528 lines
15 KiB
JSON
528 lines
15 KiB
JSON
{
|
|
"slug": "k3s-postinstall",
|
|
"kind": "ansible",
|
|
"metadata": {
|
|
"name": "K3s Post-Install Platform Setup",
|
|
"description": "Configures common post-install building blocks for a fresh K3s cluster. Supports kubeconfig retrieval, namespace management, Traefik dashboard exposure, cert-manager bootstrap, metrics-server, Longhorn preparation, and optional kube-system tuning.",
|
|
"tags": [
|
|
"kubernetes",
|
|
"k3s",
|
|
"postinstall",
|
|
"helm",
|
|
"homelab"
|
|
],
|
|
"icon": {
|
|
"provider": "simple-icons",
|
|
"id": "kubernetes"
|
|
},
|
|
"draft": false,
|
|
"version": {
|
|
"name": "1.0.0",
|
|
"source_dep_name": "manual/k3s-postinstall"
|
|
}
|
|
},
|
|
"variables": [
|
|
{
|
|
"title": "Execution",
|
|
"name": "execution",
|
|
"items": [
|
|
{
|
|
"name": "secrets_file",
|
|
"type": "str",
|
|
"title": "Secrets File",
|
|
"required": false,
|
|
"default": "",
|
|
"description": "Optional vars file to load before running the playbook."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"title": "Kubeconfig",
|
|
"name": "kubeconfig",
|
|
"items": [
|
|
{
|
|
"name": "fetch_kubeconfig",
|
|
"type": "bool",
|
|
"title": "Fetch Kubeconfig",
|
|
"required": false,
|
|
"default": true,
|
|
"description": "Fetch the admin kubeconfig from the first K3s server before applying cluster resources"
|
|
},
|
|
{
|
|
"name": "kubeconfig_source_host",
|
|
"type": "str",
|
|
"title": "Source Host",
|
|
"required": false,
|
|
"default": "k3s-server-01",
|
|
"description": "Inventory host that stores the K3s admin kubeconfig",
|
|
"needs": [
|
|
"fetch_kubeconfig=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "k3s-server-01"
|
|
}
|
|
},
|
|
{
|
|
"name": "kubeconfig_source_path",
|
|
"type": "str",
|
|
"title": "Source Path",
|
|
"required": false,
|
|
"default": "/etc/rancher/k3s/k3s.yaml",
|
|
"description": "Path to the kubeconfig file on the K3s server",
|
|
"needs": [
|
|
"fetch_kubeconfig=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "/etc/rancher/k3s/k3s.yaml"
|
|
}
|
|
},
|
|
{
|
|
"name": "kubeconfig_server_endpoint",
|
|
"type": "str",
|
|
"title": "API Endpoint",
|
|
"required": false,
|
|
"default": "{{ hostvars['k3s-server-01'].ansible_host | default('k3s-server-01') }}",
|
|
"description": "Host or IP that should replace 127.0.0.1 in the fetched kubeconfig",
|
|
"needs": [
|
|
"fetch_kubeconfig=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "192.168.1.10"
|
|
}
|
|
},
|
|
{
|
|
"name": "kubeconfig_local_path",
|
|
"type": "str",
|
|
"title": "Local Kubeconfig",
|
|
"required": false,
|
|
"default": "{{ lookup('env', 'HOME') }}/.kube/k3s.yaml",
|
|
"description": "Local kubeconfig path used by the control machine for all cluster operations",
|
|
"config": {
|
|
"placeholder": "{{ lookup('env', 'HOME') }}/.kube/k3s.yaml"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"title": "Namespaces",
|
|
"name": "namespaces",
|
|
"items": [
|
|
{
|
|
"name": "ensure_namespaces",
|
|
"type": "bool",
|
|
"title": "Manage Namespaces",
|
|
"required": false,
|
|
"default": true,
|
|
"description": "Ensure common namespaces exist before installing platform add-ons"
|
|
},
|
|
{
|
|
"name": "extra_namespaces_yaml",
|
|
"type": "str",
|
|
"title": "Extra Namespaces",
|
|
"required": false,
|
|
"default": "[]",
|
|
"description": "YAML list of extra namespaces to create",
|
|
"needs": [
|
|
"ensure_namespaces=true"
|
|
],
|
|
"config": {
|
|
"textarea": true,
|
|
"placeholder": "- apps\n- monitoring"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"title": "Traefik",
|
|
"name": "traefik",
|
|
"items": [
|
|
{
|
|
"name": "traefik_dashboard_exposure_enabled",
|
|
"type": "bool",
|
|
"title": "Expose Dashboard",
|
|
"required": false,
|
|
"default": false,
|
|
"description": "Create a Traefik IngressRoute that exposes the internal Traefik dashboard"
|
|
},
|
|
{
|
|
"name": "traefik_dashboard_namespace",
|
|
"type": "str",
|
|
"title": "Namespace",
|
|
"required": false,
|
|
"default": "traefik",
|
|
"description": "Namespace where the Traefik release is installed",
|
|
"needs": [
|
|
"traefik_dashboard_exposure_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "traefik"
|
|
}
|
|
},
|
|
{
|
|
"name": "traefik_dashboard_host",
|
|
"type": "str",
|
|
"title": "Dashboard Host",
|
|
"required": false,
|
|
"default": "traefik.example.internal",
|
|
"description": "FQDN used to expose the Traefik dashboard",
|
|
"needs": [
|
|
"traefik_dashboard_exposure_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "traefik.example.internal"
|
|
}
|
|
},
|
|
{
|
|
"name": "traefik_dashboard_entrypoint",
|
|
"type": "str",
|
|
"title": "Entrypoint",
|
|
"required": false,
|
|
"default": "websecure",
|
|
"description": "Traefik entrypoint for the dashboard route",
|
|
"needs": [
|
|
"traefik_dashboard_exposure_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "websecure"
|
|
}
|
|
},
|
|
{
|
|
"name": "traefik_dashboard_tls_enabled",
|
|
"type": "bool",
|
|
"title": "TLS",
|
|
"required": false,
|
|
"default": true,
|
|
"needs": [
|
|
"traefik_dashboard_exposure_enabled=true"
|
|
]
|
|
},
|
|
{
|
|
"name": "traefik_dashboard_tls_secret_name",
|
|
"type": "str",
|
|
"title": "TLS Secret",
|
|
"required": false,
|
|
"default": "traefik-dashboard-tls",
|
|
"description": "TLS secret used by the dashboard route when TLS is enabled",
|
|
"needs": [
|
|
"traefik_dashboard_exposure_enabled=true",
|
|
"traefik_dashboard_tls_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "traefik-dashboard-tls"
|
|
}
|
|
},
|
|
{
|
|
"name": "traefik_dashboard_middleware_name",
|
|
"type": "str",
|
|
"title": "Middleware",
|
|
"required": false,
|
|
"default": "",
|
|
"description": "Optional Traefik middleware name attached to the dashboard route",
|
|
"needs": [
|
|
"traefik_dashboard_exposure_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "traefik-dashboard-auth"
|
|
}
|
|
},
|
|
{
|
|
"name": "traefik_dashboard_middleware_namespace",
|
|
"type": "str",
|
|
"title": "Middleware NS",
|
|
"required": false,
|
|
"default": "traefik",
|
|
"needs": [
|
|
"traefik_dashboard_exposure_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "traefik"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"title": "Cert-Manager",
|
|
"name": "cert-manager",
|
|
"items": [
|
|
{
|
|
"name": "cert_manager_install_enabled",
|
|
"type": "bool",
|
|
"title": "Install cert-manager",
|
|
"required": false,
|
|
"default": false
|
|
},
|
|
{
|
|
"name": "cert_manager_chart_version",
|
|
"type": "str",
|
|
"title": "Chart Version",
|
|
"required": false,
|
|
"default": "1.18.2",
|
|
"needs": [
|
|
"cert_manager_install_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "1.18.2"
|
|
}
|
|
},
|
|
{
|
|
"name": "cert_manager_namespace",
|
|
"type": "str",
|
|
"title": "Namespace",
|
|
"required": false,
|
|
"default": "cert-manager",
|
|
"config": {
|
|
"placeholder": "cert-manager"
|
|
}
|
|
},
|
|
{
|
|
"name": "cert_manager_create_cloudflare_secret",
|
|
"type": "bool",
|
|
"title": "Cloudflare Secret",
|
|
"required": false,
|
|
"default": false,
|
|
"description": "Create a placeholder secret for a Cloudflare DNS API token"
|
|
},
|
|
{
|
|
"name": "cert_manager_cloudflare_secret_name",
|
|
"type": "str",
|
|
"title": "Secret Name",
|
|
"required": false,
|
|
"default": "cloudflare-api-token-secret",
|
|
"description": "Secret name for the Cloudflare DNS API token",
|
|
"needs": [
|
|
"cert_manager_create_cloudflare_secret=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "cloudflare-api-token-secret"
|
|
}
|
|
},
|
|
{
|
|
"name": "cert_manager_cloudflare_secret_key",
|
|
"type": "str",
|
|
"title": "Secret Key",
|
|
"required": false,
|
|
"default": "api-token",
|
|
"description": "Secret key that stores the Cloudflare API token",
|
|
"needs": [
|
|
"cert_manager_create_cloudflare_secret=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "api-token"
|
|
}
|
|
},
|
|
{
|
|
"name": "cert_manager_cloudflare_api_token",
|
|
"type": "secret",
|
|
"title": "Cloudflare Token",
|
|
"required": false,
|
|
"default": "",
|
|
"description": "Optional Cloudflare API token value used to populate the placeholder secret",
|
|
"needs": [
|
|
"cert_manager_create_cloudflare_secret=true"
|
|
]
|
|
},
|
|
{
|
|
"name": "cert_manager_clusterissuer_enabled",
|
|
"type": "bool",
|
|
"title": "ClusterIssuer",
|
|
"required": false,
|
|
"default": false,
|
|
"description": "Create a production Let's Encrypt ClusterIssuer that uses Cloudflare DNS-01"
|
|
},
|
|
{
|
|
"name": "cert_manager_clusterissuer_name",
|
|
"type": "str",
|
|
"title": "ClusterIssuer Name",
|
|
"required": false,
|
|
"default": "letsencrypt-production",
|
|
"needs": [
|
|
"cert_manager_clusterissuer_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "letsencrypt-production"
|
|
}
|
|
},
|
|
{
|
|
"name": "cert_manager_acme_email",
|
|
"type": "str",
|
|
"title": "ACME Email",
|
|
"required": false,
|
|
"default": "",
|
|
"description": "Email address used for ACME registration",
|
|
"needs": [
|
|
"cert_manager_clusterissuer_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "me@example.com"
|
|
}
|
|
},
|
|
{
|
|
"name": "cert_manager_acme_server",
|
|
"type": "str",
|
|
"title": "ACME Server",
|
|
"required": false,
|
|
"default": "https://acme-v02.api.letsencrypt.org/directory",
|
|
"description": "ACME directory URL used by the ClusterIssuer",
|
|
"needs": [
|
|
"cert_manager_clusterissuer_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "https://acme-v02.api.letsencrypt.org/directory"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"title": "Metrics Server",
|
|
"name": "metrics-server",
|
|
"items": [
|
|
{
|
|
"name": "metrics_server_install_enabled",
|
|
"type": "bool",
|
|
"title": "Install Metrics Server",
|
|
"required": false,
|
|
"default": false
|
|
},
|
|
{
|
|
"name": "metrics_server_chart_version",
|
|
"type": "str",
|
|
"title": "Chart Version",
|
|
"required": false,
|
|
"default": "3.13.0",
|
|
"needs": [
|
|
"metrics_server_install_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "3.13.0"
|
|
}
|
|
},
|
|
{
|
|
"name": "metrics_server_namespace",
|
|
"type": "str",
|
|
"title": "Namespace",
|
|
"required": false,
|
|
"default": "kube-system",
|
|
"needs": [
|
|
"metrics_server_install_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "kube-system"
|
|
}
|
|
},
|
|
{
|
|
"name": "metrics_server_kubelet_insecure_tls",
|
|
"type": "bool",
|
|
"title": "Insecure TLS",
|
|
"required": false,
|
|
"default": true,
|
|
"description": "Add --kubelet-insecure-tls for clusters that use self-signed kubelet certificates",
|
|
"needs": [
|
|
"metrics_server_install_enabled=true"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"title": "Longhorn",
|
|
"name": "longhorn",
|
|
"items": [
|
|
{
|
|
"name": "longhorn_prerequisites_enabled",
|
|
"type": "bool",
|
|
"title": "Prepare Nodes",
|
|
"required": false,
|
|
"default": false,
|
|
"description": "Install host packages and kernel module configuration needed by Longhorn"
|
|
},
|
|
{
|
|
"name": "longhorn_node_hosts",
|
|
"type": "str",
|
|
"title": "Node Hosts",
|
|
"required": false,
|
|
"default": "k3s_cluster",
|
|
"description": "Inventory host pattern for the nodes that should be prepared for Longhorn",
|
|
"needs": [
|
|
"longhorn_prerequisites_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "k3s_cluster"
|
|
}
|
|
},
|
|
{
|
|
"name": "longhorn_disable_multipathd",
|
|
"type": "bool",
|
|
"title": "Disable multipathd",
|
|
"required": false,
|
|
"default": false,
|
|
"description": "Stop and disable multipathd if your nodes do not use multipath storage",
|
|
"needs": [
|
|
"longhorn_prerequisites_enabled=true"
|
|
]
|
|
},
|
|
{
|
|
"name": "longhorn_install_enabled",
|
|
"type": "bool",
|
|
"title": "Install Longhorn",
|
|
"required": false,
|
|
"default": false,
|
|
"description": "Install Longhorn with Helm after prerequisites are in place"
|
|
},
|
|
{
|
|
"name": "longhorn_chart_version",
|
|
"type": "str",
|
|
"title": "Chart Version",
|
|
"required": false,
|
|
"default": "1.9.1",
|
|
"needs": [
|
|
"longhorn_install_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "1.9.1"
|
|
}
|
|
},
|
|
{
|
|
"name": "longhorn_namespace",
|
|
"type": "str",
|
|
"title": "Namespace",
|
|
"required": false,
|
|
"default": "longhorn-system",
|
|
"needs": [
|
|
"longhorn_install_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "longhorn-system"
|
|
}
|
|
},
|
|
{
|
|
"name": "longhorn_default_data_path",
|
|
"type": "str",
|
|
"title": "Data Path",
|
|
"required": false,
|
|
"default": "/var/lib/longhorn",
|
|
"description": "Default host path used by Longhorn for replica data",
|
|
"needs": [
|
|
"longhorn_install_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "/var/lib/longhorn"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"title": "Kube-System",
|
|
"name": "kube-system",
|
|
"items": [
|
|
{
|
|
"name": "kube_proxy_strict_arp_enabled",
|
|
"type": "bool",
|
|
"title": "Enable strictARP",
|
|
"required": false,
|
|
"default": false,
|
|
"description": "Patch the kube-proxy ConfigMap and restart the daemonset with strictARP enabled"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|