onedr0p / k3s-homeops-ansible Goto Github PK

https://rook.io/docs/rook/v1.2/k8s-pre-reqs.html

tl;dr

sudo apt-get install -y lvm2

and yoink this from my repo

https://github.com/onedr0p/k3s-gitops/blob/master/ansible/roles/system/tasks/main.yml#L6

https://github.com/hashicorp/terraform-github-actions

Explore secret management in GitHub.

Might make configuring more dynamic to allow a variable to pass any k3s install flags to

https://rancher.com/docs/k3s/latest/en/installation/install-options/

Minor consideration would be to check if docker flag is included and then install docker.

This would also cover issues #6 and #5

Needed to update vault in other stages.

Add to gitignore too.

toggle with variable, default to no

https://github.com/instrumenta/kubeval

https://github.com/kubernetes/test-infra/tree/master/prow

Related to BGP mode.

edit /etc/systemd/logind.conf

change #HandlePowerKey=poweroff to HandlePowerKey=ignore

this will prevent misclicks with the power button on my NUCs, you can still force poweroff by holding the button

Would be nice to taint the servers running rook-ceph and apply tolerations to the rook-ceph deployments. This way standard workloads can only be ran on the worker nodes without any affinity rules.

Getting errors because it references a local path that is no longer local.

failed: [k3s-0 -> localhost] (item=kubectl apply -f /home/ryan/src/k3s-bootstrap/devops/kube-system/calico/calico.yaml) => {"ansible_loop_var": "item", "attempts": 6, "changed": false, "cmd": ["kubectl", "apply", "-f", "/home/ryan/src/k3s-bootstrap/devops/kube-system/calico/calico.yaml"], "delta": "0:00:00.239140", "end": "2020-02-17 00:55:58.162550", "item": "kubectl apply -f /home/ryan/src/k3s-bootstrap/devops/kube-system/calico/calico.yaml", "msg": "non-zero return code", "rc": 1, "start": "2020-02-17 00:55:57.923410", "stderr": "Unable to connect to the server: x509: certificate signed by unknown authority", "stderr_lines": ["Unable to connect to the server: x509: certificate signed by unknown authority"], "stdout": "", "stdout_lines": []}

Ensure tools are installed locally

• helm
• kubectl
• fluxctl
• calicoctl
• vault

...

Prompt to copy sample files if not exists

• hosts
• main variables
• encrypted vault variables
• unencrypted vault variables

...

• Validate that a key file is created or offer to generate for Ansible Vault

...

• Warn that the option to encrypt the encrypted variables should be set to true as part as playbook

...

• Validate that pre-commit includes option to check for Ansible-Vault being encrypted
• Validate that .gitattributes includes filter for git-crypt and the vault.key file

Makes it so having settings specific to our envs for testing, but requires us to update the sample when new vars are added or removed.

• What is the goal of this project?
• What components are defaulted?
• What dependencies are needed to get started?

FYI I started to work on the k3s on vSphere. I have the infra deployment kinda done using terraform.
I think would be good to join forces here.

https://github.com/likamrat/k3s_vmware

Running into errors where vagrant thinks the block device exists

VBoxManage: error: Failed to create medium
VBoxManage: error: Could not create the medium storage unit '/Users/devin/Code/k3s-cluster-ansible/k8s-node-10-block.vdi'.
VBoxManage: error: VDI: cannot create image '/Users/devin/Code/k3s-cluster-ansible/k8s-node-10-block.vdi' (VERR_ALREADY_EXISTS)
VBoxManage: error: Details: code VBOX_E_FILE_ERROR (0x80bb0004), component MediumWrap, interface IMedium
VBoxManage: error: Context: "RTEXITCODE handleCreateMedium(HandlerArg *)" at line 510 of file VBoxManageDisk.cpp

hashicorp/vagrant#8107 (comment)

Maybe we should add this in a task to run if shit gets fubared?

They assume local access to the .txt files.

Ref: https://blog.smartive.ch/how-we-simplified-our-kubernetes-deployments-with-an-alternative-to-helm-aafedcfd4cce

Default to {{ ansible_user }} and update any local copy jobs to use that user instead.

Use case is for build processes where the remote user is different from the local user.

I believe it's initializing before consul is ready

Probably only want to stay with calico and flannel for now.

Currently set to r610... etc

• Keep a reduced number of options in our config.yaml
• Remove Docker install and stay with containerd, maybe use https://github.com/GoogleContainerTools/kaniko for building images if people want Drone CI or something.

Something like ... task macos:deps

Ceph isn't always picking up block devices at initial provision. Need to add detection for state of block device with option to clean.

• ansible
• yaml
• shellcheck

https://github.com/ansible/ansible-lint

Also setup in pre-commit: https://github.com/ansible/ansible-lint/blob/master/.pre-commit-hooks.yaml

Docker and containerd

Right now it is hardcoded in the ansible scripts.