K3s deploy on Rpis -- Rancher will live in Node
This commit is contained in:
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,213 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Downloaded via `curl -sfL https://get.rancher.io`
|
||||
|
||||
set -e
|
||||
|
||||
if [ "${DEBUG}" = 1 ]; then
|
||||
set -x
|
||||
fi
|
||||
|
||||
# Usage:
|
||||
# curl ... | ENV_VAR=... sh -
|
||||
# or
|
||||
# ENV_VAR=... ./install.sh
|
||||
#
|
||||
# Environment variables:
|
||||
#
|
||||
# - INSTALL_RANCHERD_CHANNEL
|
||||
# Channel to use for fetching RANCHERD download URL.
|
||||
# Defaults to 'testing'.
|
||||
#
|
||||
# - INSTALL_RANCHERD_TYPE
|
||||
# Type of RANCHERD service. Can be either "server" or "agent".
|
||||
# Default is "server".
|
||||
#
|
||||
# - INSTALL_RANCHERD_VERSION
|
||||
# Version of RANCHERD to download from github.
|
||||
#
|
||||
# info logs the given argument at info log level.
|
||||
info() {
|
||||
echo "[INFO] " "$@"
|
||||
}
|
||||
|
||||
# warn logs the given argument at warn log level.
|
||||
warn() {
|
||||
echo "[WARN] " "$@" >&2
|
||||
}
|
||||
|
||||
# fatal logs the given argument at fatal log level.
|
||||
fatal() {
|
||||
echo "[ERROR] " "$@" >&2
|
||||
if [ -n "${SUFFIX}" ]; then
|
||||
echo "[ALT] Please visit 'https://github.com/rancher/rancher/releases' directly and download the latest rancherd-installer.${SUFFIX}.run" >&2
|
||||
fi
|
||||
exit 1
|
||||
}
|
||||
|
||||
# setup_env defines needed environment variables.
|
||||
setup_env() {
|
||||
INSTALL_RANCHERD_GITHUB_URL="https://github.com/rancher/rancher"
|
||||
# --- bail if we are not root ---
|
||||
if [ ! $(id -u) -eq 0 ]; then
|
||||
fatal "You need to be root to perform this install"
|
||||
fi
|
||||
|
||||
# --- make sure install channel has a value
|
||||
if [ -z "${INSTALL_RANCHERD_CHANNEL}" ]; then
|
||||
INSTALL_RANCHERD_CHANNEL="v2.5"
|
||||
fi
|
||||
|
||||
# --- make sure install type has a value
|
||||
if [ -z "${INSTALL_RANCHERD_TYPE}" ]; then
|
||||
INSTALL_RANCHERD_TYPE="server"
|
||||
fi
|
||||
}
|
||||
|
||||
# setup_arch set arch and suffix,
|
||||
# fatal if architecture not supported.
|
||||
setup_arch() {
|
||||
case ${ARCH:=$(uname -m)} in
|
||||
amd64)
|
||||
ARCH=amd64
|
||||
SUFFIX=${ARCH}
|
||||
;;
|
||||
x86_64)
|
||||
ARCH=amd64
|
||||
SUFFIX=${ARCH}
|
||||
;;
|
||||
*)
|
||||
fatal "unsupported architecture ${ARCH}"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# verify_downloader verifies existence of
|
||||
# network downloader executable.
|
||||
verify_downloader() {
|
||||
cmd="$(command -v "${1}")"
|
||||
if [ -z "${cmd}" ]; then
|
||||
return 1
|
||||
fi
|
||||
if [ ! -x "${cmd}" ]; then
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Set verified executable as our downloader program and return success
|
||||
DOWNLOADER=${cmd}
|
||||
return 0
|
||||
}
|
||||
|
||||
# setup_tmp creates a temporary directory
|
||||
# and cleans up when done.
|
||||
setup_tmp() {
|
||||
TMP_DIR=$(mktemp -d -t rancherd-install.XXXXXXXXXX)
|
||||
TMP_CHECKSUMS=${TMP_DIR}/rancherd.checksums
|
||||
TMP_TARBALL=${TMP_DIR}/rancherd.tarball
|
||||
cleanup() {
|
||||
code=$?
|
||||
set +e
|
||||
trap - EXIT
|
||||
rm -rf "${TMP_DIR}"
|
||||
exit $code
|
||||
}
|
||||
trap cleanup INT EXIT
|
||||
}
|
||||
|
||||
# --- use desired rancherd version if defined or find version from channel ---
|
||||
get_release_version() {
|
||||
if [ -n "${INSTALL_RANCHERD_VERSION}" ]; then
|
||||
version=${INSTALL_RANCHERD_VERSION}
|
||||
else
|
||||
info "finding release for channel ${INSTALL_RANCHERD_CHANNEL}"
|
||||
INSTALL_RANCHERD_CHANNEL_URL=${INSTALL_RANCHERD_CHANNEL_URL:-'https://update.rancher.io/v1-release/channels'}
|
||||
version_url="${INSTALL_RANCHERD_CHANNEL_URL}/${INSTALL_RANCHERD_CHANNEL}"
|
||||
case ${DOWNLOADER} in
|
||||
*curl)
|
||||
version=$(${DOWNLOADER} -w "%{url_effective}" -L -s -S ${version_url} -o /dev/null | sed -e 's|.*/||')
|
||||
;;
|
||||
*wget)
|
||||
version=$(${DOWNLOADER} -SqO /dev/null ${version_url} 2>&1 | grep -i Location | sed -e 's|.*/||')
|
||||
;;
|
||||
*)
|
||||
fatal "Unsupported downloader executable '${DOWNLOADER}'"
|
||||
;;
|
||||
esac
|
||||
INSTALL_RANCHERD_VERSION="${version}"
|
||||
fi
|
||||
info "using ${INSTALL_RANCHERD_VERSION} as release"
|
||||
}
|
||||
|
||||
# download downloads from github url.
|
||||
download() {
|
||||
if [ $# -ne 2 ]; then
|
||||
fatal "download needs exactly 2 arguments"
|
||||
fi
|
||||
|
||||
case ${DOWNLOADER} in
|
||||
*curl)
|
||||
curl -o "$1" -fsSL "$2"
|
||||
;;
|
||||
*wget)
|
||||
wget -qO "$1" "$2"
|
||||
;;
|
||||
*)
|
||||
fatal "downloader executable not supported: '${DOWNLOADER}'"
|
||||
;;
|
||||
esac
|
||||
|
||||
# Abort if download command failed
|
||||
if [ $? -ne 0 ]; then
|
||||
fatal "download failed"
|
||||
fi
|
||||
}
|
||||
|
||||
# download_checksums downloads hash from github url.
|
||||
download_checksums() {
|
||||
|
||||
CHECKSUMS_URL=${INSTALL_RANCHERD_GITHUB_URL}/releases/download/${INSTALL_RANCHERD_VERSION}/sha256sum.txt
|
||||
info "downloading checksums at ${CHECKSUMS_URL}"
|
||||
download "${TMP_CHECKSUMS}" "${CHECKSUMS_URL}"
|
||||
CHECKSUM_EXPECTED=$(grep "rancherd.${SUFFIX}.tar.gz" "${TMP_CHECKSUMS}" | awk '{print $1}')
|
||||
}
|
||||
|
||||
# download_tarball downloads binary from github url.
|
||||
download_tarball() {
|
||||
TARBALL_URL=${INSTALL_RANCHERD_GITHUB_URL}/releases/download/${INSTALL_RANCHERD_VERSION}/rancherd-${SUFFIX}.tar.gz
|
||||
info "downloading tarball at ${TARBALL_URL}"
|
||||
download "${TMP_TARBALL}" "${TARBALL_URL}"
|
||||
}
|
||||
|
||||
# verify_tarball verifies the downloaded installer checksum.
|
||||
verify_tarball() {
|
||||
info "verifying installer"
|
||||
CHECKSUM_ACTUAL=$(sha256sum "${TMP_TARBALL}" | awk '{print $1}')
|
||||
if [ "${CHECKSUM_EXPECTED}" != "${CHECKSUM_ACTUAL}" ]; then
|
||||
fatal "download sha256 does not match ${CHECKSUM_EXPECTED}, got ${CHECKSUM_ACTUAL}"
|
||||
fi
|
||||
}
|
||||
|
||||
unpack_tarball() {
|
||||
info "unpacking tarball file"
|
||||
mkdir -p /usr/local
|
||||
tar xzf $TMP_TARBALL -C /usr/local
|
||||
}
|
||||
|
||||
do_install_tar() {
|
||||
verify_downloader curl || verify_downloader wget || fatal "can not find curl or wget for downloading files"
|
||||
setup_tmp
|
||||
get_release_version
|
||||
download_checksums
|
||||
download_tarball
|
||||
verify_tarball
|
||||
unpack_tarball
|
||||
}
|
||||
|
||||
do_install() {
|
||||
setup_env
|
||||
setup_arch
|
||||
do_install_tar
|
||||
}
|
||||
|
||||
do_install
|
||||
exit 0
|
||||
@@ -0,0 +1,40 @@
|
||||
---
|
||||
|
||||
- name: Copy install script
|
||||
become: yes
|
||||
ansible.builtin.copy:
|
||||
src: get-k3s.sh
|
||||
dest: /usr/local/sbin/get-k3s.sh
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0750
|
||||
|
||||
- name: Ensure cgroup
|
||||
become: yes
|
||||
register: cgroup_changed
|
||||
ignore_errors: true
|
||||
ansible.builtin.command:
|
||||
cmd: /bin/bash -c "grep 'cgroup_memory=1 cgroup_enable=memory' /boot/firmware/cmdline.txt || (sed -i 's/$/ cgroup_memory=1 cgroup_enable=memory/' /boot/firmware/cmdline.txt && /bin/false)"
|
||||
|
||||
- name: Disable swap
|
||||
become: yes
|
||||
register: swap_changed
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/rpi/swap.conf
|
||||
regex: 'Mechanism='
|
||||
line: 'Mechanism=none'
|
||||
|
||||
- name: Reboot if there was a change.
|
||||
become: yes
|
||||
ansible.builtin.command: "/usr/sbin/reboot"
|
||||
async: 1
|
||||
poll: 0
|
||||
when: cgroup_changed is failed or swap_changed is changed
|
||||
|
||||
- name: Wait for the reboot to complete if there was a change.
|
||||
wait_for_connection:
|
||||
connect_timeout: 20
|
||||
sleep: 5
|
||||
delay: 5
|
||||
timeout: 300
|
||||
when: cgroup_changed is failed or swap_changed is changed
|
||||
@@ -1,8 +1,19 @@
|
||||
---
|
||||
- name: Geth packages
|
||||
become: yes
|
||||
package:
|
||||
name:
|
||||
- openhab2
|
||||
|
||||
- name:
|
||||
- name: General tasks
|
||||
include_tasks: general.yml
|
||||
|
||||
- name: Primary tasks
|
||||
include_tasks: primary.yml
|
||||
when: "inventory_hostname == geth_primary "
|
||||
|
||||
# - name: Rancher tasks
|
||||
# include_tasks: rancher.yml
|
||||
# when: "inventory_hostname == geth_primary "
|
||||
|
||||
- name: Worker tasks
|
||||
include_tasks: worker.yml
|
||||
when: "not inventory_hostname == geth_primary"
|
||||
|
||||
- name: Service tasks
|
||||
include_tasks: services.yml
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
---
|
||||
|
||||
- name: Set up primary
|
||||
become: yes
|
||||
ansible.builtin.command:
|
||||
cmd: '/bin/bash -c "K3S_KUBECONFIG_MODE=644 /usr/local/sbin/get-k3s.sh"'
|
||||
creates: /etc/systemd/system/k3s.service
|
||||
|
||||
- name: Check the token
|
||||
become: yes
|
||||
ansible.builtin.command:
|
||||
cmd: 'cat /var/lib/rancher/k3s/server/node-token'
|
||||
register: k3s_token_cat
|
||||
|
||||
- name: Ensure the token is in vault
|
||||
assert:
|
||||
that: k3s_token_cat.stdout_lines[0] is in secrets['Geth']['k3s_token']
|
||||
@@ -0,0 +1,46 @@
|
||||
---
|
||||
|
||||
- name: Rancher directories
|
||||
become: yes
|
||||
ansible.builtin.file:
|
||||
state: directory
|
||||
path: "{{ item }}"
|
||||
mode: 0750
|
||||
owner: root
|
||||
group: root
|
||||
loop:
|
||||
- '/etc/rancher'
|
||||
- '/etc/rancher/rke2'
|
||||
|
||||
- name: Rancher config
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: rancher.config.yaml.j2
|
||||
dest: /etc/rancher/rke2/config.yaml
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0750
|
||||
|
||||
- name: Copy install script
|
||||
become: yes
|
||||
ansible.builtin.copy:
|
||||
src: get-rancher.sh
|
||||
dest: /usr/local/sbin/get-rancher.sh
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0750
|
||||
|
||||
- name: Run install script
|
||||
become: yes
|
||||
ansible.builtin.command:
|
||||
cmd: /usr/local/sbin/get-rancher.sh
|
||||
|
||||
- name: Enable rancherd
|
||||
become: yes
|
||||
ansible.builtin.service:
|
||||
name: rancherd
|
||||
state: restarted
|
||||
enabled: yes
|
||||
|
||||
- debug:
|
||||
msg: 'Make sure to run `rancherd reset-admin` if this is a new cluster.'
|
||||
@@ -0,0 +1,8 @@
|
||||
---
|
||||
|
||||
- name: Enable k3s
|
||||
become: yes
|
||||
ansible.builtin.service:
|
||||
name: k3s
|
||||
state: restarted
|
||||
enabled: yes
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
|
||||
- name: Set up primary
|
||||
become: yes
|
||||
ansible.builtin.command:
|
||||
cmd: '/bin/bash -c "K3S_TOKEN={{ secrets['Geth']['k3s_token'] }} K3S_URL=https://{{ geth_primary }}:6443 K3S_NODE_NAME=${HOSTNAME} /usr/local/sbin/get-k3s.sh"'
|
||||
creates: /etc/systemd/system/k3s.service
|
||||
@@ -0,0 +1,5 @@
|
||||
token: '{{ secrets['Geth']['rancher_token'] }}'
|
||||
tls-san:
|
||||
- {{ inventory_hostname }}
|
||||
- {{ inventory_hostname }}.{{ replica_domain }}
|
||||
- {{ ip }}
|
||||
Reference in New Issue
Block a user