k3s setup and git action runner
This commit is contained in:
55
doc/adr/00_dns_os_etc.md
Normal file
55
doc/adr/00_dns_os_etc.md
Normal file
@@ -0,0 +1,55 @@
|
||||
# [Bases](./README.md)
|
||||
|
||||
|
||||
## DNS, OS, ...
|
||||
|
||||
```mermaid
|
||||
%%{init: { 'logLevel': 'debug', 'theme': 'base' } }%%
|
||||
flowchart TD
|
||||
subgraph Internet
|
||||
direction BT
|
||||
pirates[pirates 🏴☠️]
|
||||
robots[robots 🤖]
|
||||
prospects[prospects 🕴️]
|
||||
clients[clients 🧑💼]
|
||||
world[le monde 🌍]
|
||||
|
||||
subgraph changeip.com
|
||||
subdomain
|
||||
end
|
||||
|
||||
subgraph home[🏠]
|
||||
direction TB
|
||||
subgraph livebox
|
||||
ipPublique
|
||||
dns
|
||||
firewall
|
||||
end
|
||||
|
||||
subgraph PC
|
||||
end
|
||||
|
||||
subgraph pi1[pi1.home]
|
||||
end
|
||||
subgraph pi2[pi2.home]
|
||||
end
|
||||
|
||||
dns -- 192.168.1.201 --->pi1
|
||||
dns -- 192.168.1.202 --->pi2
|
||||
end
|
||||
|
||||
subdomain -- (*.)arcodange.duckdns.org --> ipPublique
|
||||
robots -.-> firewall
|
||||
pirates -.-> firewall
|
||||
prospects -.-> firewall
|
||||
clients -.-> firewall
|
||||
world -.-> firewall
|
||||
end
|
||||
```
|
||||
|
||||
### Mise en place
|
||||
|
||||
- Utiliser une image Raspbian à jour avec le SSID du réseau et son mot de passe préconfiguré.
|
||||
- Se connecter à la console d'administration du réseau local http://livebox.home et affecter les adresses statiques.
|
||||
- Donner accès VNC+SSH dans les raspberry-pis
|
||||
- Enregistrer sa clé SSH puis désactiver la connection avec mot de pase
|
||||
10
doc/adr/01_docker_k3s.md
Normal file
10
doc/adr/01_docker_k3s.md
Normal file
@@ -0,0 +1,10 @@
|
||||
# [Bases](./README.md)
|
||||
|
||||
|
||||
## Docker & K3S
|
||||
|
||||
- [k3s-ansible](https://github.com/k3s-io/k3s-ansible/)
|
||||
- [`ansible-playbook -i ansible/arcodange/factory/inventory/ ansible/arcodange/factory/playbooks/02_system.yml --tags='all,never'`](/ansible/arcodange/factory/playbooks/02_system.yml)
|
||||
- scp pi1:/home/pi/.kube/config ~/.kube/config
|
||||
- sed -i '' 's/127.0.0.1/pi1/g' ~/.kube/config # note the space+'' after -i for Mac
|
||||
- sometime `ssh pi1 'sudo touch /var/lib/rancher/k3s/server/manifests/traefik-config.yaml'` is required to reload traefik
|
||||
77
doc/adr/02_main_components.md
Normal file
77
doc/adr/02_main_components.md
Normal file
@@ -0,0 +1,77 @@
|
||||
# [Bases](./README.md)
|
||||
|
||||
|
||||
## Main Components
|
||||
|
||||
### Setup Volume, NFS, K8S Provisioner
|
||||
|
||||
- [`ansible-playbook -i ansible/arcodange/factory/inventory/ ansible/arcodange/factory/playbooks/02_setup.yml --tags='all,never'`](/ansible/arcodange/factory/playbooks/02_setup.yml)
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Une partie du playbook est invoqué par le précédent [playbook system](/ansible/arcodange/factory/playbooks/01_system.yml) responsasble du Provisioner K8S.
|
||||
> Le NFS est également requis pour le Persistent Volume Claim (PVC) utiliser pour les certificats SSL de Traefik.
|
||||
|
||||
### Setup Postgres
|
||||
|
||||
Le container possède sa propre partition et ne tourne pas dans le cluster K3S (pour plus de simplicité).
|
||||
|
||||
>[!NOTE]
|
||||
>Le role [`deploy_postgresql`](/ansible/arcodange/factory/playbooks/setup/roles/deploy_postgresql/tasks/create_db_and_user.yml) du playbook `setup` utilise la variable `applications_databases`: une liste de { db_name: str; db_user: str; db_password: str} à créer.
|
||||
|
||||
### Setup Gitea
|
||||
|
||||
Le container possède sa propre partition et ne tourne pas dans le cluster K3S (pour plus de simplicité). On déploiera un gitea action runner sur d'autres machines pour que l'instance principale gitea gèrent mieux les cas de famine de ressources potentiellement causés par ce dernier.
|
||||
|
||||
#### Setup mail alert
|
||||
|
||||
TODO
|
||||
>[!WARNING]
|
||||
>le template [app.ini.j2](/ansible/arcodange/factory/playbooks/setup/roles/deploy_gitea/templates/app.ini.j2) n'est pas utilisé. (voir [inventaire](/ansible/arcodange/factory/inventory/group_vars/hard_disk/gitea.yml))
|
||||
> il faudrait peut-être utiliser [community.general.ini_file](https://docs.ansible.com/ansible/latest/collections/community/general/ini_file_module.html)
|
||||
|
||||
## Annexes
|
||||
|
||||
### Ordre d'execution des playbooks
|
||||
|
||||
|
||||
```mermaid
|
||||
%%{init: { 'logLevel': 'debug', 'theme': 'dark' } }%%
|
||||
timeline
|
||||
title ordre d'execution des playbooks
|
||||
section Setup DNS, OS, ...
|
||||
configuration manuelle
|
||||
: installer OS, réserver IP statique, configurer SSH,VNC
|
||||
: formater et créer des partitions avec gparted
|
||||
section Docker & K3S
|
||||
system
|
||||
: install Docker
|
||||
: install K3S working with docker
|
||||
: configure Traefik
|
||||
|
||||
section Volume, NFS
|
||||
setup hard_disk
|
||||
: monter les partitions
|
||||
: installer NFS
|
||||
system
|
||||
: déployer provisionner NFS
|
||||
|
||||
section postgres
|
||||
setup
|
||||
: postgres
|
||||
section gitea
|
||||
setup
|
||||
: gitea
|
||||
section gitea action runner
|
||||
setup
|
||||
: gitea action runner
|
||||
section argo cd
|
||||
argo_cd
|
||||
: argo cd
|
||||
section hello world app
|
||||
setup git repository
|
||||
: terraform
|
||||
setup CI
|
||||
deploy
|
||||
: dev : list exposed deployments with label and port as a landpage
|
||||
: expose (as ngrock ? direct ? port ? )
|
||||
```
|
||||
78
doc/adr/README.md
Normal file
78
doc/adr/README.md
Normal file
@@ -0,0 +1,78 @@
|
||||
# Bases
|
||||
|
||||
## Fondamentaux
|
||||
|
||||
- [x] [Setup DNS, OS, ...](./00_dns_os_etc.md)
|
||||
- [x] [docker & k3s](./01_docker_k3s.md)
|
||||
- [x] [main components](./02_main_components.md)
|
||||
- [x] setup volume, nfs, k8s provisioner
|
||||
- [x] setup postgres
|
||||
- [x] setup gitea
|
||||
- [ ] setup mail alert
|
||||
- [ ] setup gitea runners, Argo CD
|
||||
- [ ] setup hello world web app
|
||||
|
||||
> [!NOTE]
|
||||
> Reference: [Arcodange _**Factory**_ Ansible Collection](/ansible/arcodange/factory/README.md)
|
||||
|
||||
> [!IMPORTANT]
|
||||
> [duckdns.org](https://duckdns.org/) offre un sous domaine de duckdns.org gratuitement ainsi que des (sous-)sous domaines. Avec notre token on peut valider le challenge DNS de letsencrypt (pour du SSL gratuit) et configurer un cron job pour mettre à jour l'ip publique référencée par notre sous-domaine.
|
||||
|
||||
```mermaid
|
||||
%%{init: { 'logLevel': 'debug', 'theme': 'base' } }%%
|
||||
flowchart
|
||||
net[Internet]
|
||||
subgraph "Local Network (livebox)"
|
||||
net_rules{network rules}
|
||||
subgraph pi1
|
||||
subgraph Docker_pi1[Docker]
|
||||
%%subgraph Traefik
|
||||
%% :web80
|
||||
%% :websecure443
|
||||
%%end
|
||||
gitea_action_runner
|
||||
end
|
||||
subgraph k3s_server[K3S Master]
|
||||
%% Traefik -.-> K3S_Traefik
|
||||
subgraph K3S_Traefik
|
||||
subdomain_git[/git.arcodange.duckdns.org/]
|
||||
end
|
||||
Pods[hello world web app]
|
||||
ArgoCD
|
||||
end
|
||||
end
|
||||
subgraph pi2
|
||||
subgraph Docker_pi2[Docker]
|
||||
subgraph gitea_network
|
||||
subgraph postgres_service
|
||||
end
|
||||
subgraph gitea_service
|
||||
end
|
||||
end
|
||||
end
|
||||
subgraph HardDisk[Hard Disk]
|
||||
pg_data[pg_data partition]
|
||||
gitea_data[gitea_data partition]
|
||||
nfs_data[NFS_data partition]
|
||||
K3S_storage_provisioner --o nfs_data
|
||||
end
|
||||
subgraph k3s_agent[K3S Agent]
|
||||
Pods'[hello world web app]
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
postgres_service --o pg_data
|
||||
gitea_service --o gitea_data
|
||||
|
||||
net -. "http(s)://(*.)arcodange.duckdns.org" .- net_rules -. :<i>443/80</i> .-> K3S_Traefik
|
||||
%% Traefik
|
||||
|
||||
subdomain_git -.-> gitea_service
|
||||
|
||||
classDef k3s fill:#fff,stroke:#f0f,stroke-width:1px;
|
||||
classDef storage fill:#999,stroke:#000,stroke-width:2px;
|
||||
|
||||
class HardDisk storage;
|
||||
class k3s_server,k3s_agent,K3S_storage_provisioner k3s;
|
||||
```
|
||||
Reference in New Issue
Block a user