mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 10:13:58 +00:00
abc458260c
Provisions the docker engine on [build_hosts] (gandalf) for the native arm64 daily knoe-db image build → registry.knoe.dev, run via a remote buildx builder. gandalf is also a k3s_agent, so the role holds iptables FORWARD=ACCEPT to protect k3s pod networking (docker's containerd coexists with k3s's on separate sockets). Verified idempotent: --check against gandalf = ok=5, changed=0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
36 lines
1.4 KiB
YAML
36 lines
1.4 KiB
YAML
---
|
|
# docker_build_host — provision the docker engine on an arm64 build host (e.g. gandalf)
|
|
# for the native arm64 daily knoe-db image build (push → registry.knoe.dev). Builds run
|
|
# in a remote buildx builder (buildkit container) on this host; the dev workstation only
|
|
# orchestrates over ssh.
|
|
#
|
|
# These hosts double as k3s agents, so docker's own containerd coexists with k3s's
|
|
# embedded containerd (separate sockets: /run/containerd vs /run/k3s/containerd). The one
|
|
# real hazard is docker flipping the iptables FORWARD policy to DROP, which would sever
|
|
# k3s pod networking — so we hold it at ACCEPT. We deliberately let docker manage its own
|
|
# NAT/iptables otherwise, because the buildkit container needs outbound for registry pulls.
|
|
|
|
- name: Install docker engine (docker.io)
|
|
ansible.builtin.apt:
|
|
name: docker.io
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Add the ansible user to the docker group (so buildx can drive docker over ssh)
|
|
ansible.builtin.user:
|
|
name: "{{ ansible_user | default('ansible') }}"
|
|
groups: docker
|
|
append: true
|
|
|
|
- name: Ensure docker is enabled and running
|
|
ansible.builtin.service:
|
|
name: docker
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Hold the iptables FORWARD policy at ACCEPT (protect k3s pod networking from docker)
|
|
ansible.builtin.iptables:
|
|
chain: FORWARD
|
|
policy: ACCEPT
|
|
when: "'k3s_agents' in group_names or 'k3s_servers' in group_names"
|