mirror of
https://github.com/dredx/prole.git
synced 2026-09-27 08:54:30 +00:00
26cac12759
- Refactor k3s/kube_config.sh to fetch remote kubeconfig and configure local context. - Add Ansible task svc_check.yml to deploy a status site via Kong and cert-manager. - Include svc_check.yml in k3s role's main tasks.
198 lines
5.6 KiB
YAML
198 lines
5.6 KiB
YAML
---
|
|
# Deploy a tiny static check site and route it through Kong as svc.prole.org
|
|
|
|
- name: Ensure cert-manager CRDs exist for ACME
|
|
ansible.builtin.command: k3s kubectl get crd certificates.cert-manager.io
|
|
register: svc_check_certmgr
|
|
changed_when: false
|
|
failed_when: svc_check_certmgr.rc != 0
|
|
run_once: true
|
|
|
|
- name: Read prole type gif (controller)
|
|
ansible.builtin.slurp:
|
|
src: "{{ playbook_dir }}/../../img/prole-type.gif"
|
|
register: svc_check_gif
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
|
|
- name: Set ACME contact email (defaults to admin@prole.org)
|
|
ansible.builtin.set_fact:
|
|
svc_check_acme_email: "{{ letsencrypt_email | default('admin@prole.org') }}"
|
|
run_once: true
|
|
|
|
- name: Deploy svc-check site, Kong config, and ingress
|
|
ansible.builtin.shell: |
|
|
k3s kubectl apply -f - <<'EOF'
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: svc-check
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: svc-check-content
|
|
namespace: svc-check
|
|
data:
|
|
index.html: |
|
|
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<title>svc.prole.org</title>
|
|
<style>
|
|
:root { font-family: "Helvetica Neue", Arial, sans-serif; background:#0f1419; color:#f5f7fa; }
|
|
body { margin:0; display:flex; min-height:100vh; align-items:center; justify-content:center; }
|
|
.wrap { text-align:center; padding:32px 40px; background:#1b2330; border:1px solid #2c3645; border-radius:18px; box-shadow:0 18px 38px rgba(0,0,0,0.35); }
|
|
img { max-width:320px; width:70vw; border-radius:12px; box-shadow:0 6px 18px rgba(0,0,0,0.35); }
|
|
h1 { margin:18px 0 8px; letter-spacing:0.5px; font-size:22px; }
|
|
p { margin:0; color:#9fb3c8; font-size:14px; }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<div class="wrap">
|
|
<img src="/prole-type.gif" alt="Prole type" />
|
|
<h1>svc.prole.org</h1>
|
|
<p>served by k3s → Kong on myrddin.prole.org</p>
|
|
</div>
|
|
</body>
|
|
</html>
|
|
binaryData:
|
|
prole-type.gif: {{ svc_check_gif.content | trim | quote }}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: svc-check-web
|
|
namespace: svc-check
|
|
labels:
|
|
app: svc-check-web
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: svc-check-web
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: svc-check-web
|
|
spec:
|
|
containers:
|
|
- name: nginx
|
|
image: nginx:1.27-alpine
|
|
ports:
|
|
- name: http
|
|
containerPort: 80
|
|
volumeMounts:
|
|
- name: content
|
|
mountPath: /usr/share/nginx/html
|
|
volumes:
|
|
- name: content
|
|
configMap:
|
|
name: svc-check-content
|
|
items:
|
|
- key: index.html
|
|
path: index.html
|
|
- key: prole-type.gif
|
|
path: prole-type.gif
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: svc-check-web
|
|
namespace: svc-check
|
|
labels:
|
|
app: svc-check-web
|
|
spec:
|
|
selector:
|
|
app: svc-check-web
|
|
ports:
|
|
- name: http
|
|
port: 80
|
|
targetPort: http
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt-prod
|
|
spec:
|
|
acme:
|
|
email: {{ svc_check_acme_email }}
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
privateKeySecretRef:
|
|
name: letsencrypt-prod
|
|
solvers:
|
|
- http01:
|
|
ingress:
|
|
class: traefik
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: prole-db-kong-config
|
|
namespace: prole-db
|
|
data:
|
|
kong.yml: |
|
|
_format_version: "3.0"
|
|
_transform: true
|
|
services:
|
|
- name: db-manager
|
|
url: http://prole-db-manager.prole-db.svc.cluster.local:80
|
|
routes:
|
|
- name: backup-route
|
|
paths:
|
|
- /backup
|
|
strip_path: false
|
|
- name: kubeconfig
|
|
url: http://prole-svc.prole-db.svc.cluster.local:8080
|
|
routes:
|
|
- name: kubeconfig
|
|
paths:
|
|
- /k3s/kube_config.sh
|
|
- name: svc-check
|
|
url: http://svc-check-web.svc-check.svc.cluster.local:80
|
|
routes:
|
|
- name: svc-check-root
|
|
hosts:
|
|
- svc.prole.org
|
|
paths:
|
|
- /
|
|
strip_path: false
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: svc-prole-ingress
|
|
namespace: prole-db
|
|
annotations:
|
|
kubernetes.io/ingress.class: traefik
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.priority: "10"
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- svc.prole.org
|
|
secretName: svc-prole-org-tls
|
|
rules:
|
|
- host: svc.prole.org
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: prole-db-kong
|
|
port:
|
|
number: 8000
|
|
EOF
|
|
args:
|
|
executable: /bin/bash
|
|
run_once: true
|
|
|
|
- name: Restart Kong to reload declarative config
|
|
ansible.builtin.shell: k3s kubectl rollout restart deployment/prole-db-kong -n prole-db
|
|
changed_when: true
|
|
run_once: true
|