DEV-548: testcluster

group_vars/all/firewall.yml

@@ -97,11 +97,11 @@ hcloud_firewall_objects:
      -
        type: label_selector
        label_selector:
-         selector: 'service=connect'
+         selector: 'stage={{ stage }},service=connect'
      -
        type: label_selector
        label_selector:
-         selector: 'service=keycloak'
+         selector: 'stage={{ stage }},service=keycloak'
 
 hcloud_firewall_objects_awx:
    -
@@ -119,7 +119,7 @@ hcloud_firewall_objects_awx:
      -
        type: label_selector
        label_selector:
-         selector: 'stage={{ stage }}'
+         selector: 'stage={{ stage }},service=awx'
 
 hcloud_firewall_objects_backup:
    -
@@ -138,7 +138,7 @@ hcloud_firewall_objects_backup:
      -
        type: label_selector
        label_selector:
-         selector: 'service=backup'
+         selector: 'stage={{ stage }},service=backup'
 
 hcloud_firewall_objects_gitea:
    -
@@ -170,7 +170,7 @@ hcloud_firewall_objects_gitea:
      -
        type: label_selector
        label_selector:
-         selector: 'service=gitea'
+         selector: 'stage={{ stage }},service=gitea'
 
 hcloud_firewall_objects_keycloak:
    -
@@ -202,7 +202,7 @@ hcloud_firewall_objects_keycloak:
      -
        type: label_selector
        label_selector:
-         selector: 'service=keycloak'
+         selector: 'stage={{ stage }},service=keycloak'
 
 hcloud_firewall_objects_kibana:
    -
@@ -234,7 +234,7 @@ hcloud_firewall_objects_kibana:
      -
        type: label_selector
        label_selector:
-         selector: 'service=kibana'
+         selector: 'stage={{ stage }},service=kibana'
 
 hcloud_firewall_objects_management:
    -
@@ -266,4 +266,4 @@ hcloud_firewall_objects_management:
      -
        type: label_selector
        label_selector:
-         selector: 'service=connect,tenant=management'
+         selector: 'stage={{ stage }},service=connect,tenant=management'

kubernetes.yml

@@ -30,11 +30,15 @@
     - role: kubernetes/prometheus
       tags:
         - prometheus
-    - { role: kubernetes/cert_manager }
+      when: kubernetes_with_prometheus | default(True)
+    - role: kubernetes/cert_manager
+      when: kubernetes_with_certmanager | default(True)
     - role: kubernetes/external_dns
+      when: kubernetes_with_extdns | default(True)
       tags:
         - external-dns
-    - { role: kubernetes/ingress_controller }
+    - role: kubernetes/ingress_controller
+      when: kubernetes_with_ingress | default(True)
     - role: kubernetes/argocd
       when: kubernetes_with_argocd | default(True)
       tags:

roles/hcloud/tasks/configure-firewall2.yml

@@ -2,7 +2,7 @@
 - name: "Get all existing firewalls"
   uri:
     method: GET
-    url: "https://api.hetzner.cloud/v1/firewalls"
+    url: "https://api.hetzner.cloud/v1/firewalls?per_page=1000"
     body_format: json
     headers:
       accept: application/json

roles/kubernetes/argocd/defaults/main.yml

@@ -28,7 +28,7 @@ argo_realm_users: [
     "requiredActions": []
   }
 ]
-argocd_server_admin_password: "{{ argocd_server_admin_password_vault }}"
+argocd_server_admin_password: "{{ argocd_server_admin_password_vault | default( lookup('community.general.random_string', length=20) ) }}"
 
 # https://github.com/argoproj/argo-helm/tree/master/charts/argo-cd
 k8s_argocd_helm__release_values:

roles/kubernetes/argocd/tasks/main.yml

@@ -1,4 +1,7 @@
 ---
+
+- name: "Do some stuff with keycloak as OIDC provider"
+  block:
   - name: "Login with keycloak-admin"
     include_role:
       name: keycloak
@@ -8,7 +11,6 @@
         tags:
           - argo-cd
     when:
-  - k8s_argocd_with_keycloak
     tags:
       - argo-cd
 
@@ -22,7 +24,6 @@
       create_client: False
       current_realm_password_policy: ''
     when:
-  - k8s_argocd_with_keycloak
     - inventory_hostname == groups['kube_control_plane'][0]
     args:
       apply:
@@ -41,7 +42,6 @@
       current_realm_groups:
         - name: "{{ argo_realm_group }}"
     when:
-  - k8s_argocd_with_keycloak
     - inventory_hostname == groups['kube_control_plane'][0]
     args:
       apply:
@@ -58,7 +58,6 @@
       current_realm_name: '{{ argo_realm_name }}'
       current_realm_users: '{{ argo_realm_users }}'
     when:
-  - k8s_argocd_with_keycloak
     - inventory_hostname == groups['kube_control_plane'][0]
     args:
       apply:
@@ -77,7 +76,6 @@
       realm_name: '{{ argo_realm_name }}'
       bearer_token: '{{ access_token }}'
     when:
-  - k8s_argocd_with_keycloak
     - inventory_hostname == groups['kube_control_plane'][0]
     args:
       apply:
@@ -109,7 +107,6 @@
           protocol: openid-connect
           protocolMapper: oidc-group-membership-mapper
     when:
-  - k8s_argocd_with_keycloak
     - inventory_hostname == groups['kube_control_plane'][0]
     tags:
       - argo-cd
@@ -131,8 +128,6 @@
       keycloak_clientscope_name: '{{ argo_keycloak_clientscope_name }}'
       keycloak_clientscope_protocol: '{{ argo_keycloak_clientscope_protocol }}'
       keycloak_client_secret: '{{ argo_keycloak_client_secret }}'
-  when:
-  - k8s_argocd_with_keycloak
     tags:
       - argo-cd
 
@@ -148,7 +143,6 @@
       keycloak_client_object: '{{ keycloak_realm_create_client }}'
       bearer_token: '{{ access_token }}'
     when:
-  - k8s_argocd_with_keycloak
     - inventory_hostname == groups['kube_control_plane'][0]
     args:
       apply:
@@ -169,7 +163,6 @@
       status_code: [200]
     register: argo_realm_clients
     when:
-  - k8s_argocd_with_keycloak
     - inventory_hostname == groups['kube_control_plane'][0]
     tags:
       - argo-cd
@@ -179,7 +172,6 @@
     set_fact:
       id_of_client: '{{ ( argo_realm_clients.json | selectattr("clientId","equalto",argo_client_id ) | first ).id }}'
     when:
-  - k8s_argocd_with_keycloak
     - inventory_hostname == groups['kube_control_plane'][0]
     tags:
       - argo-cd
@@ -196,7 +188,6 @@
       status_code: [200]
     register: client_secret
     when:
-  - k8s_argocd_with_keycloak
     - inventory_hostname == groups['kube_control_plane'][0]
     tags:
       - argo-cd
@@ -206,10 +197,12 @@
       msg: "DEBUGGING: {{ client_secret.json.value }}"
     when:
     - debug
-  - k8s_argocd_with_keycloak
     - inventory_hostname == groups['kube_control_plane'][0]
     tags:
       - argo-cd
+  when:
+  - k8s_argocd_with_keycloak
+  # end of block statement
 
 - name: "Create namespace <{{ k8s_argocd_helm__release_namespace }}>"
   become: yes

roles/kubernetes/cert_manager/defaults/main.yml

@@ -2,6 +2,8 @@
 
 k8s_prometheus_helm__name: "prometheus"
 
+cert_manager_dplmt: True
+
 k8s_certmanager_helm__chart_ref: cert-manager
 k8s_certmanager_helm__chart_repo_url: https://charts.jetstack.io
 k8s_certmanager_helm__release_namespace: cert-manager

roles/kubernetes/cert_manager/tasks/main.yml

@@ -3,19 +3,17 @@
 ### tags:
 ###   cert-manager
 
-- name: Install cert-manager via helm
+- name: "Create namespace>"
   become: yes
-  kubernetes.core.helm:
+  kubernetes.core.k8s:
-    name: cert-manager
+    name: "{{ k8s_certmanager_helm__release_namespace }}"
-    chart_ref: "{{ k8s_certmanager_helm__chart_ref }}"
+    api_version: v1
-    chart_repo_url: "{{ k8s_certmanager_helm__chart_repo_url }}"
+    kind: Namespace
-    release_namespace: "{{ k8s_certmanager_helm__release_namespace }}"
+    state: present
-    create_namespace: yes
-    release_values: "{{ k8s_certmanager_helm__release_values }}"
   when:
   - inventory_hostname == groups['kube_control_plane'][0]
   tags:
-    - cert-manager
+    - namespace
 
 - name: Create secret for digitalocean-dns
   become: yes
@@ -34,6 +32,19 @@
   tags:
     - cert-manager
 
+- name: "Install cert-manager"
+  block:
+
+  - name: Install cert-manager via helm
+    become: yes
+    kubernetes.core.helm:
+      name: cert-manager
+      chart_ref: "{{ k8s_certmanager_helm__chart_ref }}"
+      chart_repo_url: "{{ k8s_certmanager_helm__chart_repo_url }}"
+      release_namespace: "{{ k8s_certmanager_helm__release_namespace }}"
+      create_namespace: yes
+      release_values: "{{ k8s_certmanager_helm__release_values }}"
+
   - name: Create ClusterIssuer for letsencrypt (prod/staging)
     become: yes
     kubernetes.core.k8s:
@@ -58,7 +69,10 @@
                 dnsZones:
                 - 'smardigo.digital'
     loop: "{{ k8s_certmanager_helm__cluster_issuers | dict2items }}"
+
+  # end of block statement
   when: 
   - inventory_hostname == groups['kube_control_plane'][0]
+  - cert_manager_dplmt
   tags:
     - cert-manager

roles/kubernetes/cloud_controller_manager/defaults/main.yml

@@ -3,4 +3,4 @@
 # using kubespray default value => kube_pods_subnet
 k8s_ccm__cluster_cidr: 10.233.64.0/18
 
-k8s_ccm__template: "hetzner-ccm-networks__v1.12.1.yaml.j2"
+k8s_ccm__template: "hetzner-ccm-networks__v1.13.0.yaml.j2"

roles/kubernetes/cloud_controller_manager/templates/hetzner-ccm-networks__v1.13.0.yaml.j2

@@ -0,0 +1,106 @@
+# NOTE: this release was tested against kubernetes v1.18.x
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cloud-controller-manager
+  namespace: kube-system
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: system:cloud-controller-manager
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: cloud-controller-manager
+    namespace: kube-system
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hcloud-cloud-controller-manager
+  namespace: kube-system
+spec:
+  replicas: 1
+  revisionHistoryLimit: 2
+  selector:
+    matchLabels:
+      app: hcloud-cloud-controller-manager
+  template:
+    metadata:
+      labels:
+        app: hcloud-cloud-controller-manager
+    spec:
+      serviceAccountName: cloud-controller-manager
+      dnsPolicy: Default
+      tolerations:
+        # this taint is set by all kubelets running `--cloud-provider=external`
+        # so we should tolerate it to schedule the cloud controller manager
+        - key: "node.cloudprovider.kubernetes.io/uninitialized"
+          value: "true"
+          effect: "NoSchedule"
+        - key: "CriticalAddonsOnly"
+          operator: "Exists"
+        # cloud controller manages should be able to run on masters
+        - key: "node-role.kubernetes.io/master"
+          effect: NoSchedule
+          operator: Exists
+        - key: "node-role.kubernetes.io/control-plane"
+          effect: NoSchedule
+          operator: Exists
+        - key: "node.kubernetes.io/not-ready"
+          effect: "NoSchedule"
+      hostNetwork: true
+      containers:
+        - image: hetznercloud/hcloud-cloud-controller-manager:v1.13.0
+          name: hcloud-cloud-controller-manager
+          command:
+            - "/bin/hcloud-cloud-controller-manager"
+            - "--cloud-provider=hcloud"
+            - "--leader-elect=false"
+            - "--allow-untagged-cloud"
+            - "--allocate-node-cidrs=true"
+            - "--cluster-cidr={{ k8s_ccm__cluster_cidr | default('10.244.0.0/16') }}"
+          resources:
+            requests:
+              cpu: 100m
+              memory: 50Mi
+          env:
+            - name: HCLOUD_METRICS_ENABLED
+              value: "true"
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: HCLOUD_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: hcloud-ccm
+                  key: token
+            - name: HCLOUD_NETWORK
+              valueFrom:
+                secretKeyRef:
+                  name: hcloud-ccm
+                  key: network
+      priorityClassName: system-cluster-critical
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: 'hcloud-cloud-controller-manager-metrics'
+  namespace: kube-system
+  labels:
+    metrics: service-metrics
+spec:
+  selector:
+    app: 'hcloud-cloud-controller-manager'
+  type: ClusterIP
+  ports:
+  - port: 8233
+    targetPort: 8233
+    protocol: TCP
+    name: http-metrics