diff --git a/README.md b/README.md index f849098..33f69b8 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@ ansible-playbook site.yaml Individual playbooks can be run in a similar manner: ```bash -ansible-playbook cluster_user.yaml +ansible-playbook setup.yaml ``` # IP Plan | Name | Address | Hostname | diff --git a/cluster_user.yaml b/cluster_user.yaml deleted file mode 100644 index 9f3f2c8..0000000 --- a/cluster_user.yaml +++ /dev/null @@ -1,5 +0,0 @@ ---- -- name: Setup Cluster User - hosts: localhost - roles: - - cluster_user diff --git a/cluster_workloads.yaml b/core.yaml similarity index 52% rename from cluster_workloads.yaml rename to core.yaml index a39c686..fed5f57 100644 --- a/cluster_workloads.yaml +++ b/core.yaml @@ -1,6 +1,6 @@ --- -- name: Deploy Workloads +- name: Deploy core services hosts: localhost gather_facts: false roles: - - cluster_workloads + - core diff --git a/roles/cluster_user/templates/user-kubeconfig.yaml b/roles/cluster_user/templates/user-kubeconfig.yaml deleted file mode 100644 index e1a0428..0000000 --- a/roles/cluster_user/templates/user-kubeconfig.yaml +++ /dev/null @@ -1,22 +0,0 @@ -# vim: ft=yaml ---- -apiVersion: v1 -kind: Config -preferences: {} -current-context: {{ cluster_user }}-{{ workload_namespace }}-{{ cluster_host }} -clusters: - - name: {{ cluster_host }} - cluster: - certificate-authority: {{ cluster_user_api_crt }} - server: https://kube.{{ cluster_domain }}:{{ cluster_port }} -users: - - name: {{ cluster_user }} - user: - client-certificate: {{ cluster_user_crt }} - client-key: {{ cluster_user_key }} -contexts: - - name: {{ cluster_user }}-{{ workload_namespace }}-{{ cluster_host }} - context: - cluster: {{ cluster_host }} - user: {{ cluster_user }} - namespace: {{ workload_namespace }} diff --git a/roles/cluster_user/vars/main.yaml b/roles/cluster_user/vars/main.yaml deleted file mode 100644 index ccf7fbc..0000000 --- a/roles/cluster_user/vars/main.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -cluster_user_kube_dir: "{{ ansible_env.HOME }}/.kube" -cluster_user_key: "{{ cluster_user_kube_dir }}/{{ cluster_user }}.key" -cluster_user_csr: "{{ cluster_user_kube_dir }}/{{ cluster_user }}.csr" -cluster_user_crt: "{{ cluster_user_kube_dir }}/{{ cluster_user }}.crt" -cluster_user_api_crt: "{{ cluster_user_kube_dir }}/cluster.crt" diff --git a/roles/cluster_services/files/L2Advertisement-metallb.yaml b/roles/core/files/L2Advertisement-metallb.yaml similarity index 100% rename from roles/cluster_services/files/L2Advertisement-metallb.yaml rename to roles/core/files/L2Advertisement-metallb.yaml diff --git a/roles/cluster_services/files/alertmanagerconfig.yaml b/roles/core/files/alertmanagerconfig.yaml similarity index 100% rename from roles/cluster_services/files/alertmanagerconfig.yaml rename to roles/core/files/alertmanagerconfig.yaml diff --git a/roles/cluster_services/files/configmap-custom-headers.yaml b/roles/core/files/configmap-custom-headers.yaml similarity index 100% rename from roles/cluster_services/files/configmap-custom-headers.yaml rename to roles/core/files/configmap-custom-headers.yaml diff --git a/roles/cluster_services/files/configmap-nginx.yaml b/roles/core/files/configmap-nginx.yaml similarity index 100% rename from roles/cluster_services/files/configmap-nginx.yaml rename to roles/core/files/configmap-nginx.yaml diff --git a/roles/cluster_services/files/secret-discord-webhook-url.sops.yaml b/roles/core/files/secret-discord-webhook-url.sops.yaml similarity index 100% rename from roles/cluster_services/files/secret-discord-webhook-url.sops.yaml rename to roles/core/files/secret-discord-webhook-url.sops.yaml diff --git a/roles/cluster_services/tasks/main.yaml b/roles/core/tasks/main.yaml similarity index 100% rename from roles/cluster_services/tasks/main.yaml rename to roles/core/tasks/main.yaml diff --git a/roles/cluster_services/templates/ipaddresspool-metallb.yaml b/roles/core/templates/ipaddresspool-metallb.yaml similarity index 100% rename from roles/cluster_services/templates/ipaddresspool-metallb.yaml rename to roles/core/templates/ipaddresspool-metallb.yaml diff --git a/roles/cluster_services/templates/issuer-prod.yaml b/roles/core/templates/issuer-prod.yaml similarity index 100% rename from roles/cluster_services/templates/issuer-prod.yaml rename to roles/core/templates/issuer-prod.yaml diff --git a/roles/cluster_services/templates/issuer-staging.yaml b/roles/core/templates/issuer-staging.yaml similarity index 100% rename from roles/cluster_services/templates/issuer-staging.yaml rename to roles/core/templates/issuer-staging.yaml diff --git a/roles/cluster_services/templates/pv-jellyfin-config.yaml b/roles/core/templates/pv-jellyfin-config.yaml similarity index 100% rename from roles/cluster_services/templates/pv-jellyfin-config.yaml rename to roles/core/templates/pv-jellyfin-config.yaml diff --git a/roles/cluster_services/templates/pv-jellyfin-media.yaml b/roles/core/templates/pv-jellyfin-media.yaml similarity index 100% rename from roles/cluster_services/templates/pv-jellyfin-media.yaml rename to roles/core/templates/pv-jellyfin-media.yaml diff --git a/roles/talos_setup/files/customization.yaml b/roles/setup/files/customization.yaml similarity index 100% rename from roles/talos_setup/files/customization.yaml rename to roles/setup/files/customization.yaml diff --git a/roles/talos_setup/files/secrets.sops.yaml b/roles/setup/files/secrets.sops.yaml similarity index 100% rename from roles/talos_setup/files/secrets.sops.yaml rename to roles/setup/files/secrets.sops.yaml diff --git a/roles/talos_setup/tasks/gen-config.yaml b/roles/setup/tasks/gen-config.yaml similarity index 100% rename from roles/talos_setup/tasks/gen-config.yaml rename to roles/setup/tasks/gen-config.yaml diff --git a/roles/talos_setup/tasks/main.yaml b/roles/setup/tasks/main.yaml similarity index 100% rename from roles/talos_setup/tasks/main.yaml rename to roles/setup/tasks/main.yaml diff --git a/roles/talos_setup/templates/controlplane-patch.yaml b/roles/setup/templates/controlplane-patch.yaml similarity index 100% rename from roles/talos_setup/templates/controlplane-patch.yaml rename to roles/setup/templates/controlplane-patch.yaml diff --git a/roles/cluster_user/tasks/main.yaml b/roles/user/tasks/main.yaml similarity index 71% rename from roles/cluster_user/tasks/main.yaml rename to roles/user/tasks/main.yaml index cc68638..b19bfdf 100644 --- a/roles/cluster_user/tasks/main.yaml +++ b/roles/user/tasks/main.yaml @@ -1,27 +1,27 @@ --- - name: Create local kubeconfig directory ansible.builtin.file: - path: "{{ cluster_user_kube_dir }}" + path: "{{ user_kube_dir }}" state: directory mode: "0755" - name: Set owner of local kubeconfig directory to {{ ansible_user }} become: true ansible.builtin.file: - path: "{{ cluster_user_kube_dir }}" + path: "{{ user_kube_dir }}" state: directory owner: "{{ ansible_user }}" recurse: true - name: Generate User Private Key community.crypto.openssl_privatekey: - path: "{{ cluster_user_key }}" + path: "{{ user_key }}" size: 2048 - name: Generate User CSR community.crypto.openssl_csr: - path: "{{ cluster_user_csr }}" - privatekey_path: "{{ cluster_user_key }}" + path: "{{ user_csr }}" + privatekey_path: "{{ user_key }}" common_name: "{{ cluster_user }}" - name: Get admin kubeconfig @@ -40,7 +40,7 @@ state: present template: csr-user.yaml.j2 vars: - user_csr_base64: "{{ lookup('file', '{{ cluster_user_csr }}') | b64encode }}" + user_csr_base64: "{{ lookup('file', '{{ user_csr }}') | b64encode }}" - name: Install kubectl locally become: true @@ -70,13 +70,13 @@ - name: Save User Certificate ansible.builtin.copy: content: "{{ user_cert.resources[0].status.certificate | b64decode }}" - dest: "{{ cluster_user_crt }}" + dest: "{{ user_crt }}" mode: "0644" - name: Save Cluster Certificate ansible.builtin.copy: content: "{{ cluster_cert.resources[0]['data']['ca.crt'] }}" - dest: "{{ cluster_user_api_crt }}" + dest: "{{ user_api_crt }}" mode: "0644" - name: Create User Cluster Role Binding @@ -87,24 +87,5 @@ - name: Create User Kubeconfig ansible.builtin.template: src: user-kubeconfig.yaml - dest: "{{ cluster_user_kube_dir }}/config" + dest: "{{ user_kube_dir }}/config" mode: "0600" - -- name: Create User Namespace - kubernetes.core.k8s: - state: present - definition: - apiVersion: v1 - kind: Namespace - metadata: - name: "{{ workload_namespace }}" - -- name: Create User Resource Quota - kubernetes.core.k8s: - state: present - template: resourcequota-user.yaml - -- name: Create User Limit Range - kubernetes.core.k8s: - state: present - template: limitrange-user.yaml diff --git a/roles/cluster_user/templates/clusterrolebinding-user.yaml b/roles/user/templates/clusterrolebinding-user.yaml similarity index 86% rename from roles/cluster_user/templates/clusterrolebinding-user.yaml rename to roles/user/templates/clusterrolebinding-user.yaml index 4ecd2aa..a223216 100644 --- a/roles/cluster_user/templates/clusterrolebinding-user.yaml +++ b/roles/user/templates/clusterrolebinding-user.yaml @@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: namespace-admin + name: "{{ cluster_user }}-cluster-admin" subjects: - kind: User name: "{{ cluster_user }}" diff --git a/roles/cluster_user/templates/csr-user.yaml.j2 b/roles/user/templates/csr-user.yaml.j2 similarity index 100% rename from roles/cluster_user/templates/csr-user.yaml.j2 rename to roles/user/templates/csr-user.yaml.j2 diff --git a/roles/user/templates/user-kubeconfig.yaml b/roles/user/templates/user-kubeconfig.yaml new file mode 100644 index 0000000..687990d --- /dev/null +++ b/roles/user/templates/user-kubeconfig.yaml @@ -0,0 +1,21 @@ +# vim: ft=yaml +--- +apiVersion: v1 +kind: Config +preferences: {} +current-context: {{ cluster_user }}-{{ cluster_host }} +clusters: + - name: {{ cluster_host }} + cluster: + certificate-authority: {{ user_api_crt }} + server: https://kube.{{ cluster_domain }}:{{ cluster_port }} +users: + - name: {{ cluster_user }} + user: + client-certificate: {{ user_crt }} + client-key: {{ user_key }} +contexts: + - name: {{ cluster_user }}-{{ cluster_host }} + context: + cluster: {{ cluster_host }} + user: {{ cluster_user }} diff --git a/roles/user/vars/main.yaml b/roles/user/vars/main.yaml new file mode 100644 index 0000000..f8c03d2 --- /dev/null +++ b/roles/user/vars/main.yaml @@ -0,0 +1,6 @@ +--- +user_kube_dir: "{{ ansible_env.HOME }}/.kube" +user_key: "{{ user_kube_dir }}/{{ cluster_user }}.key" +user_csr: "{{ user_kube_dir }}/{{ cluster_user }}.csr" +user_crt: "{{ user_kube_dir }}/{{ cluster_user }}.crt" +user_api_crt: "{{ user_kube_dir }}/cluster.crt" diff --git a/roles/cluster_workloads/files/factorio.sops.yaml b/roles/workloads/files/factorio.sops.yaml similarity index 100% rename from roles/cluster_workloads/files/factorio.sops.yaml rename to roles/workloads/files/factorio.sops.yaml diff --git a/roles/cluster_workloads/files/gmod.yaml b/roles/workloads/files/gmod.yaml similarity index 100% rename from roles/cluster_workloads/files/gmod.yaml rename to roles/workloads/files/gmod.yaml diff --git a/roles/cluster_workloads/files/ingress.yaml b/roles/workloads/files/ingress.yaml similarity index 100% rename from roles/cluster_workloads/files/ingress.yaml rename to roles/workloads/files/ingress.yaml diff --git a/roles/cluster_workloads/files/jellyfin.yaml b/roles/workloads/files/jellyfin.yaml similarity index 100% rename from roles/cluster_workloads/files/jellyfin.yaml rename to roles/workloads/files/jellyfin.yaml diff --git a/roles/cluster_workloads/files/niucraft.yaml b/roles/workloads/files/niucraft.yaml similarity index 100% rename from roles/cluster_workloads/files/niucraft.yaml rename to roles/workloads/files/niucraft.yaml diff --git a/roles/cluster_workloads/files/serge.yaml b/roles/workloads/files/serge.yaml similarity index 100% rename from roles/cluster_workloads/files/serge.yaml rename to roles/workloads/files/serge.yaml diff --git a/roles/cluster_workloads/files/valheim.yaml b/roles/workloads/files/valheim.yaml similarity index 100% rename from roles/cluster_workloads/files/valheim.yaml rename to roles/workloads/files/valheim.yaml diff --git a/roles/cluster_workloads/files/website.yaml b/roles/workloads/files/website.yaml similarity index 100% rename from roles/cluster_workloads/files/website.yaml rename to roles/workloads/files/website.yaml diff --git a/roles/cluster_workloads/tasks/main.yaml b/roles/workloads/tasks/main.yaml similarity index 71% rename from roles/cluster_workloads/tasks/main.yaml rename to roles/workloads/tasks/main.yaml index 7dc7327..d1c0cf8 100644 --- a/roles/cluster_workloads/tasks/main.yaml +++ b/roles/workloads/tasks/main.yaml @@ -1,4 +1,30 @@ --- +- name: Create User Namespace + kubernetes.core.k8s: + state: present + definition: + apiVersion: v1 + kind: Namespace + metadata: + name: "{{ workload_namespace }}" + +- name: Set Namespace in kubectl context + changed_when: true + ansible.builtin.command: > + kubectl config set-context + --current + "--namespace={{ workload_namespace }}" + +- name: Create User Resource Quota + kubernetes.core.k8s: + state: present + template: resourcequota-user.yaml + +- name: Create User Limit Range + kubernetes.core.k8s: + state: present + template: limitrange-user.yaml + - name: Install Helm become: true community.general.snap: diff --git a/roles/cluster_user/templates/limitrange-user.yaml b/roles/workloads/templates/limitrange-user.yaml similarity index 100% rename from roles/cluster_user/templates/limitrange-user.yaml rename to roles/workloads/templates/limitrange-user.yaml diff --git a/roles/cluster_user/templates/resourcequota-user.yaml b/roles/workloads/templates/resourcequota-user.yaml similarity index 100% rename from roles/cluster_user/templates/resourcequota-user.yaml rename to roles/workloads/templates/resourcequota-user.yaml diff --git a/setup.yaml b/setup.yaml new file mode 100644 index 0000000..ad2e477 --- /dev/null +++ b/setup.yaml @@ -0,0 +1,5 @@ +--- +- name: Setup for cluster creation + hosts: localhost + roles: + - setup diff --git a/site.yaml b/site.yaml index ff0e0e7..4cbb762 100644 --- a/site.yaml +++ b/site.yaml @@ -1,9 +1,9 @@ --- -- name: Set Talos - import_playbook: talos_setup.yaml -- name: Setup Cluster User - import_playbook: cluster_user.yaml -- name: Setup Cluster Services - import_playbook: cluster_services.yaml -- name: Deploy Workloads - import_playbook: cluster_workloads.yaml +- name: Setup for cluster creation + import_playbook: setup.yaml +- name: Create cluster user + import_playbook: user.yaml +- name: Deploy core services + import_playbook: core.yaml +- name: Deploy workloads + import_playbook: workloads.yaml diff --git a/talos_setup.yaml b/talos_setup.yaml deleted file mode 100644 index 79bd0fa..0000000 --- a/talos_setup.yaml +++ /dev/null @@ -1,5 +0,0 @@ ---- -- name: Setup Talos - hosts: localhost - roles: - - talos_setup diff --git a/user.yaml b/user.yaml new file mode 100644 index 0000000..b9279e5 --- /dev/null +++ b/user.yaml @@ -0,0 +1,5 @@ +--- +- name: Create cluster user + hosts: localhost + roles: + - user diff --git a/cluster_services.yaml b/workloads.yaml similarity index 50% rename from cluster_services.yaml rename to workloads.yaml index c096af4..ce89a0e 100644 --- a/cluster_services.yaml +++ b/workloads.yaml @@ -1,6 +1,6 @@ --- -- name: Setup Cluster Services +- name: Deploy workloads hosts: localhost gather_facts: false roles: - - cluster_services + - workloads