One repo to rule them all.
Ansible-provisioned bare-metal k8s cluster managed by Flux.
OUT OF DATE
Soon to be deprecated after switching to Terraform-provisioned IaC.
.
|-- ansible
| |-- playbooks
| `-- roles
| |-- k8s
| | |-- k8s_all
| | |-- k8s_cpn
| | |-- k8s_flux
| | |-- k8s_reset
| | |-- k8s_vault
| | |-- k8s_vault_add
| | `-- k8s_workers
| `-- unix
| |-- nfs_init
| |-- vms_init
| `-- vms_update
|-- flux
| |-- clusters
| | `-- dev
| | |-- flux-system
| | `-- infra
| `-- infra
| |-- cloudflare-tunnel
| |-- consul
| |-- grafana-operator
| | `-- grafana
| |-- kube-bench
| |-- kubelet-csr-approver
| |-- metrics-server
| |-- postgres
| |-- prometheus
| |-- secrets-store
| | |-- secrets-store-csi-driver
| | `-- vault-csi-provider
| |-- sources
| |-- storage
| `-- weave-gitops
|-- helm
| `-- cloudflare-tunnel
| `-- templates
|-- resources
| |-- gha
| `-- scripts
`-- terraform
`-- modules
|-- bare-metal
|-- betterstack
`-- vault
hostnamectl set-hostname
mono-repo
and update the inventory
file with your managed nodes.su -
.vms.txt
file containing a space-separated list of your managed node's IPs.ansible_init.sh
script found under resources\scripts
and edit the USER and REPO vars to match your SSH user and fork.chmod u+x ansible_init.sh
to make it executable, then run ./ansible_init.sh
and follow the directions until finished.You should now be switched to the newly created
ansible
account.
If you need to add another VM in the future, simply switch to root, add it tovms.txt
and run the script again.
~/mono-repo/ansible/.vault-password
.ansible-playbook ./playbooks/ansible_init.yml
to initialize Ansible itself. ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook --ask-become-pass ./playbooks/vms_init.yml -u <USER>
to initialize managed nodes. Set <USER>
to the initial account you created across all VMs.Remaining playbooks can now be executed with
ansible-playbook ./playbooks/<PLAYBOOK_NAME> <OPTIONS>
.
Extra variables can be added with-e ''
option as a space-separated list of key=value pairs between the brackets.
k8s_init.yml
playbook with --tags k8s_init
and the following variables for Flux bootstrap:
flux_gh_owner
- repo owner username (--owner
)flux_gh_repo
- repo name (--repository
)flux_gh_cluster
- cluster path (--path
)flux_gh_token
- PAT generated in previous stepkubectl get CertificateSigningRequest | grep Pending
.kubectl certificate approve <NAME>
based on the list returned in previous step. The cluster is now ready and can be interacted with from any of the k8s nodes. You can easily ssh through the ansible user on the Ansible Controle Node.
vault
. Pay attention to the region.k8s_init.yml
playbook with --tags k8s_vault
and the following variables:
vault_aws_access_key_id
- generated in Step 2vault_aws_secret_access_key
- generated in Step 2vault_aws_region
- chosen in Step 3vault_aws_kms_key_id
- generated in Step 3Failures are expected during check tasks on the first run. These indicate lack of resource and trigger its creation.
k8s_vault_add.yml
playbook with the following variables:
vault_secret_name
vault_secret_data
- a JSON object containing a dict {} of "key":"value" pairs