeadm token create --print-join-command
-      register: join_command_raw
-      changed_when: false # Reading/generating a token text string changes no host state
-    - name: Save join command globally
-      ansible.builtin.set_fact:
-        k8s_worker_join: "{{ join_command_raw.stdout }}"
-      delegate_to: localhost
-      delegate_facts: true
-- name: Join Worker Nodes to Cluster
-  hosts: workers
-  gather_facts: false
-  tasks:
-    - name: Join cluster
-      ansible.builtin.shell: "{{ hostvars['localhost']['k8s_worker_join'] }} >> node_joined.txt"
-      args:
-        chdir: $HOME
-        creates: node_joined.txt

ansible/roles/kubernetes_common/tasks/main.yaml

@@ -2,3 +2,5 @@
   ansible.builtin.import_tasks: repo.yaml
 - name: Install Kubernetes packages
   ansible.builtin.import_tasks: packages.yaml
+- name: Ensure services running
+  ansible.builtin.import_tasks: services.yaml

ansible/roles/kubernetes_common/tasks/packages.yaml

@@ -4,4 +4,5 @@
       - kubeadm
       - kubelet
       - containerd
+      - open-iscsi
     update_cache: true

ansible/roles/kubernetes_common/tasks/services.yaml

@@ -0,0 +1,5 @@
+- name: Ensure containerd is running
+  ansible.builtin.service:
+    name: containerd
+    state: started
+    enabled: true

ansible/roles/kubernetes_control_plane/tasks/copy-config.yaml

@@ -0,0 +1,17 @@
+- name: Copy Kubernetes Admin configuration
+  block:
+    - name: Ensure .kube directory
+      ansible.builtin.file:
+        path: "{{ ansible_facts['env']['HOME'] }}/.kube"
+        state: directory
+        owner: "{{ ansible_facts['user_id'] }}"
+        group: "{{ ansible_facts['user_id'] }}"
+        mode: "0755"
+    - name: Copy Admin configuration
+      ansible.builtin.copy:
+        src: /etc/kubernetes/admin.conf
+        dest: "{{ ansible_facts['env']['HOME'] }}/.kube/config"
+        remote_src: true
+        owner: "{{ ansible_facts['user_id'] }}"
+        group: "{{ ansible_facts['user_id'] }}"
+        mode: "0600"

ansible/roles/kubernetes_control_plane/tasks/kube-vip.yaml

@@ -2,4 +2,4 @@
   ansible.builtin.template:
     src: kube-vip.yaml.j2
     dest: /etc/kubernetes/manifests/kube-vip.yaml
-    mode: "0644"
+    mode: "0600"

ansible/roles/kubernetes_control_plane/tasks/longhorn.yaml

@@ -0,0 +1,13 @@
+- name: Ensure Longhorn repository exists
+  kubernetes.core.helm_repository:
+    name: longhorn
+    url: https://charts.longhorn.io
+
+- name: Ensure Longhorn is installed
+  kubernetes.core.helm:
+    release_name: longhorn
+    release_namespace: longhorn-system
+    chart_ref: longhorn/longhorn
+    chart_version: 1.12.0
+    create_namespace: true
+  run_once: true

ansible/roles/kubernetes_control_plane/tasks/main.yaml

@@ -1,65 +1,63 @@
-- name: Install kube-vip
+- name: Install kube-vip static pod
   ansible.builtin.import_tasks: kube-vip.yaml
 
+- name: Copy kubeadm config
+  ansible.builtin.template:
+    src: kubeadm-config.yaml.j2
+    dest: /tmp/kubeadm-config.yaml
+    mode: "0600"
+
 - name: Initialise Kubernetes cluster
-  ansible.builtin.command:
-    argv:
-      - kubeadm
-      - init
-      - --pod-network-cidr=172.16.0.0/16
-      - --control-plane-endpoint={{ vip_address }}:6443
-      - --upload-certs
+  ansible.builtin.command: kubeadm init --config /tmp/kubeadm-config.yaml
   args:
     creates: /etc/kubernetes/admin.conf
   run_once: true
 
 
+- name: Copy Kubernetes Admin Configuration
+  ansible.builtin.include_tasks: copy-config.yaml
+  run_once: true
+
+
 - name: Generate Join Command
-  ansible.builtin.command:
-    argv:
-      - kubeadm
-      - token
-      - create
-      - --print-join-command
+  ansible.builtin.command: kubeadm token create --print-join-command
   register: kubernetes_control_plane_join_command
   run_once: true
   changed_when: true
 
 
 - name: Get Certificate Key
-  ansible.builtin.shell:
-    cmd: set -o pipefail && kubeadm init phase upload-certs --upload-certs | tail -n 1
+  ansible.builtin.shell: set -o pipefail && kubeadm init phase upload-certs --upload-certs | tail -n 1
   register: kubernetes_control_plane_certificate_key
   run_once: true
   changed_when: true
 
 
 - name: Join Additional Control Planes
-  ansible.builtin.command:
-    cmd: "{{ kubernetes_control_plane_join_command.stdout }} --control-plane --certificate-key {{ kubernetes_control_plane_certificate_key.stdout }}"
+  ansible.builtin.command: >-
+    {{ kubernetes_control_plane_join_command.stdout }}
+    --control-plane
+    --certificate-key
+    {{ kubernetes_control_plane_certificate_key.stdout }}
   args:
     creates: /etc/kubernetes/admin.conf
 
-- name: Copy Kubernetes Admin Config
-  ansible.builtin.command: "{{ item }}"
-  loop:
-    - mkdir -p $HOME/.kube
-    - cp /etc/kubernetes/admin.conf $HOME/.kube/config
-    - chown $(id -u):$(id -g) $HOME/.kube/config
-  args:
-    creates: $HOME/.kube/config
+
+- name: Copy Kubernetes Admin Configuration
+  ansible.builtin.include_tasks: copy-config.yaml
+
 
 - name: Untaint control planes
   ansible.builtin.import_tasks: untaint.yaml
 
-- name: Install Kubernetes CLI
-  ansible.builtin.apt:
-    pkg:
-      - kubectl
-    state: present
 
-- name: Install Helm
-  ansible.builtin.import_tasks: helm.yaml
+- name: Install Tools
+  ansible.builtin.import_tasks: tools.yaml
+
 
 - name: Install Cilium CNI
   ansible.builtin.import_tasks: cilium.yaml
+
+
+# - name: Install Longhorn CSI
+#   ansible.builtin.import_tasks: longhorn.yaml

ansible/roles/kubernetes_control_plane/tasks/tools.yaml

@@ -8,8 +8,11 @@
     signed_by: https://packages.buildkite.com/helm-linux/helm-debian/gpgkey
     state: present
 
-- name: Install Helm
+
+- name: Install Kubernetes Tools
   ansible.builtin.apt:
-    name: helm
+    pkg:
+      - kubectl
+      - helm
     state: present
     update_cache: true

ansible/roles/kubernetes_control_plane/templates/kubeadm-config.yaml.j2

@@ -0,0 +1,15 @@
+# Configuration reference can be found at https://kubernetes.io/docs/reference/config-api/kubeadm-config.v1beta4/
+apiVersion: kubeadm.k8s.io/v1beta4
+kind: InitConfiguration
+---
+apiVersion: kubeadm.k8s.io/v1beta4
+kind: ClusterConfiguration
+clusterName: aeon
+controlPlaneEndpoint: "{{ vip_address }}"
+---
+apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+cgroupDriver: systemd
+failSwapOn: false
+memorySwap:
+  swapBehaviour: LimitedSwap