unkinben
2d125487c3
ci/woodpecker/pr/ruby-validate Pipeline was successful
ci/woodpecker/pr/erb-validate Pipeline was successful
ci/woodpecker/pr/puppet-lint Pipeline was successful
ci/woodpecker/pr/bolt-validate Pipeline was successful
ci/woodpecker/pr/yamllint Pipeline was successful
ci/woodpecker/pr/epp-validate Pipeline was successful
ci/woodpecker/pr/ruby-check Pipeline was successful
ci/woodpecker/pr/puppet-validate Pipeline was successful
Bring the hand-maintained /etc/ceph/ceph.conf under Puppet on the prodnxsr ceph cluster (fsid de96a98f). The file is identified per host by role: k8s roles include profiles::ceph::osd only and get a [global] section; the incus node role also includes profiles::ceph::mds and additionally gets the [mds] + [mds.*] sections. - Add cluster topology as a single source of truth in common.yaml: cluster_public_ips (all 13 ceph host /32s), mon_initial_members, and the mds_instances map (two mds daemons per mon/mgr/mds host). - Render /etc/ceph/ceph.conf from that topology in the reworked client.conf.erb, preserving the live two-space indent and key order. - Gate the [mds] sections on render_mds_config, set true only in the incus node role hiera (the role that includes profiles::ceph::mds). - Drop the hard Package[ceph-common] dependency when the class does not manage the package (cephadm/profiles::packages deliver it on the k8s and incus hosts). - Enable manage_ceph_conf on the k8s and incus node roles. public_network is normalized to all 13 ceph host /32s on every host; this rewrites it on the mon/mgr/mds hosts (adding .1-.8) as the one intended content change. RGW hosts keep their profiles::ceph::conf variant and are untouched. Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
209 lines
5.6 KiB
YAML
209 lines
5.6 KiB
YAML
---
|
|
hiera_include:
|
|
- profiles::selinux::setenforce
|
|
- profiles::ceph::node
|
|
- profiles::ceph::osd
|
|
- profiles::ceph::client
|
|
- exporters::frr_exporter
|
|
- frrouting
|
|
- rke2
|
|
|
|
# manage rke2
|
|
rke2::bootstrap_node: prodnxsr0001.main.unkin.net
|
|
rke2::join_url: https://join-k8s.service.consul:9345
|
|
# pull the airgap image bundle via artifactapi (host-reachable pre-CNI), not github directly
|
|
rke2::container_archive_source: 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download'
|
|
rke2::manage_registries: true
|
|
rke2::registries:
|
|
docker.io:
|
|
endpoint:
|
|
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
rewrite:
|
|
"^(.*)$": "dockerhub/$1"
|
|
disable-default-registry-endpoint: true
|
|
ghcr.io:
|
|
endpoint:
|
|
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
rewrite:
|
|
"^(.*)$": "ghcr/$1"
|
|
disable-default-registry-endpoint: true
|
|
quay.io:
|
|
endpoint:
|
|
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
rewrite:
|
|
"^(.*)$": "quay/$1"
|
|
disable-default-registry-endpoint: true
|
|
registry.k8s.io:
|
|
endpoint:
|
|
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
rewrite:
|
|
"^(.*)$": "k8s-registry/$1"
|
|
disable-default-registry-endpoint: true
|
|
registry.gitlab.com:
|
|
endpoint:
|
|
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
rewrite:
|
|
"^(.*)$": "gitlab/$1"
|
|
disable-default-registry-endpoint: true
|
|
docker.elastic.co:
|
|
endpoint:
|
|
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
rewrite:
|
|
"^(.*)$": "elastic/$1"
|
|
disable-default-registry-endpoint: true
|
|
gcr.io:
|
|
endpoint:
|
|
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
rewrite:
|
|
"^(.*)$": "gcr/$1"
|
|
disable-default-registry-endpoint: true
|
|
docker.litellm.ai:
|
|
endpoint:
|
|
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
rewrite:
|
|
"^(.*)$": "litellm/$1"
|
|
disable-default-registry-endpoint: true
|
|
public.ecr.aws:
|
|
endpoint:
|
|
- "https://artifactapi.k8s.syd1.au.unkin.net"
|
|
rewrite:
|
|
"^(.*)$": "ecr-public/$1"
|
|
disable-default-registry-endpoint: true
|
|
rke2::config_hash:
|
|
bind-address: "%{hiera('networking_loopback0_ip')}"
|
|
node-ip: "%{hiera('networking_loopback0_ip')}"
|
|
node-external-ip: "%{hiera('networking_loopback0_ip')}"
|
|
write-kubeconfig-mode: 644
|
|
kubelet-arg:
|
|
- '--node-status-update-frequency=4s'
|
|
- '--max-pods=100'
|
|
node-label:
|
|
- "region=%{facts.region}"
|
|
- "country=%{facts.country}"
|
|
- "asset=%{facts.dmi.product.serial_number}"
|
|
- "zone=%{zone}"
|
|
|
|
# FIXME: puppet-python wants to try manage python-dev, which is required by the ceph package
|
|
python::manage_dev_package: false
|
|
|
|
profiles::packages::include:
|
|
bridge-utils: {}
|
|
cephadm: {}
|
|
|
|
profiles::selinux::setenforce::mode: disabled
|
|
|
|
profiles::ceph::client::manage_ceph_conf: true
|
|
profiles::ceph::client::manage_ceph_package: false
|
|
profiles::ceph::client::manage_ceph_paths: false
|
|
profiles::ceph::client::fsid: 'de96a98f-3d23-465a-a899-86d3d67edab8'
|
|
profiles::ceph::client::mons:
|
|
- 198.18.23.9
|
|
- 198.18.23.10
|
|
- 198.18.23.11
|
|
- 198.18.23.12
|
|
- 198.18.23.13
|
|
|
|
# additional repos
|
|
profiles::yum::global::repos:
|
|
ceph:
|
|
ensure: present
|
|
ceph-noarch:
|
|
ensure: present
|
|
frr-extras:
|
|
ensure: present
|
|
frr-stable:
|
|
ensure: present
|
|
rancher-rke2-common-latest:
|
|
ensure: present
|
|
rancher-rke2-1-33-latest:
|
|
ensure: present
|
|
|
|
# dns
|
|
profiles::dns::base::primary_interface: loopback0
|
|
|
|
# networking
|
|
systemd::manage_networkd: true
|
|
systemd::manage_all_network_files: true
|
|
networking::interfaces:
|
|
"%{hiera('networking_1000_iface')}":
|
|
type: physical
|
|
ipaddress: "%{hiera('networking_1000_ip')}"
|
|
gateway: 198.18.15.254
|
|
txqueuelen: 10000
|
|
forwarding: true
|
|
"%{hiera('networking_2500_iface')}":
|
|
type: physical
|
|
ipaddress: "%{hiera('networking_2500_ip')}"
|
|
mtu: 1500
|
|
txqueuelen: 10000
|
|
forwarding: true
|
|
loopback0:
|
|
type: dummy
|
|
ipaddress: "%{hiera('networking_loopback0_ip')}"
|
|
netmask: 255.255.255.255
|
|
mtu: 1500
|
|
loopback1:
|
|
type: dummy
|
|
ipaddress: "%{hiera('networking_loopback1_ip')}"
|
|
netmask: 255.255.255.255
|
|
mtu: 1500
|
|
loopback2:
|
|
type: dummy
|
|
ipaddress: "%{hiera('networking_loopback2_ip')}"
|
|
netmask: 255.255.255.255
|
|
mtu: 1500
|
|
|
|
# configure consul service
|
|
profiles::consul::client::host_addr: "%{hiera('networking_loopback0_ip')}"
|
|
profiles::consul::client::node_rules:
|
|
- resource: service
|
|
segment: frr_exporter
|
|
disposition: write
|
|
|
|
# frrouting
|
|
exporters::frr_exporter::enable: true
|
|
frrouting::ospfd_router_id: "%{hiera('networking_loopback0_ip')}"
|
|
frrouting::ospf_preferred_source_enable: true
|
|
frrouting::ospf_preferred_source: "%{hiera('networking_loopback0_ip')}"
|
|
frrouting::ospfd_redistribute:
|
|
- connected
|
|
frrouting::ospfd_interfaces:
|
|
"%{hiera('networking_1000_iface')}":
|
|
area: 0.0.0.0
|
|
"%{hiera('networking_2500_iface')}":
|
|
area: 0.0.0.0
|
|
loopback0:
|
|
area: 0.0.0.0
|
|
loopback1:
|
|
area: 0.0.0.0
|
|
loopback2:
|
|
area: 0.0.0.0
|
|
frrouting::daemons:
|
|
ospfd: true
|
|
frrouting::ospf_exclude_k8s_enable: true
|
|
frrouting::k8s_cluster_cidr: '10.42.0.0/16' # RKE2 cluster-cidr (pods)
|
|
frrouting::k8s_service_cidr: '10.43.0.0/16' # RKE2 service-cidr
|
|
|
|
# sysctl recommendations
|
|
sysctl::base::values:
|
|
net.ipv4.conf.default.rp_filter:
|
|
value: '0'
|
|
net.ipv4.conf.all.rp_filter:
|
|
value: '0'
|
|
fs.inotify.max_user_watches:
|
|
value: '524288'
|
|
fs.inotify.max_user_instances:
|
|
value: '512'
|
|
|
|
# add loopback interfaces to ssh list
|
|
ssh::server::options:
|
|
ListenAddress:
|
|
- "%{hiera('networking_loopback0_ip')}"
|
|
- "%{hiera('networking_1000_ip')}"
|
|
- "%{hiera('networking_2500_ip')}"
|
|
|
|
profiles::ssh::sign::principals:
|
|
- "%{hiera('networking_loopback0_ip')}"
|
|
- "%{hiera('networking_1000_ip')}"
|
|
- "%{hiera('networking_2500_ip')}"
|