K3s deploy on Rpis -- Rancher will live in Node

roles/Geth/files/get-rancher.sh

@@ -0,0 +1,213 @@
+#!/bin/bash
+
+# Downloaded via `curl -sfL https://get.rancher.io`
+
+set -e
+
+if [ "${DEBUG}" = 1 ]; then
+    set -x
+fi
+
+# Usage:
+#   curl ... | ENV_VAR=... sh -
+#       or
+#   ENV_VAR=... ./install.sh
+#
+# Environment variables:
+#
+#   - INSTALL_RANCHERD_CHANNEL
+#     Channel to use for fetching RANCHERD download URL.
+#     Defaults to 'testing'.
+#
+#   - INSTALL_RANCHERD_TYPE
+#     Type of RANCHERD service. Can be either "server" or "agent".
+#     Default is "server".
+#
+#   - INSTALL_RANCHERD_VERSION
+#     Version of RANCHERD to download from github.
+#
+# info logs the given argument at info log level.
+info() {
+    echo "[INFO] " "$@"
+}
+
+# warn logs the given argument at warn log level.
+warn() {
+    echo "[WARN] " "$@" >&2
+}
+
+# fatal logs the given argument at fatal log level.
+fatal() {
+    echo "[ERROR] " "$@" >&2
+    if [ -n "${SUFFIX}" ]; then
+        echo "[ALT] Please visit 'https://github.com/rancher/rancher/releases' directly and download the latest rancherd-installer.${SUFFIX}.run" >&2
+    fi
+    exit 1
+}
+
+# setup_env defines needed environment variables.
+setup_env() {
+    INSTALL_RANCHERD_GITHUB_URL="https://github.com/rancher/rancher"
+    # --- bail if we are not root ---
+    if [ ! $(id -u) -eq 0 ]; then
+        fatal "You need to be root to perform this install"
+    fi
+
+    # --- make sure install channel has a value
+    if [ -z "${INSTALL_RANCHERD_CHANNEL}" ]; then
+        INSTALL_RANCHERD_CHANNEL="v2.5"
+    fi
+
+    # --- make sure install type has a value
+    if [ -z "${INSTALL_RANCHERD_TYPE}" ]; then
+        INSTALL_RANCHERD_TYPE="server"
+    fi
+}
+
+# setup_arch set arch and suffix,
+# fatal if architecture not supported.
+setup_arch() {
+    case ${ARCH:=$(uname -m)} in
+    amd64)
+        ARCH=amd64
+        SUFFIX=${ARCH}
+        ;;
+    x86_64)
+        ARCH=amd64
+        SUFFIX=${ARCH}
+        ;;
+    *)
+        fatal "unsupported architecture ${ARCH}"
+        ;;
+    esac
+}
+
+# verify_downloader verifies existence of
+# network downloader executable.
+verify_downloader() {
+    cmd="$(command -v "${1}")"
+    if [ -z "${cmd}" ]; then
+        return 1
+    fi
+    if [ ! -x "${cmd}" ]; then
+        return 1
+    fi
+
+    # Set verified executable as our downloader program and return success
+    DOWNLOADER=${cmd}
+    return 0
+}
+
+# setup_tmp creates a temporary directory
+# and cleans up when done.
+setup_tmp() {
+    TMP_DIR=$(mktemp -d -t rancherd-install.XXXXXXXXXX)
+    TMP_CHECKSUMS=${TMP_DIR}/rancherd.checksums
+    TMP_TARBALL=${TMP_DIR}/rancherd.tarball
+    cleanup() {
+        code=$?
+        set +e
+        trap - EXIT
+        rm -rf "${TMP_DIR}"
+        exit $code
+    }
+    trap cleanup INT EXIT
+}
+
+# --- use desired rancherd version if defined or find version from channel ---
+get_release_version() {
+    if [ -n "${INSTALL_RANCHERD_VERSION}" ]; then
+        version=${INSTALL_RANCHERD_VERSION}
+    else
+        info "finding release for channel ${INSTALL_RANCHERD_CHANNEL}"
+        INSTALL_RANCHERD_CHANNEL_URL=${INSTALL_RANCHERD_CHANNEL_URL:-'https://update.rancher.io/v1-release/channels'}
+        version_url="${INSTALL_RANCHERD_CHANNEL_URL}/${INSTALL_RANCHERD_CHANNEL}"
+        case ${DOWNLOADER} in
+        *curl)
+            version=$(${DOWNLOADER} -w "%{url_effective}" -L -s -S ${version_url} -o /dev/null | sed -e 's|.*/||')
+            ;;
+        *wget)
+            version=$(${DOWNLOADER} -SqO /dev/null ${version_url} 2>&1 | grep -i Location | sed -e 's|.*/||')
+            ;;
+        *)
+            fatal "Unsupported downloader executable '${DOWNLOADER}'"
+            ;;
+        esac
+        INSTALL_RANCHERD_VERSION="${version}"
+    fi
+    info "using ${INSTALL_RANCHERD_VERSION} as release"
+}
+
+# download downloads from github url.
+download() {
+    if [ $# -ne 2 ]; then
+        fatal "download needs exactly 2 arguments"
+    fi
+
+    case ${DOWNLOADER} in
+    *curl)
+        curl -o "$1" -fsSL "$2"
+        ;;
+    *wget)
+        wget -qO "$1" "$2"
+        ;;
+    *)
+        fatal "downloader executable not supported: '${DOWNLOADER}'"
+        ;;
+    esac
+
+    # Abort if download command failed
+    if [ $? -ne 0 ]; then
+        fatal "download failed"
+    fi
+}
+
+# download_checksums downloads hash from github url.
+download_checksums() {
+
+    CHECKSUMS_URL=${INSTALL_RANCHERD_GITHUB_URL}/releases/download/${INSTALL_RANCHERD_VERSION}/sha256sum.txt
+    info "downloading checksums at ${CHECKSUMS_URL}"
+    download "${TMP_CHECKSUMS}" "${CHECKSUMS_URL}"
+    CHECKSUM_EXPECTED=$(grep "rancherd.${SUFFIX}.tar.gz" "${TMP_CHECKSUMS}" | awk '{print $1}')
+}
+
+# download_tarball downloads binary from github url.
+download_tarball() {
+    TARBALL_URL=${INSTALL_RANCHERD_GITHUB_URL}/releases/download/${INSTALL_RANCHERD_VERSION}/rancherd-${SUFFIX}.tar.gz
+    info "downloading tarball at ${TARBALL_URL}"
+    download "${TMP_TARBALL}" "${TARBALL_URL}"
+}
+
+# verify_tarball verifies the downloaded installer checksum.
+verify_tarball() {
+    info "verifying installer"
+    CHECKSUM_ACTUAL=$(sha256sum "${TMP_TARBALL}" | awk '{print $1}')
+    if [ "${CHECKSUM_EXPECTED}" != "${CHECKSUM_ACTUAL}" ]; then
+        fatal "download sha256 does not match ${CHECKSUM_EXPECTED}, got ${CHECKSUM_ACTUAL}"
+    fi
+}
+
+unpack_tarball() {
+    info "unpacking tarball file"
+    mkdir -p /usr/local
+    tar xzf $TMP_TARBALL -C /usr/local
+}
+
+do_install_tar() {
+    verify_downloader curl || verify_downloader wget || fatal "can not find curl or wget for downloading files"
+    setup_tmp
+    get_release_version
+    download_checksums
+    download_tarball
+    verify_tarball
+    unpack_tarball
+}
+
+do_install() {
+    setup_env
+    setup_arch
+    do_install_tar
+}
+
+do_install
+exit 0

roles/Geth/tasks/general.yml

@@ -0,0 +1,40 @@
+---
+
+ - name: Copy install script
+   become: yes
+   ansible.builtin.copy:
+     src: get-k3s.sh
+     dest: /usr/local/sbin/get-k3s.sh
+     owner: root
+     group: root
+     mode: 0750
+
+ - name: Ensure cgroup
+   become: yes
+   register: cgroup_changed
+   ignore_errors: true
+   ansible.builtin.command:
+     cmd: /bin/bash -c "grep 'cgroup_memory=1 cgroup_enable=memory' /boot/firmware/cmdline.txt || (sed -i 's/$/ cgroup_memory=1 cgroup_enable=memory/' /boot/firmware/cmdline.txt && /bin/false)"
+
+ - name: Disable swap
+   become: yes
+   register: swap_changed
+   ansible.builtin.lineinfile:
+     path: /etc/rpi/swap.conf
+     regex: 'Mechanism='
+     line: 'Mechanism=none'
+
+ - name: Reboot if there was a change.
+   become: yes
+   ansible.builtin.command: "/usr/sbin/reboot"
+   async: 1
+   poll: 0
+   when: cgroup_changed is failed or swap_changed is changed
+
+ - name: Wait for the reboot to complete if there was a change.
+   wait_for_connection:
+     connect_timeout: 20
+     sleep: 5
+     delay: 5
+     timeout: 300
+   when: cgroup_changed is failed or swap_changed is changed

roles/Geth/tasks/main.yml

@@ -1,8 +1,19 @@
 ---
- - name: Geth packages
-   become: yes
-   package:
-     name:
-       - openhab2
 
- - name:
+ - name: General tasks
+   include_tasks: general.yml
+
+ - name: Primary tasks
+   include_tasks: primary.yml
+   when: "inventory_hostname == geth_primary "
+
+ #  - name: Rancher tasks
+ #    include_tasks: rancher.yml
+ #    when: "inventory_hostname == geth_primary "
+
+ - name: Worker tasks
+   include_tasks: worker.yml
+   when: "not inventory_hostname == geth_primary"
+
+ - name: Service tasks
+   include_tasks: services.yml

roles/Geth/tasks/primary.yml

@@ -0,0 +1,17 @@
+---
+
+- name: Set up primary
+  become: yes
+  ansible.builtin.command:
+    cmd: '/bin/bash -c "K3S_KUBECONFIG_MODE=644 /usr/local/sbin/get-k3s.sh"'
+    creates: /etc/systemd/system/k3s.service
+
+- name: Check the token
+  become: yes
+  ansible.builtin.command:
+    cmd: 'cat /var/lib/rancher/k3s/server/node-token'
+  register: k3s_token_cat
+
+- name: Ensure the token is in vault
+  assert:
+    that: k3s_token_cat.stdout_lines[0] is in secrets['Geth']['k3s_token']

roles/Geth/tasks/rancher.yml

@@ -0,0 +1,46 @@
+---
+
+- name: Rancher directories
+  become: yes
+  ansible.builtin.file:
+    state: directory
+    path: "{{ item }}"
+    mode: 0750
+    owner: root
+    group: root
+  loop:
+    - '/etc/rancher'
+    - '/etc/rancher/rke2'
+
+- name: Rancher config
+  become: true
+  ansible.builtin.template:
+    src: rancher.config.yaml.j2
+    dest: /etc/rancher/rke2/config.yaml
+    owner: root
+    group: root
+    mode: 0750
+
+- name: Copy install script
+  become: yes
+  ansible.builtin.copy:
+    src: get-rancher.sh
+    dest: /usr/local/sbin/get-rancher.sh
+    owner: root
+    group: root
+    mode: 0750
+
+- name: Run install script
+  become: yes
+  ansible.builtin.command:
+    cmd: /usr/local/sbin/get-rancher.sh
+
+- name: Enable rancherd
+  become: yes
+  ansible.builtin.service:
+    name: rancherd
+    state: restarted
+    enabled: yes
+
+- debug:
+    msg: 'Make sure to run `rancherd reset-admin` if this is a new cluster.'

roles/Geth/tasks/services.yml

@@ -0,0 +1,8 @@
+---
+
+- name: Enable k3s
+  become: yes
+  ansible.builtin.service:
+    name: k3s
+    state: restarted
+    enabled: yes

roles/Geth/tasks/worker.yml

@@ -0,0 +1,7 @@
+---
+
+ - name: Set up primary
+   become: yes
+   ansible.builtin.command:
+     cmd: '/bin/bash -c "K3S_TOKEN={{ secrets['Geth']['k3s_token'] }} K3S_URL=https://{{ geth_primary }}:6443 K3S_NODE_NAME=${HOSTNAME} /usr/local/sbin/get-k3s.sh"'
+     creates: /etc/systemd/system/k3s.service

roles/Geth/templates/rancher.config.yaml.j2

@@ -0,0 +1,5 @@
+token: '{{ secrets['Geth']['rancher_token'] }}'
+tls-san:
+    - {{ inventory_hostname }}
+    - {{ inventory_hostname }}.{{ replica_domain }}
+    - {{ ip }}