Robert RappandClaude Fable 5.1
1f3b12d099
ci / test (push) Failing after 23s
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
110 lines
3.9 KiB
YAML
110 lines
3.9 KiB
YAML
# k3s-Agent neben Docker: k3s bringt sein eigenes containerd mit und erkennt nvidia-container-runtime
|
||
# von selbst (Runtime "nvidia"). Docker bleibt für die bestehenden Compose-Stacks, bis sie umgezogen sind.
|
||
# cloud-init (Ubuntu-Cloud-Image: manage_etc_hosts template) schreibt /etc/hosts bei jedem Start neu und warf den
|
||
# Eintrag k3s.knaster weg (Befund 20.10.: nach VM-Neustart am 15.10. lebten die Agents nur vom gemerkten Serverstand;
|
||
# als die k3s-VM per DHCP eine andere Adresse bekam, waren alle Knoten NotReady).
|
||
- name: cloud-init verwaltet /etc/hosts nicht mehr
|
||
ansible.builtin.copy:
|
||
dest: /etc/cloud/cloud.cfg.d/99-knaster-hosts.cfg
|
||
content: |
|
||
# Rolle k3s-agent: /etc/hosts gehört Ansible (Eintrag k3s.knaster), nicht cloud-init
|
||
manage_etc_hosts: false
|
||
mode: "0644"
|
||
|
||
- name: Server-Name in /etc/hosts (Adresse per DHCP, D5)
|
||
ansible.builtin.lineinfile:
|
||
path: /etc/hosts
|
||
regexp: '\s{{ k3s_server_name | regex_escape }}$'
|
||
line: "{{ k3s_server_host }} {{ k3s_server_name }}"
|
||
|
||
- name: curl vorhanden
|
||
ansible.builtin.apt:
|
||
name: curl
|
||
state: present
|
||
|
||
- name: Installationsskript laden
|
||
ansible.builtin.get_url:
|
||
url: https://get.k3s.io
|
||
dest: "{{ k3s_install_script }}"
|
||
mode: "0755"
|
||
|
||
- name: Verzeichnis /etc/rancher/k3s
|
||
ansible.builtin.file:
|
||
path: /etc/rancher/k3s
|
||
state: directory
|
||
mode: "0755"
|
||
|
||
- name: Konfiguration /etc/rancher/k3s/config.yaml
|
||
ansible.builtin.copy:
|
||
dest: /etc/rancher/k3s/config.yaml
|
||
mode: "0600"
|
||
content: |
|
||
# Verwaltet von Ansible (Rolle k3s-agent)
|
||
server: https://{{ k3s_server_name }}:6443
|
||
token: {{ k3s_token }}
|
||
node-label: {{ k3s_node_labels | to_json }}
|
||
register: k3s_agent_config
|
||
no_log: true
|
||
|
||
# ufw (nur in VMs mit aktiver Firewall): Kubelet und NodePorts aus dem LAN, Flannel-VXLAN zwischen den
|
||
# Knoten, alles aus dem Pod-Netz (CoreDNS, Device-Plugin, Portainer-Agent sprechen mit dem Knoten).
|
||
- name: Ist ufw vorhanden?
|
||
ansible.builtin.stat:
|
||
path: /usr/sbin/ufw
|
||
register: k3s_ufw
|
||
|
||
- name: ufw – k3s-Ports
|
||
community.general.ufw:
|
||
rule: allow
|
||
from_ip: "{{ item.from }}"
|
||
port: "{{ item.port | default(omit) }}"
|
||
proto: "{{ item.proto | default(omit) }}"
|
||
comment: "{{ item.comment }}"
|
||
loop:
|
||
- {from: "{{ k3s_lan }}", port: "10250", proto: tcp, comment: k3s-kubelet}
|
||
- {from: "{{ k3s_lan }}", port: "8472", proto: udp, comment: k3s-flannel}
|
||
- {from: "{{ k3s_lan }}", port: "30000:32767", proto: tcp, comment: k3s-nodeport}
|
||
- {from: "{{ k3s_pod_cidr }}", comment: k3s-pods}
|
||
loop_control:
|
||
label: "{{ item.comment }}"
|
||
when: k3s_ufw.stat.exists
|
||
|
||
- name: Installierte Version lesen
|
||
ansible.builtin.command: /usr/local/bin/k3s --version
|
||
register: k3s_installed
|
||
failed_when: false
|
||
changed_when: false
|
||
|
||
- name: k3s-Agent installieren oder auf die gepinnte Version bringen
|
||
ansible.builtin.command: "{{ k3s_install_script }} agent"
|
||
environment:
|
||
INSTALL_K3S_VERSION: "{{ k3s_version }}"
|
||
when: k3s_version not in (k3s_installed.stdout | default(''))
|
||
|
||
- name: Agent neu starten, wenn sich die Konfiguration geändert hat
|
||
ansible.builtin.service:
|
||
name: k3s-agent
|
||
state: restarted
|
||
when: k3s_agent_config.changed and k3s_version in (k3s_installed.stdout | default(''))
|
||
|
||
- name: Warten, bis containerd von k3s läuft
|
||
ansible.builtin.wait_for:
|
||
path: /var/lib/rancher/k3s/agent/etc/containerd/config.toml
|
||
timeout: 120
|
||
|
||
- name: NVIDIA-Runtime von k3s erkannt?
|
||
ansible.builtin.command: grep -c nvidia /var/lib/rancher/k3s/agent/etc/containerd/config.toml
|
||
register: k3s_nvidia
|
||
changed_when: false
|
||
failed_when: k3s_nvidia.stdout | int == 0
|
||
|
||
- name: Warten, bis der Knoten im Cluster bereit ist (von ops aus)
|
||
ansible.builtin.command: kubectl get node {{ inventory_hostname }} -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}'
|
||
register: k3s_node_ready
|
||
until: k3s_node_ready.stdout == "True"
|
||
retries: 36
|
||
delay: 5
|
||
changed_when: false
|
||
delegate_to: localhost
|
||
become: false
|