feat: adding rke2 (#394)
- manage rke2 repos - add rke2 module (init, params, install, config, service) - split roles::infra::k8s::node -> control/compute roles - moved common k8s config into k8s.yaml - add bootstrap_node, manage server and token fields in rke2 config - manage install of helm - manage node attributes (from puppet facts) - manage frr exclusions for service/cluster network Reviewed-on: #394
This commit was merged in pull request #394.
This commit is contained in:
@@ -0,0 +1,87 @@
|
||||
# config rke2
|
||||
class rke2::config (
|
||||
Enum['server', 'agent'] $node_type = $rke2::node_type,
|
||||
Stdlib::Absolutepath $config_file = $rke2::config_file,
|
||||
Hash $config_hash = $rke2::config_hash,
|
||||
Stdlib::HTTPSUrl $join_url = $rke2::join_url,
|
||||
Stdlib::Fqdn $bootstrap_node = $rke2::bootstrap_node,
|
||||
String $node_token = $rke2::node_token,
|
||||
Array[String[1]] $extra_config_files = $rke2::extra_config_files,
|
||||
){
|
||||
|
||||
# if agent, add token. what other fields should i add?
|
||||
# how can I add a tls secret using kubectl to add ephemeral certs.
|
||||
|
||||
# if its not the bootstrap node, add join path to config
|
||||
if $node_type == 'server' {
|
||||
if $trusted['certname'] != $bootstrap_node {
|
||||
$config = merge($config_hash, {
|
||||
server => $join_url,
|
||||
token => $node_token,
|
||||
} )
|
||||
}else{
|
||||
$config = $config_hash
|
||||
}
|
||||
} elsif $node_type == 'agent' {
|
||||
$config = merge($config_hash, {
|
||||
server => $join_url,
|
||||
token => $node_token,
|
||||
} )
|
||||
}else{
|
||||
$config = $config_hash
|
||||
}
|
||||
|
||||
# create the config file
|
||||
file { $config_file:
|
||||
ensure => file,
|
||||
content => Sensitive($config.to_yaml),
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0644',
|
||||
require => Package["rke2-${node_type}"],
|
||||
before => Service["rke2-${node_type}"],
|
||||
}
|
||||
|
||||
# create a script to verify k8s api is up (used by consul)
|
||||
file {'/usr/local/bin/check_k8s_api.sh':
|
||||
ensure => file,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0755',
|
||||
source => 'puppet:///modules/rke2/check_k8s_api.sh',
|
||||
}
|
||||
|
||||
# symlink kubectl to path
|
||||
file {'/usr/bin/kubectl':
|
||||
ensure => link,
|
||||
target => '/var/lib/rancher/rke2/bin/kubectl',
|
||||
require => Package["rke2-${node_type}"],
|
||||
}
|
||||
|
||||
# when ProtectKernelDefaults=true
|
||||
sysctl { 'vm.overcommit_memory':
|
||||
value => '1',
|
||||
before => Service["rke2-${node_type}"],
|
||||
}
|
||||
sysctl { 'kernel.panic':
|
||||
value => '10',
|
||||
before => Service["rke2-${node_type}"],
|
||||
}
|
||||
|
||||
# on the controller nodes only
|
||||
if $node_type == 'server' {
|
||||
|
||||
# manage extra config config
|
||||
$extra_config_files.each |$file| {
|
||||
|
||||
file {"/var/lib/rancher/rke2/server/manifests/${file}.yaml":
|
||||
ensure => file,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0644',
|
||||
source => "puppet:///modules/rke2/${file}.yaml",
|
||||
require => Service['rke2-server'],
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
|
||||
# manage helm
|
||||
class rke2::helm (
|
||||
Enum['server', 'agent'] $node_type = $rke2::node_type,
|
||||
Stdlib::Fqdn $bootstrap_node = $rke2::bootstrap_node,
|
||||
Boolean $helm_install = $rke2::helm_install,
|
||||
Hash $helm_repos = $rke2::helm_repos
|
||||
){
|
||||
|
||||
# when installing helm, manage the repos
|
||||
if $helm_install {
|
||||
|
||||
package {'helm':
|
||||
ensure => installed,
|
||||
}
|
||||
|
||||
file { '/etc/helm':
|
||||
ensure => directory,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0755',
|
||||
}
|
||||
|
||||
# on the controller nodes only
|
||||
if $node_type == 'server' {
|
||||
|
||||
# check if the repo already exists
|
||||
$helm_repos.each | String $repo, Stdlib::HTTPSUrl $url | {
|
||||
|
||||
# if repo isnt in repo list from helm, install it
|
||||
if ! $facts['helm_repos'].any |$existing| { $existing['name'] == $repo } {
|
||||
|
||||
exec { "helm_add_repo_${repo}":
|
||||
command => "helm repo add ${repo} ${url} --repository-config /etc/helm/repositories.yaml",
|
||||
path => ['/usr/bin'],
|
||||
environment => [
|
||||
'KUBECONFIG=/etc/rancher/rke2/rke2.yaml',
|
||||
],
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
# manage rke2
|
||||
class rke2 (
|
||||
Enum['server', 'agent'] $node_type = $rke2::params::node_type,
|
||||
String $rke2_version = $rke2::params::rke2_version,
|
||||
String $rke2_release = $rke2::params::rke2_release,
|
||||
Stdlib::Absolutepath $config_file = $rke2::params::config_file,
|
||||
Hash $config_hash = $rke2::params::config_hash,
|
||||
Stdlib::HTTPSUrl $join_url = $rke2::params::join_url,
|
||||
Stdlib::Fqdn $bootstrap_node = $rke2::params::bootstrap_node,
|
||||
String $node_token = $rke2::params::node_token,
|
||||
Boolean $helm_install = $rke2::params::helm_install,
|
||||
Hash $helm_repos = $rke2::params::helm_repos,
|
||||
Array[String[1]] $extra_config_files = $rke2::params::extra_config_files,
|
||||
Stdlib::HTTPUrl $container_archive_source = $rke2::params::container_archive_source,
|
||||
) inherits rke2::params {
|
||||
|
||||
include rke2::install
|
||||
include rke2::config
|
||||
include rke2::service
|
||||
include rke2::helm
|
||||
|
||||
Class['rke2::install'] -> Class['rke2::service'] -> Class['rke2::helm']
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
# install rke2
|
||||
class rke2::install (
|
||||
Enum['server', 'agent'] $node_type = $rke2::node_type,
|
||||
String $rke2_version = $rke2::rke2_version,
|
||||
String $rke2_release = $rke2::rke2_release,
|
||||
Stdlib::HTTPUrl $container_archive_source = $rke2::container_archive_source,
|
||||
){
|
||||
|
||||
# versionlock rke2
|
||||
yum::versionlock{"rke2-${node_type}":
|
||||
ensure => present,
|
||||
version => "${rke2_version}~${rke2_release}",
|
||||
}
|
||||
|
||||
# install rke2
|
||||
package {"rke2-${node_type}":
|
||||
ensure => "${rke2_version}~${rke2_release}",
|
||||
}
|
||||
|
||||
# ensure images path exists
|
||||
file { ['/var/lib/rancher/rke2/agent', '/var/lib/rancher/rke2/agent/images']:
|
||||
ensure => 'directory',
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0750',
|
||||
require => Package["rke2-${node_type}"],
|
||||
before => Service["rke2-${node_type}"],
|
||||
}
|
||||
|
||||
# download required archive of containers
|
||||
archive { '/var/lib/rancher/rke2/agent/images/rke2-images.linux-amd64.tar.zst':
|
||||
ensure => present,
|
||||
source => "https://github.com/rancher/rke2/releases/download/v${rke2_version}%2B${rke2_release}/rke2-images.linux-amd64.tar.zst",
|
||||
require => [
|
||||
Package["rke2-${node_type}"],
|
||||
File['/var/lib/rancher/rke2/agent/images'],
|
||||
],
|
||||
before => Service["rke2-${node_type}"],
|
||||
}
|
||||
|
||||
# ensure the images cache file exists
|
||||
file {'/var/lib/rancher/rke2/agent/images/.cache.json':
|
||||
ensure => file,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0644',
|
||||
require => [
|
||||
Package["rke2-${node_type}"],
|
||||
File['/var/lib/rancher/rke2/agent/images'],
|
||||
],
|
||||
before => Service["rke2-${node_type}"],
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
# rke2 params
|
||||
class rke2::params (
|
||||
Enum['server', 'agent'] $node_type = 'agent',
|
||||
String $rke2_version = '1.33.4',
|
||||
String $rke2_release = 'rke2r1',
|
||||
Stdlib::Absolutepath $config_file = '/etc/rancher/rke2/config.yaml',
|
||||
Hash $config_hash = {},
|
||||
Stdlib::HTTPSUrl $join_url = 'https://127.0.0.1:9345',
|
||||
Stdlib::Fqdn $bootstrap_node = 'localhost.localdomain',
|
||||
String $node_token = '',
|
||||
Boolean $helm_install = false,
|
||||
Hash $helm_repos = {},
|
||||
Array[String[1]] $extra_config_files = [],
|
||||
Stdlib::HTTPUrl $container_archive_source = 'https://github.com/rancher/rke2/releases/download',
|
||||
) {}
|
||||
@@ -0,0 +1,13 @@
|
||||
# manage rke2 service
|
||||
class rke2::service (
|
||||
Enum['server', 'agent'] $node_type = $rke2::node_type,
|
||||
Stdlib::Absolutepath $config_file = $rke2::config_file,
|
||||
){
|
||||
|
||||
service {"rke2-${node_type}":
|
||||
ensure => true,
|
||||
enable => true,
|
||||
subscribe => File[$config_file],
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user