GRETA
/
TP-IaC-Kubernetes
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Cluster is working!

master
guppy 2023-05-13 16:00:00 +02:00
parent 51a54da4ad
commit 1103d2ba7a
19 changed files with 5329 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
README.md 100644
View File

@ -0,0 +1,11 @@
# K8s cluster on Debian 11
# Tested on 13/05/2023 with kubernetes 1.27.1, containerd 1.6.21 and flannel 1.1.2
kubeadm version
containerd --version
/opt/cni/bin/flannel --version
# Boostrap
ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook -i ../terraform/hosts.ini pre-start.yaml
# Initialisation du cluster, ajout de flannel, openebs, helm et ajout de Gitea
ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook -i ../terraform/hosts.ini start.yaml

7
bootstrap.yaml
View File

@ -5,8 +5,11 @@
- name: base setup
role: commons
- name: installing container runtime
role: container-runtime
# - name: installing container runtime CRI-O
# role: CRIO
- name: installing container runtime containerd
role: containerd
- name: installing Kubernetes packages
role: kubernetes-packages

6
flannel.yaml 100644
View File

@ -0,0 +1,6 @@
---
- hosts: control-plane
name: "Install Flannel CNI"
roles:
- role: flannel
run_once: True

6
gitea-helm.yaml 100644
View File

@ -0,0 +1,6 @@
---
- hosts: control-plane
name: "Install Gitea via Helm"
roles:
- role: gitea-helm
run_once: True

6
group_vars/all
View File

@ -1,10 +1,14 @@
---
ansible_user: ansuser
pods_subnet: "192.168.64.0/20"
#pods_subnet: "192.168.64.0/20"
pods_subnet: "10.244.0.0/16"
services_subnet: "10.96.0.0/12"
os: "Debian_11"
version: "1.27"
dns: "192.168.230.254"
metalrange: "192.168.230.100-192.168.230.200"
flannel:
network: "192.168.64.0/20"
subnet: "192.168.64.1/24"
gitea:
fqdn: gitea.domain.test

16
initialize-kubernetes.yaml
View File

@ -9,15 +9,16 @@
register: kubeadmconfig
- debug: var=kubeadmconfig.stdout_lines
- name: crictl image
become: yes
command: crictl image
register: crictl
- debug: var=crictl.stdout_lines
# - name: crictl image
# become: yes
# command: crictl image
# register: crictl
# - debug: var=crictl.stdout_lines
- name: kubadm init
become: yes
command: kubeadm init --pod-network-cidr={{ pods_subnet }} --service-cidr={{ services_subnet }} --apiserver-advertise-address={{ ansible_default_ipv4.address }} --cri-socket=unix:///var/run/crio/crio.sock
# command: kubeadm init --pod-network-cidr={{ pods_subnet }} --service-cidr={{ services_subnet }} --apiserver-advertise-address={{ ansible_default_ipv4.address }} --cri-socket=unix:///var/run/crio/crio.sock
command: kubeadm init --pod-network-cidr={{ pods_subnet }}
register: kubeadminit
- debug: var=kubeadminit.stdout_lines
@ -49,7 +50,10 @@
- name: kubectl cluster-info
command: kubectl cluster-info
retries: 3
delay: 5
register: kubectl
until: kubectl.rc == 0
- debug: var=kubectl.stdout_lines
- name: show pods

3
join.yml 100644
View File

@ -0,0 +1,3 @@
---
- import_playbook: pre-join.yaml
- import_playbook: kubernetes-worker.yaml

2
pre-start.yaml
View File

@ -1,3 +1,3 @@
---
- import_playbook: bootstrap.yaml
- import_playbook: hostname.yaml
- import_playbook: bootstrap.yaml

6
roles/container-runtime/tasks/main.yaml → roles/CRIO/tasks/main.yaml
View File

@ -1,4 +1,4 @@
- name: install container runtime
- name: install container runtime CRI-O source
become: yes
block:
- name: Create a /usr/share/keyrings
@ -39,7 +39,7 @@
repo: "deb [signed-by=/usr/share/keyrings/libcontainers-crio-archive-keyring.gpg] https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/{{ version }}/{{ os }}/ /"
state: present
- name: install container runtime
- name: install container runtime CRI-O
ansible.builtin.apt:
pkg:
- cri-o
@ -59,7 +59,7 @@
src: etc/cni/net.d/100-crio-bridge.conflist.j2
dest: /etc/cni/net.d/100-crio-bridge.conflist
- name: Restart service crio
- name: Restart service CRI-O
become: yes
ansible.builtin.systemd:
enabled: true

0
roles/container-runtime/templates/etc/cni/net.d/100-crio-bridge.conflist.j2 → roles/CRIO/templates/etc/cni/net.d/100-crio-bridge.conflist.j2
View File

0
roles/container-runtime/templates/etc/crio/crio.conf → roles/CRIO/templates/etc/crio/crio.conf
View File

44
roles/containerd/tasks/main.yaml 100644
View File

@ -0,0 +1,44 @@
- name: install container runtime containerd source
become: yes
block:
- name: Create a /usr/share/keyrings
ansible.builtin.file:
path: /usr/share/keyrings
state: directory
mode: '0755'
- name: get pseudo gpg docker
get_url:
url: https://download.docker.com/linux/debian/gpg
dest: /usr/share/keyrings/false-docker.gpg
- name: get gpg docker
shell: cat /usr/share/keyrings/false-docker.gpg | gpg --dearmor -o /usr/share/keyrings/docker.gpg
args:
chdir: /usr/share/keyrings
creates: /usr/share/keyrings/docker.gpg
- name: docker | apt source
ansible.builtin.apt_repository:
repo: "deb [signed-by=/usr/share/keyrings/docker.gpg] https://download.docker.com/linux/debian bullseye stable"
state: present
- name: install containerd
ansible.builtin.apt:
pkg:
- containerd.io=1.6*
become: yes
- name: change config file
become: yes
template:
src: config.toml
dest: /etc/containerd/config.toml
- name: Restart service containerd
become: yes
ansible.builtin.systemd:
enabled: true
state: restarted
daemon_reload: true
name: containerd

216
roles/containerd/templates/config.toml 100644
View File

@ -0,0 +1,216 @@
disabled_plugins = []
imports = []
oom_score = 0
plugin_dir = ""
required_plugins = []
root = "/var/lib/containerd"
state = "/run/containerd"
version = 2
[cgroup]
path = ""
[debug]
address = ""
format = ""
gid = 0
level = ""
uid = 0
[grpc]
address = "/run/containerd/containerd.sock"
gid = 0
max_recv_message_size = 16777216
max_send_message_size = 16777216
tcp_address = ""
tcp_tls_cert = ""
tcp_tls_key = ""
uid = 0
[metrics]
address = ""
grpc_histogram = false
[plugins]
[plugins."io.containerd.gc.v1.scheduler"]
deletion_threshold = 0
mutation_threshold = 100
pause_threshold = 0.02
schedule_delay = "0s"
startup_delay = "100ms"
[plugins."io.containerd.grpc.v1.cri"]
disable_apparmor = false
disable_cgroup = false
disable_hugetlb_controller = true
disable_proc_mount = false
disable_tcp_service = true
enable_selinux = false
enable_tls_streaming = false
ignore_image_defined_volumes = false
max_concurrent_downloads = 3
max_container_log_line_size = 16384
netns_mounts_under_state_dir = false
restrict_oom_score_adj = false
sandbox_image = "k8s.gcr.io/pause:3.5"
selinux_category_range = 1024
stats_collect_period = 10
stream_idle_timeout = "4h0m0s"
stream_server_address = "127.0.0.1"
stream_server_port = "0"
systemd_cgroup = false
tolerate_missing_hugetlb_controller = true
unset_seccomp_profile = ""
[plugins."io.containerd.grpc.v1.cri".cni]
bin_dir = "/opt/cni/bin"
conf_dir = "/etc/cni/net.d"
conf_template = ""
max_conf_num = 1
[plugins."io.containerd.grpc.v1.cri".containerd]
default_runtime_name = "runc"
disable_snapshot_annotations = true
discard_unpacked_layers = false
no_pivot = false
snapshotter = "overlayfs"
[plugins."io.containerd.grpc.v1.cri".containerd.default_runtime]
base_runtime_spec = ""
container_annotations = []
pod_annotations = []
privileged_without_host_devices = false
runtime_engine = ""
runtime_root = ""
runtime_type = ""
[plugins."io.containerd.grpc.v1.cri".containerd.default_runtime.options]
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
base_runtime_spec = ""
container_annotations = []
pod_annotations = []
privileged_without_host_devices = false
runtime_engine = ""
runtime_root = ""
runtime_type = "io.containerd.runc.v2"
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
BinaryName = ""
CriuImagePath = ""
CriuPath = ""
CriuWorkPath = ""
IoGid = 0
IoUid = 0
NoNewKeyring = false
NoPivotRoot = false
Root = ""
ShimCgroup = ""
SystemdCgroup = true
[plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime]
base_runtime_spec = ""
container_annotations = []
pod_annotations = []
privileged_without_host_devices = false
runtime_engine = ""
runtime_root = ""
runtime_type = ""
[plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime.options]
[plugins."io.containerd.grpc.v1.cri".image_decryption]
key_model = "node"
[plugins."io.containerd.grpc.v1.cri".registry]
config_path = ""
[plugins."io.containerd.grpc.v1.cri".registry.auths]
[plugins."io.containerd.grpc.v1.cri".registry.configs]
[plugins."io.containerd.grpc.v1.cri".registry.headers]
[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
[plugins."io.containerd.grpc.v1.cri".x509_key_pair_streaming]
tls_cert_file = ""
tls_key_file = ""
[plugins."io.containerd.internal.v1.opt"]
path = "/opt/containerd"
[plugins."io.containerd.internal.v1.restart"]
interval = "10s"
[plugins."io.containerd.metadata.v1.bolt"]
content_sharing_policy = "shared"
[plugins."io.containerd.monitor.v1.cgroups"]
no_prometheus = false
[plugins."io.containerd.runtime.v1.linux"]
no_shim = false
runtime = "runc"
runtime_root = ""
shim = "containerd-shim"
shim_debug = false
[plugins."io.containerd.runtime.v2.task"]
platforms = ["linux/amd64"]
[plugins."io.containerd.service.v1.diff-service"]
default = ["walking"]
[plugins."io.containerd.snapshotter.v1.aufs"]
root_path = ""
[plugins."io.containerd.snapshotter.v1.btrfs"]
root_path = ""
[plugins."io.containerd.snapshotter.v1.devmapper"]
async_remove = false
base_image_size = ""
pool_name = ""
root_path = ""
[plugins."io.containerd.snapshotter.v1.native"]
root_path = ""
[plugins."io.containerd.snapshotter.v1.overlayfs"]
root_path = ""
[plugins."io.containerd.snapshotter.v1.zfs"]
root_path = ""
[proxy_plugins]
[stream_processors]
[stream_processors."io.containerd.ocicrypt.decoder.v1.tar"]
accepts = ["application/vnd.oci.image.layer.v1.tar+encrypted"]
args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
path = "ctd-decoder"
returns = "application/vnd.oci.image.layer.v1.tar"
[stream_processors."io.containerd.ocicrypt.decoder.v1.tar.gzip"]
accepts = ["application/vnd.oci.image.layer.v1.tar+gzip+encrypted"]
args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
path = "ctd-decoder"
returns = "application/vnd.oci.image.layer.v1.tar+gzip"
[timeouts]
"io.containerd.timeout.shim.cleanup" = "5s"
"io.containerd.timeout.shim.load" = "5s"
"io.containerd.timeout.shim.shutdown" = "3s"
"io.containerd.timeout.task.state" = "2s"
[ttrpc]
address = ""
gid = 0
uid = 0

11
roles/flannel/tasks/main.yaml 100644
View File

@ -0,0 +1,11 @@
#- name: install conf file
# become: yes
# template:
# src: flannel.j2
# dest: /run/flannel/subnet.env
- name: install flannel
shell: kubectl apply -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml
register: flannel
- debug: var=flannel.stdout_lines

4
roles/flannel/templates/flannel.j2 100644
View File

@ -0,0 +1,4 @@
FLANNEL_NETWORK={{ flannel.network }}
FLANNEL_SUBNET={{ flannel.subnet }}
FLANNEL_MTU=1450
FLANNEL_IPMASQ=true

5
roles/gitea-helm/tasks/main.yaml 100644
View File

@ -0,0 +1,5 @@
- name: install gitea via helm
shell: |
helm repo add gitea-charts https://dl.gitea.io/charts/
helm repo update
helm install gitea gitea-charts/gitea

4988
roles/gitea-helm/templates/calico.yaml.j2 100644
View File

File diff suppressed because it is too large Load Diff

9
start.yaml
View File

@ -1,7 +1,10 @@
---
- import_playbook: initialize-kubernetes.yaml
- import_playbook: calico.yaml
#- import_playbook: calico.yaml
- import_playbook: flannel.yaml
- import_playbook: pre-join.yaml
- import_playbook: kubernetes-worker.yaml
#- import_playbook: openebs.yaml
#- import_playbook: purelb.yaml
- import_playbook: openebs.yaml
- import_playbook: helm.yaml
- import_playbook: gitea-helm.yaml
#- import_playbook: purelb.yaml

5
test.yml 100644
View File

@ -0,0 +1,5 @@
---
#- import_playbook: helm.yaml
#- import_playbook: gitea-helm.yaml
- import_playbook: openebs.yaml
#- import_playbook: purelb.yaml