puppet-prod/hieradata/roles/infra/k8s/node.yaml

---
hiera_include:
  - profiles::selinux::setenforce
  - frrouting
  - profiles::ceph::node
  - profiles::ceph::client
  - exporters::frr_exporter
  - profiles::rke2::node

# manage rke2
profiles::rke2::node::servers:
  - prodnxsr0001.main.unkin.net
  - prodnxsr0002.main.unkin.net
  - prodnxsr0003.main.unkin.net

rke2::config_hash:
  bind-address: "%{hiera('networking_loopback0_ip')}"
  advertise-address: "%{hiera('networking_loopback0_ip')}"
  node-ip: "%{hiera('networking_loopback0_ip')}"
  node-external-ip: "%{hiera('networking_loopback0_ip')}"
  cluster-domain: "svc.k8s.unkin.net"
  tls-san:
    - "api.k8s.unkin.net"
    - "join.k8s.unkin.net"
  cni: cilium

# FIXME: puppet-python wants to try manage python-dev, which is required by the ceph package
python::manage_dev_package: false

profiles::packages::include:
  bridge-utils: {}
  cephadm: {}

profiles::selinux::setenforce::mode: disabled

profiles::ceph::client::manage_ceph_conf: false
profiles::ceph::client::manage_ceph_package: false
profiles::ceph::client::manage_ceph_paths: false
profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
profiles::ceph::client::mons:
  - 198.18.23.9
  - 198.18.23.10
  - 198.18.23.11
  - 198.18.23.12
  - 198.18.23.13

# additional repos
profiles::yum::global::repos:
  ceph:
    name: ceph
    descr: ceph repository
    target: /etc/yum.repos.d/ceph.repo
    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/%{facts.os.architecture}
    gpgkey: https://download.ceph.com/keys/release.asc
    mirrorlist: absent
  ceph-noarch:
    name: ceph-noarch
    descr: ceph-noarch repository
    target: /etc/yum.repos.d/ceph-noarch.repo
    baseurl: https://edgecache.query.consul/ceph/yum/el%{facts.os.release.major}/noarch
    gpgkey: https://download.ceph.com/keys/release.asc
    mirrorlist: absent
  frr-extras:
    name: frr-extras
    descr: frr-extras repository
    target: /etc/yum.repos.d/frr-extras.repo
    baseurl: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os
    gpgkey: https://packagerepo.service.consul/frr/el9/extras-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
    mirrorlist: absent
  frr-stable:
    name: frr-stable
    descr: frr-stable repository
    target: /etc/yum.repos.d/frr-stable.repo
    baseurl: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os
    gpgkey: https://packagerepo.service.consul/frr/el9/stable-daily/%{facts.os.architecture}/os/RPM-GPG-KEY-FRR
    mirrorlist: absent
  rancher-rke2-common-latest:
    name: rancher-rke2-common-latest
    descr: rancher-rke2-common-latest
    target: /etc/yum.repos.d/rke2-common.repo
    baseurl: https://rpm.rancher.io/rke2/latest/common/centos/%{facts.os.release.major}/noarch
    gpgkey: https://rpm.rancher.io/public.key
    mirrorlist: absent
  rancher-rke2-1-33-latest:
    name: rancher-rke2-1-33-latest
    descr: rancher-rke2-1-33-latest
    target: /etc/yum.repos.d/rke2-1-33.repo
    baseurl: https://rpm.rancher.io/rke2/latest/1.33/centos/%{facts.os.release.major}/x86_64
    gpgkey: https://rpm.rancher.io/public.key
    mirrorlist: absent

# dns
profiles::dns::base::primary_interface: loopback0

# networking
systemd::manage_networkd: true
systemd::manage_all_network_files: true
networking::interfaces:
  "%{hiera('networking_1000_iface')}":
    type: physical
    ipaddress: "%{hiera('networking_1000_ip')}"
    gateway: 198.18.15.254
    txqueuelen: 10000
    forwarding: true
  "%{hiera('networking_2500_iface')}":
    type: physical
    ipaddress: "%{hiera('networking_2500_ip')}"
    mtu: 1500
    txqueuelen: 10000
    forwarding: true
  loopback0:
    type: dummy
    ipaddress: "%{hiera('networking_loopback0_ip')}"
    netmask: 255.255.255.255
    mtu: 1500
  loopback1:
    type: dummy
    ipaddress: "%{hiera('networking_loopback1_ip')}"
    netmask: 255.255.255.255
    mtu: 1500
  loopback2:
    type: dummy
    ipaddress: "%{hiera('networking_loopback2_ip')}"
    netmask: 255.255.255.255
    mtu: 1500

# configure consul service
profiles::consul::client::host_addr: "%{hiera('networking_loopback0_ip')}"
consul::services:
  api-k8s:
    service_name: 'api-k8s'
    address: "%{facts.networking.fqdn}"
    port: 6443
    checks:
      - id: 'api-k8s_https_check'
        name: 'api-k8s HTTPS Check'
        http: "https://%{facts.networking.fqdn}:6443"
        method: 'GET'
        tls_skip_verify: true
        interval: '10s'
        timeout: '1s'
  join-k8s:
    service_name: 'join-k8s'
    address: "%{facts.networking.fqdn}"
    port: 9345
    checks:
      - id: 'etcd_tcp_check_9345'
        name: 'ETCD TCP Check 9345'
        tcp: "%{facts.networking.fqdn}:9345"
        interval: '10s'
        timeout: '1s'
profiles::consul::client::node_rules:
  - resource: service
    segment: api-k8s
    disposition: write
  - resource: service
    segment: join-k8s
    disposition: write
  - resource: service
    segment: frr_exporter
    disposition: write

# frrouting
exporters::frr_exporter::enable: true
frrouting::ospfd_router_id: "%{hiera('networking_loopback0_ip')}"
frrouting::ospf_preferred_source_enable: true
frrouting::ospf_preferred_source: "%{hiera('networking_loopback0_ip')}"
frrouting::ospfd_redistribute:
  - connected
frrouting::ospfd_interfaces:
  "%{hiera('networking_1000_iface')}":
    area: 0.0.0.0
  "%{hiera('networking_2500_iface')}":
    area: 0.0.0.0
  loopback0:
    area: 0.0.0.0
  loopback1:
    area: 0.0.0.0
  loopback2:
    area: 0.0.0.0
frrouting::daemons:
  ospfd: true

# add loopback interfaces to ssh list
ssh::server::options:
  ListenAddress:
    - "%{hiera('networking_loopback0_ip')}"
    - "%{hiera('networking_1000_ip')}"
    - "%{hiera('networking_2500_ip')}"

profiles::ssh::sign::principals:
  - "%{hiera('networking_loopback0_ip')}"
  - "%{hiera('networking_1000_ip')}"
  - "%{hiera('networking_2500_ip')}"

profiles::pki::vault::alt_names:
  - api-k8s.service.consul
  - api-k8s.query.consul
  - "api-k8s.service.%{facts.country}-%{facts.region}.consul"