removing node from kubernetes works now

9 files changed, 177 insertions, 124 deletions

diff --git a/roles/kubernetes-master/tasks/main.yml b/roles/kubernetes-master/tasks/main.yml
index 4d6bdd6b..373ab09e 100644
--- a/roles/kubernetes-master/tasks/main.yml
+++ b/roles/kubernetes-master/tasks/main.yml
@@ -77,6 +77,7 @@
 
 - name: get ca certificate digest
   shell: "openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'"
+  check_mode: no
   register: kube_ca_openssl
   changed_when: False
 
diff --git a/roles/kubernetes-net/handlers/main.yaml b/roles/kubernetes-net/handlers/main.yaml
new file mode 100644
index 00000000..bb7fde2b
--- /dev/null
+++ b/roles/kubernetes-net/handlers/main.yaml
@@ -0,0 +1,4 @@
+---
+- name: reload systemd
+  systemd:
+    daemon_reload: yes
diff --git a/roles/kubernetes-net/meta/main.yml b/roles/kubernetes-net/meta/main.yml
index b5a72b6e..03dfcb23 100644
--- a/roles/kubernetes-net/meta/main.yml
+++ b/roles/kubernetes-net/meta/main.yml
@@ -1,3 +1,4 @@
 ---
 dependencies:
 - role: wireguard
+  when: k8s_remove_node is not defined
diff --git a/roles/kubernetes-net/tasks/add.yaml b/roles/kubernetes-net/tasks/add.yaml
new file mode 100644
index 00000000..d0a8449f
--- /dev/null
+++ b/roles/kubernetes-net/tasks/add.yaml
@@ -0,0 +1,112 @@
+---
+- name: create docker config directory
+  file:
+    name: /etc/docker
+    state: directory
+    mode: 0700
+
+- name: disable docker iptables and bridge
+  copy:
+    src: daemon.json
+    dest: /etc/docker/daemon.json
+
+- name: create network config directory
+  file:
+    name: /var/lib/kubenet/
+    state: directory
+
+- name: configure wireguard port
+  set_fact:
+    kubenet_wireguard_port: "{{ kubernetes.wireguard_port | default(51820) }}"
+
+- name: install ifupdown script
+  template:
+    src: ifupdown.sh.j2
+    dest: /var/lib/kubenet/ifupdown.sh
+    mode: 0755
+  # TODO: notify reload... this is unfortunately already to late because
+  #                        it must probably be brought down by the old version of the script
+
+- name: generate wireguard private key
+  shell: "umask 077; wg genkey > /var/lib/kubenet/kube-wg0.privatekey"
+  args:
+    creates: /var/lib/kubenet/kube-wg0.privatekey
+
+- name: fetch wireguard public key
+  shell: "wg pubkey < /var/lib/kubenet/kube-wg0.privatekey"
+  register: kubenet_wireguard_pubkey
+  changed_when: false
+  check_mode: no
+
+- name: install systemd service unit for network interfaces
+  copy:
+    src: kubenet-interfaces.service
+    dest: /etc/systemd/system/kubenet-interfaces.service
+  # TODO: notify: reload???
+
+- name: make sure kubenet interfaces service is started and enabled
+  systemd:
+    daemon_reload: yes
+    name: kubenet-interfaces.service
+    state: started
+    enabled: yes
+
+- name: get list of currently installed kubenet peers installed
+  find:
+    path: /etc/systemd/system/
+    pattern: "kubenet-peer-*.service"
+  register: kubenet_peers_installed
+
+- name: compute list of peers to be added
+  set_fact:
+    kubenet_peers_to_add: "{{ kubernetes_nodes | difference(inventory_hostname) }}"
+
+- name: compute list of peers to be removed
+  set_fact:
+    kubenet_peers_to_remove: "{{ kubenet_peers_installed.files | map(attribute='path') | map('replace', '/etc/systemd/system/kubenet-peer-', '') | map('replace', '.service', '') | difference(kubenet_peers_to_add) }}"
+
+- name: stop/disable systemd units for stale kubenet peers
+  with_items: "{{ kubenet_peers_to_remove }}"
+  systemd:
+    name: "kubenet-peer-{{ item }}.service"
+    state: stopped
+    enabled: no
+
+- name: remove systemd units for stale kubenet peers
+  with_items: "{{ kubenet_peers_to_remove }}"
+  file:
+    name: "/etc/systemd/system/kubenet-peer-{{ item }}.service"
+    state: absent
+
+- name: install systemd units for every kubenet peer
+  with_items: "{{ kubenet_peers_to_add }}"
+  template:
+    src: kubenet-peer.service.j2
+    dest: "/etc/systemd/system/kubenet-peer-{{ item }}.service"
+  # TODO: notify restart for peers that change...
+
+- name: make sure kubenet peer services are started and enabled
+  with_items: "{{ kubenet_peers_to_add }}"
+  systemd:
+    daemon_reload: yes
+    name: "kubenet-peer-{{ item }}.service"
+    state: started
+    enabled: yes
+
+- name: enable IPv4 forwarding
+  sysctl:
+    name: net.ipv4.ip_forward
+    value: 1
+    sysctl_set: yes
+    state: present
+    reload: yes
+
+- name: create cni config directory
+  file:
+    name: /etc/cni/net.d
+    state: directory
+
+- name: install cni config
+  template:
+    src: k8s.json.j2
+    dest: /etc/cni/net.d/k8s.json
diff --git a/roles/kubernetes-net/tasks/main.yaml b/roles/kubernetes-net/tasks/main.yaml
index ba8b2089..c8d06380 100644
--- a/roles/kubernetes-net/tasks/main.yaml
+++ b/roles/kubernetes-net/tasks/main.yaml
@@ -1,112 +1,8 @@
 ---
-- name: create docker config directory
-  file:
-    name: /etc/docker
-    state: directory
-    mode: 0700
+- name: add node to overlay network
+  include_tasks: add.yaml
+  when: k8s_remove_node is not defined
 
-- name: disable docker iptales and bridge
-  copy:
-    src: daemon.json
-    dest: /etc/docker/daemon.json
-
-- name: create network config directory
-  file:
-    name: /var/lib/kubenet/
-    state: directory
-
-- name: configure wireguard port
-  set_fact:
-    kubenet_wireguard_port: "{{ kubernetes.wireguard_port | default(51820) }}"
-
-- name: install ifupdown script
-  template:
-    src: ifupdown.sh.j2
-    dest: /var/lib/kubenet/ifupdown.sh
-    mode: 0755
-  # TODO: notify reload... this is unfortunately already to late because
-  #                        it must probably be brought down by the old version of the script
-
-- name: generate wireguard private key
-  shell: "umask 077; wg genkey > /var/lib/kubenet/kube-wg0.privatekey"
-  args:
-    creates: /var/lib/kubenet/kube-wg0.privatekey
-
-- name: fetch wireguard public key
-  shell: "wg pubkey < /var/lib/kubenet/kube-wg0.privatekey"
-  register: kubenet_wireguard_pubkey
-  changed_when: false
-  check_mode: no
-
-- name: install systemd service unit for network interfaces
-  copy:
-    src: kubenet-interfaces.service
-    dest: /etc/systemd/system/kubenet-interfaces.service
-  # TODO: notify: reload???
-
-- name: make sure kubenet interfaces service is started and enabled
-  systemd:
-    daemon_reload: yes
-    name: kubenet-interfaces.service
-    state: started
-    enabled: yes
-
-- name: get list of currently installed kubenet peers installed
-  find:
-    path: /etc/systemd/system/
-    pattern: "kubenet-peer-*.service"
-  register: kubenet_peers_installed
-
-- name: compute list of peers to be added
-  set_fact:
-    kubenet_peers_to_add: "{{ kubernetes_nodes | difference(inventory_hostname) }}"
-
-- name: compute list of peers to be removed
-  set_fact:
-    kubenet_peers_to_remove: "{{ kubenet_peers_installed.files | map(attribute='path') | map('replace', '/etc/systemd/system/kubenet-peer-', '') | map('replace', '.service', '') | difference(kubenet_peers_to_add) }}"
-
-- name: stop/disable systemd units for stale kubenet peers
-  with_items: "{{ kubenet_peers_to_remove }}"
-  systemd:
-    name: "kubenet-peer-{{ item }}.service"
-    state: stopped
-    enabled: no
-
-- name: remove systemd units for stale kubenet peers
-  with_items: "{{ kubenet_peers_to_remove }}"
-  file:
-    name: "/etc/systemd/system/kubenet-peer-{{ item }}.service"
-    state: absent
-
-- name: install systemd units for every kubenet peer
-  with_items: "{{ kubenet_peers_to_add }}"
-  template:
-    src: kubenet-peer.service.j2
-    dest: "/etc/systemd/system/kubenet-peer-{{ item }}.service"
-  # TODO: notify restart for peers that change...
-
-- name: make sure kubenet peer services are started and enabled
-  with_items: "{{ kubenet_peers_to_add }}"
-  systemd:
-    daemon_reload: yes
-    name: "kubenet-peer-{{ item }}.service"
-    state: started
-    enabled: yes
-
-- name: enable IPv4 forwarding
-  sysctl:
-    name: net.ipv4.ip_forward
-    value: 1
-    sysctl_set: yes
-    state: present
-    reload: yes
-
-- name: create cni config directory
-  file:
-    name: /etc/cni/net.d
-    state: directory
-
-- name: install cni config
-  template:
-    src: k8s.json.j2
-    dest: /etc/cni/net.d/k8s.json
+- name: remove node from overlay network
+  include_tasks: remove.yaml
+  when: k8s_remove_node is defined
diff --git a/roles/kubernetes-net/tasks/remove.yaml b/roles/kubernetes-net/tasks/remove.yaml
new file mode 100644
index 00000000..6695bd5d
--- /dev/null
+++ b/roles/kubernetes-net/tasks/remove.yaml
@@ -0,0 +1,28 @@
+---
+- name: check if kubenet interface service unit exists
+  stat:
+    path: /etc/systemd/system/kubenet-interfaces.service
+  register: kubenet_interface_unit
+
+- name: bring down kubenet interface
+  systemd:
+    name: kubenet-interfaces.service
+    state: stopped
+  when: kubenet_interface_unit.stat.exists
+
+- name: gather list of all kubenet related service units
+  find:
+    path: /etc/systemd/system/
+    patterns:
+      - "kubenet-peer-*.service"
+      - kubenet-interfaces.service
+  register: kubenet_units_installed
+
+- name: remove all kubenet related files and directories
+  with_flattened:
+  - "{{ kubenet_units_installed.files | map(attribute='path') | list }}"
+  - /var/lib/kubenet
+  file:
+    path: "{{ item }}"
+    state: absent
+  notify: reload systemd
diff --git a/roles/kubernetes-node/tasks/add.yml b/roles/kubernetes-node/tasks/add.yml
new file mode 100644
index 00000000..5b2eb9bc
--- /dev/null
+++ b/roles/kubernetes-node/tasks/add.yml
@@ -0,0 +1,16 @@
+---
+- name: get master vars
+  set_fact:
+    kube_master_vars: "{{ hostvars[kubernetes_nodes_master] }}"
+
+- name: set up kubernetes master
+  command: "kubeadm join --token {{ kube_master_vars.kube_bootstrap_token }} {{ kube_master_vars.ansible_default_ipv4.address }}:6443 --discovery-token-ca-cert-hash {{ kube_master_vars.kube_bootstrap_ca_cert_hash }}"
+  args:
+    creates: /etc/kubernetes/kubelet.conf
+  register: kubeadm_join
+
+- name: dump output of kubeadm join to log file
+  when: kubeadm_join.changed
+  copy:
+    content: "{{ kubeadm_join.stdout }}\n"
+    dest: /etc/kubernetes/kubeadm-join.log
diff --git a/roles/kubernetes-node/tasks/main.yml b/roles/kubernetes-node/tasks/main.yml
index 5b2eb9bc..d078d2fb 100644
--- a/roles/kubernetes-node/tasks/main.yml
+++ b/roles/kubernetes-node/tasks/main.yml
@@ -1,16 +1,8 @@
 ---
-- name: get master vars
-  set_fact:
-    kube_master_vars: "{{ hostvars[kubernetes_nodes_master] }}"
+- name: add node cluster
+  include_tasks: add.yml
+  when: k8s_remove_node is not defined
 
-- name: set up kubernetes master
-  command: "kubeadm join --token {{ kube_master_vars.kube_bootstrap_token }} {{ kube_master_vars.ansible_default_ipv4.address }}:6443 --discovery-token-ca-cert-hash {{ kube_master_vars.kube_bootstrap_ca_cert_hash }}"
-  args:
-    creates: /etc/kubernetes/kubelet.conf
-  register: kubeadm_join
-
-- name: dump output of kubeadm join to log file
-  when: kubeadm_join.changed
-  copy:
-    content: "{{ kubeadm_join.stdout }}\n"
-    dest: /etc/kubernetes/kubeadm-join.log
+- name: remove node from cluster
+  include_tasks: remove.yml
+  when: k8s_remove_node is defined
diff --git a/roles/kubernetes-node/tasks/remove.yml b/roles/kubernetes-node/tasks/remove.yml
new file mode 100644
index 00000000..95787629
--- /dev/null
+++ b/roles/kubernetes-node/tasks/remove.yml
@@ -0,0 +1,3 @@
+---
+- name: clean up settings and files created by kubeadm
+  command: kubeadm reset