migrate
This commit is contained in:
Mike McFetridge
@@ -0,0 +1,404 @@
|
||||
---
|
||||
- name: Configure K3s post-install platform services - Fetch kubeconfig
|
||||
hosts: all
|
||||
gather_facts: false
|
||||
become: true
|
||||
<%- if secrets_file %>
|
||||
vars_files:
|
||||
- << secrets_file >>
|
||||
<%- endif %>
|
||||
|
||||
vars:
|
||||
kubeconfig_path: "<< kubeconfig_local_path >>"
|
||||
kubeconfig_server_target: "<< kubeconfig_server_endpoint >>"
|
||||
|
||||
tasks:
|
||||
- name: Validate that the kubeconfig source host exists in inventory
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- "'<< kubeconfig_source_host | default('k3s-server-01') >>' in hostvars"
|
||||
fail_msg: "Inventory host '<< kubeconfig_source_host | default('k3s-server-01') >>' was not found."
|
||||
run_once: true
|
||||
|
||||
- name: Read kubeconfig from the primary K3s server
|
||||
ansible.builtin.slurp:
|
||||
src: "<< kubeconfig_source_path | default('/etc/rancher/k3s/k3s.yaml') >>"
|
||||
delegate_to: "<< kubeconfig_source_host | default('k3s-server-01') >>"
|
||||
register: k3s_source_kubeconfig
|
||||
when: fetch_kubeconfig | default(true)
|
||||
run_once: true
|
||||
|
||||
- name: Ensure local kubeconfig directory exists
|
||||
ansible.builtin.file:
|
||||
path: "{{ kubeconfig_path | dirname }}"
|
||||
state: directory
|
||||
mode: "0700"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
when: fetch_kubeconfig | default(true)
|
||||
|
||||
- name: Write kubeconfig to the control machine
|
||||
ansible.builtin.copy:
|
||||
dest: "{{ kubeconfig_path }}"
|
||||
mode: "0600"
|
||||
content: "{{ (k3s_source_kubeconfig.content | b64decode) | regex_replace('https://127\\.0\\.0\\.1:6443', 'https://' ~ kubeconfig_server_target ~ ':6443') }}"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
when: fetch_kubeconfig | default(true)
|
||||
|
||||
- name: Configure K3s post-install platform services - Prepare Longhorn prerequisites
|
||||
hosts: all
|
||||
gather_facts: false
|
||||
become: true
|
||||
<%- if secrets_file %>
|
||||
vars_files:
|
||||
- << secrets_file >>
|
||||
<%- endif %>
|
||||
vars:
|
||||
longhorn_target_hosts: "{{ query('inventory_hostnames', '<< longhorn_node_hosts >>') }}"
|
||||
|
||||
tasks:
|
||||
- name: Validate Longhorn target host pattern
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- longhorn_target_hosts | length > 0
|
||||
fail_msg: "No inventory hosts matched '<< longhorn_node_hosts >>'."
|
||||
when: longhorn_prerequisites_enabled | default(false)
|
||||
run_once: true
|
||||
|
||||
- name: Install Longhorn prerequisite packages
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- open-iscsi
|
||||
- nfs-common
|
||||
- cryptsetup
|
||||
- util-linux
|
||||
state: present
|
||||
update_cache: true
|
||||
when:
|
||||
- longhorn_prerequisites_enabled | default(false)
|
||||
- inventory_hostname in longhorn_target_hosts
|
||||
|
||||
- name: Ensure iscsid service is enabled and running
|
||||
ansible.builtin.service:
|
||||
name: iscsid
|
||||
state: started
|
||||
enabled: true
|
||||
when:
|
||||
- longhorn_prerequisites_enabled | default(false)
|
||||
- inventory_hostname in longhorn_target_hosts
|
||||
|
||||
- name: Ensure open-iscsi service is enabled and running when present
|
||||
ansible.builtin.service:
|
||||
name: open-iscsi
|
||||
state: started
|
||||
enabled: true
|
||||
failed_when: false
|
||||
when:
|
||||
- longhorn_prerequisites_enabled | default(false)
|
||||
- inventory_hostname in longhorn_target_hosts
|
||||
|
||||
- name: Persist dm_crypt kernel module for Longhorn
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/modules-load.d/longhorn.conf
|
||||
mode: "0644"
|
||||
content: |
|
||||
dm_crypt
|
||||
when:
|
||||
- longhorn_prerequisites_enabled | default(false)
|
||||
- inventory_hostname in longhorn_target_hosts
|
||||
|
||||
- name: Load dm_crypt kernel module immediately
|
||||
community.general.modprobe:
|
||||
name: dm_crypt
|
||||
state: present
|
||||
when:
|
||||
- longhorn_prerequisites_enabled | default(false)
|
||||
- inventory_hostname in longhorn_target_hosts
|
||||
|
||||
- name: Disable multipathd when the environment does not use multipath storage
|
||||
ansible.builtin.service:
|
||||
name: multipathd
|
||||
state: stopped
|
||||
enabled: false
|
||||
failed_when: false
|
||||
when:
|
||||
- longhorn_prerequisites_enabled | default(false)
|
||||
- longhorn_disable_multipathd | default(false)
|
||||
- inventory_hostname in longhorn_target_hosts
|
||||
|
||||
- name: Configure K3s post-install platform services - Configure cluster add-ons
|
||||
hosts: all
|
||||
gather_facts: false
|
||||
<%- if secrets_file %>
|
||||
vars_files:
|
||||
- << secrets_file >>
|
||||
<%- endif %>
|
||||
|
||||
vars:
|
||||
kubeconfig_path: "<< kubeconfig_local_path >>"
|
||||
|
||||
tasks:
|
||||
- block:
|
||||
- name: Ensure the kubeconfig file exists before applying cluster resources
|
||||
ansible.builtin.stat:
|
||||
path: "{{ kubeconfig_path }}"
|
||||
register: kubeconfig_stat
|
||||
|
||||
- name: Fail when the kubeconfig file is missing
|
||||
ansible.builtin.fail:
|
||||
msg: "Kubeconfig not found at {{ kubeconfig_path }}. Enable fetch_kubeconfig or provide an existing kubeconfig path."
|
||||
when: not (kubeconfig_stat.stat.exists | default(false))
|
||||
|
||||
- name: Verify Helm is available on the control machine when required
|
||||
ansible.builtin.command:
|
||||
cmd: helm version --short
|
||||
changed_when: false
|
||||
when: (cert_manager_install_enabled | default(false)) or (metrics_server_install_enabled | default(false)) or (longhorn_install_enabled | default(false))
|
||||
|
||||
- name: Validate ACME email when ClusterIssuer creation is enabled
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- (cert_manager_acme_email | default('')) | length > 0
|
||||
fail_msg: "cert_manager_acme_email must be set when cert_manager_clusterissuer_enabled=true."
|
||||
when: cert_manager_clusterissuer_enabled | default(false)
|
||||
|
||||
- name: Build namespace list for enabled platform components
|
||||
ansible.builtin.set_fact:
|
||||
managed_namespaces: >-
|
||||
{{
|
||||
(
|
||||
(extra_namespaces_yaml | default('[]') | from_yaml)
|
||||
+ ([cert_manager_namespace | default('cert-manager')] if cert_manager_install_enabled | default(false) or cert_manager_create_cloudflare_secret | default(false) or cert_manager_clusterissuer_enabled | default(false) else [])
|
||||
+ ([longhorn_namespace | default('longhorn-system')] if longhorn_install_enabled | default(false) else [])
|
||||
+ ([traefik_dashboard_namespace | default('traefik')] if traefik_dashboard_exposure_enabled | default(false) else [])
|
||||
) | unique
|
||||
}}
|
||||
when: ensure_namespaces | default(true)
|
||||
|
||||
- name: Ensure selected namespaces exist
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: "{{ kubeconfig_path }}"
|
||||
state: present
|
||||
definition:
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: "{{ item }}"
|
||||
loop: "{{ managed_namespaces | default([]) }}"
|
||||
loop_control:
|
||||
label: "{{ item }}"
|
||||
when:
|
||||
- ensure_namespaces | default(true)
|
||||
- item | length > 0
|
||||
|
||||
- name: Add cert-manager Helm repository
|
||||
kubernetes.core.helm_repository:
|
||||
name: jetstack
|
||||
repo_url: https://charts.jetstack.io
|
||||
when: cert_manager_install_enabled | default(false)
|
||||
|
||||
- name: Install cert-manager
|
||||
kubernetes.core.helm:
|
||||
kubeconfig: "{{ kubeconfig_path }}"
|
||||
name: cert-manager
|
||||
chart_ref: jetstack/cert-manager
|
||||
chart_version: "<< cert_manager_chart_version | default('1.18.2') >>"
|
||||
release_namespace: "<< cert_manager_namespace | default('cert-manager') >>"
|
||||
create_namespace: true
|
||||
wait: true
|
||||
values:
|
||||
crds:
|
||||
enabled: true
|
||||
when: cert_manager_install_enabled | default(false)
|
||||
|
||||
- name: Create Cloudflare API token secret placeholder for cert-manager
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: "{{ kubeconfig_path }}"
|
||||
state: present
|
||||
definition:
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: "<< cert_manager_cloudflare_secret_name | default('cloudflare-api-token-secret') >>"
|
||||
namespace: "<< cert_manager_namespace | default('cert-manager') >>"
|
||||
type: Opaque
|
||||
stringData:
|
||||
<< cert_manager_cloudflare_secret_key | default('api-token') >>: "<< cert_manager_cloudflare_api_token | default('replace-me-with-your-cloudflare-api-token') >>"
|
||||
when: cert_manager_create_cloudflare_secret | default(false)
|
||||
|
||||
- name: Create cert-manager ClusterIssuer
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: "{{ kubeconfig_path }}"
|
||||
state: present
|
||||
definition:
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: "<< cert_manager_clusterissuer_name | default('letsencrypt-production') >>"
|
||||
spec:
|
||||
acme:
|
||||
email: "<< cert_manager_acme_email >>"
|
||||
server: "<< cert_manager_acme_server | default('https://acme-v02.api.letsencrypt.org/directory') >>"
|
||||
privateKeySecretRef:
|
||||
name: "<< cert_manager_clusterissuer_name | default('letsencrypt-production') >>-account-key"
|
||||
solvers:
|
||||
- dns01:
|
||||
cloudflare:
|
||||
apiTokenSecretRef:
|
||||
name: "<< cert_manager_cloudflare_secret_name | default('cloudflare-api-token-secret') >>"
|
||||
key: "<< cert_manager_cloudflare_secret_key | default('api-token') >>"
|
||||
when: cert_manager_clusterissuer_enabled | default(false)
|
||||
|
||||
- name: Add metrics-server Helm repository
|
||||
kubernetes.core.helm_repository:
|
||||
name: metrics-server
|
||||
repo_url: https://kubernetes-sigs.github.io/metrics-server/
|
||||
when: metrics_server_install_enabled | default(false)
|
||||
|
||||
- name: Install metrics-server
|
||||
kubernetes.core.helm:
|
||||
kubeconfig: "{{ kubeconfig_path }}"
|
||||
name: metrics-server
|
||||
chart_ref: metrics-server/metrics-server
|
||||
chart_version: "<< metrics_server_chart_version | default('3.13.0') >>"
|
||||
release_namespace: "<< metrics_server_namespace | default('kube-system') >>"
|
||||
create_namespace: true
|
||||
wait: true
|
||||
<%- if metrics_server_kubelet_insecure_tls %>
|
||||
values:
|
||||
args:
|
||||
- --kubelet-insecure-tls
|
||||
<%- endif %>
|
||||
when: metrics_server_install_enabled | default(false)
|
||||
|
||||
- name: Add Longhorn Helm repository
|
||||
kubernetes.core.helm_repository:
|
||||
name: longhorn
|
||||
repo_url: https://charts.longhorn.io
|
||||
when: longhorn_install_enabled | default(false)
|
||||
|
||||
- name: Install Longhorn
|
||||
kubernetes.core.helm:
|
||||
kubeconfig: "{{ kubeconfig_path }}"
|
||||
name: longhorn
|
||||
chart_ref: longhorn/longhorn
|
||||
chart_version: "<< longhorn_chart_version | default('1.9.1') >>"
|
||||
release_namespace: "<< longhorn_namespace | default('longhorn-system') >>"
|
||||
create_namespace: true
|
||||
wait: true
|
||||
values:
|
||||
defaultSettings:
|
||||
defaultDataPath: "<< longhorn_default_data_path | default('/var/lib/longhorn') >>"
|
||||
when: longhorn_install_enabled | default(false)
|
||||
|
||||
- name: Expose Traefik dashboard through an IngressRoute
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: "{{ kubeconfig_path }}"
|
||||
state: present
|
||||
definition:
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: traefik-dashboard
|
||||
namespace: "<< traefik_dashboard_namespace | default('traefik') >>"
|
||||
spec:
|
||||
entryPoints:
|
||||
- "<< traefik_dashboard_entrypoint | default('websecure') >>"
|
||||
routes:
|
||||
- match: "Host(`<< traefik_dashboard_host | default('traefik.example.internal') >>`)"
|
||||
kind: Rule
|
||||
<%- if traefik_dashboard_middleware_name %>
|
||||
middlewares:
|
||||
- name: "<< traefik_dashboard_middleware_name >>"
|
||||
namespace: "<< traefik_dashboard_middleware_namespace | default('traefik') >>"
|
||||
<%- endif %>
|
||||
services:
|
||||
- kind: TraefikService
|
||||
name: api@internal
|
||||
<%- if traefik_dashboard_tls_enabled %>
|
||||
tls:
|
||||
secretName: "<< traefik_dashboard_tls_secret_name | default('traefik-dashboard-tls') >>"
|
||||
<%- endif %>
|
||||
when: traefik_dashboard_exposure_enabled | default(false)
|
||||
|
||||
- name: Read kube-proxy ConfigMap before strictARP patch
|
||||
kubernetes.core.k8s_info:
|
||||
kubeconfig: "{{ kubeconfig_path }}"
|
||||
api_version: v1
|
||||
kind: ConfigMap
|
||||
namespace: kube-system
|
||||
name: kube-proxy
|
||||
register: kube_proxy_configmap
|
||||
when: kube_proxy_strict_arp_enabled | default(false)
|
||||
|
||||
- name: Build kube-proxy configuration with strictARP enabled
|
||||
ansible.builtin.set_fact:
|
||||
kube_proxy_rendered_config: >-
|
||||
{{
|
||||
(kube_proxy_configmap.resources[0].data['config.conf'] | from_yaml)
|
||||
| combine(
|
||||
{
|
||||
'ipvs': (
|
||||
(kube_proxy_configmap.resources[0].data['config.conf'] | from_yaml).ipvs
|
||||
| default({})
|
||||
| combine({'strictARP': true})
|
||||
)
|
||||
},
|
||||
recursive=True
|
||||
)
|
||||
}}
|
||||
when:
|
||||
- kube_proxy_strict_arp_enabled | default(false)
|
||||
- kube_proxy_configmap.resources | length > 0
|
||||
|
||||
- name: Patch kube-proxy ConfigMap with strictARP enabled
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: "{{ kubeconfig_path }}"
|
||||
state: present
|
||||
merge_type:
|
||||
- merge
|
||||
definition:
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: kube-proxy
|
||||
namespace: kube-system
|
||||
data:
|
||||
config.conf: "{{ kube_proxy_rendered_config | to_nice_yaml(indent=2) }}"
|
||||
when:
|
||||
- kube_proxy_strict_arp_enabled | default(false)
|
||||
- kube_proxy_configmap.resources | length > 0
|
||||
|
||||
- name: Read kube-proxy daemonset for restart
|
||||
kubernetes.core.k8s_info:
|
||||
kubeconfig: "{{ kubeconfig_path }}"
|
||||
api_version: apps/v1
|
||||
kind: DaemonSet
|
||||
namespace: kube-system
|
||||
name: kube-proxy
|
||||
register: kube_proxy_daemonset
|
||||
when: kube_proxy_strict_arp_enabled | default(false)
|
||||
|
||||
- name: Restart kube-proxy daemonset after strictARP change
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: "{{ kubeconfig_path }}"
|
||||
state: present
|
||||
merge_type:
|
||||
- merge
|
||||
definition:
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: kube-proxy
|
||||
namespace: kube-system
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
homelab.boilerplates.io/restarted-at: "{{ lookup('pipe', 'date -u +%Y-%m-%dT%H:%M:%SZ') }}"
|
||||
when:
|
||||
- kube_proxy_strict_arp_enabled | default(false)
|
||||
- kube_proxy_daemonset.resources | length > 0
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
@@ -0,0 +1,527 @@
|
||||
{
|
||||
"slug": "k3s-postinstall",
|
||||
"kind": "ansible",
|
||||
"metadata": {
|
||||
"name": "K3s Post-Install Platform Setup",
|
||||
"description": "Configures common post-install building blocks for a fresh K3s cluster. Supports kubeconfig retrieval, namespace management, Traefik dashboard exposure, cert-manager bootstrap, metrics-server, Longhorn preparation, and optional kube-system tuning.",
|
||||
"tags": [
|
||||
"kubernetes",
|
||||
"k3s",
|
||||
"postinstall",
|
||||
"helm",
|
||||
"homelab"
|
||||
],
|
||||
"icon": {
|
||||
"provider": "simple-icons",
|
||||
"id": "kubernetes"
|
||||
},
|
||||
"draft": false,
|
||||
"version": {
|
||||
"name": "1.0.0",
|
||||
"source_dep_name": "manual/k3s-postinstall"
|
||||
}
|
||||
},
|
||||
"variables": [
|
||||
{
|
||||
"title": "Execution",
|
||||
"name": "execution",
|
||||
"items": [
|
||||
{
|
||||
"name": "secrets_file",
|
||||
"type": "str",
|
||||
"title": "Secrets File",
|
||||
"required": false,
|
||||
"default": "",
|
||||
"description": "Optional vars file to load before running the playbook."
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Kubeconfig",
|
||||
"name": "kubeconfig",
|
||||
"items": [
|
||||
{
|
||||
"name": "fetch_kubeconfig",
|
||||
"type": "bool",
|
||||
"title": "Fetch Kubeconfig",
|
||||
"required": false,
|
||||
"default": true,
|
||||
"description": "Fetch the admin kubeconfig from the first K3s server before applying cluster resources"
|
||||
},
|
||||
{
|
||||
"name": "kubeconfig_source_host",
|
||||
"type": "str",
|
||||
"title": "Source Host",
|
||||
"required": false,
|
||||
"default": "k3s-server-01",
|
||||
"description": "Inventory host that stores the K3s admin kubeconfig",
|
||||
"needs": [
|
||||
"fetch_kubeconfig=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "k3s-server-01"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubeconfig_source_path",
|
||||
"type": "str",
|
||||
"title": "Source Path",
|
||||
"required": false,
|
||||
"default": "/etc/rancher/k3s/k3s.yaml",
|
||||
"description": "Path to the kubeconfig file on the K3s server",
|
||||
"needs": [
|
||||
"fetch_kubeconfig=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "/etc/rancher/k3s/k3s.yaml"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubeconfig_server_endpoint",
|
||||
"type": "str",
|
||||
"title": "API Endpoint",
|
||||
"required": false,
|
||||
"default": "{{ hostvars['k3s-server-01'].ansible_host | default('k3s-server-01') }}",
|
||||
"description": "Host or IP that should replace 127.0.0.1 in the fetched kubeconfig",
|
||||
"needs": [
|
||||
"fetch_kubeconfig=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "192.168.1.10"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "kubeconfig_local_path",
|
||||
"type": "str",
|
||||
"title": "Local Kubeconfig",
|
||||
"required": false,
|
||||
"default": "{{ lookup('env', 'HOME') }}/.kube/k3s.yaml",
|
||||
"description": "Local kubeconfig path used by the control machine for all cluster operations",
|
||||
"config": {
|
||||
"placeholder": "{{ lookup('env', 'HOME') }}/.kube/k3s.yaml"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Namespaces",
|
||||
"name": "namespaces",
|
||||
"items": [
|
||||
{
|
||||
"name": "ensure_namespaces",
|
||||
"type": "bool",
|
||||
"title": "Manage Namespaces",
|
||||
"required": false,
|
||||
"default": true,
|
||||
"description": "Ensure common namespaces exist before installing platform add-ons"
|
||||
},
|
||||
{
|
||||
"name": "extra_namespaces_yaml",
|
||||
"type": "str",
|
||||
"title": "Extra Namespaces",
|
||||
"required": false,
|
||||
"default": "[]",
|
||||
"description": "YAML list of extra namespaces to create",
|
||||
"needs": [
|
||||
"ensure_namespaces=true"
|
||||
],
|
||||
"config": {
|
||||
"textarea": true,
|
||||
"placeholder": "- apps\n- monitoring"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Traefik",
|
||||
"name": "traefik",
|
||||
"items": [
|
||||
{
|
||||
"name": "traefik_dashboard_exposure_enabled",
|
||||
"type": "bool",
|
||||
"title": "Expose Dashboard",
|
||||
"required": false,
|
||||
"default": false,
|
||||
"description": "Create a Traefik IngressRoute that exposes the internal Traefik dashboard"
|
||||
},
|
||||
{
|
||||
"name": "traefik_dashboard_namespace",
|
||||
"type": "str",
|
||||
"title": "Namespace",
|
||||
"required": false,
|
||||
"default": "traefik",
|
||||
"description": "Namespace where the Traefik release is installed",
|
||||
"needs": [
|
||||
"traefik_dashboard_exposure_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "traefik"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "traefik_dashboard_host",
|
||||
"type": "str",
|
||||
"title": "Dashboard Host",
|
||||
"required": false,
|
||||
"default": "traefik.example.internal",
|
||||
"description": "FQDN used to expose the Traefik dashboard",
|
||||
"needs": [
|
||||
"traefik_dashboard_exposure_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "traefik.example.internal"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "traefik_dashboard_entrypoint",
|
||||
"type": "str",
|
||||
"title": "Entrypoint",
|
||||
"required": false,
|
||||
"default": "websecure",
|
||||
"description": "Traefik entrypoint for the dashboard route",
|
||||
"needs": [
|
||||
"traefik_dashboard_exposure_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "websecure"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "traefik_dashboard_tls_enabled",
|
||||
"type": "bool",
|
||||
"title": "TLS",
|
||||
"required": false,
|
||||
"default": true,
|
||||
"needs": [
|
||||
"traefik_dashboard_exposure_enabled=true"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "traefik_dashboard_tls_secret_name",
|
||||
"type": "str",
|
||||
"title": "TLS Secret",
|
||||
"required": false,
|
||||
"default": "traefik-dashboard-tls",
|
||||
"description": "TLS secret used by the dashboard route when TLS is enabled",
|
||||
"needs": [
|
||||
"traefik_dashboard_exposure_enabled=true",
|
||||
"traefik_dashboard_tls_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "traefik-dashboard-tls"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "traefik_dashboard_middleware_name",
|
||||
"type": "str",
|
||||
"title": "Middleware",
|
||||
"required": false,
|
||||
"default": "",
|
||||
"description": "Optional Traefik middleware name attached to the dashboard route",
|
||||
"needs": [
|
||||
"traefik_dashboard_exposure_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "traefik-dashboard-auth"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "traefik_dashboard_middleware_namespace",
|
||||
"type": "str",
|
||||
"title": "Middleware NS",
|
||||
"required": false,
|
||||
"default": "traefik",
|
||||
"needs": [
|
||||
"traefik_dashboard_exposure_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "traefik"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Cert-Manager",
|
||||
"name": "cert-manager",
|
||||
"items": [
|
||||
{
|
||||
"name": "cert_manager_install_enabled",
|
||||
"type": "bool",
|
||||
"title": "Install cert-manager",
|
||||
"required": false,
|
||||
"default": false
|
||||
},
|
||||
{
|
||||
"name": "cert_manager_chart_version",
|
||||
"type": "str",
|
||||
"title": "Chart Version",
|
||||
"required": false,
|
||||
"default": "1.18.2",
|
||||
"needs": [
|
||||
"cert_manager_install_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "1.18.2"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "cert_manager_namespace",
|
||||
"type": "str",
|
||||
"title": "Namespace",
|
||||
"required": false,
|
||||
"default": "cert-manager",
|
||||
"config": {
|
||||
"placeholder": "cert-manager"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "cert_manager_create_cloudflare_secret",
|
||||
"type": "bool",
|
||||
"title": "Cloudflare Secret",
|
||||
"required": false,
|
||||
"default": false,
|
||||
"description": "Create a placeholder secret for a Cloudflare DNS API token"
|
||||
},
|
||||
{
|
||||
"name": "cert_manager_cloudflare_secret_name",
|
||||
"type": "str",
|
||||
"title": "Secret Name",
|
||||
"required": false,
|
||||
"default": "cloudflare-api-token-secret",
|
||||
"description": "Secret name for the Cloudflare DNS API token",
|
||||
"needs": [
|
||||
"cert_manager_create_cloudflare_secret=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "cloudflare-api-token-secret"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "cert_manager_cloudflare_secret_key",
|
||||
"type": "str",
|
||||
"title": "Secret Key",
|
||||
"required": false,
|
||||
"default": "api-token",
|
||||
"description": "Secret key that stores the Cloudflare API token",
|
||||
"needs": [
|
||||
"cert_manager_create_cloudflare_secret=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "api-token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "cert_manager_cloudflare_api_token",
|
||||
"type": "secret",
|
||||
"title": "Cloudflare Token",
|
||||
"required": false,
|
||||
"default": "",
|
||||
"description": "Optional Cloudflare API token value used to populate the placeholder secret",
|
||||
"needs": [
|
||||
"cert_manager_create_cloudflare_secret=true"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "cert_manager_clusterissuer_enabled",
|
||||
"type": "bool",
|
||||
"title": "ClusterIssuer",
|
||||
"required": false,
|
||||
"default": false,
|
||||
"description": "Create a production Let's Encrypt ClusterIssuer that uses Cloudflare DNS-01"
|
||||
},
|
||||
{
|
||||
"name": "cert_manager_clusterissuer_name",
|
||||
"type": "str",
|
||||
"title": "ClusterIssuer Name",
|
||||
"required": false,
|
||||
"default": "letsencrypt-production",
|
||||
"needs": [
|
||||
"cert_manager_clusterissuer_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "letsencrypt-production"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "cert_manager_acme_email",
|
||||
"type": "str",
|
||||
"title": "ACME Email",
|
||||
"required": false,
|
||||
"default": "",
|
||||
"description": "Email address used for ACME registration",
|
||||
"needs": [
|
||||
"cert_manager_clusterissuer_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "me@example.com"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "cert_manager_acme_server",
|
||||
"type": "str",
|
||||
"title": "ACME Server",
|
||||
"required": false,
|
||||
"default": "https://acme-v02.api.letsencrypt.org/directory",
|
||||
"description": "ACME directory URL used by the ClusterIssuer",
|
||||
"needs": [
|
||||
"cert_manager_clusterissuer_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "https://acme-v02.api.letsencrypt.org/directory"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Metrics Server",
|
||||
"name": "metrics-server",
|
||||
"items": [
|
||||
{
|
||||
"name": "metrics_server_install_enabled",
|
||||
"type": "bool",
|
||||
"title": "Install Metrics Server",
|
||||
"required": false,
|
||||
"default": false
|
||||
},
|
||||
{
|
||||
"name": "metrics_server_chart_version",
|
||||
"type": "str",
|
||||
"title": "Chart Version",
|
||||
"required": false,
|
||||
"default": "3.13.0",
|
||||
"needs": [
|
||||
"metrics_server_install_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "3.13.0"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "metrics_server_namespace",
|
||||
"type": "str",
|
||||
"title": "Namespace",
|
||||
"required": false,
|
||||
"default": "kube-system",
|
||||
"needs": [
|
||||
"metrics_server_install_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "kube-system"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "metrics_server_kubelet_insecure_tls",
|
||||
"type": "bool",
|
||||
"title": "Insecure TLS",
|
||||
"required": false,
|
||||
"default": true,
|
||||
"description": "Add --kubelet-insecure-tls for clusters that use self-signed kubelet certificates",
|
||||
"needs": [
|
||||
"metrics_server_install_enabled=true"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Longhorn",
|
||||
"name": "longhorn",
|
||||
"items": [
|
||||
{
|
||||
"name": "longhorn_prerequisites_enabled",
|
||||
"type": "bool",
|
||||
"title": "Prepare Nodes",
|
||||
"required": false,
|
||||
"default": false,
|
||||
"description": "Install host packages and kernel module configuration needed by Longhorn"
|
||||
},
|
||||
{
|
||||
"name": "longhorn_node_hosts",
|
||||
"type": "str",
|
||||
"title": "Node Hosts",
|
||||
"required": false,
|
||||
"default": "k3s_cluster",
|
||||
"description": "Inventory host pattern for the nodes that should be prepared for Longhorn",
|
||||
"needs": [
|
||||
"longhorn_prerequisites_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "k3s_cluster"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "longhorn_disable_multipathd",
|
||||
"type": "bool",
|
||||
"title": "Disable multipathd",
|
||||
"required": false,
|
||||
"default": false,
|
||||
"description": "Stop and disable multipathd if your nodes do not use multipath storage",
|
||||
"needs": [
|
||||
"longhorn_prerequisites_enabled=true"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "longhorn_install_enabled",
|
||||
"type": "bool",
|
||||
"title": "Install Longhorn",
|
||||
"required": false,
|
||||
"default": false,
|
||||
"description": "Install Longhorn with Helm after prerequisites are in place"
|
||||
},
|
||||
{
|
||||
"name": "longhorn_chart_version",
|
||||
"type": "str",
|
||||
"title": "Chart Version",
|
||||
"required": false,
|
||||
"default": "1.9.1",
|
||||
"needs": [
|
||||
"longhorn_install_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "1.9.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "longhorn_namespace",
|
||||
"type": "str",
|
||||
"title": "Namespace",
|
||||
"required": false,
|
||||
"default": "longhorn-system",
|
||||
"needs": [
|
||||
"longhorn_install_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "longhorn-system"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "longhorn_default_data_path",
|
||||
"type": "str",
|
||||
"title": "Data Path",
|
||||
"required": false,
|
||||
"default": "/var/lib/longhorn",
|
||||
"description": "Default host path used by Longhorn for replica data",
|
||||
"needs": [
|
||||
"longhorn_install_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "/var/lib/longhorn"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Kube-System",
|
||||
"name": "kube-system",
|
||||
"items": [
|
||||
{
|
||||
"name": "kube_proxy_strict_arp_enabled",
|
||||
"type": "bool",
|
||||
"title": "Enable strictARP",
|
||||
"required": false,
|
||||
"default": false,
|
||||
"description": "Patch the kube-proxy ConfigMap and restart the daemonset with strictARP enabled"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user