openstack-ansible-ops/mcapi_vexxhost/playbooks/k8s_install.yml

---
# Copyright 2023, BBC R&D
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

- name: Gather k8s facts
  hosts: k8s_all
  gather_facts: false
  tags:
    - always
  tasks:
    - name: Gather minimal facts for k8s
      setup:
        gather_subset:
          - "!all"
          - min
      when: osa_gather_facts | default(True)

- name: Create and configure k8s container
  hosts: k8s_all
  serial: "{{ k8s_serial | default('20%') }}"
  gather_facts: true
  user: root
  pre_tasks:
    - import_role:
        name: openstack.osa.lxc_container_setup
      vars:
        list_of_bind_mounts:
          - bind_dir_path: '/usr/lib/modules'
            mount_path: '/usr/lib/modules'
          - bind_dir_path: '/usr/src'
            mount_path: '/usr/src'
          - bind_dir_path: '/dev/kmsg'
            mount_path: '/dev/kmsg'
            create: file
        extra_container_config:
          - 'security.privileged=true'
          - 'security.nested=true'
          - 'raw.lxc="lxc.apparmor.profile=unconfined"'
          - 'lxc.cap.drop='
          - 'lxc.cgroup.devices.allow=a'
          - 'lxc.cgroup2.devices.allow=a'

      when: not is_metal

    - include_tasks: common-tasks/unbound-clients.yml
      when:
        - hostvars['localhost']['resolvconf_enabled'] | bool

    - name: ensure kernel headers are installed on host
      package:
        name: "linux-headers-{{ ansible_facts['kernel'] }}"
        state: present
      delegate_to: "{{ physical_host }}"
      when: not is_metal

  roles:
    - role: "openstack.osa.system_crontab_coordination"
    - role: "systemd_service"
      systemd_services:
        - service_name: bpf-mount
          execstarts: /usr/bin/bash -c '/usr/bin/mount bpffs -t bpf /sys/fs/bpf && /usr/bin/mount --make-shared /sys/fs/bpf'
        - service_name: cilium-cgroup2-mount
          execstarts: /usr/bin/bash -c 'mkdir -p /run/cilium/cgroupv2 && /usr/bin/mount -t cgroup2 none /run/cilium/cgroupv2 && /usr/bin/mount --make-shared /run/cilium/cgroupv2'

          #  environment: "{{ deployment_environment_variables | default({}) }}"
  tags:
    - k8s-container
    - k8s

- name: Configure haproxy services
  import_playbook: openstack.osa.haproxy_service_config.yml
  vars:
    service_group: k8s_all
    service_variable: "k8s_haproxy_services"
  when: groups[service_group] | length > 0
  tags:
    - haproxy-service-config

- name: Install kubernetes
  hosts: k8s_all
  gather_facts: true
  serial: "{{ k8s_serial | default('20%') }}"
  user: root
  roles:
      - role: "vexxhost.containers.containerd"
      - role: "vexxhost.kubernetes.kubernetes"
      - role: "vexxhost.kubernetes.helm"
      - role: "vexxhost.kubernetes.cilium"
        environment: "{{ deployment_environment_variables | default({}) }}"
  tags:
    - k8s
    - k8s-install

- name: Install cluster_api
  hosts: k8s_all
  gather_facts: true
  user: root
  roles:
    - role: "vexxhost.kubernetes.cert_manager"
    - role: "vexxhost.kubernetes.cluster_api"
      #  environment: "{{ deployment_environment_variables | default({}) }}"
  tags:
    - cluster-api

- name: Set up helm and k8s credentials in magnum hosts
  hosts: magnum_all
  gather_facts: true
  user: root
  vars:
    k8s_admin_conf_src: "/etc/kubernetes/admin.conf"
    k8s_admin_conf_dest: "/var/lib/magnum/.kube/config"
  tasks:
    - name: Collect admin config from k8s cluster
      slurp:
        src: "{{ k8s_admin_conf_src }}"
      register: k8s_admin_conf_slurp
      delegate_to: "{{ groups['k8s_all'][0] }}"
      run_once: true

    - name: Ensure target directory exists
      file:
        state: directory
        path: "{{ k8s_admin_conf_dest | dirname }}"
        owner: magnum
        group: magnum

    - name: Write k8s admin config to magnum home dir
      copy:
        content: "{{ k8s_admin_conf_slurp.content | b64decode }}"
        dest: "{{ k8s_admin_conf_dest }}"
        owner: magnum
        group: magnum
        mode: '0600'

    - name: Install helm
      include_role:
        name: "vexxhost.kubernetes.helm"

        #  environment: "{{ deployment_environment_variables | default({}) }}"
  tags:
    - magnum_k8s_conf

# deploy the proxy service to communicate directly between magnum coe
# clusters and the capi control plane without going via a public floating
# IP
# For OVS/Linuxbridge this can be installed to compute nodes, but for
# OVN it must be installed to all computes. Override the target hosts
# for this play as required
- name: Install magnum-cluster-api-proxy
  hosts: "{{ magnum_cluster_api_proxy_hosts | default('network_hosts') }}"
  vars:
    _venv_tag: "{{ venv_tag | default('untagged') }}"
    _bin: "/openstack/venvs/magnum-cluster-api-proxy-{{ _venv_tag }}/bin"
    magnum_cluster_api_proxy_system_group_name: 'capi_proxy'
    magnum_cluster_api_proxy_system_user_name: 'capi_proxy'
    magnum_cluster_api_proxy_system_user_comment: 'Magnum Cluster API Proxy System User'
    magnum_cluster_api_proxy_system_user_home: '/var/lib/{{ magnum_cluster_api_proxy_system_user_name }}'
    magnum_cluster_api_proxy_system_user_shell: '/bin/false'
    magnum_cluster_api_proxy_etc_directory: '/etc/capi_proxy'

    k8s_admin_conf_src: "/etc/kubernetes/admin.conf"
    k8s_admin_conf_dest: "{{ magnum_cluster_api_proxy_system_user_home }}/.kube/config"
  environment: "{{ deployment_environment_variables | default({}) }}"
  tasks:

    - name: Gather facts
      setup:
        gather_subset:
          - "!all"
          - min
      when: osa_gather_facts | default(True)
      tags:
        - always

    - name: Setup installation variables
      import_role:
        name: openstack.osa.install_defaults

    - name: Install proxy service
      include_role:
        name: osa_ops.mcapi_vexxhost.proxy

  tags:
    - magnum-cluster-api-proxy