blob: f4e422c66aa48d7044b5dc2db66bb4d60d270854 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
|
---
- name: create docker config directory
file:
name: /etc/docker
state: directory
mode: 0700
- name: disable docker iptables and bridge
copy:
src: daemon.json
dest: /etc/docker/daemon.json
- name: create network config directory
file:
name: /var/lib/kubenet/
state: directory
- name: configure wireguard port
set_fact:
kubenet_wireguard_port: "{{ kubernetes.wireguard_port | default(51820) }}"
- name: install ifupdown script
template:
src: ifupdown.sh.j2
dest: /var/lib/kubenet/ifupdown.sh
mode: 0755
# TODO: notify reload... this is unfortunately already to late because
# it must probably be brought down by the old version of the script
- name: generate wireguard private key
shell: "umask 077; wg genkey > /var/lib/kubenet/kube-wg0.privatekey"
args:
creates: /var/lib/kubenet/kube-wg0.privatekey
- name: fetch wireguard public key
shell: "wg pubkey < /var/lib/kubenet/kube-wg0.privatekey"
register: kubenet_wireguard_pubkey
changed_when: false
check_mode: no
- name: install systemd service unit for network interfaces
copy:
src: kubenet-interfaces.service
dest: /etc/systemd/system/kubenet-interfaces.service
# TODO: notify: reload???
- name: make sure kubenet interfaces service is started and enabled
systemd:
daemon_reload: yes
name: kubenet-interfaces.service
state: started
enabled: yes
- name: get list of currently installed kubenet peers
find:
path: /etc/systemd/system/
pattern: "kubenet-peer-*.service"
register: kubenet_peers_installed
- name: compute list of peers to be added
set_fact:
kubenet_peers_to_add: "{{ kubernetes_nodes | difference(inventory_hostname) }}"
- name: compute list of peers to be removed
set_fact:
kubenet_peers_to_remove: "{{ kubenet_peers_installed.files | map(attribute='path') | map('replace', '/etc/systemd/system/kubenet-peer-', '') | map('replace', '.service', '') | difference(kubenet_peers_to_add) }}"
- name: stop/disable systemd units for stale kubenet peers
with_items: "{{ kubenet_peers_to_remove }}"
systemd:
name: "kubenet-peer-{{ item }}.service"
state: stopped
enabled: no
- name: remove systemd units for stale kubenet peers
with_items: "{{ kubenet_peers_to_remove }}"
file:
name: "/etc/systemd/system/kubenet-peer-{{ item }}.service"
state: absent
- name: install systemd units for every kubenet peer
with_items: "{{ kubenet_peers_to_add }}"
loop_control:
loop_var: peer
template:
src: kubenet-peer.service.j2
dest: "/etc/systemd/system/kubenet-peer-{{ peer }}.service"
# TODO: notify restart for peers that change...
- name: make sure kubenet peer services are started and enabled
with_items: "{{ kubenet_peers_to_add }}"
systemd:
daemon_reload: yes
name: "kubenet-peer-{{ item }}.service"
state: started
enabled: yes
- name: enable IPv4 forwarding
sysctl:
name: net.ipv4.ip_forward
value: 1
sysctl_set: yes
state: present
reload: yes
- name: create cni config directory
file:
name: /etc/cni/net.d
state: directory
- name: install cni config
template:
src: k8s.json.j2
dest: /etc/cni/net.d/k8s.json
|
