Unverified Commit 565c9fa0 authored by Derek Nola's avatar Derek Nola
Browse files

Enforce use of a defined token. Simplifies additional server and agent joining process. 



Signed-off-by: default avatarDerek Nola <derek.nola@suse.com>
parent 9ecdc933

Vagrantfile

+8 −8
Original line number Diff line number Diff line
@@ -9,13 +9,16 @@ NETWORK_PREFIX = "10.10.10" 
def provision(vm, role, node_num)

  vm.box = NODE_BOXES[node_num]

  vm.hostname = role

  # An expanded netmask is required to allow VM<-->VM communication, virtualbox defaults to /32

  # We use a private network because the default IPs are dynamicly assigned 

  # during provisioning. This makes it impossible to know the server-0 IP when 

  # provisioning subsequent servers and agents. A private network allows us to

  # assign static IPs to each node, and thus provide a known IP for the API endpoint.

  node_ip = "#{NETWORK_PREFIX}.#{100+node_num}"

  # An expanded netmask is required to allow VM<-->VM communication, virtualbox defaults to /32

  vm.network "private_network", ip: node_ip, netmask: "255.255.255.0"



  vm.provision "ansible", run: 'once' do |ansible|

    ansible.compatibility_mode = "2.0"

    ansible.verbose = "vv"

    ansible.playbook = "playbook/site.yml"

    ansible.groups = {

      "server" => NODE_ROLES.grep(/^server/),
@@ -25,13 +28,12 @@ def provision(vm, role, node_num) 
    ansible.extra_vars = {

      k3s_version: "v1.26.5+k3s1",

      api_endpoint: "#{NETWORK_PREFIX}.100",

      api_port: 6443,

      extra_server_args: "",

      extra_server_init_args: "",

      token: "myyagrant",

      # Required to use the private network configured above

      extra_server_args: "--node-external-ip #{node_ip} --flannel-iface eth1", 

      extra_agent_args: "",

    }

  end



end



Vagrant.configure("2") do |config|
@@ -45,8 +47,6 @@ Vagrant.configure("2") do |config| 
    v.memory = NODE_MEMORY

  end

  

  # Must iterate on the index, vagrant does not understand iterating 

  # over the node roles themselves

  NODE_ROLES.each_with_index do |name, i|

    config.vm.define name do |node|

      provision(node.vm, name, i)

inventory-sample.yml

+2 −2
Original line number Diff line number Diff line
@@ -14,12 +14,12 @@ k3s_cluster: 
    ansible_port: 22

    ansible_user: debian

    k3s_version: v1.25.5+k3s2

    token: "mytoken"  # Use ansible vault if you want to keep it secret

    api_endpoint: "{{ hostvars[groups['server'][0]]['ansible_host'] | default(groups['server'][0]) }}"

    api_port: 6443

    extra_server_args: ""

    extra_server_init_args: ""

    extra_agent_args: ""



  # Optional vars

    # api_port: 6443

    # k3s_server_location: /var/lib/rancher/k3s

    # systemd_dir: /etc/systemd/system

roles/k3s/agent/defaults/main.yml

+1 −0
Original line number Diff line number Diff line 
---

k3s_server_location: "/var/lib/rancher/k3s"

systemd_dir: "/etc/systemd/system"

api_port: 6443

roles/k3s/agent/templates/k3s-agent.service.j2

+1 −1
Original line number Diff line number Diff line
@@ -7,7 +7,7 @@ After=network-online.target 
Type=notify

ExecStartPre=-/sbin/modprobe br_netfilter

ExecStartPre=-/sbin/modprobe overlay

ExecStart=/usr/local/bin/k3s agent --data-dir {{ k3s_server_location }} --server https://{{ api_endpoint }}:{{ api_port }} --token {{ hostvars[groups['server'][0]]['token'] }} {{ extra_agent_args }}

ExecStart=/usr/local/bin/k3s agent --data-dir {{ k3s_server_location }} --server https://{{ api_endpoint }}:{{ api_port }} --token {{ token }} {{ extra_agent_args }}

KillMode=process

Delegate=yes

# Having non-zero Limit*s causes performance problems due to accounting overhead

roles/k3s/server/defaults/main.yml

+1 −0
Original line number Diff line number Diff line 
---

k3s_server_location: "/var/lib/rancher/k3s"

systemd_dir: "/etc/systemd/system"

api_port: 6443