Skip to content

Commit 3241eeb

Browse files
alsmkadskyiproger
alsmk
authored and
adskyiproger
committed
Inventory file has been added
1 parent cbaf832 commit 3241eeb

File tree

10 files changed

+280
-50
lines changed

10 files changed

+280
-50
lines changed

‎.github/workflows/provision.yml‎

Lines changed: 27 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,25 +26,42 @@ on:
2626
- application
2727
- tools
2828
- fail2ban
29-
- data-partition
30-
- ufw
3129
- decrypt-on-boot
32-
30+
- metrics-server
31+
- checks
32+
- containerd-setup
33+
- kubernetes-installation
34+
- control-plane-init
35+
- cni-plugin-installation
36+
- join-workers
37+
- system-preparation
38+
3339
jobs:
3440
provision:
35-
runs-on: [self-hosted]
41+
runs-on: ubuntu-24.04
42+
environment: ${{ inputs.environment }}
3643
steps:
3744
- name: Collect ssh key from secrets
3845
run: |
39-
echo "${{ secrets.SSH_PRIVATE_KEY }}" > /tmp/id_rsa
46+
echo "${{ secrets.SSH_KEY }}" > /tmp/id_rsa
4047
chmod 600 /tmp/id_rsa
48+
env:
49+
SSH_KEY: ${{ secrets.SSH_KEY }}
4150

4251
- name: checkout repository
4352
uses: actions/checkout@v4
4453

4554
- name: Run Ansible Playbook
46-
run: |
47-
ansible-playbook infrastructure/infrastructure/server-setup/playbook-k8s.yml \
48-
-i infrastructure/infrastructure/server-setup/inventory/e2e-test.yml \
49-
--private-key /tmp/id_rsa \
50-
--extra-vars="ansible_user=provision"
55+
uses: dawidd6/action-ansible-playbook@v4
56+
env:
57+
ANSIBLE_PERSISTENT_COMMAND_TIMEOUT: 10
58+
ANSIBLE_SSH_TIMEOUT: 10
59+
ANSIBLE_SSH_RETRIES: 5
60+
with:
61+
playbook: playbook-k8s.yml
62+
directory: ./infrastructure/server-setup
63+
options: |
64+
--verbose
65+
--inventory inventory/${{ inputs.environment }}.yml
66+
--private-key /tmp/id_rsa
67+
${{ inputs.tags != 'all' && format('--tags={0}', inputs.tags) || '' }}

‎infrastructure/server-setup/group_vars/all.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,6 @@ backup_server_user: 'backup'
1414
backup_server_user_home: '/home/backup'
1515
crontab_user: root
1616
provisioning_user: provision
17+
kubernetes_version: "v1.33"
18+
pod_network_cidr: "192.168.0.0/16"
19+
calico_version: "v3.26.1"

‎infrastructure/server-setup/inventory/e2e.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
all:
2+
vars:
3+
ansible_ssh_common_args: '-o StrictHostKeyChecking=no'
4+
ansible_user: provision
5+
single_node: false
6+
users:
7+
- name: shoumik
8+
ssh_keys:
9+
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC24iEmVR5UKl51apaLRpJKcGpW3D900F/wSD+8CiNTVZJ56b1+HPteQHzEXDFEh5bl5IEJCkhE5S6sdYLCK6n+UgauJWrSNHm0+xgAXpR6Zv7qo9sCVwrkbr9uZw/14l7mUTjv4gj9sTvkrjRW8LlBKvkqUXEadustDriJCbfkLxLwtHydwp/r8IAuCp1pfx3VblZBbDS+6R5S1f8qsr0nGHU7pmesW+jkyTzGWZuUrE8o8J9BB244CcIXrPjRzdiX/jU0O/HMrgfnlvVuVaA3W1KvYIrD4wOb9LUfUc22Bd/tpV1ZGJBV/A+fxOmZZjmlhTNxztLaXOIwjywDSUm5BxxgbIeY6ntobIWr3LNlF714nYOqjOGM3gncmbmpCqxHO04r8Wh5fCyEPDd0L8YfIJD5GZTJ6KRsP9l1M8uZ35N+AhOLhDNcWwWJuuA1inMmRFIwBCRAw6BRX9XRK2AYfmVZkU5cBbq9v+f6UAkRaMFl1rtG0UDDNTKk9HQ+Qj65tfgEs580dM0d+I5rF4KvRXZqrgrGIbn2BwOaxcbcor6v1YE4IE5UnS7YqOZqWoquSF3oWTEWYWtPlaLiu/04KaRDMGOwYglhgGQbHmMXdrKuOhKyulilyUtkNCxXCGBEqDSUjWJdp09rjN+rK+gNQ8jocG5fYg7QO/SWhOBM/w== alhel444@gmail.com
10+
state: present
11+
sudoer: true
12+
13+
- name: vmudryi
14+
ssh_keys:
15+
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINgMcsSBwTE0EbMDRSF1T4vJDcN/5HAjKGbi2DqV7g/Q vmudryi@opencrvs.org
16+
state: present
17+
sudoer: true
18+
children:
19+
master:
20+
hosts:
21+
test-k8s-master:
22+
ansible_host: 5.78.158.131
23+
workers:
24+
hosts:
25+
test-k8s-worker-0:
26+
ansible_host: 5.78.67.216
27+
test-k8s-worker-1:
28+
ansible_host: 5.78.133.88

‎infrastructure/server-setup/k8s.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
- name: Setup Kubernetes Cluster
3+
hosts: all
4+
gather_facts: yes
5+
tasks:
6+
- name: Include system preparation tasks
7+
include_tasks: tasks/system-preparation.yml
8+
tags:
9+
- system-preparation
10+
11+
- name: Include containerd installation tasks
12+
include_tasks: tasks/install-containerd.yml
13+
tags:
14+
- containerd-setup
15+
16+
- name: Include Kubernetes installation tasks
17+
include_tasks: tasks/install-kubernetes.yml
18+
tags:
19+
- kubernetes-installation
20+
21+
- name: Initialize Kubernetes Master
22+
hosts: master
23+
tasks:
24+
- name: Include master initialization tasks
25+
include_tasks: tasks/init-master.yml
26+
tags:
27+
- control-plane-init
28+
29+
- name: Include network plugin installation tasks
30+
include_tasks: tasks/install-network-plugin.yml
31+
tags:
32+
- cni-plugin-installation
33+
34+
- name: Join Worker Nodes
35+
hosts: workers
36+
37+
tasks:
38+
- name: Include worker join tasks
39+
include_tasks: tasks/join-workers.yml
40+
tags:
41+
- join-workers
42+
when: single_node == false
43+
44+
- name: Install metrics server
45+
hosts: master
46+
tasks:
47+
- name: Install metrics server on control plane
48+
include_tasks: tasks/metrics-server.yml
49+
tags:
50+
- metrics-server

‎infrastructure/server-setup/playbook-k8s.yml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
# This Source Code Form is subject to the terms of the Mozilla Public
2+
# License, v. 2.0. If a copy of the MPL was not distributed with this
3+
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
4+
#
5+
# OpenCRVS is also distributed under the terms of the Civil Registration
6+
# & Healthcare Disclaimer located at http://opencrvs.org/license.
7+
#
8+
# Copyright (C) The OpenCRVS Authors located at https://github.com/opencrvs/opencrvs-core/blob/master/AUTHORS.
9+
---
10+
11+
- hosts: all
12+
become: yes
13+
gather_facts: yes
14+
ignore_unreachable: false
15+
become_method: sudo
16+
tasks:
17+
- include_tasks:
18+
file: tasks/checks.yml
19+
apply:
20+
tags:
21+
- checks
22+
tags:
23+
- checks
24+
25+
- include_tasks:
26+
file: tasks/updates.yml
27+
apply:
28+
tags:
29+
- updates
30+
31+
- include_tasks:
32+
file: tasks/users.yml
33+
apply:
34+
tags:
35+
- users
36+
tags:
37+
- users
38+
39+
- include_tasks:
40+
file: tasks/application.yml
41+
apply:
42+
tags:
43+
- application
44+
tags:
45+
- application
46+
47+
- include_tasks:
48+
file: tasks/tools.yml
49+
apply:
50+
tags:
51+
- tools
52+
tags:
53+
- tools
54+
55+
- include_tasks:
56+
file: tasks/fail2ban.yml
57+
apply:
58+
tags:
59+
- fail2ban
60+
tags:
61+
- fail2ban
62+
63+
- name: 'Copy logrotate script'
64+
copy:
65+
src: ../logrotate.conf
66+
dest: /etc/
67+
68+
69+
- name: 'Save system logs to Papertrail'
70+
register: papaertrailSystemLogs
71+
shell: ' cd / && wget -qO - --header="X-Papertrail-Token: {{ papertrail_token }}" \ https://papertrailapp.com/destinations/16712142/setup.sh | sudo bash >> /var/log/papertrail.log 2>&1'
72+
when: papertrail_token is defined
73+
74+
- include_tasks:
75+
file: tasks/decrypt-on-boot.yml
76+
apply:
77+
tags:
78+
- decrypt-on-boot
79+
tags:
80+
- decrypt-on-boot
81+
82+
- import_playbook: k8s.yml
83+

‎infrastructure/server-setup/tasks/checks.yml‎

Lines changed: 29 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,34 @@
1-
- name: Check if external_backup_server_user is set
1+
- name: Check if single_node is defined
22
fail:
3-
msg: 'external_backup_server_user variable was deprecated in OpenCRVS 1.5. Please rename the variable to backup_server_remote_target_directory'
4-
when: external_backup_server_user is defined
3+
msg: |
4+
Configuration error: single_node variable is not defined.
5+
Please add 'single_node: true' or 'single_node: false' under the 'all.vars' section.
6+
when: single_node is not defined
57

6-
- name: Check if external_backup_server_remote_directory is set
7-
fail:
8-
msg: 'external_backup_server_remote_directory variable was deprecated in OpenCRVS 1.5. Please rename the variable to backup_server_remote_target_directory'
9-
when: external_backup_server_remote_directory is defined
8+
- name: Get all Node groups
9+
set_fact:
10+
child_groups: "{{ groups.keys() | difference(['all', 'ungrouped']) | list }}"
11+
12+
- name: Display child groups
13+
debug:
14+
msg: "Detected Node groups: {{ child_groups }}"
1015

11-
- name: 'Check mandatory variables are defined'
12-
assert:
13-
that:
14-
- mongodb_admin_username is defined
15-
- mongodb_admin_password is defined
16-
- elasticsearch_superuser_password is defined
17-
- encrypted_disk_size is defined
16+
- name: Fail if single_node is set to False and worker nodes are not present
17+
fail:
18+
msg: |
19+
Configuration mismatch detected!
20+
single_node is set to 'false' but only {{ child_groups | length }} group found: {{ child_groups }}
21+
For multi-node setup (single_node: false), you need at least 2 groups (e.g., master and workers).
22+
when:
23+
- single_node == false
24+
- child_groups | length == 1
1825

19-
- name: 'Prevent single-node configuration in production'
26+
- name: Fail if single_node is set to True and multiple groups are present
2027
fail:
21-
msg: 'The production environment should always use more than one node. Please check the inventory file for production.'
22-
when: >
23-
(single_node | default(false)) == false and (
24-
'docker-workers' not in groups or
25-
groups['docker-workers'] | length == 0
26-
)
28+
msg: |
29+
Configuration mismatch detected!
30+
single_node is set to 'true' but multiple groups found: {{ child_groups }}
31+
For single-node setup (single_node: true), only one group should be present.
32+
when:
33+
- single_node == true
34+
- child_groups | length > 1

‎infrastructure/server-setup/tasks/install-containerd.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,17 @@
66
77
- name: Remove Docker's old version if it exists
88
shell: sudo apt remove -y docker docker-engine docker.io containerd runc
9+
ignore_errors: true
910

1011
- name: Remove Docker's official GPG key if it exists
1112
shell: sudo rm -f /etc/apt/trusted.gpg.d/docker.gpg
13+
ignore_errors: true
1214

1315
- name: Add Docker's official GPG key
1416
shell: curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/docker.gpg
1517

1618
- name: Add Docker repository
17-
shell: sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
19+
shell: sudo add-apt-repository -y "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
1820

1921
- name: Install containerd
2022
shell: |

‎infrastructure/server-setup/tasks/metrics-server.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
- name: Download manifest for metrics server
2+
get_url:
3+
url: https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
4+
dest: /tmp/metrics-server.yaml
5+
mode: '0644'
6+
7+
- name: Install metrics server on control plane
8+
shell: |
9+
kubectl apply -f /tmp/metrics-server.yaml
10+
become: yes
11+
environment:
12+
KUBECONFIG: /home/provision/.kube/config
13+
14+
- name: Add --kubelet-insecure-tls to metrics-server
15+
shell: |
16+
kubectl -n kube-system patch deployment metrics-server \
17+
--type='json' \
18+
-p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--kubelet-insecure-tls"}]'
19+
environment:
20+
KUBECONFIG: /home/provision/.kube/config
21+
- name: Wait for metrics server to be ready
22+
shell: |
23+
kubectl wait --for=condition=ready pod -l k8s-app=metrics-server -n kube-system --timeout=30s
24+
become: yes
25+
retries: 3
26+
delay: 1
27+
environment:
28+
KUBECONFIG: /home/provision/.kube/config
29+
- name: Verify metrics server installation
30+
shell: |
31+
kubectl get deployment metrics-server -n kube-system
32+
become: yes
33+
register: metrics_server_status
34+
environment:
35+
KUBECONFIG: /home/provision/.kube/config
36+
- name: Display metrics server status
37+
debug:
38+
msg: "Metrics server is installed and running: {{ metrics_server_status.stdout }}"
39+
when: metrics_server_status.rc == 0
40+
41+
- name: Clean up temporary files
42+
file:
43+
path: /tmp/metrics-server.yaml
44+
state: absent

‎infrastructure/server-setup/tasks/tools.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@
88
name: jq
99
state: present
1010

11+
- name: 'Install yq'
12+
apt:
13+
name: yq
14+
state: present
15+
1116
- name: 'Install pexpect python module for ansible expect commands'
1217
apt:
1318
name: python-3pexpect

0 commit comments

Comments
 (0)