Merge branch 'master' into k3s-1-27

.ansible-lint

@@ -13,5 +13,8 @@ exclude_paths:
  - 'molecule/**/prepare.yml'
  - 'molecule/**/reset.yml'
 
+ # The file was generated by galaxy ansible - don't mess with it.
+ - 'galaxy.yml'
+
 skip_list:
  - 'fqcn-builtins'

.github/workflows/cache.yml

@@ -0,0 +1,42 @@
+---
+name: "Cache"
+on:
+ workflow_call:
+jobs:
+ molecule:
+ name: cache
+ runs-on: self-hosted
+ env:
+ PYTHON_VERSION: "3.11"
+
+ steps:
+ - name: Check out the codebase
+ uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v3 2.5.0
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+
+ - name: Set up Python ${{ env.PYTHON_VERSION }}
+ uses: actions/setup-python@75f3110429a8c05be0e1bf360334e4cced2b63fa # 2.3.3
+ with:
+ python-version: ${{ env.PYTHON_VERSION }}
+ cache: 'pip' # caching pip dependencies
+
+ - name: Cache Vagrant boxes
+ id: cache-vagrant
+ uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # 4.0
+ with:
+ lookup-only: true #if it exists, we don't need to restore and can skip the next step
+ path: |
+ ~/.vagrant.d/boxes
+ key: vagrant-boxes-${{ hashFiles('**/molecule.yml') }}
+ restore-keys: |
+ vagrant-boxes
+
+ - name: Download Vagrant boxes for all scenarios
+ # To save some cache space, all scenarios share the same cache key.
+ # On the other hand, this means that the cache contents should be
+ # the same across all scenarios. This step ensures that.
+ if: steps.cache-vagrant.outputs.cache-hit != 'true' # only run if false since this is just a cache step
+ run: |
+ ./.github/download-boxes.sh
+ vagrant box list

.github/workflows/ci.yml

@@ -8,8 +8,11 @@ on:
  paths-ignore:
  - '**/README.md'
 jobs:
+ pre:
+ uses: ./.github/workflows/cache.yml
  lint:
  uses: ./.github/workflows/lint.yml
+ needs: [pre]
  test:
  uses: ./.github/workflows/test.yml
- needs: [lint]
+ needs: [pre, lint]

.github/workflows/lint.yml

@@ -5,7 +5,7 @@ on:
 jobs:
  pre-commit-ci:
  name: Pre-Commit
- runs-on: ubuntu-latest
+ runs-on: self-hosted
  env:
  PYTHON_VERSION: "3.11"
 
@@ -21,21 +21,11 @@ jobs:
  python-version: ${{ env.PYTHON_VERSION }}
  cache: 'pip' # caching pip dependencies
 
- - name: Cache pip
- uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
- with:
- path: ~/.cache/pip
- key: ${{ runner.os }}-pip-${{ hashFiles('./requirements.txt') }}
- restore-keys: |
- ${{ runner.os }}-pip-
-
- - name: Cache Ansible
- uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
+ - name: Restore Ansible cache
+ uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # 4.0
  with:
  path: ~/.ansible/collections
- key: ${{ runner.os }}-ansible-${{ hashFiles('collections/requirements.txt') }}
- restore-keys: |
- ${{ runner.os }}-ansible-
+ key: ansible-${{ hashFiles('collections/requirements.yml') }}
 
  - name: Install dependencies
  run: |
@@ -47,16 +37,12 @@ jobs:
  python3 -m pip install -r requirements.txt
  echo "::endgroup::"
 
- echo "::group::Install Ansible role requirements from collections/requirements.yml"
- ansible-galaxy install -r collections/requirements.yml
- echo "::endgroup::"
-
  - name: Run pre-commit
  uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # 3.0.0
 
  ensure-pinned-actions:
  name: Ensure SHA Pinned Actions
- runs-on: ubuntu-latest
+ runs-on: self-hosted
  steps:
  - name: Checkout code
  uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v3 2.5.0

.github/workflows/test.yml

@@ -5,7 +5,7 @@ on:
 jobs:
  molecule:
  name: Molecule
- runs-on: macos-12
+ runs-on: self-hosted
  strategy:
  matrix:
  scenario:
@@ -30,35 +30,19 @@ jobs:
  * fdad:bad:ba55::/64
  EOF
 
- - name: Cache pip
- uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
- with:
- path: ~/.cache/pip
- key: ${{ runner.os }}-pip-${{ hashFiles('./requirements.txt') }}
- restore-keys: |
- ${{ runner.os }}-pip-
-
- - name: Cache Vagrant boxes
- uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
- with:
- path: |
- ~/.vagrant.d/boxes
- key: vagrant-boxes-${{ hashFiles('**/molecule.yml') }}
- restore-keys: |
- vagrant-boxes
-
- - name: Download Vagrant boxes for all scenarios
- # To save some cache space, all scenarios share the same cache key.
- # On the other hand, this means that the cache contents should be
- # the same across all scenarios. This step ensures that.
- run: ./.github/download-boxes.sh
-
  - name: Set up Python ${{ env.PYTHON_VERSION }}
  uses: actions/setup-python@75f3110429a8c05be0e1bf360334e4cced2b63fa # 2.3.3
  with:
  python-version: ${{ env.PYTHON_VERSION }}
  cache: 'pip' # caching pip dependencies
 
+ - name: Restore vagrant Boxes cache
+ uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # 4.0
+ with:
+ path: ~/.vagrant.d/boxes
+ key: vagrant-boxes-${{ hashFiles('**/molecule.yml') }}
+ fail-on-cache-miss: true
+
  - name: Install dependencies
  run: |
  echo "::group::Upgrade pip"
@@ -75,7 +59,7 @@ jobs:
  env:
  ANSIBLE_K3S_LOG_DIR: ${{ runner.temp }}/logs/k3s-ansible/${{ matrix.scenario }}
  ANSIBLE_SSH_RETRIES: 4
- ANSIBLE_TIMEOUT: 60
+ ANSIBLE_TIMEOUT: 120
  PY_COLORS: 1
  ANSIBLE_FORCE_COLOR: 1
 

.yamllint

@@ -6,4 +6,6 @@ rules:
  max: 120
  level: warning
  truthy:
- allowed-values: ['true', 'false', 'yes', 'no']
+ allowed-values: ['true', 'false']
+ignore:
+ - galaxy.yml

README.md

@@ -4,7 +4,7 @@
 
 This playbook will build an HA Kubernetes cluster with `k3s`, `kube-vip` and MetalLB via `ansible`.
 
-This is based on the work from [this fork](https://github.com/212850a/k3s-ansible) which is based on the work from [k3s-io/k3s-ansible](https://github.com/k3s-io/k3s-ansible). It uses [kube-vip](https://kube-vip.chipzoller.dev/) to create a load balancer for control plane, and [metal-lb](https://metallb.universe.tf/installation/) for its service `LoadBalancer`.
+This is based on the work from [this fork](https://github.com/212850a/k3s-ansible) which is based on the work from [k3s-io/k3s-ansible](https://github.com/k3s-io/k3s-ansible). It uses [kube-vip](https://kube-vip.io/) to create a load balancer for control plane, and [metal-lb](https://metallb.universe.tf/installation/) for its service `LoadBalancer`.
 
 If you want more context on how this works, see:
 
@@ -118,6 +118,28 @@ You can find more information about it [here](molecule/README.md).
 
 This repo uses `pre-commit` and `pre-commit-hooks` to lint and fix common style and syntax errors. Be sure to install python packages and then run `pre-commit install`. For more information, see [pre-commit](https://pre-commit.com/)
 
+## 🌌 Ansible Galaxy
+
+This collection can now be used in larger ansible projects.
+
+Instructions:
+
+- create or modify a file `collections/requirements.yml` in your project
+
+```yml
+collections:
+ - name: ansible.utils
+ - name: community.general
+ - name: ansible.posix
+ - name: kubernetes.core
+ - name: https://github.com/techno-tim/k3s-ansible.git
+ type: git
+ version: master
+```
+
+- install via `ansible-galaxy collection install -r ./collections/requirements.yml`
+- every role is now available via the prefix `techno_tim.k3s_ansible.` e.g. `techno_tim.k3s_ansible.lxc`
+
 ## Thanks 🤝
 
 This repo is really standing on the shoulders of giants. Thank you to all those who have contributed and thanks to these repos for code and ideas:

galaxy.yml

@@ -0,0 +1,81 @@
+### REQUIRED
+# The namespace of the collection. This can be a company/brand/organization or product namespace under which all
+# content lives. May only contain alphanumeric lowercase characters and underscores. Namespaces cannot start with
+# underscores or numbers and cannot contain consecutive underscores
+namespace: techno_tim
+
+# The name of the collection. Has the same character restrictions as 'namespace'
+name: k3s_ansible
+
+# The version of the collection. Must be compatible with semantic versioning
+version: 1.0.0
+
+# The path to the Markdown (.md) readme file. This path is relative to the root of the collection
+readme: README.md
+
+# A list of the collection's content authors. Can be just the name or in the format 'Full Name <email> (url)
+# @nicks:irc/im.site#channel'
+authors:
+- your name <[email protected]>
+
+
+### OPTIONAL but strongly recommended
+# A short summary description of the collection
+description: >
+ The easiest way to bootstrap a self-hosted High Availability Kubernetes
+ cluster. A fully automated HA k3s etcd install with kube-vip, MetalLB,
+ and more.
+
+# Either a single license or a list of licenses for content inside of a collection. Ansible Galaxy currently only
+# accepts L(SPDX,https://spdx.org/licenses/) licenses. This key is mutually exclusive with 'license_file'
+license:
+- Apache-2.0
+
+
+# A list of tags you want to associate with the collection for indexing/searching. A tag name has the same character
+# requirements as 'namespace' and 'name'
+tags:
+ - etcd
+ - high-availability
+ - k8s
+ - k3s
+ - k3s-cluster
+ - kube-vip
+ - kubernetes
+ - metallb
+ - rancher
+
+# Collections that this collection requires to be installed for it to be usable. The key of the dict is the
+# collection label 'namespace.name'. The value is a version range
+# L(specifiers,https://python-semanticversion.readthedocs.io/en/latest/#requirement-specification). Multiple version
+# range specifiers can be set and are separated by ','
+dependencies:
+ ansible.utils: '*'
+ ansible.posix: '*'
+ community.general: '*'
+ kubernetes.core: '*'
+
+# The URL of the originating SCM repository
+repository: https://github.com/techno-tim/k3s-ansible
+
+# The URL to any online docs
+documentation: https://github.com/techno-tim/k3s-ansible
+
+# The URL to the homepage of the collection/project
+homepage: https://www.youtube.com/watch?v=CbkEWcUZ7zM
+
+# The URL to the collection issue tracker
+issues: https://github.com/techno-tim/k3s-ansible/issues
+
+# A list of file glob-like patterns used to filter any files or directories that should not be included in the build
+# artifact. A pattern is matched from the relative path of the file or directory of the collection directory. This
+# uses 'fnmatch' to match the files or directories. Some directories and files like 'galaxy.yml', '*.pyc', '*.retry',
+# and '.git' are always filtered. Mutually exclusive with 'manifest'
+build_ignore: []
+
+# A dict controlling use of manifest directives used in building the collection artifact. The key 'directives' is a
+# list of MANIFEST.in style
+# L(directives,https://packaging.python.org/en/latest/guides/using-manifest-in/#manifest-in-commands). The key
+# 'omit_default_directives' is a boolean that controls whether the default directives are used. Mutually exclusive
+# with 'build_ignore'
+# manifest: null

inventory/sample/group_vars/all.yml

@@ -66,9 +66,9 @@ metal_lb_ip_range: "192.168.30.80-192.168.30.90"
 # Please read https://gist.github.com/triangletodd/02f595cd4c0dc9aac5f7763ca2264185 before using this.
 # Most notably, your containers must be privileged, and must not have nesting set to true.
 # Please note this script disables most of the security of lxc containers, with the trade off being that lxc
-# containers are significantly more resource efficent compared to full VMs.
+# containers are significantly more resource efficient compared to full VMs.
 # Mixing and matching VMs and lxc containers is not supported, ymmv if you want to do this.
-# I would only really recommend using this if you have partiularly low powered proxmox nodes where the overhead of
+# I would only really recommend using this if you have particularly low powered proxmox nodes where the overhead of
 # VMs would use a significant portion of your available resources.
 proxmox_lxc_configure: false
 # the user that you would use to ssh into the host, for example if you run ssh some-user@my-proxmox-host,
@@ -81,3 +81,49 @@ proxmox_lxc_ct_ids:
  - 202
  - 203
  - 204
+
+# Only enable this if you have set up your own container registry to act as a mirror / pull-through cache
+# (harbor / nexus / docker's official registry / etc).
+# Can be beneficial for larger dev/test environments (for example if you're getting rate limited by docker hub),
+# or air-gapped environments where your nodes don't have internet access after the initial setup
+# (which is still needed for downloading the k3s binary and such).
+# k3s's documentation about private registries here: https://docs.k3s.io/installation/private-registry
+custom_registries: false
+# The registries can be authenticated or anonymous, depending on your registry server configuration.
+# If they allow anonymous access, simply remove the following bit from custom_registries_yaml
+# configs:
+# "registry.domain.com":
+# auth:
+# username: yourusername
+# password: yourpassword
+# The following is an example that pulls all images used in this playbook through your private registries.
+# It also allows you to pull your own images from your private registry, without having to use imagePullSecrets
+# in your deployments.
+# If all you need is your own images and you don't care about caching the docker/quay/ghcr.io images,
+# you can just remove those from the mirrors: section.
+custom_registries_yaml: |
+ mirrors:
+ docker.io:
+ endpoint:
+ - "https://registry.domain.com/v2/dockerhub"
+ quay.io:
+ endpoint:
+ - "https://registry.domain.com/v2/quayio"
+ ghcr.io:
+ endpoint:
+ - "https://registry.domain.com/v2/ghcrio"
+ registry.domain.com:
+ endpoint:
+ - "https://registry.domain.com"
+
+ configs:
+ "registry.domain.com":
+ auth:
+ username: yourusername
+ password: yourpassword
+
+# Only enable and configure these if you access the internet through a proxy
+# proxy_env:
+# HTTP_PROXY: "http://proxy.domain.local:3128"
+# HTTPS_PROXY: "http://proxy.domain.local:3128"
+# NO_PROXY: "*.domain.local,127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"