gitea-admin
/
hetzner-ansible
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

DEV-548: testcluster

Browse Source
feature/DEV-655
Görz, Friedrich 3 years ago committed by Ketelsen, Sven
parent bad109ad83
commit 01049bf031
9 changed files with 363 additions and 244 deletions
Show Stats Download Patch File Download Diff File

16
group_vars/all/firewall.yml
Unescape Escape View File

@ -97,11 +97,11 @@ hcloud_firewall_objects:
-
type: label_selector
label_selector:
selector: 'service=connect'
selector: 'stage={{ stage }},service=connect'
-
type: label_selector
label_selector:
selector: 'service=keycloak'
selector: 'stage={{ stage }},service=keycloak'
hcloud_firewall_objects_awx:
-
@ -119,7 +119,7 @@ hcloud_firewall_objects_awx:
-
type: label_selector
label_selector:
selector: 'stage={{ stage }}'
selector: 'stage={{ stage }},service=awx'
hcloud_firewall_objects_backup:
-
@ -138,7 +138,7 @@ hcloud_firewall_objects_backup:
-
type: label_selector
label_selector:
selector: 'service=backup'
selector: 'stage={{ stage }},service=backup'
hcloud_firewall_objects_gitea:
-
@ -170,7 +170,7 @@ hcloud_firewall_objects_gitea:
-
type: label_selector
label_selector:
selector: 'service=gitea'
selector: 'stage={{ stage }},service=gitea'
hcloud_firewall_objects_keycloak:
-
@ -202,7 +202,7 @@ hcloud_firewall_objects_keycloak:
-
type: label_selector
label_selector:
selector: 'service=keycloak'
selector: 'stage={{ stage }},service=keycloak'
hcloud_firewall_objects_kibana:
-
@ -234,7 +234,7 @@ hcloud_firewall_objects_kibana:
-
type: label_selector
label_selector:
selector: 'service=kibana'
selector: 'stage={{ stage }},service=kibana'
hcloud_firewall_objects_management:
-
@ -266,4 +266,4 @@ hcloud_firewall_objects_management:
-
type: label_selector
label_selector:
selector: 'service=connect,tenant=management'
selector: 'stage={{ stage }},service=connect,tenant=management'

8
kubernetes.yml
Unescape Escape View File

@ -30,11 +30,15 @@
- role: kubernetes/prometheus
tags:
- prometheus
- { role: kubernetes/cert_manager }
when: kubernetes_with_prometheus | default(True)
- role: kubernetes/cert_manager
when: kubernetes_with_certmanager | default(True)
- role: kubernetes/external_dns
when: kubernetes_with_extdns | default(True)
tags:
- external-dns
- { role: kubernetes/ingress_controller }
- role: kubernetes/ingress_controller
when: kubernetes_with_ingress | default(True)
- role: kubernetes/argocd
when: kubernetes_with_argocd | default(True)
tags:

2
roles/hcloud/tasks/configure-firewall2.yml
Unescape Escape View File

@ -2,7 +2,7 @@
- name: "Get all existing firewalls"
uri:
method: GET
url: "https://api.hetzner.cloud/v1/firewalls"
url: "https://api.hetzner.cloud/v1/firewalls?per_page=1000"
body_format: json
headers:
accept: application/json

2
roles/kubernetes/argocd/defaults/main.yml
Unescape Escape View File

@ -28,7 +28,7 @@ argo_realm_users: [
"requiredActions": []
}
]
argocd_server_admin_password: "{{ argocd_server_admin_password_vault }}"
argocd_server_admin_password: "{{ argocd_server_admin_password_vault | default( lookup('community.general.random_string', length=20) ) }}"
# https://github.com/argoproj/argo-helm/tree/master/charts/argo-cd
k8s_argocd_helm__release_values:

55
roles/kubernetes/argocd/tasks/main.yml
Unescape Escape View File

@ -1,5 +1,8 @@
---
- name: "Login with keycloak-admin"
- name: "Do some stuff with keycloak as OIDC provider"
block:
- name: "Login with keycloak-admin"
include_role:
name: keycloak
tasks_from: _authenticate
@ -8,11 +11,10 @@
tags:
- argo-cd
when:
- k8s_argocd_with_keycloak
tags:
- argo-cd
- name: "Setup keycloak-realm for argocd"
- name: "Setup keycloak-realm for argocd"
include_role:
name: keycloak
tasks_from: _configure_realm
@ -22,7 +24,6 @@
create_client: False
current_realm_password_policy: ''
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
args:
apply:
@ -31,7 +32,7 @@
tags:
- argo-cd
- name: "Create a Keycloak group, authentication with credentials"
- name: "Create a Keycloak group, authentication with credentials"
include_role:
name: keycloak
tasks_from: _create_realm_groups
@ -41,7 +42,6 @@
current_realm_groups:
- name: "{{ argo_realm_group }}"
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
args:
apply:
@ -50,7 +50,7 @@
tags:
- argo-cd
- name: "Create keycloak user(s)"
- name: "Create keycloak user(s)"
include_role:
name: keycloak
tasks_from: _create_realm_users
@ -58,7 +58,6 @@
current_realm_name: '{{ argo_realm_name }}'
current_realm_users: '{{ argo_realm_users }}'
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
args:
apply:
@ -67,7 +66,7 @@
tags:
- argo-cd
- name: "ADD user group mapping"
- name: "ADD user group mapping"
include_role:
name: keycloak
tasks_from: _configure_user_groupmembership_crud
@ -77,7 +76,6 @@
realm_name: '{{ argo_realm_name }}'
bearer_token: '{{ access_token }}'
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
args:
apply:
@ -86,7 +84,7 @@
tags:
- argo-cd
- name: "Create keycloak clientscope"
- name: "Create keycloak clientscope"
delegate_to: localhost
become: False
community.general.keycloak_clientscope:
@ -109,15 +107,14 @@
protocol: openid-connect
protocolMapper: oidc-group-membership-mapper
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- argo-cd
# using template from exported keycloak client object
# due to needed params but missing in community.general.keycloak_client
# e.g. defaultClientScopes
- name: "Create json object as VAR from template"
# using template from exported keycloak client object
# due to needed params but missing in community.general.keycloak_client
# e.g. defaultClientScopes
- name: "Create json object as VAR from template"
set_fact:
keycloak_realm_create_client: "{{ lookup('template','keycloak-realm-create-client-argocd.json.j2') }}"
vars:
@ -131,14 +128,12 @@
keycloak_clientscope_name: '{{ argo_keycloak_clientscope_name }}'
keycloak_clientscope_protocol: '{{ argo_keycloak_clientscope_protocol }}'
keycloak_client_secret: '{{ argo_keycloak_client_secret }}'
when:
- k8s_argocd_with_keycloak
tags:
- argo-cd
# throw needed VARs against keycloak API
# to CRUD
- name: "Create client"
# throw needed VARs against keycloak API
# to CRUD
- name: "Create client"
include_role:
name: keycloak
tasks_from: _configure_client_crud
@ -148,7 +143,6 @@
keycloak_client_object: '{{ keycloak_realm_create_client }}'
bearer_token: '{{ access_token }}'
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
args:
apply:
@ -157,7 +151,7 @@
tags:
- argo-cd
- name: "GET available clients from <<{{ argo_realm_name }}>>-realm"
- name: "GET available clients from <<{{ argo_realm_name }}>>-realm"
delegate_to: localhost
become: False
uri:
@ -169,22 +163,20 @@
status_code: [200]
register: argo_realm_clients
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- argo-cd
# available clients: get needed ID
- name: "Get ID of client by paring argo_realm_clients object"
# available clients: get needed ID
- name: "Get ID of client by paring argo_realm_clients object"
set_fact:
id_of_client: '{{ ( argo_realm_clients.json | selectattr("clientId","equalto",argo_client_id ) | first ).id }}'
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- argo-cd
- name: "GET client-secret for client <<{{ argo_client_id }}>> in realm <<{{ argo_realm_name }}>>"
- name: "GET client-secret for client <<{{ argo_client_id }}>> in realm <<{{ argo_realm_name }}>>"
delegate_to: localhost
become: False
uri:
@ -196,20 +188,21 @@
status_code: [200]
register: client_secret
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- argo-cd
- name: "DEBUG"
- name: "DEBUG"
debug:
msg: "DEBUGGING: {{ client_secret.json.value }}"
when:
- debug
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- argo-cd
when:
- k8s_argocd_with_keycloak
# end of block statement
- name: "Create namespace <{{ k8s_argocd_helm__release_namespace }}>"
become: yes

2
roles/kubernetes/cert_manager/defaults/main.yml
Unescape Escape View File

@ -2,6 +2,8 @@
k8s_prometheus_helm__name: "prometheus"
cert_manager_dplmt: True
k8s_certmanager_helm__chart_ref: cert-manager
k8s_certmanager_helm__chart_repo_url: https://charts.jetstack.io
k8s_certmanager_helm__release_namespace: cert-manager

34
roles/kubernetes/cert_manager/tasks/main.yml
Unescape Escape View File

@ -3,19 +3,17 @@
### tags:
### cert-manager
- name: Install cert-manager via helm
- name: "Create namespace>"
become: yes
kubernetes.core.helm:
name: cert-manager
chart_ref: "{{ k8s_certmanager_helm__chart_ref }}"
chart_repo_url: "{{ k8s_certmanager_helm__chart_repo_url }}"
release_namespace: "{{ k8s_certmanager_helm__release_namespace }}"
create_namespace: yes
release_values: "{{ k8s_certmanager_helm__release_values }}"
kubernetes.core.k8s:
name: "{{ k8s_certmanager_helm__release_namespace }}"
api_version: v1
kind: Namespace
state: present
when:
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- cert-manager
- namespace
- name: Create secret for digitalocean-dns
become: yes
@ -34,7 +32,20 @@
tags:
- cert-manager
- name: Create ClusterIssuer for letsencrypt (prod/staging)
- name: "Install cert-manager"
block:
- name: Install cert-manager via helm
become: yes
kubernetes.core.helm:
name: cert-manager
chart_ref: "{{ k8s_certmanager_helm__chart_ref }}"
chart_repo_url: "{{ k8s_certmanager_helm__chart_repo_url }}"
release_namespace: "{{ k8s_certmanager_helm__release_namespace }}"
create_namespace: yes
release_values: "{{ k8s_certmanager_helm__release_values }}"
- name: Create ClusterIssuer for letsencrypt (prod/staging)
become: yes
kubernetes.core.k8s:
definition:
@ -58,7 +69,10 @@
dnsZones:
- 'smardigo.digital'
loop: "{{ k8s_certmanager_helm__cluster_issuers | dict2items }}"
# end of block statement
when:
- inventory_hostname == groups['kube_control_plane'][0]
- cert_manager_dplmt
tags:
- cert-manager

2
roles/kubernetes/cloud_controller_manager/defaults/main.yml
Unescape Escape View File

@ -3,4 +3,4 @@
# using kubespray default value => kube_pods_subnet
k8s_ccm__cluster_cidr: 10.233.64.0/18
k8s_ccm__template: "hetzner-ccm-networks__v1.12.1.yaml.j2"
k8s_ccm__template: "hetzner-ccm-networks__v1.13.0.yaml.j2"

106
roles/kubernetes/cloud_controller_manager/templates/hetzner-ccm-networks__v1.13.0.yaml.j2
Unescape Escape View File

@ -0,0 +1,106 @@
# NOTE: this release was tested against kubernetes v1.18.x
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: cloud-controller-manager
namespace: kube-system
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: system:cloud-controller-manager
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: cloud-controller-manager
namespace: kube-system
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: hcloud-cloud-controller-manager
namespace: kube-system
spec:
replicas: 1
revisionHistoryLimit: 2
selector:
matchLabels:
app: hcloud-cloud-controller-manager
template:
metadata:
labels:
app: hcloud-cloud-controller-manager
spec:
serviceAccountName: cloud-controller-manager
dnsPolicy: Default
tolerations:
# this taint is set by all kubelets running `--cloud-provider=external`
# so we should tolerate it to schedule the cloud controller manager
- key: "node.cloudprovider.kubernetes.io/uninitialized"
value: "true"
effect: "NoSchedule"
- key: "CriticalAddonsOnly"
operator: "Exists"
# cloud controller manages should be able to run on masters
- key: "node-role.kubernetes.io/master"
effect: NoSchedule
operator: Exists
- key: "node-role.kubernetes.io/control-plane"
effect: NoSchedule
operator: Exists
- key: "node.kubernetes.io/not-ready"
effect: "NoSchedule"
hostNetwork: true
containers:
- image: hetznercloud/hcloud-cloud-controller-manager:v1.13.0
name: hcloud-cloud-controller-manager
command:
- "/bin/hcloud-cloud-controller-manager"
- "--cloud-provider=hcloud"
- "--leader-elect=false"
- "--allow-untagged-cloud"
- "--allocate-node-cidrs=true"
- "--cluster-cidr={{ k8s_ccm__cluster_cidr | default('10.244.0.0/16') }}"
resources:
requests:
cpu: 100m
memory: 50Mi
env:
- name: HCLOUD_METRICS_ENABLED
value: "true"
- name: NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
- name: HCLOUD_TOKEN
valueFrom:
secretKeyRef:
name: hcloud-ccm
key: token
- name: HCLOUD_NETWORK
valueFrom:
secretKeyRef:
name: hcloud-ccm
key: network
priorityClassName: system-cluster-critical
---
apiVersion: v1
kind: Service
metadata:
name: 'hcloud-cloud-controller-manager-metrics'
namespace: kube-system
labels:
metrics: service-metrics
spec:
selector:
app: 'hcloud-cloud-controller-manager'
type: ClusterIP
ports:
- port: 8233
targetPort: 8233
protocol: TCP
name: http-metrics
Write Preview
Loading…
Cancel
Save