jakman85andClaude Opus 4.8
81ef78295a
Controller now reaches the kube-API directly through the pfSense NAT (192.168.2.50:6443 -> kube-vip VIP 192.168.1.49:6443), validating TLS against the VIP via tls-server-name. Removes the dev.sh SSH-tunnel scaffolding and updates the ansible source-of-truth so a rebuild regenerates a direct-access kubeconfig. Co-Authored-By: Claude Opus 4.8 <[email protected]>
112 lines
3.3 KiB
YAML
112 lines
3.3 KiB
YAML
---
|
|
# Install Cilium as the CNI (ADR-0002). Runs from the controller (dev container,
|
|
# which has kubectl + helm) against a kubeconfig fetched from the primary node.
|
|
# The cluster is NotReady until this completes — expected (PHASE1-SCOPE risks).
|
|
# run_once: this whole role acts on the cluster once, not per host.
|
|
|
|
- name: Fetch the k3s kubeconfig from the primary
|
|
ansible.builtin.slurp:
|
|
src: /etc/rancher/k3s/k3s.yaml
|
|
register: k3s_kubeconfig_raw
|
|
delegate_to: "{{ groups['k3s_primary'][0] }}"
|
|
run_once: true
|
|
|
|
- name: Ensure the local cache dir exists
|
|
ansible.builtin.file:
|
|
path: "{{ cilium_kubeconfig | dirname }}"
|
|
state: directory
|
|
mode: "0700"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
|
|
- name: Write kubeconfig locally (server rewritten to the direct NAT endpoint)
|
|
ansible.builtin.copy:
|
|
content: >-
|
|
{{ k3s_kubeconfig_raw.content | b64decode
|
|
| regex_replace('https://127.0.0.1:6443', cluster_controller_api_server) }}
|
|
dest: "{{ cilium_kubeconfig }}"
|
|
mode: "0600"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
|
|
- name: Read the cluster name from the written kubeconfig
|
|
ansible.builtin.command:
|
|
cmd: "kubectl config view -o jsonpath={.clusters[0].name}"
|
|
environment:
|
|
KUBECONFIG: "{{ cilium_kubeconfig }}"
|
|
register: cilium_kubeconfig_cluster
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
changed_when: false
|
|
|
|
- name: Pin tls-server-name to the kube-vip VIP so TLS validates through the NAT
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
kubectl config set
|
|
clusters.{{ cilium_kubeconfig_cluster.stdout }}.tls-server-name
|
|
{{ cluster_controller_tls_server_name }}
|
|
environment:
|
|
KUBECONFIG: "{{ cilium_kubeconfig }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
changed_when: true
|
|
|
|
- name: Install Gateway API CRDs (must precede Cilium gatewayAPI.enabled)
|
|
ansible.builtin.command:
|
|
cmd: "kubectl apply -f {{ item }}"
|
|
environment:
|
|
KUBECONFIG: "{{ cilium_kubeconfig }}"
|
|
loop: "{{ gateway_api_crd_urls }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
changed_when: true
|
|
|
|
- name: Add the Cilium Helm repo
|
|
ansible.builtin.command:
|
|
cmd: "helm repo add {{ cilium_chart_repo_name }} {{ cilium_chart_repo_url }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
register: cilium_repo_add
|
|
changed_when: "'has been added' in cilium_repo_add.stdout"
|
|
failed_when:
|
|
- cilium_repo_add.rc != 0
|
|
- "'already exists' not in cilium_repo_add.stderr"
|
|
|
|
- name: Update Helm repos
|
|
ansible.builtin.command:
|
|
cmd: "helm repo update {{ cilium_chart_repo_name }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
changed_when: false
|
|
|
|
- name: Render the Cilium values file (parity-critical settings from k3s_api_host)
|
|
ansible.builtin.template:
|
|
src: cilium-values.yaml.j2
|
|
dest: "{{ cilium_values_path }}"
|
|
mode: "0644"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
|
|
- name: Install/upgrade Cilium via Helm
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
helm upgrade --install cilium {{ cilium_chart_repo_name }}/cilium
|
|
--version {{ cilium_version }}
|
|
--namespace {{ cilium_namespace }}
|
|
--values {{ cilium_values_path }}
|
|
--wait --timeout 10m
|
|
environment:
|
|
KUBECONFIG: "{{ cilium_kubeconfig }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
changed_when: true
|