k3s: Portainer CE mit übernommener Datenbank von appsrv08 (Manifest + Playbook mit Rollback BE→CE)
ci / test (push) Failing after 24s
ci / test (push) Failing after 24s
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Robert Rapp
co-authored by
Claude Fable 5.1
Claude Fable 5.1
parent
26e1079f3d
commit
4d31dda0e5
@@ -0,0 +1,95 @@
|
|||||||
|
# Portainer CE im Cluster, Umzug von appsrv08 (Portainer EE 2.45.1) mit übernommener Datenbank (Benutzer,
|
||||||
|
# API-Schlüssel, Umgebungen, Stacks). Läuft auf der Dienst-VM k3s (tank, HA), Daten auf local-path dieser VM.
|
||||||
|
# Erst-Befüllung und Rollback BE→CE macht playbooks/portainer-k3s.yml aus /root/.config/knaster/portainer_data.tgz.
|
||||||
|
# Erreichbar: https://<Knoten-IP>:30779 (NodePort), von außen über den nginx auf appsrv08 (portainer.mygodel.de).
|
||||||
|
# Dieselbe Version wie auf appsrv08 (2.45.1): die Datenbank wird beim Start nicht migriert.
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: portainer-ce
|
||||||
|
labels:
|
||||||
|
knaster.app: portainer
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: portainer-data
|
||||||
|
namespace: portainer-ce
|
||||||
|
spec:
|
||||||
|
accessModes: [ReadWriteOnce]
|
||||||
|
storageClassName: local-path
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 2Gi
|
||||||
|
---
|
||||||
|
# Portainer verwaltet den eigenen Cluster über ein ServiceAccount (Umgebung „local“ wird beim ersten Start angelegt).
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: portainer-sa-clusteradmin
|
||||||
|
namespace: portainer-ce
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: portainer-ce-crb
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: cluster-admin
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: portainer-sa-clusteradmin
|
||||||
|
namespace: portainer-ce
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: portainer
|
||||||
|
namespace: portainer-ce
|
||||||
|
labels: {app: portainer-ce}
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
strategy: {type: Recreate}
|
||||||
|
selector:
|
||||||
|
matchLabels: {app: portainer-ce}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels: {app: portainer-ce}
|
||||||
|
spec:
|
||||||
|
serviceAccountName: portainer-sa-clusteradmin
|
||||||
|
nodeSelector:
|
||||||
|
knaster.role: control # Dienst-VM k3s: tank, HA, Replikation
|
||||||
|
containers:
|
||||||
|
- name: portainer
|
||||||
|
image: portainer/portainer-ce:2.45.1
|
||||||
|
ports:
|
||||||
|
- {name: https, containerPort: 9443}
|
||||||
|
- {name: edge, containerPort: 8000}
|
||||||
|
resources:
|
||||||
|
requests: {cpu: 50m, memory: 128Mi}
|
||||||
|
limits: {memory: 512Mi}
|
||||||
|
volumeMounts:
|
||||||
|
- {name: data, mountPath: /data}
|
||||||
|
readinessProbe:
|
||||||
|
httpGet: {path: /api/system/status, port: https, scheme: HTTPS}
|
||||||
|
periodSeconds: 10
|
||||||
|
livenessProbe:
|
||||||
|
httpGet: {path: /api/system/status, port: https, scheme: HTTPS}
|
||||||
|
periodSeconds: 30
|
||||||
|
failureThreshold: 3
|
||||||
|
volumes:
|
||||||
|
- name: data
|
||||||
|
persistentVolumeClaim: {claimName: portainer-data}
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: portainer
|
||||||
|
namespace: portainer-ce
|
||||||
|
labels: {app: portainer-ce}
|
||||||
|
spec:
|
||||||
|
type: NodePort
|
||||||
|
selector: {app: portainer-ce}
|
||||||
|
ports:
|
||||||
|
- {name: https, port: 9443, targetPort: https, nodePort: 30779}
|
||||||
@@ -0,0 +1,103 @@
|
|||||||
|
# Portainer CE in k3s mit der Datenbank von appsrv08 (Portainer EE 2.45.1). Läuft auf ops:
|
||||||
|
# ansible-playbook playbooks/portainer-k3s.yml
|
||||||
|
#
|
||||||
|
# Voraussetzung: Sicherung des Docker-Volumes portainer_data von appsrv08 als /root/.config/knaster/portainer_data.tgz
|
||||||
|
# (Inhalt: data/portainer.db, data/portainer.key, …; erzeugt mit
|
||||||
|
# docker run --rm -v portainer_data:/data:ro alpine tar -C / -czf - data > portainer_data.tgz ).
|
||||||
|
# Beim ersten Lauf wird das Volume befüllt und die Datenbank mit dem offiziellen Werkzeug der EE
|
||||||
|
# (`--rollback-to-ce`) auf Community Edition zurückgesetzt; danach bleibt der Datenstand im Cluster.
|
||||||
|
# Benutzer, API-Schlüssel und Umgebungen bleiben erhalten (getestet 15.10.2026). Die Umgebung 4 (Docker-Socket
|
||||||
|
# von appsrv08) funktioniert im Cluster nicht mehr; appsrv08 wird als Agent-Umgebung neu angebunden.
|
||||||
|
- name: Portainer CE nach k3s
|
||||||
|
hosts: localhost
|
||||||
|
connection: local
|
||||||
|
gather_facts: false
|
||||||
|
vars:
|
||||||
|
manifest: "{{ playbook_dir }}/../../../../deploy/k8s/portainer/portainer.yaml"
|
||||||
|
backup: /root/.config/knaster/portainer_data.tgz
|
||||||
|
ns: portainer-ce
|
||||||
|
version: 2.45.1
|
||||||
|
tasks:
|
||||||
|
- name: Namespace, PVC, RBAC (noch ohne Deployment, damit das Volume zuerst befüllt wird)
|
||||||
|
ansible.builtin.shell: >
|
||||||
|
set -o pipefail;
|
||||||
|
python3 -c "import sys,yaml; docs=[d for d in yaml.safe_load_all(open('{{ manifest }}')) if d and d['kind']!='Deployment' and d['kind']!='Service']; yaml.safe_dump_all(docs, sys.stdout)"
|
||||||
|
| kubectl apply -f -
|
||||||
|
args: {executable: /bin/bash}
|
||||||
|
register: base
|
||||||
|
changed_when: "'created' in base.stdout"
|
||||||
|
|
||||||
|
- name: Ist das Volume schon befüllt?
|
||||||
|
ansible.builtin.command: kubectl -n {{ ns }} get configmap portainer-seeded
|
||||||
|
register: seeded
|
||||||
|
failed_when: false
|
||||||
|
changed_when: false
|
||||||
|
|
||||||
|
- name: Sicherung vorhanden?
|
||||||
|
ansible.builtin.stat:
|
||||||
|
path: "{{ backup }}"
|
||||||
|
register: bk
|
||||||
|
when: seeded.rc != 0
|
||||||
|
failed_when: not bk.stat.exists
|
||||||
|
|
||||||
|
- name: Volume aus der Sicherung befüllen (Hilfs-Pod auf dem Knoten k3s)
|
||||||
|
ansible.builtin.shell: |
|
||||||
|
set -e
|
||||||
|
kubectl -n {{ ns }} delete pod seed --ignore-not-found >/dev/null
|
||||||
|
cat <<EOF | kubectl apply -f - >/dev/null
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata: {name: seed, namespace: {{ ns }}}
|
||||||
|
spec:
|
||||||
|
nodeSelector: {knaster.role: control}
|
||||||
|
restartPolicy: Never
|
||||||
|
containers:
|
||||||
|
- name: seed
|
||||||
|
image: alpine:3.20
|
||||||
|
command: ["sleep", "600"]
|
||||||
|
volumeMounts: [{name: data, mountPath: /data}]
|
||||||
|
volumes: [{name: data, persistentVolumeClaim: {claimName: portainer-data}}]
|
||||||
|
EOF
|
||||||
|
kubectl -n {{ ns }} wait --for=condition=Ready pod/seed --timeout=180s >/dev/null
|
||||||
|
kubectl -n {{ ns }} cp {{ backup }} seed:/tmp/pd.tgz
|
||||||
|
kubectl -n {{ ns }} exec seed -- sh -c "cd /tmp && tar xzf pd.tgz && cp -a data/. /data/ && test -s /data/portainer.db"
|
||||||
|
kubectl -n {{ ns }} delete pod seed --wait=true >/dev/null
|
||||||
|
when: seeded.rc != 0
|
||||||
|
|
||||||
|
- name: Datenbank auf Community Edition zurücksetzen (offizielles Werkzeug der EE, fragt per stdin)
|
||||||
|
ansible.builtin.shell: |
|
||||||
|
set -e
|
||||||
|
kubectl -n {{ ns }} delete pod rollback --ignore-not-found >/dev/null
|
||||||
|
echo y | kubectl -n {{ ns }} run rollback -i --restart=Never --image=portainer/portainer-ee:{{ version }} \
|
||||||
|
--overrides='{"spec":{"nodeSelector":{"knaster.role":"control"},"containers":[{"name":"rollback","image":"portainer/portainer-ee:{{ version }}","args":["--rollback-to-ce"],"stdin":true,"volumeMounts":[{"name":"data","mountPath":"/data"}]}],"volumes":[{"name":"data","persistentVolumeClaim":{"claimName":"portainer-data"}}]}}' >/dev/null 2>&1 || true
|
||||||
|
sleep 5
|
||||||
|
kubectl -n {{ ns }} logs rollback | grep -q "rolled back to CE Edition"
|
||||||
|
kubectl -n {{ ns }} delete pod rollback --wait=false >/dev/null
|
||||||
|
kubectl -n {{ ns }} create configmap portainer-seeded --from-literal=source={{ backup | basename }} --from-literal=date="$(date -Is)"
|
||||||
|
when: seeded.rc != 0
|
||||||
|
|
||||||
|
- name: Deployment und Service
|
||||||
|
ansible.builtin.command: kubectl apply -f {{ manifest }}
|
||||||
|
register: dep
|
||||||
|
changed_when: "'configured' in dep.stdout or 'created' in dep.stdout"
|
||||||
|
|
||||||
|
- name: Warten, bis bereit
|
||||||
|
ansible.builtin.command: kubectl -n {{ ns }} rollout status deployment/portainer --timeout=300s
|
||||||
|
changed_when: false
|
||||||
|
|
||||||
|
- name: Version und Edition über NodePort (Knoten k3s)
|
||||||
|
ansible.builtin.uri:
|
||||||
|
url: "https://{{ hostvars['k3s'].ansible_host }}:30779/api/system/version"
|
||||||
|
validate_certs: false
|
||||||
|
return_content: true
|
||||||
|
register: ver
|
||||||
|
until: ver.status == 200
|
||||||
|
retries: 6
|
||||||
|
delay: 5
|
||||||
|
|
||||||
|
- name: Ergebnis
|
||||||
|
ansible.builtin.assert:
|
||||||
|
that:
|
||||||
|
- ver.json.ServerEdition == 'CE'
|
||||||
|
- ver.json.ServerVersion == version
|
||||||
|
success_msg: "Portainer {{ ver.json.ServerEdition }} {{ ver.json.ServerVersion }} unter https://{{ hostvars['k3s'].ansible_host }}:30779"
|
||||||
Reference in New Issue
Block a user