Separate tasks in kubernetes role
This commit is contained in:
parent
07afd3f694
commit
be70ab72bb
@ -1,5 +1,7 @@
|
||||
---
|
||||
- hosts: kubernetes
|
||||
- hosts:
|
||||
- k8s-masters
|
||||
- k8s-nodes
|
||||
remote_user: hybris
|
||||
become: yes
|
||||
|
||||
@ -10,7 +12,4 @@
|
||||
roles:
|
||||
- dns
|
||||
- proxy
|
||||
- network
|
||||
- kubernetes
|
||||
|
||||
# TODO: set ipv6 static so it will stick even on reboots
|
||||
|
||||
35
roles/kubernetes/tasks/firewalld.yml
Normal file
35
roles/kubernetes/tasks/firewalld.yml
Normal file
@ -0,0 +1,35 @@
|
||||
---
|
||||
########################
|
||||
#### FIREWALL TASKS ####
|
||||
########################
|
||||
|
||||
# ## kubernetes requirements
|
||||
|
||||
# - name: enable port 6443/tcp
|
||||
# firewalld:
|
||||
# port: 6443/tcp
|
||||
# permanent: yes
|
||||
# state: enabled
|
||||
|
||||
# - name: enable port 10250/tcp
|
||||
# firewalld:
|
||||
# port: 10250/tcp
|
||||
# permanent: yes
|
||||
# state: enabled
|
||||
|
||||
# - name: enable port 6443/udp
|
||||
# firewalld:
|
||||
# port: 6443/udp
|
||||
# permanent: yes
|
||||
# state: enabled
|
||||
|
||||
# - name: enable port 10250/udp
|
||||
# firewalld:
|
||||
# port: 10250/udp
|
||||
# permanent: yes
|
||||
# state: enabled
|
||||
|
||||
# ## reload firewalld after setting rules
|
||||
|
||||
# - name: reload firewalld
|
||||
# shell: firewall-cmd --reload
|
||||
@ -1,181 +1,106 @@
|
||||
---
|
||||
#######################
|
||||
#### NETWORK TASKS ####
|
||||
#######################
|
||||
|
||||
- name: set static ipv6 for hosts
|
||||
lineinfile:
|
||||
path: /etc/sysconfig/network-scripts/ifcfg-eth0
|
||||
line: {{ item.line }}
|
||||
regexp: {{ item.regexp }}
|
||||
with_items:
|
||||
- { regexp: "^IPV6INIT=", line: "IPV6INIT=yes" }
|
||||
- { regexp: "^IPV6AUTOCONF=", line: "IPV6AUTOCONF=no" }
|
||||
- { regexp: "^IPV6ADDR=", line: "IPV6ADDR={{ host_ipv6 }}"}
|
||||
- { regexp: "^IPV6_DEFAULTGW=", line: "IPV6_DEFAULTGW={{ network_default_gw }}"}
|
||||
- name: upgrade all packages
|
||||
yum:
|
||||
name: '*'
|
||||
state: latest
|
||||
|
||||
- name: reboot
|
||||
reboot:
|
||||
- name: permanently disable selinux
|
||||
lineinfile:
|
||||
dest: /etc/sysconfig/selinux
|
||||
regexp: "^SELINUX="
|
||||
line: "SELINUX=disabled"
|
||||
|
||||
########################
|
||||
#### FIREWALL TASKS ####
|
||||
########################
|
||||
- name: temporarily disable swap
|
||||
shell: swapoff -a
|
||||
|
||||
# ## kubernetes requirements
|
||||
- name: permanently disable swap
|
||||
lineinfile:
|
||||
dest: /etc/fstab
|
||||
regexp: "^/dev/mapper/centos-swap"
|
||||
line: "# /dev/mapper/centos-swap swap swap defaults 0 0"
|
||||
|
||||
# - name: enable port 6443/tcp
|
||||
# firewalld:
|
||||
# port: 6443/tcp
|
||||
# permanent: yes
|
||||
# state: enabled
|
||||
- name: activate kernel module
|
||||
shell: modprobe br_netfilter
|
||||
|
||||
# - name: enable port 10250/tcp
|
||||
# firewalld:
|
||||
# port: 10250/tcp
|
||||
# permanent: yes
|
||||
# state: enabled
|
||||
- name: enable bridge-nf-call-iptables
|
||||
sysctl:
|
||||
name: net.bridge.bridge-nf-call-iptables
|
||||
value: 1
|
||||
sysctl_set: yes
|
||||
state: present
|
||||
reload: yes
|
||||
|
||||
# - name: enable port 6443/udp
|
||||
# firewalld:
|
||||
# port: 6443/udp
|
||||
# permanent: yes
|
||||
# state: enabled
|
||||
- name: enable bridge-nf-call-ip6tables
|
||||
sysctl:
|
||||
name: net.bridge.bridge-nf-call-ip6tables
|
||||
value: 1
|
||||
sysctl_set: yes
|
||||
state: present
|
||||
reload: yes
|
||||
|
||||
# - name: enable port 10250/udp
|
||||
# firewalld:
|
||||
# port: 10250/udp
|
||||
# permanent: yes
|
||||
# state: enabled
|
||||
- name: enable ipv6 default forwarding
|
||||
sysctl:
|
||||
name: net.ipv6.conf.default.forwarding
|
||||
value: 1
|
||||
sysctl_set: yes
|
||||
state: present
|
||||
reload: yes
|
||||
|
||||
# ## reload firewalld after setting rules
|
||||
|
||||
# - name: reload firewalld
|
||||
# shell: firewall-cmd --reload
|
||||
|
||||
######################
|
||||
#### UPDATE TASKS ####
|
||||
######################
|
||||
|
||||
- name: upgrade all packages
|
||||
yum:
|
||||
name: '*'
|
||||
state: latest
|
||||
|
||||
######################
|
||||
#### KERNEL TASKS ####
|
||||
######################
|
||||
- name: add docker-ce yum repository
|
||||
shell: yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
|
||||
|
||||
|
||||
# TODO: get rid of inline http_proxy and fetch repo with the yum-repository ansible module
|
||||
- name: import elrepo gpg key
|
||||
shell: rpm -httpproxy http://[2001:470:6d:22c::1]:3128 --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
|
||||
- name: copy kubernetes repo config
|
||||
copy:
|
||||
src: ../files/kubernetes.repo
|
||||
dest: /etc/yum.repos.d/kubernetes.repo
|
||||
|
||||
- name: enable elrepo-release rpm
|
||||
shell: rpm -httpproxy http://[2001:470:6d:22c::1]:3128 -Uvh http://www.elrepo.org/elrepo-release-7.0-3.el7.elrepo.noarch.rpm
|
||||
- name: create cni config directory
|
||||
file:
|
||||
path: /etc/cni/net.d
|
||||
state: directory
|
||||
|
||||
# - name: Add repository
|
||||
# yum_repository:
|
||||
# name: elrepo-kernel
|
||||
# description: elrepo-release
|
||||
# baseurl: http://www.elrepo.org/elrepo-release-7.0-3.el7.elrepo.noarch.rpm
|
||||
# TODO: this
|
||||
# - name: copy cni config
|
||||
# template:
|
||||
# src: "../files/####CNI CONFIG####"
|
||||
# dest: /etc/cni/net.d/####CNI CONFIG####
|
||||
# owner: root
|
||||
# group: root
|
||||
# with_items: "{{ kubernetes }}"
|
||||
|
||||
- name: install mainline kernel
|
||||
shell: yum --enablerepo=elrepo-kernel install kernel-ml -y
|
||||
- name: install packages
|
||||
yum:
|
||||
name:
|
||||
- yum-utils
|
||||
- device-mapper-persistent-data
|
||||
- lvm2
|
||||
- docker-ce
|
||||
- kubelet
|
||||
- kubeadm
|
||||
- kubectl
|
||||
- kubernetes-cni
|
||||
state: present
|
||||
|
||||
- name: set default kernel version in grub
|
||||
lineinfile:
|
||||
dest: /etc/default/grub
|
||||
regexp: "^GRUB_DEFAULT"
|
||||
line: "GRUB_DEFAULT=0"
|
||||
- name: set cgroup
|
||||
lineinfile:
|
||||
dest: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
|
||||
regexp: "^cgroup-driver="
|
||||
line: "cgroup-driver=cgroupfs"
|
||||
|
||||
- name: write grub config
|
||||
shell: grub2-mkconfig -o /boot/grub2/grub.cfg
|
||||
- name: force systemd to reread configs and restart service docker
|
||||
systemd:
|
||||
name: docker
|
||||
enabled: yes
|
||||
state: restarted
|
||||
|
||||
####################
|
||||
#### MAIN TASKS ####
|
||||
####################
|
||||
- name: force systemd to reread configs and restart service kubelet
|
||||
systemd:
|
||||
name: kubelet
|
||||
enabled: yes
|
||||
state: restarted
|
||||
daemon_reload: yes
|
||||
|
||||
- name: permanently disable selinux
|
||||
lineinfile:
|
||||
dest: /etc/sysconfig/selinux
|
||||
regexp: "^SELINUX="
|
||||
line: "SELINUX=disabled"
|
||||
|
||||
- name: temporarily disable swap
|
||||
shell: swapoff -a
|
||||
|
||||
- name: permanently disable swap
|
||||
lineinfile:
|
||||
dest: /etc/fstab
|
||||
regexp: "^/dev/mapper/centos-swap"
|
||||
line: "# /dev/mapper/centos-swap swap swap defaults 0 0"
|
||||
|
||||
- name: activate kernel module
|
||||
shell: modprobe br_netfilter
|
||||
|
||||
- name: enable bridge-nf-call-iptables
|
||||
sysctl:
|
||||
name: net.bridge.bridge-nf-call-iptables
|
||||
value: 1
|
||||
sysctl_set: yes
|
||||
state: present
|
||||
reload: yes
|
||||
|
||||
- name: enable bridge-nf-call-ip6tables
|
||||
sysctl:
|
||||
name: net.bridge.bridge-nf-call-ip6tables
|
||||
value: 1
|
||||
sysctl_set: yes
|
||||
state: present
|
||||
reload: yes
|
||||
|
||||
- name: enable ipv6 default forwarding
|
||||
sysctl:
|
||||
name: net.ipv6.conf.default.forwarding
|
||||
value: 1
|
||||
sysctl_set: yes
|
||||
state: present
|
||||
reload: yes
|
||||
|
||||
- name: add docker-ce yum repository
|
||||
shell: yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
|
||||
|
||||
|
||||
- name: copy kubernetes repo config
|
||||
copy:
|
||||
src: ../files/kubernetes.repo
|
||||
dest: /etc/yum.repos.d/kubernetes.repo
|
||||
|
||||
- name: install packages
|
||||
yum:
|
||||
name:
|
||||
- yum-utils
|
||||
- device-mapper-persistent-data
|
||||
- lvm2
|
||||
- docker-ce
|
||||
- kubelet
|
||||
- kubeadm
|
||||
- kubectl
|
||||
state: present
|
||||
|
||||
- name: set cgroup
|
||||
lineinfile:
|
||||
dest: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
|
||||
regexp: "^cgroup-driver="
|
||||
line: "cgroup-driver=cgroupfs"
|
||||
|
||||
- name: force systemd to reread configs and restart service kubelet
|
||||
systemd:
|
||||
name: docker
|
||||
enabled: yes
|
||||
state: restarted
|
||||
|
||||
- name: force systemd to reread configs and restart service kubelet
|
||||
systemd:
|
||||
name: kubelet
|
||||
enabled: yes
|
||||
state: restarted
|
||||
daemon_reload: yes
|
||||
|
||||
- name: reboot
|
||||
reboot:
|
||||
- name: reboot
|
||||
reboot:
|
||||
30
roles/kubernetes/tasks/update_kernel.yml
Normal file
30
roles/kubernetes/tasks/update_kernel.yml
Normal file
@ -0,0 +1,30 @@
|
||||
---
|
||||
######################
|
||||
#### KERNEL TASKS ####
|
||||
######################
|
||||
|
||||
|
||||
# TODO: get rid of inline http_proxy and fetch repo with the yum-repository ansible module
|
||||
- name: import elrepo gpg key
|
||||
shell: rpm -httpproxy http://[2001:470:6d:22c::1]:3128 --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
|
||||
|
||||
- name: enable elrepo-release rpm
|
||||
shell: rpm -httpproxy http://[2001:470:6d:22c::1]:3128 -Uvh http://www.elrepo.org/elrepo-release-7.0-3.el7.elrepo.noarch.rpm
|
||||
|
||||
# - name: Add repository
|
||||
# yum_repository:
|
||||
# name: elrepo-kernel
|
||||
# description: elrepo-release
|
||||
# baseurl: http://www.elrepo.org/elrepo-release-7.0-3.el7.elrepo.noarch.rpm
|
||||
|
||||
- name: install mainline kernel
|
||||
shell: yum --enablerepo=elrepo-kernel install kernel-ml -y
|
||||
|
||||
- name: set default kernel version in grub
|
||||
lineinfile:
|
||||
dest: /etc/default/grub
|
||||
regexp: "^GRUB_DEFAULT"
|
||||
line: "GRUB_DEFAULT=0"
|
||||
|
||||
- name: write grub config
|
||||
shell: grub2-mkconfig -o /boot/grub2/grub.cfg
|
||||
@ -1,67 +1,56 @@
|
||||
---
|
||||
- name: install packages
|
||||
yum:
|
||||
name:
|
||||
- libvirt-devel
|
||||
- git
|
||||
- gcc
|
||||
- unzip
|
||||
state: present
|
||||
become: yes
|
||||
|
||||
- name: download and install terraform 0.11.11 release
|
||||
unarchive:
|
||||
src: https://releases.hashicorp.com/terraform/0.11.11/terraform_0.11.11_linux_amd64.zip
|
||||
dest: /usr/local/bin
|
||||
remote_src: yes
|
||||
become: yes
|
||||
- name: remove files and directories
|
||||
file:
|
||||
path: "/home/{{ ansible_ssh_user }}/terraform/"
|
||||
state: "{{ item }}"
|
||||
with_items:
|
||||
- absent
|
||||
- directory
|
||||
|
||||
- name: download and install golang 1.11.4 release
|
||||
unarchive:
|
||||
src: https://dl.google.com/go/go1.11.4.linux-amd64.tar.gz
|
||||
dest: /usr/local
|
||||
remote_src: yes
|
||||
become: yes
|
||||
- name: "download qcow2 cloud image"
|
||||
copy:
|
||||
src: "/home/{{ ansible_ssh_user }}/images/{{ source_cloud_image_name }}"
|
||||
dest: "/home/{{ ansible_ssh_user }}/terraform/{{ source_cloud_image_name }}"
|
||||
remote_src: yes
|
||||
|
||||
- name: export path
|
||||
lineinfile:
|
||||
path: /etc/profile
|
||||
regexp: '^export PATH=$PATH:/usr/local/go/bin'
|
||||
line: 'export PATH=$PATH:/usr/local/go/bin'
|
||||
become: yes
|
||||
- name: create vm definitions
|
||||
template:
|
||||
src: "../files/cloud-init.tf.j2"
|
||||
dest: "/home/{{ ansible_ssh_user }}/terraform/{{ item.hostname }}.tf"
|
||||
owner: "{{ ansible_ssh_user }}"
|
||||
group: "{{ ansible_ssh_user }}"
|
||||
with_items: "{{ kubernetes }}"
|
||||
|
||||
- name: go get terraform-provider-libvirt
|
||||
shell: /usr/local/go/bin/go get github.com/dmacvicar/terraform-provider-libvirt
|
||||
- name: create cloud-init config
|
||||
template:
|
||||
src: "../files/cloud-init.cfg.j2"
|
||||
dest: "/home/{{ ansible_ssh_user }}/terraform/{{ item.hostname }}.cloud_init.cfg"
|
||||
owner: "{{ ansible_ssh_user }}"
|
||||
group: "{{ ansible_ssh_user }}"
|
||||
with_items: "{{ kubernetes }}"
|
||||
|
||||
- name: go install terraform-provider-libvirt
|
||||
shell: /usr/local/go/bin/go install
|
||||
args:
|
||||
chdir: /home/{{ remote_user }}/go/src/github.com/dmacvicar/terraform-provider-libvirt
|
||||
- name: create cloud-init network config
|
||||
template:
|
||||
src: "../files/cloud-init-network.cfg.j2"
|
||||
dest: "/home/{{ ansible_ssh_user }}/terraform/{{ item.hostname }}.cloud_init_network.cfg"
|
||||
owner: "{{ ansible_ssh_user }}"
|
||||
group: "{{ ansible_ssh_user }}"
|
||||
with_items: "{{ kubernetes }}"
|
||||
|
||||
- name: create terraform config directory
|
||||
file:
|
||||
path: /home/{{ remote_user }}/.terraform.d/
|
||||
state: directory
|
||||
- name: create libvirt_provider config
|
||||
template:
|
||||
src: "../files/libvirt_provider.tf.j2"
|
||||
dest: "/home/{{ ansible_ssh_user }}/terraform/libvirt_provider.tf"
|
||||
owner: "{{ ansible_ssh_user }}"
|
||||
group: "{{ ansible_ssh_user }}"
|
||||
|
||||
- name: create terraform plugin directory
|
||||
file:
|
||||
path: /home/{{ remote_user }}/.terraform.d/plugins
|
||||
state: directory
|
||||
- name: initialize terraform
|
||||
shell: terraform init
|
||||
args:
|
||||
chdir: /home/{{ ansible_ssh_user }}/terraform/
|
||||
|
||||
- name: install terraform-provider-libvirt
|
||||
copy:
|
||||
src: /home/{{ remote_user }}/go/bin/terraform-provider-libvirt
|
||||
dest: /home/{{ remote_user }}/.terraform.d/plugins/terraform-provider-libvirt
|
||||
mode: 0777
|
||||
owner: {{ remote_user }}
|
||||
remote_src: yes
|
||||
|
||||
- name: delete terraform directory
|
||||
file:
|
||||
path: /home/{{ remote_user }}/terraform
|
||||
state: absent
|
||||
|
||||
- name: create terraform directory
|
||||
file:
|
||||
path: /home/{{ remote_user }}/terraform
|
||||
state: directory
|
||||
- name: terraform deploy
|
||||
terraform:
|
||||
project_path: /home/{{ ansible_ssh_user }}/terraform
|
||||
state: present
|
||||
|
||||
Loading…
Reference in New Issue
Block a user