k3s (D6): Dienst-VM k3s per tofu, Rollen k3s-server/k3s-agent/k3s-apps, Manifeste, NEX-Sprachdienste als k3s-Umzugstest

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-15 11:55:18 +02:00
parent 6cccc01d14
commit 2c1d43e9c7
23 changed files with 701 additions and 15 deletions
@@ -0,0 +1,10 @@
+# k3s-Agent in den GPU-VMs (D6). Der Server heißt k3s.knaster (/etc/hosts), Token aus der Datei auf ops.
+k3s_version: v1.36.5+k3s1
+k3s_server_name: k3s.knaster
+k3s_server_host: "{{ hostvars['k3s'].ansible_host }}"
+k3s_env_file: /root/.config/knaster/k3s.env
+k3s_token: "{{ lookup('ini', 'K3S_TOKEN', type='properties', file=k3s_env_file) }}"
+k3s_install_script: /usr/local/src/k3s-install.sh
+k3s_node_labels: []
+k3s_lan: 192.168.100.0/24
+k3s_pod_cidr: 10.42.0.0/16
@@ -0,0 +1,92 @@
+# k3s-Agent neben Docker: k3s bringt sein eigenes containerd mit und erkennt nvidia-container-runtime
+# von selbst (Runtime "nvidia"). Docker bleibt für die bestehenden Compose-Stacks, bis sie umgezogen sind.
+- name: Server-Name in /etc/hosts (Adresse per DHCP, D5)
+  ansible.builtin.lineinfile:
+    path: /etc/hosts
+    regexp: '\s{{ k3s_server_name | regex_escape }}$'
+    line: "{{ k3s_server_host }} {{ k3s_server_name }}"
+
+- name: curl vorhanden
+  ansible.builtin.apt:
+    name: curl
+    state: present
+
+- name: Installationsskript laden
+  ansible.builtin.get_url:
+    url: https://get.k3s.io
+    dest: "{{ k3s_install_script }}"
+    mode: "0755"
+
+- name: Konfiguration /etc/rancher/k3s/config.yaml
+  ansible.builtin.copy:
+    dest: /etc/rancher/k3s/config.yaml
+    mode: "0600"
+    content: |
+      # Verwaltet von Ansible (Rolle k3s-agent)
+      server: https://{{ k3s_server_name }}:6443
+      token: {{ k3s_token }}
+      node-label: {{ k3s_node_labels | to_json }}
+  register: k3s_agent_config
+  no_log: true
+
+# ufw (nur in VMs mit aktiver Firewall): Kubelet und NodePorts aus dem LAN, Flannel-VXLAN zwischen den
+# Knoten, alles aus dem Pod-Netz (CoreDNS, Device-Plugin, Portainer-Agent sprechen mit dem Knoten).
+- name: Ist ufw vorhanden?
+  ansible.builtin.stat:
+    path: /usr/sbin/ufw
+  register: k3s_ufw
+
+- name: ufw – k3s-Ports
+  community.general.ufw:
+    rule: allow
+    from_ip: "{{ item.from }}"
+    port: "{{ item.port | default(omit) }}"
+    proto: "{{ item.proto | default(omit) }}"
+    comment: "{{ item.comment }}"
+  loop:
+    - {from: "{{ k3s_lan }}", port: "10250", proto: tcp, comment: k3s-kubelet}
+    - {from: "{{ k3s_lan }}", port: "8472", proto: udp, comment: k3s-flannel}
+    - {from: "{{ k3s_lan }}", port: "30000:32767", proto: tcp, comment: k3s-nodeport}
+    - {from: "{{ k3s_pod_cidr }}", comment: k3s-pods}
+  loop_control:
+    label: "{{ item.comment }}"
+  when: k3s_ufw.stat.exists
+
+- name: Installierte Version lesen
+  ansible.builtin.command: /usr/local/bin/k3s --version
+  register: k3s_installed
+  failed_when: false
+  changed_when: false
+
+- name: k3s-Agent installieren oder auf die gepinnte Version bringen
+  ansible.builtin.command: "{{ k3s_install_script }} agent"
+  environment:
+    INSTALL_K3S_VERSION: "{{ k3s_version }}"
+  when: k3s_version not in (k3s_installed.stdout | default(''))
+
+- name: Agent neu starten, wenn sich die Konfiguration geändert hat
+  ansible.builtin.service:
+    name: k3s-agent
+    state: restarted
+  when: k3s_agent_config.changed and k3s_version in (k3s_installed.stdout | default(''))
+
+- name: Warten, bis containerd von k3s läuft
+  ansible.builtin.wait_for:
+    path: /var/lib/rancher/k3s/agent/etc/containerd/config.toml
+    timeout: 120
+
+- name: NVIDIA-Runtime von k3s erkannt?
+  ansible.builtin.command: grep -c nvidia /var/lib/rancher/k3s/agent/etc/containerd/config.toml
+  register: k3s_nvidia
+  changed_when: false
+  failed_when: k3s_nvidia.stdout | int == 0
+
+- name: Warten, bis der Knoten im Cluster bereit ist (von ops aus)
+  ansible.builtin.command: kubectl get node {{ inventory_hostname }} -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}'
+  register: k3s_node_ready
+  until: k3s_node_ready.stdout == "True"
+  retries: 36
+  delay: 5
+  changed_when: false
+  delegate_to: localhost
+  become: false