mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 15:04:31 +00:00
56806984bc
- k3s_sync: choose any server as sync source fallback; refresh kubeconfig and validate nodes\n- fetch_kubeconfig: save to prole-k3s.kubeconfig and etc/secrets/k3s.kubeconfig\n- k3s sync: sync server URL into config.yaml; restore TLS bundle only on servers\n- cert-manager/ACME: wait for CNI/webhook readiness; retry ClusterIssuer/Certificate apply\n- inventory: tune myrddin control-plane timing args; add render test\n- misc: update port mappings and prole-db manifests/version Co-authored-by: Junie <junie@jetbrains.com>
105 lines
3.8 KiB
YAML
105 lines
3.8 KiB
YAML
---
|
|
|
|
- name: Build kubeconfig fetch candidates
|
|
ansible.builtin.set_fact:
|
|
k3s_kubeconfig_source_candidates: "{{ groups['k3s_hosts'] | default([inventory_hostname]) }}"
|
|
|
|
- name: Initialize kubeconfig source host
|
|
ansible.builtin.set_fact:
|
|
k3s_kubeconfig_source_host: ""
|
|
|
|
- name: Select k3s init server as kubeconfig source (preferred)
|
|
ansible.builtin.set_fact:
|
|
k3s_kubeconfig_source_host: "{{ item }}"
|
|
loop: "{{ k3s_kubeconfig_source_candidates }}"
|
|
when:
|
|
- (k3s_kubeconfig_source_host | length) == 0
|
|
- hostvars[item].k3s_role | default('agent') == 'server'
|
|
- hostvars[item].k3s_cluster_init | default(false) | bool
|
|
|
|
- name: Fallback to first k3s server as kubeconfig source
|
|
ansible.builtin.set_fact:
|
|
k3s_kubeconfig_source_host: "{{ item }}"
|
|
loop: "{{ k3s_kubeconfig_source_candidates }}"
|
|
when:
|
|
- (k3s_kubeconfig_source_host | length) == 0
|
|
- hostvars[item].k3s_role | default('agent') == 'server'
|
|
|
|
- name: Final fallback to current host as kubeconfig source
|
|
ansible.builtin.set_fact:
|
|
k3s_kubeconfig_source_host: "{{ inventory_hostname }}"
|
|
when: (k3s_kubeconfig_source_host | length) == 0
|
|
|
|
- name: Require kubeconfig source host
|
|
ansible.builtin.assert:
|
|
that:
|
|
- (k3s_kubeconfig_source_host | length) > 0
|
|
fail_msg: "Unable to select a k3s kubeconfig source host."
|
|
|
|
- name: Determine kubeconfig API server URL
|
|
ansible.builtin.set_fact:
|
|
k3s_kubeconfig_api_server: >-
|
|
{{ (k3s_server_url | trim) if (k3s_server_url | default('') | trim | length) > 0
|
|
else 'https://' ~ k3s_kubeconfig_source_host ~ ':6443' }}
|
|
|
|
- name: Read k3s kubeconfig from source node
|
|
ansible.builtin.slurp:
|
|
src: /etc/rancher/k3s/k3s.yaml
|
|
register: _k3s_kubeconfig_raw
|
|
delegate_to: "{{ k3s_kubeconfig_source_host }}"
|
|
become: true
|
|
|
|
- name: Rewrite kubeconfig server to primary endpoint
|
|
ansible.builtin.set_fact:
|
|
k3s_kubeconfig_rendered: >-
|
|
{{ _k3s_kubeconfig_raw.content
|
|
| b64decode
|
|
| regex_replace('server:\s*https?://\S+', 'server: ' ~ k3s_kubeconfig_api_server) }}
|
|
|
|
- name: Validate rendered kubeconfig YAML (controller-side scripts depend on this)
|
|
ansible.builtin.set_fact:
|
|
_k3s_kubeconfig_parsed: "{{ k3s_kubeconfig_rendered | from_yaml }}"
|
|
changed_when: false
|
|
|
|
- name: Require kubeconfig to contain required keys
|
|
ansible.builtin.assert:
|
|
that:
|
|
- _k3s_kubeconfig_parsed is mapping
|
|
- (_k3s_kubeconfig_parsed.clusters | default([])) | length > 0
|
|
- (_k3s_kubeconfig_parsed.contexts | default([])) | length > 0
|
|
- (_k3s_kubeconfig_parsed.users | default([])) | length > 0
|
|
- (_k3s_kubeconfig_parsed['current-context'] | default('') | length) > 0
|
|
fail_msg: >-
|
|
Rendered kubeconfig is invalid or missing required keys. Refusing to save
|
|
kubeconfig to the controller.
|
|
|
|
- name: Define controller kubeconfig destinations
|
|
ansible.builtin.set_fact:
|
|
k3s_kubeconfig_controller_project_path: "{{ playbook_dir }}/../../prole-k3s.kubeconfig"
|
|
k3s_kubeconfig_controller_service_path: "{{ playbook_dir }}/../../etc/secrets/k3s.kubeconfig"
|
|
changed_when: false
|
|
|
|
- name: Ensure controller kubeconfig directory exists (service path)
|
|
ansible.builtin.file:
|
|
path: "{{ k3s_kubeconfig_controller_service_path | dirname }}"
|
|
state: directory
|
|
mode: "0700"
|
|
delegate_to: localhost
|
|
become: false
|
|
|
|
- name: Save kubeconfig locally for controller-side init scripts (project root)
|
|
ansible.builtin.copy:
|
|
content: "{{ k3s_kubeconfig_rendered }}"
|
|
dest: "{{ k3s_kubeconfig_controller_project_path }}"
|
|
mode: "0600"
|
|
delegate_to: localhost
|
|
become: false
|
|
|
|
- name: Save kubeconfig locally for controller-side init scripts (etc/secrets)
|
|
ansible.builtin.copy:
|
|
content: "{{ k3s_kubeconfig_rendered }}"
|
|
dest: "{{ k3s_kubeconfig_controller_service_path }}"
|
|
mode: "0600"
|
|
delegate_to: localhost
|
|
become: false
|