Cluster is working!

README.md

@@ -0,0 +1,11 @@
+# K8s cluster on Debian 11
+# Tested on 13/05/2023 with kubernetes 1.27.1, containerd 1.6.21 and flannel 1.1.2
+
+kubeadm version
+containerd --version
+/opt/cni/bin/flannel --version
+
+# Boostrap
+ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook -i ../terraform/hosts.ini pre-start.yaml 
+# Initialisation du cluster, ajout de flannel, openebs, helm et ajout de Gitea
+ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook -i ../terraform/hosts.ini start.yaml 

bootstrap.yaml

@@ -5,8 +5,11 @@
     - name: base setup
       role: commons
 
-    - name: installing container runtime
+#    - name: installing container runtime CRI-O
-      role: container-runtime
+#      role: CRIO
+
+    - name: installing container runtime containerd
+      role: containerd
 
     - name: installing Kubernetes packages
       role: kubernetes-packages

flannel.yaml

@@ -0,0 +1,6 @@
+---
+- hosts: control-plane
+  name: "Install Flannel CNI"
+  roles:
+    - role: flannel
+      run_once: True

gitea-helm.yaml

@@ -0,0 +1,6 @@
+---
+- hosts: control-plane
+  name: "Install Gitea via Helm"
+  roles:
+    - role: gitea-helm
+      run_once: True

group_vars/all

@@ -1,10 +1,14 @@
 ---
 ansible_user: ansuser
-pods_subnet: "192.168.64.0/20"
+#pods_subnet: "192.168.64.0/20"
+pods_subnet: "10.244.0.0/16"
 services_subnet: "10.96.0.0/12"
 os: "Debian_11"
 version: "1.27"
 dns: "192.168.230.254"
 metalrange: "192.168.230.100-192.168.230.200"
+flannel:
+  network: "192.168.64.0/20"
+  subnet: "192.168.64.1/24"
 gitea:
   fqdn: gitea.domain.test

initialize-kubernetes.yaml

@@ -9,15 +9,16 @@
       register: kubeadmconfig
     - debug: var=kubeadmconfig.stdout_lines
 
-    - name: crictl image
+#    - name: crictl image
-      become: yes
+#      become: yes
-      command: crictl image
+#      command: crictl image
-      register: crictl
+#      register: crictl
-    - debug: var=crictl.stdout_lines
+#    - debug: var=crictl.stdout_lines
 
     - name: kubadm init
       become: yes
-      command: kubeadm init --pod-network-cidr={{ pods_subnet }} --service-cidr={{ services_subnet }} --apiserver-advertise-address={{ ansible_default_ipv4.address }} --cri-socket=unix:///var/run/crio/crio.sock
+#      command: kubeadm init --pod-network-cidr={{ pods_subnet }} --service-cidr={{ services_subnet }} --apiserver-advertise-address={{ ansible_default_ipv4.address }} --cri-socket=unix:///var/run/crio/crio.sock
+      command: kubeadm init --pod-network-cidr={{ pods_subnet }}
       register: kubeadminit
     - debug: var=kubeadminit.stdout_lines
 
@@ -49,7 +50,10 @@
 
     - name: kubectl cluster-info
       command: kubectl cluster-info
+      retries: 3
+      delay: 5
       register: kubectl
+      until: kubectl.rc == 0
     - debug: var=kubectl.stdout_lines
 
     - name: show pods

join.yml

@@ -0,0 +1,3 @@
+---
+- import_playbook: pre-join.yaml
+- import_playbook: kubernetes-worker.yaml

pre-start.yaml

@@ -1,3 +1,3 @@
 ---
-- import_playbook: bootstrap.yaml
 - import_playbook: hostname.yaml
+- import_playbook: bootstrap.yaml

roles/CRIO/tasks/main.yaml

@@ -1,4 +1,4 @@
-- name: install container runtime
+- name: install container runtime CRI-O source
   become: yes
   block:
    - name: Create a /usr/share/keyrings
@@ -39,7 +39,7 @@
        repo: "deb [signed-by=/usr/share/keyrings/libcontainers-crio-archive-keyring.gpg] https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/{{ version }}/{{ os }}/ /"
        state: present
 
-- name: install container runtime
+- name: install container runtime CRI-O
   ansible.builtin.apt:
     pkg:
     - cri-o
@@ -59,7 +59,7 @@
     src: etc/cni/net.d/100-crio-bridge.conflist.j2
     dest: /etc/cni/net.d/100-crio-bridge.conflist
 
-- name: Restart service crio
+- name: Restart service CRI-O
   become: yes
   ansible.builtin.systemd:
     enabled: true

roles/containerd/tasks/main.yaml

@@ -0,0 +1,44 @@
+- name: install container runtime containerd source
+  become: yes
+  block:
+   - name: Create a /usr/share/keyrings
+     ansible.builtin.file:
+       path: /usr/share/keyrings
+       state: directory
+       mode: '0755'
+
+   - name: get pseudo gpg docker
+     get_url:
+       url: https://download.docker.com/linux/debian/gpg
+       dest: /usr/share/keyrings/false-docker.gpg
+
+   - name: get gpg docker
+     shell: cat /usr/share/keyrings/false-docker.gpg | gpg --dearmor -o /usr/share/keyrings/docker.gpg
+     args: 
+       chdir: /usr/share/keyrings 
+       creates: /usr/share/keyrings/docker.gpg
+
+   - name: docker | apt source
+     ansible.builtin.apt_repository:
+       repo: "deb [signed-by=/usr/share/keyrings/docker.gpg] https://download.docker.com/linux/debian bullseye stable"
+       state: present
+
+- name: install containerd
+  ansible.builtin.apt:
+    pkg:
+    - containerd.io=1.6*
+  become: yes
+
+- name: change config file
+  become: yes
+  template:
+    src: config.toml
+    dest: /etc/containerd/config.toml
+
+- name: Restart service containerd
+  become: yes
+  ansible.builtin.systemd:
+    enabled: true
+    state: restarted
+    daemon_reload: true
+    name: containerd

roles/containerd/templates/config.toml

@@ -0,0 +1,216 @@
+disabled_plugins = []
+imports = []
+oom_score = 0
+plugin_dir = ""
+required_plugins = []
+root = "/var/lib/containerd"
+state = "/run/containerd"
+version = 2
+
+[cgroup]
+  path = ""
+
+[debug]
+  address = ""
+  format = ""
+  gid = 0
+  level = ""
+  uid = 0
+
+[grpc]
+  address = "/run/containerd/containerd.sock"
+  gid = 0
+  max_recv_message_size = 16777216
+  max_send_message_size = 16777216
+  tcp_address = ""
+  tcp_tls_cert = ""
+  tcp_tls_key = ""
+  uid = 0
+
+[metrics]
+  address = ""
+  grpc_histogram = false
+
+[plugins]
+
+  [plugins."io.containerd.gc.v1.scheduler"]
+    deletion_threshold = 0
+    mutation_threshold = 100
+    pause_threshold = 0.02
+    schedule_delay = "0s"
+    startup_delay = "100ms"
+
+  [plugins."io.containerd.grpc.v1.cri"]
+    disable_apparmor = false
+    disable_cgroup = false
+    disable_hugetlb_controller = true
+    disable_proc_mount = false
+    disable_tcp_service = true
+    enable_selinux = false
+    enable_tls_streaming = false
+    ignore_image_defined_volumes = false
+    max_concurrent_downloads = 3
+    max_container_log_line_size = 16384
+    netns_mounts_under_state_dir = false
+    restrict_oom_score_adj = false
+    sandbox_image = "k8s.gcr.io/pause:3.5"
+    selinux_category_range = 1024
+    stats_collect_period = 10
+    stream_idle_timeout = "4h0m0s"
+    stream_server_address = "127.0.0.1"
+    stream_server_port = "0"
+    systemd_cgroup = false
+    tolerate_missing_hugetlb_controller = true
+    unset_seccomp_profile = ""
+
+    [plugins."io.containerd.grpc.v1.cri".cni]
+      bin_dir = "/opt/cni/bin"
+      conf_dir = "/etc/cni/net.d"
+      conf_template = ""
+      max_conf_num = 1
+
+    [plugins."io.containerd.grpc.v1.cri".containerd]
+      default_runtime_name = "runc"
+      disable_snapshot_annotations = true
+      discard_unpacked_layers = false
+      no_pivot = false
+      snapshotter = "overlayfs"
+
+      [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime]
+        base_runtime_spec = ""
+        container_annotations = []
+        pod_annotations = []
+        privileged_without_host_devices = false
+        runtime_engine = ""
+        runtime_root = ""
+        runtime_type = ""
+
+        [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime.options]
+
+      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
+
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
+          base_runtime_spec = ""
+          container_annotations = []
+          pod_annotations = []
+          privileged_without_host_devices = false
+          runtime_engine = ""
+          runtime_root = ""
+          runtime_type = "io.containerd.runc.v2"
+
+          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
+            BinaryName = ""
+            CriuImagePath = ""
+            CriuPath = ""
+            CriuWorkPath = ""
+            IoGid = 0
+            IoUid = 0
+            NoNewKeyring = false
+            NoPivotRoot = false
+            Root = ""
+            ShimCgroup = ""
+            SystemdCgroup = true
+
+      [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime]
+        base_runtime_spec = ""
+        container_annotations = []
+        pod_annotations = []
+        privileged_without_host_devices = false
+        runtime_engine = ""
+        runtime_root = ""
+        runtime_type = ""
+
+        [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime.options]
+
+    [plugins."io.containerd.grpc.v1.cri".image_decryption]
+      key_model = "node"
+
+    [plugins."io.containerd.grpc.v1.cri".registry]
+      config_path = ""
+
+      [plugins."io.containerd.grpc.v1.cri".registry.auths]
+
+      [plugins."io.containerd.grpc.v1.cri".registry.configs]
+
+      [plugins."io.containerd.grpc.v1.cri".registry.headers]
+
+      [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
+
+    [plugins."io.containerd.grpc.v1.cri".x509_key_pair_streaming]
+      tls_cert_file = ""
+      tls_key_file = ""
+
+  [plugins."io.containerd.internal.v1.opt"]
+    path = "/opt/containerd"
+
+  [plugins."io.containerd.internal.v1.restart"]
+    interval = "10s"
+
+  [plugins."io.containerd.metadata.v1.bolt"]
+    content_sharing_policy = "shared"
+
+  [plugins."io.containerd.monitor.v1.cgroups"]
+    no_prometheus = false
+
+  [plugins."io.containerd.runtime.v1.linux"]
+    no_shim = false
+    runtime = "runc"
+    runtime_root = ""
+    shim = "containerd-shim"
+    shim_debug = false
+
+  [plugins."io.containerd.runtime.v2.task"]
+    platforms = ["linux/amd64"]
+
+  [plugins."io.containerd.service.v1.diff-service"]
+    default = ["walking"]
+
+  [plugins."io.containerd.snapshotter.v1.aufs"]
+    root_path = ""
+
+  [plugins."io.containerd.snapshotter.v1.btrfs"]
+    root_path = ""
+
+  [plugins."io.containerd.snapshotter.v1.devmapper"]
+    async_remove = false
+    base_image_size = ""
+    pool_name = ""
+    root_path = ""
+
+  [plugins."io.containerd.snapshotter.v1.native"]
+    root_path = ""
+
+  [plugins."io.containerd.snapshotter.v1.overlayfs"]
+    root_path = ""
+
+  [plugins."io.containerd.snapshotter.v1.zfs"]
+    root_path = ""
+
+[proxy_plugins]
+
+[stream_processors]
+
+  [stream_processors."io.containerd.ocicrypt.decoder.v1.tar"]
+    accepts = ["application/vnd.oci.image.layer.v1.tar+encrypted"]
+    args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
+    env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
+    path = "ctd-decoder"
+    returns = "application/vnd.oci.image.layer.v1.tar"
+
+  [stream_processors."io.containerd.ocicrypt.decoder.v1.tar.gzip"]
+    accepts = ["application/vnd.oci.image.layer.v1.tar+gzip+encrypted"]
+    args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
+    env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
+    path = "ctd-decoder"
+    returns = "application/vnd.oci.image.layer.v1.tar+gzip"
+
+[timeouts]
+  "io.containerd.timeout.shim.cleanup" = "5s"
+  "io.containerd.timeout.shim.load" = "5s"
+  "io.containerd.timeout.shim.shutdown" = "3s"
+  "io.containerd.timeout.task.state" = "2s"
+
+[ttrpc]
+  address = ""
+  gid = 0
+  uid = 0

roles/flannel/tasks/main.yaml

@@ -0,0 +1,11 @@
+#- name: install conf file
+#  become: yes
+#  template:
+#    src: flannel.j2
+#    dest: /run/flannel/subnet.env
+
+- name: install flannel
+  shell: kubectl apply -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml
+  register: flannel
+- debug: var=flannel.stdout_lines
+

roles/flannel/templates/flannel.j2

@@ -0,0 +1,4 @@
+FLANNEL_NETWORK={{ flannel.network  }}
+FLANNEL_SUBNET={{ flannel.subnet }}
+FLANNEL_MTU=1450
+FLANNEL_IPMASQ=true

roles/gitea-helm/tasks/main.yaml

@@ -0,0 +1,5 @@
+- name: install gitea via helm
+  shell: |
+    helm repo add gitea-charts https://dl.gitea.io/charts/
+    helm repo update
+    helm install gitea gitea-charts/gitea

start.yaml

@@ -1,7 +1,10 @@
 ---
 - import_playbook: initialize-kubernetes.yaml
-- import_playbook: calico.yaml
+#- import_playbook: calico.yaml
+- import_playbook: flannel.yaml
 - import_playbook: pre-join.yaml
 - import_playbook: kubernetes-worker.yaml
-  #- import_playbook: openebs.yaml
+- import_playbook: openebs.yaml
+- import_playbook: helm.yaml
+- import_playbook: gitea-helm.yaml
 #- import_playbook: purelb.yaml

test.yml

@@ -0,0 +1,5 @@
+---
+#- import_playbook: helm.yaml
+#- import_playbook: gitea-helm.yaml
+- import_playbook: openebs.yaml
+#- import_playbook: purelb.yaml