1082 lines
36 KiB
YAML
1082 lines
36 KiB
YAML
- name: Validate bootstrap inputs
|
|
ansible.builtin.assert:
|
|
that:
|
|
- k3s_platform_git_url | length > 0
|
|
- k3s_platform_git_branch | length > 0
|
|
- k3s_platform_flux_root_path | length > 0
|
|
- k3s_platform_git_auth_mode | default('public') | lower in ['public', 'ssh', 'https-basic', 'https-bearer', '']
|
|
fail_msg: "k3s platform bootstrap requires git url, branch, root path, and a supported git auth mode."
|
|
|
|
- name: Resolve flux git auth inputs
|
|
ansible.builtin.set_fact:
|
|
k3s_platform_git_auth_mode_effective: "{{ (k3s_platform_git_auth_mode | default('public')) | lower | trim }}"
|
|
no_log: true
|
|
|
|
- name: Resolve SSH git private key when needed
|
|
ansible.builtin.set_fact:
|
|
k3s_platform_git_private_key_resolved: >-
|
|
{{
|
|
k3s_platform_git_private_key
|
|
if (k3s_platform_git_auth_mode_effective == 'ssh' and k3s_platform_git_private_key | default('') | length > 0)
|
|
else (
|
|
lookup('ansible.builtin.file', k3s_platform_git_private_key_path) | trim
|
|
if (k3s_platform_git_auth_mode_effective == 'ssh')
|
|
else ''
|
|
)
|
|
}}
|
|
no_log: true
|
|
|
|
- name: Assert SSH auth material is available
|
|
ansible.builtin.assert:
|
|
that:
|
|
- k3s_platform_git_private_key_resolved | length > 0
|
|
fail_msg: "SSH auth requires a git deploy key content or readable key path."
|
|
when:
|
|
- k3s_platform_git_auth_mode_effective == 'ssh'
|
|
|
|
- name: Assert HTTPS basic auth material is available
|
|
ansible.builtin.assert:
|
|
that:
|
|
- k3s_platform_git_http_username | default('') | length > 0
|
|
- k3s_platform_git_http_password | default('') | length > 0
|
|
fail_msg: "HTTPS basic auth requires username and password/token."
|
|
when:
|
|
- k3s_platform_git_auth_mode_effective == 'https-basic'
|
|
|
|
- name: Assert HTTPS bearer auth material is available
|
|
ansible.builtin.assert:
|
|
that:
|
|
- k3s_platform_git_bearer_token | default('') | length > 0
|
|
fail_msg: "HTTPS bearer auth requires a bearer token."
|
|
when:
|
|
- k3s_platform_git_auth_mode_effective == 'https-bearer'
|
|
|
|
- name: Normalize public git auth mode
|
|
ansible.builtin.set_fact:
|
|
k3s_platform_git_auth_mode_effective: public
|
|
when:
|
|
- k3s_platform_git_auth_mode_effective in ['', 'public', 'none']
|
|
|
|
- name: Install bootstrap dependencies
|
|
ansible.builtin.package:
|
|
name:
|
|
- curl
|
|
- git
|
|
- openssh-client
|
|
- ca-certificates
|
|
- python3-pip
|
|
- tar
|
|
state: present
|
|
|
|
- name: Ensure k3s config directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ k3s_platform_k3s_config_path | dirname }}"
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Ensure install directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ k3s_platform_install_dir }}"
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Render k3s config
|
|
ansible.builtin.template:
|
|
src: k3s-config.yaml.j2
|
|
dest: "{{ k3s_platform_k3s_config_path }}"
|
|
mode: "0644"
|
|
|
|
- name: Check whether k3s is already installed
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
if { [ -x /usr/local/bin/k3s ] || [ -x /usr/bin/k3s ]; } && [ -f /etc/systemd/system/k3s.service ]; then
|
|
echo "installed"
|
|
exit 0
|
|
fi
|
|
echo "missing"
|
|
args:
|
|
executable: /bin/bash
|
|
register: k3s_platform_k3s_install_state
|
|
changed_when: false
|
|
|
|
- name: Download k3s installer script
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
if [ "{{ k3s_platform_k3s_install_state.stdout | default('missing') }}" = "installed" ]; then
|
|
exit 0
|
|
fi
|
|
echo "[k3s-bootstrap] downloading installer from {{ k3s_platform_k3s_install_script_url }}"
|
|
rm -f "{{ k3s_platform_k3s_install_script_path }}"
|
|
curl -fL \
|
|
--retry 5 \
|
|
--retry-all-errors \
|
|
--connect-timeout 15 \
|
|
--max-time 1800 \
|
|
-o "{{ k3s_platform_k3s_install_script_path }}" \
|
|
"{{ k3s_platform_k3s_install_script_url }}"
|
|
chmod 0755 "{{ k3s_platform_k3s_install_script_path }}"
|
|
args:
|
|
executable: /bin/bash
|
|
when:
|
|
- k3s_platform_k3s_install_state.stdout | default('missing') != 'installed'
|
|
|
|
- name: Run k3s installer script
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
if [ "{{ k3s_platform_k3s_install_state.stdout | default('missing') }}" = "installed" ]; then
|
|
exit 0
|
|
fi
|
|
echo "[k3s-bootstrap] starting installer at $(date -Is)"
|
|
bash -x "{{ k3s_platform_k3s_install_script_path }}" \
|
|
2>&1 | tee "{{ k3s_platform_k3s_install_log_path }}"
|
|
echo "[k3s-bootstrap] finished installer at $(date -Is)"
|
|
args:
|
|
executable: /bin/bash
|
|
async: "{{ k3s_platform_k3s_install_timeout_seconds }}"
|
|
poll: 15
|
|
when:
|
|
- k3s_platform_k3s_install_state.stdout | default('missing') != 'installed'
|
|
|
|
- name: Wait for k3s binary and unit file to appear
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
for attempt in $(seq 1 30); do
|
|
k3s_state="missing"
|
|
unit_state="missing"
|
|
if command -v k3s >/dev/null 2>&1; then
|
|
k3s_state="present"
|
|
fi
|
|
if [ -f /etc/systemd/system/k3s.service ]; then
|
|
unit_state="present"
|
|
fi
|
|
echo "[k3s-bootstrap] wait ${attempt}/30: k3s=${k3s_state}, unit=${unit_state}"
|
|
if [ "${k3s_state}" = "present" ] && [ "${unit_state}" = "present" ]; then
|
|
echo "[k3s-bootstrap] k3s binary and unit file detected"
|
|
exit 0
|
|
fi
|
|
sleep 2
|
|
done
|
|
echo "[k3s-bootstrap] timed out waiting for k3s binary and unit file" >&2
|
|
exit 1
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Reload systemd after k3s install
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
|
|
- name: Ensure k3s service is enabled and started
|
|
ansible.builtin.systemd:
|
|
name: k3s
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Install helm
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
if command -v helm >/dev/null 2>&1; then
|
|
exit 0
|
|
fi
|
|
curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Install flux cli
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
if command -v flux >/dev/null 2>&1; then
|
|
exit 0
|
|
fi
|
|
curl -s https://fluxcd.io/install.sh | bash
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Ensure flux namespace exists
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl get namespace "{{ k3s_platform_flux_namespace }}" >/dev/null 2>&1 || kubectl create namespace "{{ k3s_platform_flux_namespace }}"
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Install flux controllers
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
flux install --namespace "{{ k3s_platform_flux_namespace }}"
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Wait for flux controllers to become ready
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl -n "{{ k3s_platform_flux_namespace }}" rollout status deployment/source-controller --timeout=300s
|
|
kubectl -n "{{ k3s_platform_flux_namespace }}" rollout status deployment/kustomize-controller --timeout=300s
|
|
kubectl -n "{{ k3s_platform_flux_namespace }}" rollout status deployment/helm-controller --timeout=300s
|
|
kubectl -n "{{ k3s_platform_flux_namespace }}" rollout status deployment/notification-controller --timeout=300s
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Wait for Kubernetes API to become ready for bootstrap resources
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl get --raw=/readyz >/dev/null
|
|
args:
|
|
executable: /bin/bash
|
|
register: k3s_platform_apiserver_ready
|
|
changed_when: false
|
|
retries: 24
|
|
delay: 5
|
|
until: k3s_platform_apiserver_ready.rc == 0
|
|
|
|
- name: Ensure Vault bootstrap namespace exists
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl get namespace extsvc >/dev/null 2>&1 || kubectl create namespace extsvc
|
|
args:
|
|
executable: /bin/bash
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
|
|
- name: Ensure platform namespace exists for bootstrap secrets
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl get namespace platform >/dev/null 2>&1 || kubectl create namespace platform
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Ensure core namespaces exist for bootstrap secrets
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
for namespace in database core-pre core-prod; do
|
|
kubectl get namespace "${namespace}" >/dev/null 2>&1 || kubectl create namespace "${namespace}"
|
|
done
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Create runtime bootstrap configmap for platform inputs
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl -n platform create configmap platform-bootstrap-env \
|
|
--from-literal=GITOPS_REPO="{{ bootstrap_gitops_repo | default('') }}" \
|
|
--from-literal=VAULT_URL="{{ bootstrap_vault_url | default('') }}" \
|
|
--from-literal=CLOUDFLARE_ZONE_ID="{{ cloudflare_zone_id | default('') }}" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
args:
|
|
executable: /bin/bash
|
|
when:
|
|
- (bootstrap_gitops_repo | default('')) | length > 0
|
|
- (bootstrap_vault_url | default('')) | length > 0
|
|
- (cloudflare_zone_id | default('')) | length > 0
|
|
|
|
- name: Create runtime bootstrap secret for platform inputs
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl -n platform create secret generic platform-bootstrap-secrets \
|
|
--from-literal=VAULT_TOKEN="{{ bootstrap_vault_token | default('') }}" \
|
|
--from-literal=VAULT_ROOT_TOKEN="{{ vault_root_token | default('') }}" \
|
|
--from-literal=CLOUDFLARE_DNS_API_TOKEN="{{ lookup('env', 'CLOUDFLARE_DNS_API_TOKEN') | default('', true) }}" \
|
|
--from-literal=CLOUDFLARE_API_TOKEN="{{ cloudflare_api_token | default('') }}" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
args:
|
|
executable: /bin/bash
|
|
no_log: true
|
|
when:
|
|
- (bootstrap_vault_token | default('')) | length > 0
|
|
- (vault_root_token | default('')) | length > 0
|
|
- (lookup('env', 'CLOUDFLARE_DNS_API_TOKEN') | default('', true)) | length > 0
|
|
- (cloudflare_api_token | default('')) | length > 0
|
|
|
|
- name: Create runtime bootstrap secret for Vault seeding
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl -n extsvc create secret generic vault-bootstrap \
|
|
--from-literal=rootToken="{{ vault_root_token | default('') }}" \
|
|
--from-literal=cloudflareApiToken="{{ cloudflare_api_token | default('') }}" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
args:
|
|
executable: /bin/bash
|
|
no_log: true
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- (vault_root_token | default('')) | length > 0
|
|
- (cloudflare_api_token | default('')) | length > 0
|
|
|
|
- name: Create runtime bootstrap secret for ExternalDNS seeding
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl -n platform create secret generic cloudflare-api-token \
|
|
--from-literal=api-token="{{ cloudflare_api_token | default('') }}" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
args:
|
|
executable: /bin/bash
|
|
no_log: true
|
|
when:
|
|
- (cloudflare_api_token | default('')) | length > 0
|
|
|
|
- name: Render direct Helm values for caddy
|
|
ansible.builtin.copy:
|
|
content: "{{ (k3s_platform_values.components.caddy['values'] | default({})) | to_nice_yaml(indent=2) }}"
|
|
dest: /tmp/platform-caddy-values.yaml
|
|
mode: "0600"
|
|
|
|
- name: Render direct Helm values for apisix
|
|
ansible.builtin.copy:
|
|
content: "{{ (k3s_platform_values.components.apisix['values'] | default({})) | to_nice_yaml(indent=2) }}"
|
|
dest: /tmp/platform-apisix-values.yaml
|
|
mode: "0600"
|
|
|
|
- name: Render direct Helm values for external-dns
|
|
ansible.builtin.copy:
|
|
content: "{{ (k3s_platform_values.components.externalDns['values'] | default({})) | to_nice_yaml(indent=2) }}"
|
|
dest: /tmp/platform-external-dns-values.yaml
|
|
mode: "0600"
|
|
|
|
- name: Render native APISIX ingress manifest
|
|
ansible.builtin.template:
|
|
src: apisix-ingress.yaml.j2
|
|
dest: /tmp/platform-apisix-ingress.yaml
|
|
mode: "0600"
|
|
when:
|
|
- k3s_platform_values.apisixIngress.enabled | default(false)
|
|
|
|
- name: Render native shared TLS sync manifest
|
|
ansible.builtin.template:
|
|
src: shared-tls-secret-sync.yaml.j2
|
|
dest: /tmp/platform-shared-tls-secret-sync.yaml
|
|
mode: "0600"
|
|
when:
|
|
- k3s_platform_values.components.sharedTlsSecretSync.enabled | default(false)
|
|
|
|
- name: Render native PostgreSQL TLS ingress manifest
|
|
ansible.builtin.template:
|
|
src: postgresql-tls-ingress.yaml.j2
|
|
dest: /tmp/platform-postgresql-tls-ingress.yaml
|
|
mode: "0600"
|
|
when:
|
|
- k3s_platform_values.postgresqlTlsIngress.enabled | default(false)
|
|
|
|
- name: Ensure platform Helm repositories are configured
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
if helm repo list | awk '{print $1}' | grep -qx '{{ item.name }}'; then
|
|
helm repo add --force-update '{{ item.name }}' '{{ item.url }}' >/dev/null
|
|
else
|
|
helm repo add '{{ item.name }}' '{{ item.url }}' >/dev/null
|
|
fi
|
|
args:
|
|
executable: /bin/bash
|
|
loop: "{{ k3s_platform_helm_repos }}"
|
|
|
|
- name: Refresh platform Helm repositories
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
helm repo update >/dev/null
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Remove legacy Flux-managed platform release objects
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl -n platform delete helmrelease external-secrets k3s-platform caddy apisix external-dns reloader --ignore-not-found=true
|
|
kubectl -n platform delete ocirepository k3s-platform-chart --ignore-not-found=true
|
|
kubectl -n platform delete configmap k3s-platform-values --ignore-not-found=true
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Install external-secrets directly with Helm
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
helm upgrade --install external-secrets external-secrets/external-secrets \
|
|
--namespace platform \
|
|
--create-namespace \
|
|
--version "{{ k3s_platform_external_secrets_chart_version }}" \
|
|
--set installCRDs=true \
|
|
--wait \
|
|
--timeout 10m
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Install reloader directly with Helm
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
helm upgrade --install reloader stakater/reloader \
|
|
--namespace platform \
|
|
--create-namespace \
|
|
--version "{{ k3s_platform_reloader_chart_version }}" \
|
|
--wait \
|
|
--timeout 10m
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Install caddy directly with Helm
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
helm upgrade --install "{{ k3s_platform_values.components.caddy.releaseName }}" caddy-ingress/caddy-ingress-controller \
|
|
--namespace platform \
|
|
--create-namespace \
|
|
--version "{{ k3s_platform_caddy_chart_version }}" \
|
|
-f /tmp/platform-caddy-values.yaml \
|
|
--wait \
|
|
--timeout 10m
|
|
args:
|
|
executable: /bin/bash
|
|
when:
|
|
- k3s_platform_values.components.caddy.enabled | default(false)
|
|
|
|
- name: Install apisix directly with Helm
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
helm upgrade --install "{{ k3s_platform_values.components.apisix.releaseName }}" apisix/apisix \
|
|
--namespace platform \
|
|
--create-namespace \
|
|
--version "{{ k3s_platform_apisix_chart_version }}" \
|
|
-f /tmp/platform-apisix-values.yaml \
|
|
--wait \
|
|
--timeout 10m
|
|
args:
|
|
executable: /bin/bash
|
|
when:
|
|
- k3s_platform_values.components.apisix.enabled | default(false)
|
|
|
|
- name: Install external-dns directly with Helm
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
helm upgrade --install "{{ k3s_platform_values.components.externalDns.releaseName }}" external-dns/external-dns \
|
|
--namespace platform \
|
|
--create-namespace \
|
|
--version "{{ k3s_platform_external_dns_chart_version }}" \
|
|
-f /tmp/platform-external-dns-values.yaml \
|
|
--wait \
|
|
--timeout 10m
|
|
args:
|
|
executable: /bin/bash
|
|
when:
|
|
- k3s_platform_values.components.externalDns.enabled | default(false)
|
|
|
|
- name: Apply native APISIX ingress manifest
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl apply -f /tmp/platform-apisix-ingress.yaml
|
|
args:
|
|
executable: /bin/bash
|
|
when:
|
|
- k3s_platform_values.apisixIngress.enabled | default(false)
|
|
|
|
- name: Apply native shared TLS sync manifest
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl apply -f /tmp/platform-shared-tls-secret-sync.yaml
|
|
args:
|
|
executable: /bin/bash
|
|
when:
|
|
- k3s_platform_values.components.sharedTlsSecretSync.enabled | default(false)
|
|
|
|
- name: Apply native PostgreSQL TLS ingress manifest
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl apply -f /tmp/platform-postgresql-tls-ingress.yaml
|
|
args:
|
|
executable: /bin/bash
|
|
when:
|
|
- k3s_platform_values.postgresqlTlsIngress.enabled | default(false)
|
|
|
|
- name: Wait for direct platform Helm deployments to become available
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl -n platform wait deployment \
|
|
-l {{ item.selector }} \
|
|
--for=condition=Available \
|
|
--timeout=300s
|
|
args:
|
|
executable: /bin/bash
|
|
loop:
|
|
- { name: "external-secrets", selector: "app.kubernetes.io/instance=external-secrets" }
|
|
- { name: "reloader", selector: "release=reloader" }
|
|
- { name: "caddy", selector: "app.kubernetes.io/instance=caddy" }
|
|
- { name: "apisix", selector: "app.kubernetes.io/instance=apisix" }
|
|
- { name: "external-dns", selector: "app.kubernetes.io/instance=external-dns" }
|
|
|
|
- name: Render Vault bootstrap values file
|
|
ansible.builtin.template:
|
|
src: vault-bootstrap-values.yaml.j2
|
|
dest: /tmp/vault-bootstrap-values.yaml
|
|
mode: "0600"
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
|
|
- name: Bootstrap Vault server with Helm
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
helm repo add hashicorp https://helm.releases.hashicorp.com >/dev/null 2>&1 || true
|
|
helm repo update hashicorp >/dev/null
|
|
helm upgrade --install "{{ k3s_platform_vault_release_name }}" hashicorp/vault \
|
|
--namespace extsvc \
|
|
--create-namespace \
|
|
--version "{{ k3s_platform_vault_chart_version }}" \
|
|
-f /tmp/vault-bootstrap-values.yaml
|
|
args:
|
|
executable: /bin/bash
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
|
|
- name: Wait for Vault server rollout
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl -n extsvc wait --for=condition=Ready pod \
|
|
-l app.kubernetes.io/name={{ k3s_platform_vault_release_name }} \
|
|
--timeout=300s
|
|
args:
|
|
executable: /bin/bash
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'pre_flux'
|
|
|
|
- name: Discover Vault pod name
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl -n extsvc get pod \
|
|
-l app.kubernetes.io/name={{ k3s_platform_vault_release_name }} \
|
|
-o jsonpath='{.items[0].metadata.name}'
|
|
register: k3s_platform_vault_pod_name_result
|
|
changed_when: false
|
|
args:
|
|
executable: /bin/bash
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'pre_flux'
|
|
|
|
- name: Capture Vault status
|
|
ansible.builtin.command:
|
|
argv:
|
|
- kubectl
|
|
- -n
|
|
- extsvc
|
|
- exec
|
|
- "{{ k3s_platform_vault_pod_name_result.stdout }}"
|
|
- --
|
|
- /bin/vault
|
|
- status
|
|
- -format=json
|
|
register: k3s_platform_vault_status_result
|
|
changed_when: false
|
|
failed_when: false
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'pre_flux'
|
|
|
|
- name: Parse Vault status JSON
|
|
ansible.builtin.set_fact:
|
|
k3s_platform_vault_status: >-
|
|
{{
|
|
(
|
|
k3s_platform_vault_status_result.stdout
|
|
if (k3s_platform_vault_status_result.stdout | default('') | trim | length) > 0
|
|
else '{}'
|
|
) | from_json
|
|
}}
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'pre_flux'
|
|
|
|
- name: Assert Vault bootstrap mode is valid
|
|
ansible.builtin.assert:
|
|
that:
|
|
- k3s_platform_vault_bootstrap_mode in ['init', 'migrate']
|
|
fail_msg: "k3s_platform_vault_bootstrap_mode must be init or migrate."
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'pre_flux'
|
|
|
|
- name: Assert migrate mode has inputs when Vault is already initialized
|
|
ansible.builtin.assert:
|
|
that:
|
|
- (vault_root_token | default('')) | length > 0
|
|
- (vault_init_json | default('')) | length > 0
|
|
fail_msg: "Vault migrate mode requires vault_root_token and vault_init_json."
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'pre_flux'
|
|
- k3s_platform_vault_bootstrap_mode == 'migrate'
|
|
- k3s_platform_vault_status.initialized | default(false)
|
|
|
|
- name: Assert migrate mode targets an initialized Vault
|
|
ansible.builtin.assert:
|
|
that:
|
|
- k3s_platform_vault_status.initialized | default(false)
|
|
fail_msg: "Vault migrate mode requires an already initialized Vault instance."
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'pre_flux'
|
|
- k3s_platform_vault_bootstrap_mode == 'migrate'
|
|
|
|
- name: Initialize Vault when requested and not yet initialized
|
|
ansible.builtin.command:
|
|
argv:
|
|
- kubectl
|
|
- -n
|
|
- extsvc
|
|
- exec
|
|
- "{{ k3s_platform_vault_pod_name_result.stdout }}"
|
|
- --
|
|
- /bin/vault
|
|
- operator
|
|
- init
|
|
- -format=json
|
|
- -key-shares=1
|
|
- -key-threshold=1
|
|
register: k3s_platform_vault_init_result
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'pre_flux'
|
|
- k3s_platform_vault_bootstrap_mode == 'init'
|
|
- not (k3s_platform_vault_status.initialized | default(false))
|
|
|
|
- name: Store Vault init JSON on disk
|
|
ansible.builtin.copy:
|
|
content: "{{ k3s_platform_vault_init_result.stdout }}"
|
|
dest: "{{ k3s_platform_vault_init_json_path }}"
|
|
mode: "0600"
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'pre_flux'
|
|
- k3s_platform_vault_init_result is defined
|
|
|
|
- name: Parse Vault init JSON
|
|
ansible.builtin.set_fact:
|
|
k3s_platform_vault_init_data: "{{ k3s_platform_vault_init_result.stdout | from_json }}"
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'pre_flux'
|
|
- k3s_platform_vault_init_result is defined
|
|
|
|
- name: Unseal Vault after init
|
|
ansible.builtin.command:
|
|
argv:
|
|
- kubectl
|
|
- -n
|
|
- extsvc
|
|
- exec
|
|
- "{{ k3s_platform_vault_pod_name_result.stdout }}"
|
|
- --
|
|
- /bin/vault
|
|
- operator
|
|
- unseal
|
|
- "{{ k3s_platform_vault_init_data.unseal_keys_b64[0] }}"
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'pre_flux'
|
|
- k3s_platform_vault_init_result is defined
|
|
|
|
- name: Sync Vault bootstrap secret with generated root token
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl -n extsvc create secret generic vault-bootstrap \
|
|
--from-literal=rootToken="{{ k3s_platform_vault_init_data.root_token }}" \
|
|
--from-literal=cloudflareApiToken="{{ cloudflare_api_token | default('') }}" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
args:
|
|
executable: /bin/bash
|
|
no_log: true
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'pre_flux'
|
|
- k3s_platform_vault_init_result is defined
|
|
|
|
- name: Emit Vault bootstrap outputs
|
|
ansible.builtin.debug:
|
|
msg:
|
|
mode: "{{ k3s_platform_vault_bootstrap_mode }}"
|
|
vault_initialized: "{{ k3s_platform_vault_status.initialized | default(false) }}"
|
|
vault_sealed: "{{ k3s_platform_vault_status.sealed | default(true) }}"
|
|
admin_username: "{{ k3s_platform_vault_admin_username }}"
|
|
init_json_path: "{{ k3s_platform_vault_init_json_path if k3s_platform_vault_init_result is defined else omit }}"
|
|
root_token: "{{ k3s_platform_vault_init_data.root_token if (k3s_platform_vault_init_result is defined and k3s_platform_vault_allow_sensitive_output) else omit }}"
|
|
init_json: "{{ k3s_platform_vault_init_result.stdout if (k3s_platform_vault_init_result is defined and k3s_platform_vault_allow_sensitive_output) else omit }}"
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'pre_flux'
|
|
- k3s_platform_vault_bootstrap_mode == 'init'
|
|
- k3s_platform_vault_init_result is defined
|
|
|
|
- name: Render flux bootstrap env file
|
|
ansible.builtin.template:
|
|
src: flux-bootstrap.env.j2
|
|
dest: /tmp/flux-bootstrap.env
|
|
mode: "0600"
|
|
|
|
- name: Write flux git private key file
|
|
ansible.builtin.copy:
|
|
content: "{{ k3s_platform_git_private_key_resolved }}\n"
|
|
dest: /tmp/flux-git-deploy.key
|
|
mode: "0600"
|
|
no_log: true
|
|
when:
|
|
- k3s_platform_git_auth_mode_effective == 'ssh'
|
|
|
|
- name: Write flux git public key file when provided
|
|
ansible.builtin.copy:
|
|
content: "{{ k3s_platform_git_public_key }}\n"
|
|
dest: /tmp/flux-git-deploy.pub
|
|
mode: "0644"
|
|
when:
|
|
- k3s_platform_git_public_key | length > 0
|
|
- k3s_platform_git_auth_mode_effective == 'ssh'
|
|
|
|
- name: Remove flux git auth secret for public repositories
|
|
ansible.builtin.command:
|
|
argv:
|
|
- kubectl
|
|
- -n
|
|
- "{{ k3s_platform_flux_namespace }}"
|
|
- delete
|
|
- secret
|
|
- "{{ k3s_platform_flux_source_name }}"
|
|
- --ignore-not-found
|
|
environment:
|
|
KUBECONFIG: "{{ k3s_platform_kubeconfig_path }}"
|
|
when:
|
|
- k3s_platform_git_auth_mode_effective in ['public', 'none', '']
|
|
|
|
- name: Create or update flux git auth secret with SSH
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
. /tmp/flux-bootstrap.env
|
|
flux create secret git "${GIT_SOURCE_NAME}" \
|
|
--url="${GIT_URL}" \
|
|
--private-key-file=/tmp/flux-git-deploy.key \
|
|
--namespace="${FLUX_NAMESPACE}" \
|
|
--export | kubectl apply -f -
|
|
args:
|
|
executable: /bin/bash
|
|
environment:
|
|
KUBECONFIG: "{{ k3s_platform_kubeconfig_path }}"
|
|
no_log: true
|
|
when:
|
|
- k3s_platform_git_auth_mode_effective == 'ssh'
|
|
|
|
- name: Create or update flux git auth secret with HTTPS basic auth
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
. /tmp/flux-bootstrap.env
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ${GIT_SOURCE_NAME}
|
|
namespace: ${FLUX_NAMESPACE}
|
|
type: Opaque
|
|
stringData:
|
|
username: {{ k3s_platform_git_http_username | to_json }}
|
|
password: {{ k3s_platform_git_http_password | to_json }}
|
|
EOF
|
|
args:
|
|
executable: /bin/bash
|
|
environment:
|
|
KUBECONFIG: "{{ k3s_platform_kubeconfig_path }}"
|
|
no_log: true
|
|
when:
|
|
- k3s_platform_git_auth_mode_effective == 'https-basic'
|
|
|
|
- name: Create or update flux git auth secret with HTTPS bearer token
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
. /tmp/flux-bootstrap.env
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ${GIT_SOURCE_NAME}
|
|
namespace: ${FLUX_NAMESPACE}
|
|
type: Opaque
|
|
stringData:
|
|
bearerToken: {{ k3s_platform_git_bearer_token | to_json }}
|
|
EOF
|
|
args:
|
|
executable: /bin/bash
|
|
environment:
|
|
KUBECONFIG: "{{ k3s_platform_kubeconfig_path }}"
|
|
no_log: true
|
|
when:
|
|
- k3s_platform_git_auth_mode_effective == 'https-bearer'
|
|
|
|
- name: Apply root Flux source and kustomization
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
. /tmp/flux-bootstrap.env
|
|
if [ "{{ k3s_platform_git_auth_mode_effective }}" = "public" ] || [ "{{ k3s_platform_git_auth_mode_effective }}" = "none" ] || [ -z "{{ k3s_platform_git_auth_mode_effective }}" ]; then
|
|
SECRET_REF_BLOCK=""
|
|
else
|
|
SECRET_REF_BLOCK=" secretRef:\n name: ${GIT_SOURCE_NAME}\n"
|
|
fi
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: source.toolkit.fluxcd.io/v1
|
|
kind: GitRepository
|
|
metadata:
|
|
name: ${GIT_SOURCE_NAME}
|
|
namespace: ${FLUX_NAMESPACE}
|
|
spec:
|
|
interval: 1m0s
|
|
url: ${GIT_URL}
|
|
ref:
|
|
branch: ${GIT_BRANCH}
|
|
${SECRET_REF_BLOCK}
|
|
---
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: platform-root
|
|
namespace: ${FLUX_NAMESPACE}
|
|
spec:
|
|
interval: 5m0s
|
|
sourceRef:
|
|
kind: GitRepository
|
|
name: ${GIT_SOURCE_NAME}
|
|
path: ${FLUX_ROOT_PATH}
|
|
prune: true
|
|
wait: true
|
|
timeout: 5m0s
|
|
EOF
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Reconcile root Flux kustomization
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
flux reconcile source git "{{ k3s_platform_flux_source_name }}" \
|
|
--namespace "{{ k3s_platform_flux_namespace }}" \
|
|
--timeout=5m
|
|
flux reconcile kustomization platform-root \
|
|
--namespace "{{ k3s_platform_flux_namespace }}" \
|
|
--with-source \
|
|
--timeout=10m
|
|
args:
|
|
executable: /bin/bash
|
|
async: 1200
|
|
poll: 0
|
|
changed_when: true
|
|
|
|
- name: Verify flux resources
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl -n "{{ k3s_platform_flux_namespace }}" get gitrepositories,kustomizations
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Verify platform namespaces exist after Flux bootstrap
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl get namespace "{{ item }}"
|
|
args:
|
|
executable: /bin/bash
|
|
loop: "{{ k3s_platform_namespaces }}"
|
|
|
|
- name: Wait for Vault server rollout after Flux bootstrap
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl -n extsvc wait --for=condition=Ready pod \
|
|
-l app.kubernetes.io/name={{ k3s_platform_vault_release_name }} \
|
|
--timeout=300s
|
|
args:
|
|
executable: /bin/bash
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'post_flux'
|
|
|
|
- name: Discover Vault pod name after Flux bootstrap
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl -n extsvc get pod \
|
|
-l app.kubernetes.io/name={{ k3s_platform_vault_release_name }} \
|
|
-o jsonpath='{.items[0].metadata.name}'
|
|
register: k3s_platform_vault_pod_name_result
|
|
changed_when: false
|
|
args:
|
|
executable: /bin/bash
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'post_flux'
|
|
|
|
- name: Capture Vault status after Flux bootstrap
|
|
ansible.builtin.command:
|
|
argv:
|
|
- kubectl
|
|
- -n
|
|
- extsvc
|
|
- exec
|
|
- "{{ k3s_platform_vault_pod_name_result.stdout }}"
|
|
- --
|
|
- /bin/vault
|
|
- status
|
|
- -format=json
|
|
register: k3s_platform_vault_status_result
|
|
changed_when: false
|
|
failed_when: false
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'post_flux'
|
|
|
|
- name: Parse Vault status JSON after Flux bootstrap
|
|
ansible.builtin.set_fact:
|
|
k3s_platform_vault_status: >-
|
|
{{
|
|
(
|
|
k3s_platform_vault_status_result.stdout
|
|
if (k3s_platform_vault_status_result.stdout | default('') | trim | length) > 0
|
|
else '{}'
|
|
) | from_json
|
|
}}
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'post_flux'
|
|
|
|
- name: Assert Vault bootstrap mode is valid after Flux bootstrap
|
|
ansible.builtin.assert:
|
|
that:
|
|
- k3s_platform_vault_bootstrap_mode in ['init', 'migrate']
|
|
fail_msg: "k3s_platform_vault_bootstrap_mode must be init or migrate."
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'post_flux'
|
|
|
|
- name: Assert migrate mode has inputs when Vault is already initialized after Flux bootstrap
|
|
ansible.builtin.assert:
|
|
that:
|
|
- (vault_root_token | default('')) | length > 0
|
|
- (vault_init_json | default('')) | length > 0
|
|
fail_msg: "Vault migrate mode requires vault_root_token and vault_init_json."
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'post_flux'
|
|
- k3s_platform_vault_bootstrap_mode == 'migrate'
|
|
- k3s_platform_vault_status.initialized | default(false)
|
|
|
|
- name: Assert migrate mode targets an initialized Vault after Flux bootstrap
|
|
ansible.builtin.assert:
|
|
that:
|
|
- k3s_platform_vault_status.initialized | default(false)
|
|
fail_msg: "Vault migrate mode requires an already initialized Vault instance."
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'post_flux'
|
|
- k3s_platform_vault_bootstrap_mode == 'migrate'
|
|
|
|
- name: Initialize Vault when requested and not yet initialized after Flux bootstrap
|
|
ansible.builtin.command:
|
|
argv:
|
|
- kubectl
|
|
- -n
|
|
- extsvc
|
|
- exec
|
|
- "{{ k3s_platform_vault_pod_name_result.stdout }}"
|
|
- --
|
|
- /bin/vault
|
|
- operator
|
|
- init
|
|
- -format=json
|
|
- -key-shares=1
|
|
- -key-threshold=1
|
|
register: k3s_platform_vault_init_result
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'post_flux'
|
|
- k3s_platform_vault_bootstrap_mode == 'init'
|
|
- not (k3s_platform_vault_status.initialized | default(false))
|
|
|
|
- name: Store Vault init JSON on disk after Flux bootstrap
|
|
ansible.builtin.copy:
|
|
content: "{{ k3s_platform_vault_init_result.stdout }}"
|
|
dest: "{{ k3s_platform_vault_init_json_path }}"
|
|
mode: "0600"
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'post_flux'
|
|
- k3s_platform_vault_init_result is defined
|
|
|
|
- name: Parse Vault init JSON after Flux bootstrap
|
|
ansible.builtin.set_fact:
|
|
k3s_platform_vault_init_data: "{{ k3s_platform_vault_init_result.stdout | from_json }}"
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'post_flux'
|
|
- k3s_platform_vault_init_result is defined
|
|
|
|
- name: Unseal Vault after init and Flux bootstrap
|
|
ansible.builtin.command:
|
|
argv:
|
|
- kubectl
|
|
- -n
|
|
- extsvc
|
|
- exec
|
|
- "{{ k3s_platform_vault_pod_name_result.stdout }}"
|
|
- --
|
|
- /bin/vault
|
|
- operator
|
|
- unseal
|
|
- "{{ k3s_platform_vault_init_data.unseal_keys_b64[0] }}"
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'post_flux'
|
|
- k3s_platform_vault_init_result is defined
|
|
|
|
- name: Sync Vault bootstrap secret with generated root token after Flux bootstrap
|
|
ansible.builtin.shell: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="{{ k3s_platform_kubeconfig_path }}"
|
|
kubectl -n extsvc create secret generic vault-bootstrap \
|
|
--from-literal=rootToken="{{ k3s_platform_vault_init_data.root_token }}" \
|
|
--from-literal=cloudflareApiToken="{{ cloudflare_api_token | default('') }}" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
args:
|
|
executable: /bin/bash
|
|
no_log: true
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'post_flux'
|
|
- k3s_platform_vault_init_result is defined
|
|
|
|
- name: Emit Vault bootstrap outputs after Flux bootstrap
|
|
ansible.builtin.debug:
|
|
msg:
|
|
mode: "{{ k3s_platform_vault_bootstrap_mode }}"
|
|
vault_initialized: "{{ k3s_platform_vault_status.initialized | default(false) }}"
|
|
vault_sealed: "{{ k3s_platform_vault_status.sealed | default(true) }}"
|
|
admin_username: "{{ k3s_platform_vault_admin_username }}"
|
|
init_json_path: "{{ k3s_platform_vault_init_json_path if k3s_platform_vault_init_result is defined else omit }}"
|
|
root_token: "{{ k3s_platform_vault_init_data.root_token if (k3s_platform_vault_init_result is defined and k3s_platform_vault_allow_sensitive_output) else omit }}"
|
|
init_json: "{{ k3s_platform_vault_init_result.stdout if (k3s_platform_vault_init_result is defined and k3s_platform_vault_allow_sensitive_output) else omit }}"
|
|
when:
|
|
- k3s_platform_manage_extsvc | bool
|
|
- k3s_platform_vault_init_phase == 'post_flux'
|
|
- k3s_platform_vault_bootstrap_mode == 'init'
|
|
- k3s_platform_vault_init_result is defined
|