mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 12:03:59 +00:00
b8a55888be
Summarize CLAUDE.md updates: - Document both live GKE clusters as e2-standard-2 x3 in us-west3 and note stale app default in code. - Call out DB cluster naming mismatch between conf (knoe-dev-cnpg-0) and code default (knoe-cnpg-0). - Add SSD quota guidance: 300GB fully consumed by CNPG, so non-CNPG PVCs must use standard/pd-standard. - Refresh reset script reference and quota section details to match current runtime state. Co-authored-by: Junie <junie@jetbrains.com>
233 lines
5.4 KiB
YAML
233 lines
5.4 KiB
YAML
---
|
|
# Runbook tiers (systemd-like startup ordering):
|
|
# 1) boot / kernel
|
|
# 2) storage: iscsi auth, iscsi login
|
|
# 3) filesystem mount
|
|
# 4) OS configuration (e.g., samba)
|
|
# 5) OS package installation (k3s)
|
|
# 6) OS package configuration (helm/kubectl apply)
|
|
#
|
|
# This playbook is intentionally ordered so each tier fully completes before
|
|
# moving on to the next tier.
|
|
|
|
- name: Tier 1 - Boot / kernel (cgroups)
|
|
hosts: k3s_hosts
|
|
gather_facts: false
|
|
become: true
|
|
serial: 1
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
roles:
|
|
- cgroups
|
|
|
|
- name: Tier 1.5 - Quiesce k3s and detach migrated iSCSI LUNs (myrddin)
|
|
hosts: myrddin.prole.org
|
|
gather_facts: false
|
|
become: true
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
tasks:
|
|
- name: Check if k3s systemd unit exists
|
|
ansible.builtin.stat:
|
|
path: /etc/systemd/system/k3s.service
|
|
register: _k3s_unit
|
|
|
|
- name: Stop k3s (quiesce before iSCSI detach)
|
|
ansible.builtin.systemd:
|
|
name: k3s
|
|
state: stopped
|
|
when:
|
|
- not ansible_check_mode
|
|
- _k3s_unit.stat.exists | default(false)
|
|
- (iscsi_absent_mounts | default([]) | length) > 0 or (iscsi_absent_targets | default([]) | length) > 0
|
|
|
|
- name: Detach migrated iSCSI targets/mounts (best-effort cleanup)
|
|
ansible.builtin.import_role:
|
|
name: iscsi
|
|
tasks_from: detach
|
|
when:
|
|
- (iscsi_absent_mounts | default([]) | length) > 0 or (iscsi_absent_targets | default([]) | length) > 0
|
|
|
|
- name: Tier 2 - Storage (iSCSI auth/login)
|
|
hosts: iscsi
|
|
gather_facts: false
|
|
become: true
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
tasks:
|
|
- name: iSCSI auth/login
|
|
ansible.builtin.import_role:
|
|
name: iscsi
|
|
tasks_from: login
|
|
|
|
- name: Tier 3 - Filesystem mounts (iSCSI)
|
|
hosts: iscsi
|
|
gather_facts: false
|
|
become: true
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
tasks:
|
|
- name: iSCSI mounts
|
|
ansible.builtin.import_role:
|
|
name: iscsi
|
|
tasks_from: mount
|
|
|
|
- name: Tier 4 - OS configuration (Pi-hole DNS and resilience)
|
|
hosts: pihole
|
|
gather_facts: false
|
|
become: true
|
|
tags:
|
|
- pihole
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
roles:
|
|
- pihole_dns
|
|
|
|
- name: Tier 4 - OS configuration (Samba AD DNS reverse zones and PTRs)
|
|
hosts: ad_dc
|
|
gather_facts: false
|
|
become: true
|
|
tags:
|
|
- samba
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
roles:
|
|
- samba_ad_dc
|
|
- samba_dns
|
|
- samba_reverse_dns
|
|
|
|
- name: Tier 4 - OS configuration (base linux)
|
|
hosts: linux_hosts
|
|
gather_facts: false
|
|
become: true
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
roles:
|
|
- role: netplan_static
|
|
when: netplan_static_enabled | default(false) | bool
|
|
- local_user
|
|
- rsyslog
|
|
- prole
|
|
|
|
- name: Tier 4.1 - OS configuration (Prole SSL certs)
|
|
hosts: ssl_hosts
|
|
gather_facts: false
|
|
become: true
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
roles:
|
|
- prole_ssl
|
|
|
|
- name: Tier 4 - OS configuration (console dashboard)
|
|
hosts: k3s_hosts
|
|
gather_facts: false
|
|
become: true
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
roles:
|
|
- dashboard
|
|
|
|
- name: Tier 4.5 - Database (MariaDB primary)
|
|
hosts: mariadb_primary
|
|
gather_facts: false
|
|
become: true
|
|
serial: 1
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
roles:
|
|
- mariadb_primary
|
|
|
|
- name: Tier 4.6 - Database (MariaDB replica)
|
|
hosts: mariadb_replica
|
|
gather_facts: false
|
|
become: true
|
|
serial: 1
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
roles:
|
|
- mariadb_replica
|
|
|
|
- name: Tier 5 - OS package installation (k3s)
|
|
hosts: k3s_hosts
|
|
gather_facts: false
|
|
become: true
|
|
serial: 1
|
|
tags: [k3s]
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
tasks:
|
|
- name: Install and start k3s
|
|
ansible.builtin.import_role:
|
|
name: k3s
|
|
tasks_from: install
|
|
|
|
- name: Tier 5.5 - Kubernetes node operations (labels)
|
|
hosts: k3s_servers
|
|
gather_facts: false
|
|
become: true
|
|
serial: 1
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
tasks:
|
|
- name: Persist Kubernetes node labels (post-provisioning)
|
|
ansible.builtin.import_role:
|
|
name: k3s
|
|
tasks_from: label_nodes
|
|
when: (k3s_node_labels | default({}) | length) > 0
|
|
|
|
- name: Tier 6 - OS package configuration (helm/kubectl apply)
|
|
hosts: k3s_hosts
|
|
gather_facts: false
|
|
become: true
|
|
serial: 1
|
|
tags: [k3s]
|
|
pre_tasks:
|
|
- name: Gather minimal facts
|
|
ansible.builtin.setup:
|
|
gather_subset:
|
|
- min
|
|
tasks:
|
|
- name: Configure k3s add-ons
|
|
ansible.builtin.import_role:
|
|
name: k3s
|
|
tasks_from: configure
|