init

ansible/roles/k8s/install/00_python/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+- name: Ensure required Python libraries are installed
+  ansible.builtin.apt:
+    name:
+      - python3-pip
+      - python3-kubernetes
+    state: present
+    update_cache: yes

ansible/roles/k8s/install/01_helm/install-helm.md

@@ -0,0 +1,3 @@
+```bash
+curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+```

ansible/roles/k8s/install/01_helm/tasks/main.yml

@@ -0,0 +1,20 @@
+---
+- name: Download Helm install script
+  ansible.builtin.get_url:
+    url: https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
+    dest: /tmp/get-helm-3.sh
+    mode: '0755'
+
+- name: Install Helm
+  ansible.builtin.command: /tmp/get-helm-3.sh
+  args:
+    creates: /usr/local/bin/helm
+
+- name: Verify Helm installation
+  ansible.builtin.command: helm version
+  register: helm_version_output
+  changed_when: false
+
+- name: Show Helm version
+  ansible.builtin.debug:
+    var: helm_version_output.stdout

ansible/roles/k8s/install/02_common/tasks/main.yml

@@ -0,0 +1,172 @@
+# roles/k8s/k8scommon/tasks/main.yml
+---
+# === 1. Обновление пакетов и базовые утилиты ===
+- name: Install base packages
+  ansible.builtin.apt:
+    update_cache: yes
+    name:
+      - apt-transport-https
+      - ca-certificates
+      - curl
+      - gnupg
+      - lsb-release
+    state: present
+
+# === 2. Отключить swap ===
+- name: Disable swap immediately
+  ansible.builtin.command: swapoff -a
+  changed_when: false
+
+- name: Backup fstab
+  ansible.builtin.copy:
+    src: /etc/fstab
+    dest: /etc/fstab.bak
+    remote_src: yes
+    force: no
+
+- name: Comment out swap entries in fstab
+  ansible.builtin.replace:
+    path: /etc/fstab
+    regexp: '^\s*([^#].*\s+swap\s+.*)$'
+    replace: '# \1'
+
+# === 3. Модули ядра ===
+- name: Write kernel modules config for Kubernetes
+  ansible.builtin.copy:
+    dest: /etc/modules-load.d/k8s.conf
+    content: |
+      overlay
+      br_netfilter
+
+- name: Load overlay module
+  ansible.builtin.command: modprobe overlay
+  changed_when: false
+
+- name: Load br_netfilter module
+  ansible.builtin.command: modprobe br_netfilter
+  changed_when: false
+
+# === 4. sysctl для Kubernetes / containerd ===
+- name: Configure Kubernetes sysctl params
+  ansible.builtin.copy:
+    dest: /etc/sysctl.d/99-kubernetes-cri.conf
+    content: |
+      net.bridge.bridge-nf-call-iptables = 1
+      net.bridge.bridge-nf-call-ip6tables = 1
+      net.ipv4.ip_forward = 1
+
+- name: Apply sysctl settings
+  ansible.builtin.command: sysctl --system
+  changed_when: false
+
+# === 5. Установить containerd ===
+- name: Install containerd
+  ansible.builtin.apt:
+    update_cache: yes
+    name: containerd
+    state: present
+
+- name: Ensure containerd config directory exists
+  ansible.builtin.file:
+    path: /etc/containerd
+    state: directory
+    mode: '0755'
+
+# ВАЖНО: всегда пересоздаём config.toml, как в manual script
+- name: Generate default containerd config (overwrite)
+  ansible.builtin.shell: |
+    set -o errexit
+    containerd config default > /etc/containerd/config.toml
+  args:
+    executable: /bin/bash
+
+- name: Enable SystemdCgroup in containerd config
+  ansible.builtin.replace:
+    path: /etc/containerd/config.toml
+    regexp: 'SystemdCgroup = false'
+    replace: 'SystemdCgroup = true'
+
+- name: Set correct CNI bin_dir in containerd config
+  ansible.builtin.replace:
+    path: /etc/containerd/config.toml
+    regexp: 'bin_dir = .*'
+    replace: 'bin_dir = "/opt/cni/bin"'
+
+- name: Set correct CNI conf_dir in containerd config
+  ansible.builtin.replace:
+    path: /etc/containerd/config.toml
+    regexp: 'conf_dir = .*'
+    replace: 'conf_dir = "/etc/cni/net.d"'
+
+- name: Enable and restart containerd
+  ansible.builtin.systemd:
+    name: containerd
+    enabled: true
+    state: restarted
+
+# === 6. Подготовить директории для CNI ===
+- name: Ensure CNI directories exist
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: '0755'
+  loop:
+    - /opt/cni/bin
+    - /etc/cni/net.d
+
+# /usr/lib/cni → /opt/cni/bin, только если /usr/lib/cni не существует
+- name: Check if /usr/lib/cni exists
+  ansible.builtin.stat:
+    path: /usr/lib/cni
+  register: cni_usr_lib
+
+- name: Create symlink /usr/lib/cni -> /opt/cni/bin (if not exists)
+  ansible.builtin.file:
+    src: /opt/cni/bin
+    dest: /usr/lib/cni
+    state: link
+  when: not cni_usr_lib.stat.exists
+
+# === 7. Репозиторий Kubernetes v1.34 ===
+- name: Ensure apt keyrings directory exists
+  ansible.builtin.file:
+    path: /etc/apt/keyrings
+    state: directory
+    mode: '0755'
+
+- name: Download Kubernetes repo key
+  ansible.builtin.shell: |
+    set -o errexit
+    curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.34/deb/Release.key \
+      | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
+  args:
+    executable: /bin/bash
+    creates: /etc/apt/keyrings/kubernetes-apt-keyring.gpg
+
+- name: Add Kubernetes apt repository
+  ansible.builtin.copy:
+    dest: /etc/apt/sources.list.d/kubernetes.list
+    content: |
+      deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.34/deb/ /
+
+- name: Update apt cache after adding Kubernetes repo
+  ansible.builtin.apt:
+    update_cache: yes
+
+# === 8. Установить kubelet, kubeadm, kubectl и зафиксировать версии ===
+- name: Install kubelet, kubeadm, kubectl
+  ansible.builtin.apt:
+    name:
+      - kubelet
+      - kubeadm
+      - kubectl
+    state: present
+    update_cache: yes
+
+- name: Hold Kubernetes packages
+  ansible.builtin.command: apt-mark hold kubelet kubeadm kubectl
+  register: hold_result
+  changed_when: >-
+    'hold' in hold_result.stdout
+    or 'marked' in hold_result.stdout
+    or hold_result.rc == 0

ansible/roles/k8s/install/03_master/tasks/main.yml

@@ -0,0 +1,136 @@
+# roles/k8s/k8smaster/tasks/main.yml
+---
+# === 9. kubeadm init (аналог шага 14) ===
+- name: Initialize Kubernetes control plane (kubeadm init)
+  ansible.builtin.command: >
+    kubeadm init
+    --apiserver-advertise-address={{ ansible_default_ipv4.address }}
+    --pod-network-cidr=10.244.0.0/16
+  args:
+    creates: /etc/kubernetes/admin.conf
+
+# === 10. kubeconfig для root и пользователя ===
+- name: Ensure kubeconfig directory for root exists
+  ansible.builtin.file:
+    path: /root/.kube
+    state: directory
+    mode: "0700"
+
+- name: Copy admin kubeconfig for root
+  ansible.builtin.copy:
+    src: /etc/kubernetes/admin.conf
+    dest: /root/.kube/config
+    owner: root
+    group: root
+    mode: "0600"
+    remote_src: yes
+
+- name: Ensure kubeconfig directory for user exists
+  ansible.builtin.file:
+    path: "/home/adminuser/.kube"
+    state: directory
+    owner: "adminuser"
+    group: "adminuser"
+    mode: "0700"
+
+- name: Copy admin kubeconfig to user home
+  ansible.builtin.copy:
+    src: /etc/kubernetes/admin.conf
+    dest: "/home/adminuser/.kube/config"
+    owner: "adminuser"
+    group: "adminuser"
+    mode: "0600"
+    remote_src: yes
+
+# === 11. Ждём API-сервер ===
+- name: Wait for Kubernetes API to become reachable
+  ansible.builtin.command: kubectl get --raw=/healthz
+  register: api_health
+  until: api_health.rc == 0
+  retries: 30
+  delay: 10
+  environment:
+    KUBECONFIG: /etc/kubernetes/admin.conf
+
+# === 12. Ставим Flannel CNI (НЕ ждём Ready ноды до него) ===
+- name: Install Flannel CNI
+  ansible.builtin.command: >
+    kubectl apply --validate=false
+    -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml
+  register: flannel_result
+  until: flannel_result.rc == 0
+  retries: 10
+  delay: 6
+  environment:
+    KUBECONFIG: /etc/kubernetes/admin.conf
+
+- name: Wait for flannel DaemonSet to be Ready
+  ansible.builtin.command: >
+    kubectl -n kube-flannel rollout status daemonset/kube-flannel-ds --timeout=300s
+  register: flannel_rollout
+  until: flannel_rollout.rc == 0
+  retries: 5
+  delay: 15
+  environment:
+    KUBECONFIG: /etc/kubernetes/admin.conf
+
+# === 13. Теперь ждём, пока нода станет Ready ===
+- name: Wait for control-plane node to become Ready
+  ansible.builtin.shell: |
+    kubectl get node "$(hostname -s)" \
+      -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}'
+  register: node_ready
+  until: node_ready.stdout == "True"
+  retries: 30
+  delay: 10
+  environment:
+    KUBECONFIG: /etc/kubernetes/admin.conf
+
+# === 14. Ждём CoreDNS ===
+- name: Wait for CoreDNS deployment to be Ready
+  ansible.builtin.command: >
+    kubectl -n kube-system rollout status deployment/coredns --timeout=300s
+  register: coredns_rollout
+  until: coredns_rollout.rc == 0
+  retries: 5
+  delay: 15
+  environment:
+    KUBECONFIG: /etc/kubernetes/admin.conf
+
+# === 14. Разрешаем поды на master (как шаг 18), если нужно ===
+- name: Allow scheduling pods on control-plane node
+  ansible.builtin.command: >
+    kubectl taint nodes --all node-role.kubernetes.io/control-plane-
+  environment:
+    KUBECONFIG: /etc/kubernetes/admin.conf
+  when: false
+
+# === 15. Проверка статуса кластера ===
+- name: Get nodes
+  ansible.builtin.command: kubectl get nodes
+  register: nodes_out
+  environment:
+    KUBECONFIG: /etc/kubernetes/admin.conf
+
+- name: Show nodes
+  ansible.builtin.debug:
+    var: nodes_out.stdout
+
+- name: Get all pods in all namespaces
+  ansible.builtin.command: kubectl get pods -A
+  register: pods_out
+  environment:
+    KUBECONFIG: /etc/kubernetes/admin.conf
+
+- name: Show pods
+  ansible.builtin.debug:
+    var: pods_out.stdout
+
+# === 16. Вывести join-команду (как шаг 20) ===
+- name: Get kubeadm join command
+  ansible.builtin.command: kubeadm token create --print-join-command
+  register: join_cmd
+
+- name: Show join command
+  ansible.builtin.debug:
+    msg: "Use this command on workers: {{ join_cmd.stdout }}"

ansible/roles/k8s/install/04_worker/tasks/main.yml

@@ -0,0 +1,13 @@
+---
+# === 2. Join в кластер (аналог kubeadm join в ручном скрипте) ===
+- name: Join node to Kubernetes cluster
+  ansible.builtin.command: "{{ k8s_kubeadm_join_command }}"
+  args:
+    creates: /etc/kubernetes/kubelet.conf
+
+# === 3. Убедиться, что kubelet включён и работает ===
+- name: Ensure kubelet is enabled and running
+  ansible.builtin.systemd:
+    name: kubelet
+    enabled: true
+    state: started