mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 15:54:32 +00:00
598eae4633
- Add ssl_hosts group and prole_ssl role to deploy registry cert/key to /etc/ssl/certs/prole - Configure k8s registry deployment to serve HTTPS using mounted host certs - Switch k3s/containerd registry mirror config to https:// and prefer HTTPS checks with HTTP fallback Co-authored-by: Junie <junie@jetbrains.com>
198 lines
4.3 KiB
YAML
198 lines
4.3 KiB
YAML
---
|
|
# Runbook tiers (systemd-like startup ordering):
|
|
# 1) boot / kernel
|
|
# 2) storage: iscsi auth, iscsi login
|
|
# 3) filesystem mount
|
|
# 4) OS configuration (e.g., samba)
|
|
# 5) OS package installation (k3s)
|
|
# 6) OS package configuration (helm/kubectl apply)
|
|
#
|
|
# This playbook is intentionally ordered so each tier fully completes before
|
|
# moving on to the next tier.
|
|
|
|
- name: Tier 1 - Boot / kernel (cgroups)
|
|
hosts: k3s_hosts
|
|
gather_facts: false
|
|
become: true
|
|
serial: 1
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
roles:
|
|
- cgroups
|
|
|
|
- name: Tier 2 - Storage (iSCSI auth/login)
|
|
hosts: iscsi
|
|
gather_facts: false
|
|
become: true
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
tasks:
|
|
- name: iSCSI auth/login
|
|
ansible.builtin.import_role:
|
|
name: iscsi
|
|
tasks_from: login
|
|
|
|
- name: Tier 3 - Filesystem mounts (iSCSI)
|
|
hosts: iscsi
|
|
gather_facts: false
|
|
become: true
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
tasks:
|
|
- name: iSCSI mounts
|
|
ansible.builtin.import_role:
|
|
name: iscsi
|
|
tasks_from: mount
|
|
|
|
- name: Tier 4 - OS configuration (Pi-hole DNS and resilience)
|
|
hosts: pihole
|
|
gather_facts: false
|
|
become: true
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
roles:
|
|
- pihole_dns
|
|
|
|
- name: Tier 4 - OS configuration (Samba AD DNS reverse zones and PTRs)
|
|
hosts: ad_dc
|
|
gather_facts: false
|
|
become: true
|
|
tags:
|
|
- samba
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
roles:
|
|
- samba_ad_dc
|
|
- samba_dns
|
|
- samba_reverse_dns
|
|
|
|
- name: Tier 4 - OS configuration (base linux)
|
|
hosts: linux_hosts
|
|
gather_facts: false
|
|
become: true
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
roles:
|
|
- role: netplan_static
|
|
when: netplan_static_enabled | default(false) | bool
|
|
- local_user
|
|
- rsyslog
|
|
- prole
|
|
|
|
- name: Tier 4.1 - OS configuration (Prole SSL certs)
|
|
hosts: ssl_hosts
|
|
gather_facts: false
|
|
become: true
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
roles:
|
|
- prole_ssl
|
|
|
|
- name: Tier 4 - OS configuration (console dashboard)
|
|
hosts: k3s_hosts
|
|
gather_facts: false
|
|
become: true
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
roles:
|
|
- dashboard
|
|
|
|
- name: Tier 4.5 - Database (MariaDB primary)
|
|
hosts: mariadb_primary
|
|
gather_facts: false
|
|
become: true
|
|
serial: 1
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
roles:
|
|
- mariadb_primary
|
|
|
|
- name: Tier 4.6 - Database (MariaDB replica)
|
|
hosts: mariadb_replica
|
|
gather_facts: false
|
|
become: true
|
|
serial: 1
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
roles:
|
|
- mariadb_replica
|
|
|
|
- name: Tier 5 - OS package installation (k3s)
|
|
hosts: k3s_hosts
|
|
gather_facts: false
|
|
become: true
|
|
serial: 1
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
tasks:
|
|
- name: Install and start k3s
|
|
ansible.builtin.import_role:
|
|
name: k3s
|
|
tasks_from: install
|
|
|
|
- name: Tier 5.5 - Kubernetes node operations (labels)
|
|
hosts: k3s_servers
|
|
gather_facts: false
|
|
become: true
|
|
serial: 1
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
tasks:
|
|
- name: Persist Kubernetes node labels (post-provisioning)
|
|
ansible.builtin.import_role:
|
|
name: k3s
|
|
tasks_from: label_nodes
|
|
when: (k3s_node_labels | default({}) | length) > 0
|
|
|
|
- name: Tier 6 - OS package configuration (helm/kubectl apply)
|
|
hosts: k3s_hosts
|
|
gather_facts: false
|
|
become: true
|
|
serial: 1
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
tasks:
|
|
- name: Configure k3s add-ons
|
|
ansible.builtin.import_role:
|
|
name: k3s
|
|
tasks_from: configure
|