summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--common/kubernetes-cluster.yml5
-rw-r--r--roles/kubernetes/decorations/tasks/annotations.yml44
-rw-r--r--roles/kubernetes/decorations/tasks/labels.yml44
-rw-r--r--roles/kubernetes/decorations/tasks/main.yml21
-rw-r--r--roles/kubernetes/decorations/tasks/taints.yml44
-rw-r--r--roles/kubernetes/kubeadm/control-plane/tasks/primary.yml8
-rw-r--r--roles/kubernetes/kubeadm/control-plane/tasks/secondary.yml5
-rw-r--r--roles/kubernetes/kubeadm/reset/tasks/main.yml1
-rw-r--r--roles/kubernetes/kubeadm/worker/tasks/main.yml1
9 files changed, 166 insertions, 7 deletions
diff --git a/common/kubernetes-cluster.yml b/common/kubernetes-cluster.yml
index 6958db15..d6860f60 100644
--- a/common/kubernetes-cluster.yml
+++ b/common/kubernetes-cluster.yml
@@ -55,4 +55,7 @@
roles:
- role: kubernetes/kubeadm/worker
-### TODO: add node labels (ie. for ingress daeomnset)
+- name: finalize nodes
+ hosts: _kubernetes_nodes_
+ roles:
+ - role: kubernetes/decorations
diff --git a/roles/kubernetes/decorations/tasks/annotations.yml b/roles/kubernetes/decorations/tasks/annotations.yml
new file mode 100644
index 00000000..9b47ecbf
--- /dev/null
+++ b/roles/kubernetes/decorations/tasks/annotations.yml
@@ -0,0 +1,44 @@
+---
+- name: get list of current annotations
+ delegate_to: "{{ groups['_kubernetes_primary_controlplane_node_'] | first }}"
+ check_mode: no
+ command: kubectl --kubeconfig /etc/kubernetes/admin.conf get node '{{ kubernetes_node_name }}' -o jsonpath='{.metadata.annotations}'
+ changed_when: false
+ register: kubectl_list_annotations
+
+- set_fact:
+ current_annotations: "{{ kubectl_list_annotations.stdout | from_json }}"
+
+- name: add annotations to node
+ delegate_to: "{{ groups['_kubernetes_primary_controlplane_node_'] | first }}"
+ loop: "{{ kubernetes_node_annotations | dict2items }}"
+ loop_control:
+ label: "{{ item.key }}={{ item.value }}"
+ when: "item.key not in current_annotations or current_annotations[item.key] != item.value"
+ command: kubectl --kubeconfig /etc/kubernetes/admin.conf annotate --overwrite node '{{ kubernetes_node_name }}' '{{ item.key }}={{ item.value }}'
+
+- name: add stamp files for managed annotations
+ loop: "{{ kubernetes_node_annotations | dict2items }}"
+ loop_control:
+ label: "{{ item.key }}={{ item.value }}"
+ copy:
+ dest: "/etc/kubernetes/decorations/annotations/{{ item.key }}"
+ content: "{{ item.value }}"
+
+- name: get list of managed labels
+ find:
+ path: /etc/kubernetes/decorations/annotations
+ register: managed_annotations
+
+- name: remove superflous annotations from node
+ delegate_to: "{{ groups['_kubernetes_primary_controlplane_node_'] | first }}"
+ loop: "{{ managed_annotations.files | map(attribute='path') | map('basename') }}"
+ when: "item not in kubernetes_node_annotations"
+ command: kubectl --kubeconfig /etc/kubernetes/admin.conf annotate --overwrite node '{{ kubernetes_node_name }}' '{{ item }}-'
+
+- name: remove stamp files for superflous annotations
+ loop: "{{ managed_annotations.files | map(attribute='path') | map('basename') }}"
+ when: "item not in kubernetes_node_annotations"
+ file:
+ path: "/etc/kubernetes/decorations/annotations/{{ item }}"
+ state: absent
diff --git a/roles/kubernetes/decorations/tasks/labels.yml b/roles/kubernetes/decorations/tasks/labels.yml
new file mode 100644
index 00000000..1517616e
--- /dev/null
+++ b/roles/kubernetes/decorations/tasks/labels.yml
@@ -0,0 +1,44 @@
+---
+- name: get list of current labels
+ delegate_to: "{{ groups['_kubernetes_primary_controlplane_node_'] | first }}"
+ check_mode: no
+ command: kubectl --kubeconfig /etc/kubernetes/admin.conf get node '{{ kubernetes_node_name }}' -o jsonpath='{.metadata.labels}'
+ changed_when: false
+ register: kubectl_list_labels
+
+- set_fact:
+ current_labels: "{{ kubectl_list_labels.stdout | from_json }}"
+
+- name: add labels to node
+ delegate_to: "{{ groups['_kubernetes_primary_controlplane_node_'] | first }}"
+ loop: "{{ kubernetes_node_labels | dict2items }}"
+ loop_control:
+ label: "{{ item.key }}={{ item.value }}"
+ when: "item.key not in current_labels or current_labels[item.key] != item.value"
+ command: kubectl --kubeconfig /etc/kubernetes/admin.conf label --overwrite node '{{ kubernetes_node_name }}' '{{ item.key }}={{ item.value }}'
+
+- name: add stamp files for managed labels
+ loop: "{{ kubernetes_node_labels | dict2items }}"
+ loop_control:
+ label: "{{ item.key }}={{ item.value }}"
+ copy:
+ dest: "/etc/kubernetes/decorations/labels/{{ item.key }}"
+ content: "{{ item.value }}"
+
+- name: get list of managed labels
+ find:
+ path: /etc/kubernetes/decorations/labels
+ register: managed_labels
+
+- name: remove superflous labels from node
+ delegate_to: "{{ groups['_kubernetes_primary_controlplane_node_'] | first }}"
+ loop: "{{ managed_labels.files | map(attribute='path') | map('basename') }}"
+ when: "item not in kubernetes_node_labels"
+ command: kubectl --kubeconfig /etc/kubernetes/admin.conf label --overwrite node '{{ kubernetes_node_name }}' '{{ item }}-'
+
+- name: remove stamp files for superflous labels
+ loop: "{{ managed_labels.files | map(attribute='path') | map('basename') }}"
+ when: "item not in kubernetes_node_labels"
+ file:
+ path: "/etc/kubernetes/decorations/labels/{{ item }}"
+ state: absent
diff --git a/roles/kubernetes/decorations/tasks/main.yml b/roles/kubernetes/decorations/tasks/main.yml
new file mode 100644
index 00000000..7d25c9de
--- /dev/null
+++ b/roles/kubernetes/decorations/tasks/main.yml
@@ -0,0 +1,21 @@
+---
+- name: generate directories for node decorations
+ loop:
+ - annotations
+ - labels
+ - taints
+ file:
+ path: "/etc/kubernetes/decorations/{{ item }}"
+ state: directory
+
+- name: manage node annotations
+ when: kubernetes_node_annotations is defined
+ include_tasks: annotations.yml
+
+- name: manage node labels
+ when: kubernetes_node_labels is defined
+ include_tasks: labels.yml
+
+- name: manage node taints
+ when: kubernetes_node_taints is defined
+ include_tasks: taints.yml
diff --git a/roles/kubernetes/decorations/tasks/taints.yml b/roles/kubernetes/decorations/tasks/taints.yml
new file mode 100644
index 00000000..fd60ef88
--- /dev/null
+++ b/roles/kubernetes/decorations/tasks/taints.yml
@@ -0,0 +1,44 @@
+---
+- name: get list of current taints
+ delegate_to: "{{ groups['_kubernetes_primary_controlplane_node_'] | first }}"
+ check_mode: no
+ command: kubectl --kubeconfig /etc/kubernetes/admin.conf get node '{{ kubernetes_node_name }}' -o jsonpath='{.spec.taints}'
+ changed_when: false
+ register: kubectl_list_taints
+
+- set_fact:
+ current_taints: "{{ kubectl_list_taints.stdout | ternary(kubectl_list_taints.stdout, '[]') | from_json }}"
+
+- name: add taints to node
+ delegate_to: "{{ groups['_kubernetes_primary_controlplane_node_'] | first }}"
+ loop: "{{ kubernetes_node_taints | dict2items }}"
+ loop_control:
+ label: "{{ item.key }}={{ item.value }}"
+ when: "item.key not in current_taints or current_taints[item.key] != item.value"
+ command: kubectl --kubeconfig /etc/kubernetes/admin.conf taint --overwrite node '{{ kubernetes_node_name }}' '{{ item.key }}={{ item.value }}'
+
+- name: add stamp files for managed taints
+ loop: "{{ kubernetes_node_taints | dict2items }}"
+ loop_control:
+ label: "{{ item.key }}={{ item.value }}"
+ copy:
+ dest: "/etc/kubernetes/decorations/taints/{{ item.key }}"
+ content: "{{ item.value }}"
+
+- name: get list of managed taints
+ find:
+ path: /etc/kubernetes/decorations/taints
+ register: managed_taints
+
+- name: remove superflous taints from node
+ delegate_to: "{{ groups['_kubernetes_primary_controlplane_node_'] | first }}"
+ loop: "{{ managed_taints.files | map(attribute='path') | map('basename') }}"
+ when: "item not in kubernetes_node_taints"
+ command: kubectl --kubeconfig /etc/kubernetes/admin.conf taint --overwrite node '{{ kubernetes_node_name }}' '{{ item }}-'
+
+- name: remove stamp files for superflous taints
+ loop: "{{ managed_taints.files | map(attribute='path') | map('basename') }}"
+ when: "item not in kubernetes_node_taints"
+ file:
+ path: "/etc/kubernetes/decorations/taints/{{ item }}"
+ state: absent
diff --git a/roles/kubernetes/kubeadm/control-plane/tasks/primary.yml b/roles/kubernetes/kubeadm/control-plane/tasks/primary.yml
index cbad58d9..36195235 100644
--- a/roles/kubernetes/kubeadm/control-plane/tasks/primary.yml
+++ b/roles/kubernetes/kubeadm/control-plane/tasks/primary.yml
@@ -38,8 +38,8 @@
dest: /etc/kubernetes/kubeadm-init.errors
- name: create bootstrap token for new cluster
- command: kubeadm token create --ttl 42m
check_mode: no
+ command: kubeadm token create --ttl 42m
register: kubeadm_token_generate
@@ -61,9 +61,9 @@
block:
- name: fetch list of current nodes
+ check_mode: no
command: kubectl --kubeconfig /etc/kubernetes/admin.conf get nodes -o name
changed_when: False
- check_mode: no
register: kubectl_node_list
- name: save list of current nodes
@@ -71,9 +71,9 @@
kubernetes_current_nodes: "{{ kubectl_node_list.stdout_lines | map('replace', 'node/', '') | list }}"
- name: create bootstrap token for existing cluster
+ check_mode: no
when: "groups['_kubernetes_nodes_'] | map('extract', hostvars, 'kubernetes_node_name') | difference(kubernetes_current_nodes) | length > 0"
command: kubeadm token create --ttl 42m
- check_mode: no
register: kubeadm_token_create
@@ -85,10 +85,10 @@
state: present
- name: get ca certificate digest
+ check_mode: no
shell: "set -o pipefail && openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'"
args:
executable: /bin/bash
- check_mode: no
register: kube_ca_openssl
changed_when: False
diff --git a/roles/kubernetes/kubeadm/control-plane/tasks/secondary.yml b/roles/kubernetes/kubeadm/control-plane/tasks/secondary.yml
index aaa4d94e..0c7a285f 100644
--- a/roles/kubernetes/kubeadm/control-plane/tasks/secondary.yml
+++ b/roles/kubernetes/kubeadm/control-plane/tasks/secondary.yml
@@ -5,9 +5,9 @@
block:
- name: fetch list of current nodes
+ check_mode: no
command: kubectl --kubeconfig /etc/kubernetes/admin.conf get nodes -o name
changed_when: False
- check_mode: no
register: kubectl_node_list
- name: save list of current nodes
@@ -15,9 +15,9 @@
kubernetes_current_nodes: "{{ kubectl_node_list.stdout_lines | map('replace', 'node/', '') | list }}"
- name: upload certs
+ check_mode: no
when: "groups['_kubernetes_controlplane_nodes_'] | map('extract', hostvars, 'kubernetes_node_name') | difference(kubernetes_current_nodes) | length > 0"
command: kubeadm init phase upload-certs --upload-certs
- check_mode: no
register: kubeadm_upload_certs
- name: extracting encryption key for certs
@@ -57,6 +57,7 @@
- name: wait for new control-plane node to register
delegate_to: "{{ groups['_kubernetes_primary_controlplane_node_'] | first }}"
+ check_mode: no
command: "kubectl --kubeconfig /etc/kubernetes/admin.conf get nodes -o name {{ kubernetes_node_name }}"
changed_when: False
register: kubectl_node_get
diff --git a/roles/kubernetes/kubeadm/reset/tasks/main.yml b/roles/kubernetes/kubeadm/reset/tasks/main.yml
index bc38ce81..ce343f3c 100644
--- a/roles/kubernetes/kubeadm/reset/tasks/main.yml
+++ b/roles/kubernetes/kubeadm/reset/tasks/main.yml
@@ -14,6 +14,7 @@
- /etc/kubernetes/network-plugin.yml
- /etc/kubernetes/node-local-dns.yml
- /etc/kubernetes/addons
+ - /etc/kubernetes/decorations
- /etc/default/kubelet
file:
path: "{{ item }}"
diff --git a/roles/kubernetes/kubeadm/worker/tasks/main.yml b/roles/kubernetes/kubeadm/worker/tasks/main.yml
index 422f27c7..835967b8 100644
--- a/roles/kubernetes/kubeadm/worker/tasks/main.yml
+++ b/roles/kubernetes/kubeadm/worker/tasks/main.yml
@@ -30,6 +30,7 @@
- name: wait for new worker node to register
delegate_to: "{{ groups['_kubernetes_primary_controlplane_node_'] | first }}"
+ check_mode: no
command: "kubectl --kubeconfig /etc/kubernetes/admin.conf get nodes -o name {{ kubernetes_node_name }}"
changed_when: False
register: kubectl_node_get