kubernetes deployment strategy notes

2026-10-30 17:18:18 -07:00
parent 504f81de76
commit 35c9d9fd36
57 changed files with 1677 additions and 0 deletions
@@ -0,0 +1,130 @@
+---
+- name: Prepare node for Kubernetes with CRI-O
+  hosts: all
+  become: true
+  tasks:
+    - name: Disable and stop firewalld
+      ansible.builtin.systemd:
+        name: firewalld
+        state: stopped
+        enabled: false
+
+    - name: Set SELinux to permissive mode in config
+      ansible.builtin.lineinfile:
+        path: /etc/selinux/config
+        regexp: '^SELINUX='
+        line: 'SELINUX=permissive'
+
+    - name: Set SELinux to permissive runtime immediately
+      ansible.posix.selinux:
+        policy: targeted
+        state: permissive
+
+    - name: Configure kernel modules to load on boot
+      ansible.builtin.copy:
+        dest: /etc/modules-load.d/k8s.conf
+        content: |
+          overlay
+          br_netfilter
+        mode: '0644'
+
+    - name: Load kernel modules immediately
+      community.general.modprobe:
+        name: "{{ item }}"
+        state: present
+      loop:
+        - overlay
+        - br_netfilter
+
+    - name: Configure sysctl parameters for Kubernetes networking
+      ansible.posix.sysctl:
+        name: "{{ item.key }}"
+        value: "{{ item.value }}"
+        sysctl_file: /etc/sysctl.d/k8s.conf
+        state: present
+        reload: true
+      loop:
+        - { key: 'net.bridge.bridge-nf-call-iptables', value: '1' }
+        - { key: 'net.bridge.bridge-nf-call-ip6tables', value: '1' }
+        - { key: 'net.ipv4.ip_forward', value: '1' }
+
+    - name: Add Kubernetes YUM repository
+      ansible.builtin.yum_repository:
+        name: kubernetes
+        description: Kubernetes
+        baseurl: https://pkgs.k8s.io/core:/stable:/v1.37/rpm/
+        enabled: true
+        gpgcheck: true
+        gpgkey: https://pkgs.k8s.io/core:/stable:/v1.37/rpm/repodata/repomd.xml.key
+
+    - name: Add CRI-O YUM repository
+      ansible.builtin.yum_repository:
+        name: cri-o
+        description: CRI-O
+        baseurl: https://download.opensuse.org/repositories/isv:/cri-o:/stable:/v1.37/rpm/
+        enabled: true
+        gpgcheck: true
+        gpgkey: https://download.opensuse.org/repositories/isv:/cri-o:/stable:/v1.37/rpm/repodata/repomd.xml.key
+
+    - name: Install CRI-O, Podman, and Kubernetes packages
+      ansible.builtin.dnf:
+        name:
+          - cri-o
+          - cri-tools
+          - podman
+          - kubelet
+          - kubeadm
+          - kubectl
+        state: present
+
+    - name: Ensure CRI-O configuration drop-in directory exists
+      ansible.builtin.file:
+        path: /etc/crio/crio.conf.d
+        state: directory
+        mode: '0755'
+
+    - name: Configure CRI-O cgroup manager
+      ansible.builtin.copy:
+        dest: /etc/crio/crio.conf.d/10-cgroup-manager.conf
+        content: |
+          [crio.runtime]
+          conmon_cgroup = "pod"
+          cgroup_manager = "systemd"
+        mode: '0644'
+      notify: Restart crio
+
+    - name: Configure kubelet runtime endpoint
+      ansible.builtin.copy:
+        dest: /etc/sysconfig/kubelet
+        content: |
+          KUBELET_EXTRA_ARGS="--container-runtime-endpoint=unix:///var/run/crio/crio.sock"
+        mode: '0644'
+      notify: Restart kubelet
+
+    - name: Enable and start CRI-O
+      ansible.builtin.systemd:
+        name: crio
+        state: started
+        enabled: true
+        daemon_reload: true
+
+    - name: Enable and start kubelet
+      ansible.builtin.systemd:
+        name: kubelet
+        state: started
+        enabled: true
+
+    - name: Reboot the server
+      ansible.builtin.reboot:
+        reboot_timeout: 600
+
+  handlers:
+    - name: Restart crio
+      ansible.builtin.systemd:
+        name: crio
+        state: restarted
+
+    - name: Restart kubelet
+      ansible.builtin.systemd:
+        name: kubelet
+        state: restarted